Weblab v0.12.0

Weblab v0.12.0

External SSH access, browser pop-outs and PDF-based practice-lab authoring.

External access

• Optional SSH service for the same device consoles used in the browser. It
  supports public-key authentication, reader/writer/admin roles, shared input
  locks, revocation and session expiry. No guest IP address is required.
• Internet nodes can optionally provide a non-root SSH shell with SSH/Telnet
  tools and ProxyJump to reachable lab IPs. Gateway grants are separate from
  console grants; shell connections are limited to the configured lab networks.
• Public keys are managed in Storage → External SSH access. Grants and host
  identities remain deployment-local and are excluded from topology/ZIP exports.
• Internet settings use Network, Port forwards, Firewall and
  SSH access tabs with a fixed Apply footer. The Inspector SSH checkbox opens
  the SSH tab for review and Apply; listener changes require that gateway stopped.

See SSH setup and screenshots. Both access paths are
optional and require explicit configuration and public-key grants. They do not
start guests or enable SSH/Telnet services inside routers and switches.

Workspace and traffic monitoring

• Pop out Instructions, topology, combined or individual consoles, Agent and
  Traffic monitor into separate browser windows, with fullscreen and Return to
  workspace controls. The owning workspace must stay open. Browser chrome and
  popup behavior remain browser-controlled.
• Live console sockets, scrollback, input locks, Agent drafts and capture buffers
  survive pane transfer. Pop-out notifications clear normally, compact title bars
  avoid redundant headings, and shallow resize grips leave scrollbars accessible.
• Layout → Arrange floating windows, also in console Actions, tiles only
  visible workspace floats. Four consoles form an equal 2×2 grid when space
  allows; docked panes, hidden windows and separate browser pop-outs stay put.
• Traffic monitor has a 1 / 2 / 5 minute capture selector, default five
  minutes. The existing 2,000-frame / 8 MiB limits still apply and may stop a
  capture earlier. Display filtering does not reduce capture volume.
• Set WL_ALLOW_POPOUT=0 in deployment configuration to hide/disable Weblab's
  pop-out controls; the default is enabled. This is a UI preference.

Agent

• OpenAI sessions accept PDF references. The isolated companion extracts text
  and renders pages offline before sending them to the model. Limits include
  50 PDF pages per message, 256 KiB combined extracted/attached text, 24 MiB of
  rendered pages and a conversion deadline. Uploads remain four files / 2 MiB
  total. Large excerpts can consume substantial model context and allowance.
• WL_AGENT_HISTORY_LIMIT_MIB makes the companion history cap configurable
  (default 256 MiB). Raising it and recreating only the companion with the same
  volumes preserves conversations and sign-in state.
• The existing authoring-guide tool now explains exercise capabilities and
  their boundaries: directional frame loss for UDLD/loop guard, carrier loss,
  capture/decoding, Instructions, gateway controls, diagrams and saved state.
  This is guidance, not new mutation tools. Link faults, captures and publishing
  Instructions remain browser actions. Reset still preserves Instructions.

Upgrade and validation

Use matching 0.12.0 core, Agent, EXOS and optional Internet helper tags. Save
device configurations and stop the lab before recreating core. Recreate Agent
with the same dedicated volumes for PDF support. Pull/select the new helper
before starting gateways; existing containers keep their old image until restart.
Console SSH uses the optional compose.ssh.yaml source-build override described
in the setup guide; the installer does not enable it automatically.

FRR remains 10.7.1-wl1; LL2S remains 0.2.0-ovs-rstp1. No saved-topology format
change is required. SSH grants and service host keys are not portable lab state.

Validation includes backend regression, disposable Playwright workspaces,
packaged PDF conversion, real OpenSSH console and gateway/ProxyJump checks,
revocation and destination restrictions, MCP integration and verification of the
helper's exact binary/source pair. Release CI repeats packaged checks before
promoting the versioned images. This does not certify every guest image/protocol.