Weblab v0.11.0

Weblab v0.11.0

Light/Dark/System workspace themes, independent console colors and complete
Internet gateway settings bring appearance and connectivity controls into this
release. Use matching 0.11.0 core, Agent, EXOS and optional Internet helper
images once release publication completes. LL2S remains 0.2.0-ovs-rstp1 and
Weblab FRR remains 10.7.1-wl1.

Appearance

Layout → Theme selects Dark, Light or System. Console theme independently
sets the terminal area; console toolbars, tabs and controls follow the workspace.
These are browser preferences, preserved between visits and synchronized across
its tabs. Theme changes preserve connections, scrollback, locks and window layout.
The stopped-lab Start button is also readable before hovering in Map workspace.
Cancelling a multi-select rectangle with Escape keeps the previous selection
when the mouse is released.

Internet gateway controls

• Up to 64 ordered outbound firewall rules match IPv4 protocol, source/destination
  and TCP/UDP ports or ranges, with an unmatched Allow/Deny policy. Sources still
  require the attached subnet or a configured return network.
• Apply firewall changes live without restarting devices or clearing NAT/connection
  state. A new deny can interrupt existing traffic. Address, return-route, uplink
  and port-forward changes require only the Internet node stopped; other devices
  and their consoles remain running.
• Up to 32 TCP/UDP host forwards expose a reachable router, switch management IP
  or PC service. Localhost is the default; explicit LAN/wildcard bindings and LAN
  source restrictions are available. Routed targets need return routes. Services
  keep their own authentication and see the gateway's lab address as the client.

Existing settings default to the original outbound Allow policy and no inbound
ports. The new helper's capability labels prevent silently accepting features
an older helper does not support. See Internet setup.

Agent and MCP

Dedicated gateway tools read paginated settings, preview/apply exact edits and
stop/start only the gateway. Existing topology and guest storage are retained.
Compact discovery summarizes gateway settings; every rule, route and forward
remains available through bounded pages with a consistent revision.

External writes require the separate --allow-internet-write adapter flag.
The browser Agent has a separate Internet gateway settings and stop/start
permission, initially off for existing and new sessions. Exact-action approvals,
turn expiry, session isolation, topology/runtime checks and enabled-action YOLO
behavior remain enforced. See MCP coverage.

Prebuilt Internet helper

The optional ghcr.io/weblab-network/weblab-internet:0.11.0 Linux amd64 image
removes the local-build requirement. Fresh installers can use --with-internet.
Existing deployments pull it on the Docker host and configure WL_INTERNET_IMAGE;
ordinary local development builds remain supported.

The release includes the tested binary, matching component sources, Alpine
recipes/patches, verified distfiles, package inventory, notices and checksums.
Publication verifies the image identity and anonymous registry access, recording
an immutable pull reference. See distribution details.
Save and stop the lab before recreating core/Agent, retain its volumes, then
stop/start Internet nodes to adopt the new helper.