Iceon 0.1.4

• Refresh the native shell with compact header controls, a sidebar footer, and
  footer-aligned collapsed terminal controls; expanded terminal tabs stay on top.
• Add data-only Zed marketplace theme management, unified theme settings, and
  native file/folder/pasted-YAML cluster configuration.
• Improve scoped RBAC navigation, automatic namespace discovery, initial connection
  feedback, background refreshes, and persistent access-time Kubernetes versions.
• Cache Overview snapshots and bound its Events preview; add container indicators
  and pod usage columns, consistent empty states, and status-colored Events rows.
• Add console tab context menus, focus-aware close shortcuts, shared YAML dock
  creation/editing, and guarded bulk resource deletion.
• Add explicit update checks with manual release downloads; no automatic installer
  execution. Preserve 0.1.2 user-data migration and Windows portable ZIP upgrades.
• Retain signed legacy migration feeds, release integrity gates, macOS ad-hoc signing
  and Windows unsigned platform packages; no notarization/AuthentiCode claim.

Native GPUI packages with a Windows per-user setup EXE and signed migration feed for compatible older clients. macOS is ad-hoc signed, not notarized; Windows has no Authenticode signature. The native app does not yet update itself. Pre-updater installations require manual installation; installed-client migration smoke testing remains necessary.

Iceon 0.1.3

Native installers and signed migration feed

• Replace the Windows portable ZIP with a per-user x86 NSIS setup EXE, a Start
  menu shortcut, registered uninstaller and preservation of the legacy custom
  installation path. Gate packaging with synthetic upgrade/reinstall/uninstall tests.
• Publish signed macOS application archives and Windows setup EXEs, matching
  .sig files, latest.json and SHA-256 checksums. Use a standalone Rust signer
  and independent verifier with the existing public trust key and authenticated
  release-version comments; no frontend or old application runtime is required.
• Restore the download/feed format expected by compatible older updater-enabled
  clients. Pre-updater installs still require manual installation; end-to-end
  migration remains subject to installed-client testing. The native GPUI app
  does not yet update itself after migration.
• Run release jobs only on macOS and Windows. Preserve same-commit CI, immutable
  tags, fresh-release publication and uploaded/downloaded-byte integrity gates.
• macOS remains ad-hoc signed, not notarized; Windows setup is not Authenticode
  signed. Updater signatures do not replace platform signing.

Project documentation and license

• Align the project LICENSE, Cargo workspace/crate metadata and README on MIT,
  retaining third-party licenses and notices.
• Refresh native architecture, feature/OS roadmaps and icon ownership documentation;
  remove obsolete web-frontend documentation, workflows and updater tooling.

Native GPUI packages with a Windows per-user setup EXE and signed migration feed for compatible older clients. macOS is ad-hoc signed, not notarized; Windows has no Authenticode signature. The native app does not yet update itself. Pre-updater installations require manual installation; installed-client migration smoke testing remains necessary.

Iceon 0.1.2

Native Rust desktop

• Replace the Tauri/web frontend with a pure-Rust GPUI desktop application and
  Cargo workspace. Add native themes, settings, a welcome view, workspace
  breadcrumbs, and resizable navigation and resource tables.
• Improve cluster catalog import, metadata columns, namespace navigation,
  search, cluster health probes, and explicit health refresh controls.
• Add native local terminals, pod logs and console docks, kubectl/Helm tool
  preferences, and YAML resource editing while preserving guarded mutations
  and metadata-only handling of sensitive resources.

CI and distribution

• Install Linux's required XKB/X11 development library so GPUI test binaries link.
  Fix strict Rust/Clippy diagnostics across the core and native UI without
  weakening warning enforcement.
• Replace obsolete Tauri release packaging with same-commit CI-gated native
  Apple Silicon DMG/application archives and a portable Windows x86 ZIP.
  Validate package architecture, bundle metadata, immutable tag identity,
  checksums, and uploaded/downloaded bytes before publication.
• This is a manual-install native release. macOS packages are ad-hoc signed,
  not notarized; the Windows ZIP is unsigned. The former Tauri automatic updater
  is not supported, and no updater manifest is published. See docs/releases.md
  for installation and verification instructions.

Native GPUI manual-install packages. macOS is ad-hoc signed, not notarized. Windows ZIP is unsigned. No Tauri updater feed or automatic update support.

Iceon 0.1.1

Startup and Secrets workspace

• Fix the native launch abort by scheduling Secrets expiry work on Tauri's runtime
  explicitly. Add a synchronous-setup regression test outside an entered Tokio runtime.
• Make Open activate a connection workspace, with right-side login and secret details,
  discovered Vault engines, folder navigation, metadata/version history and explicit
  Reveal. Unsupported engines remain visible without pretending they are supported.
• Add editable connections, persisted sidebar pins and concurrent isolated connection
  sessions. Edits preserve identity/pin and forget the previous saved login before
  saving; switching connections clears hidden inputs and revealed values.
• Put validation messages at their fields, distinguish mount paths from login
  credentials, focus the first invalid field and prevent blur errors from moving Save
  between pointer-down and click. Keep storage failures distinct from empty data.
• Route Secrets refresh through the universal toolbar action after Go forward. Use
  consistent floating add controls, and fix frame sizing under zoom so actions and
  inspectors remain reachable in narrow windows.
• Local verification covers 540 Rust tests, 50 Secrets/shared-control UI tests,
  production build, formatting, strict Clippy and release tooling. Native OS credential
  prompts and packaged window behavior still require manual smoke verification.

Iceon 0.1.0

Secrets management

• Add a standalone Secrets workspace beside Clusters, with a + action opening
  Add secret connection. Catalog remains cluster-only; Secrets is not a Preferences
  section and provider connections are not cluster pins.
• Add provider-neutral Rust transport and credential-store interfaces, with Vault
  userpass login and read-only KV v2 browsing as the first provider. Saving a profile
  stores metadata only and does not authenticate. Secret values require explicit
  Reveal and are hidden on blur, navigation, disposal, or after 30 seconds.
• Remember only issued Vault tokens using macOS Keychain, Windows Credential
  Manager, or Linux Secret Service. Passwords are not persisted; no plaintext
  credential fallback is provided. Resume validates saved tokens before reading.
• Bound requests and responses, require verified HTTPS, disable redirects, isolate
  sessions by native window, and cancel stale authentication and reads. Add explicit
  expiry, disconnect, forgetting, and profile removal cleanup. No remote secret
  writes, automatic renewal, exports, or Kubernetes credential injection.
• Document setup, policy requirements, supported limits and manual native checks in
  docs/secrets-management.md.

Workspace fixes

• Use Astryx empty states for resource and port-forward tables, with recovery
  actions, scope-aware guidance and responsive horizontal-scroll behavior.
• Use asynchronous native kubeconfig file selection instead of a blocking wrapper.

Verification and distribution

• Local feature verification passed: 533 Rust tests, 70 navigation/UI fixture tests,
  a final 26-case Secrets/route regression run, production build, formatting and
  strict Clippy. Fixture tests do not establish live Vault or native credential-store
  behavior; those manual checks remain outstanding on each supported OS.
• The immutable 0.1.0 tag starts the existing gated macOS/Windows packaging and
  signed-updater workflow. Publication still requires same-commit CI, package and
  uploaded-artifact verification; a pushed tag is not proof of a published release.

Iceon 0.0.8

Kubeconfig import

• Keep Add config compact, with Choose file inline beside the path. A single
  native dropped-file path selects the file only; it never imports automatically.
  Import remains an explicit, metadata-only action, not authentication or connection.
• Add optional grouped platform guidance for managed providers (GKE, DOKS, LKE,
  VKE, OKE, IBM Cloud Kubernetes, Alibaba ACK, Tencent TKE, Scaleway Kapsule,
  OVHcloud and Civo), self-managed platforms (Hetzner + K3s, OpenShift, Rancher,
  RKE2 and K3s), and local clusters (MicroK8s, kind and minikube). Guidance helps
  prepare an existing kubeconfig; it does not enumerate cloud accounts or add
  authentication, login, SSH or tunnels.
• Add synthetic compatibility fixtures for provider-neutral import and connection
  preparation, source identity, credential redaction and insecure-transport
  rejection. These are not live-provider authentication or certification tests.

Other changes since 0.0.6

• Add conservative Node drain with read-only review, explicit Node-name
  confirmation, single-use expiring plans, guarded cordon and policy/v1 evictions.
  Partial inventories and unsupported/local-data Pods block execution; no force,
  PDB bypass or direct-delete fallback is provided. Completion requires observed
  Pod removal; cancellation cannot undo submitted writes.
• Expand bounded inspector facts, related collections, Event diagnostics, Helm
  details and metadata-only custom-resource snapshots. Add reduced resource
  editing with dry-run/confirmation, guarded workload actions and Service-aware
  forwarding. These are scoped workflows, not full-object editing or feature parity.
• Improve namespace continuity/caching, Catalog-aware search, cluster/section
  pins and native pin ordering, sidebar resizing and inspector/dock actions.
  Remove Web Links; Catalog navigation now contains Clusters only.
• Download verified updates automatically but defer installation/restart until
  Restart to Update. Reduce redundant updater-context renders; native CPU
  savings have not been measured. Add an authenticated development-only browser
  engine bridge, not a production Node backend.

Verification and distribution

• Group inspector facts and supporting overview/related tables in Astryx cards.
  Keep primary inventory tables compact. Repair invisible memory usage in dark
  mode and move routine overview explanations into information popovers.
• Use lifecycle terminology for workload charts, compact interactive color-key
  legends and tighter heading spacing. Add paged/sortable loaded events, default
  newest-creation ordering and semantic warning message colors. Controller
  summaries use replica counters, not Freelens's child-Pod health model.
• Repair strict IPC fixtures, responsive toolbar selectors and permission-expiry
  timing. Export same-commit Rust collection contracts alongside detail contracts
  for browser CI instead of compiling Rust on frontend-only runners.

Local validation for the 0.0.8 retry passed: 1,176 Chromium fixture tests
(four production-only skips), six synthetic dev-engine tests, 473 Rust backend
tests, 16 release-tool tests, 18 publisher tests and five Bun tool tests, plus
formatting, production build and strict Clippy. GitHub CI/package validation
remains the publication gate.
Native file drops and Windows runtime behavior still need smoke
validation; no live-provider, real-credential or live-cluster success is claimed.
Full CI and both platform packages, verified signed updater packaging and
uploaded-byte checks gate publication. macOS remains ad-hoc signed and not
notarized; Windows has no Authenticode certificate. Native installation/update
smoke checks remain outstanding. See installation.

Iceon 0.0.6

Fixed

• Fix a fish Google Cloud SDK discovery case missed by 0.0.5: installer-style
  if [ -f '…/path.fish.inc' ]; . '…/path.fish.inc'; end hints are now
  recognized, including quoted ~/ paths. The tested path and sourced path must
  match. No condition, shell startup command, SDK script, or authentication
  plugin is executed during discovery.
• Recognize bare . SDK source hints as well as source. Quoted ~/ is treated
  only as a home-relative SDK installation hint; this does not claim fish expands
  the original declaration. Additional commands, substitutions, mismatched paths,
  and comments that hide the source or closing statement are rejected.

Verification and distribution

Regression fixtures reproduce the exact guarded source declaration that 0.0.5
missed, including helper and sibling SDK command execution with synthetic data.
A separate read-only check with a minimal Finder PATH resolved the locally
installed helper from the actual fish hint without running it. Real kubeconfigs,
credentials, and live clusters were not accessed. Full CI and both verified
platform packages gate publication. Existing signed-update installations can
receive this patch automatically; native install/update smoke tests are not claimed.

Iceon 0.0.5

Fixed

• Fix Google Cloud SDK authentication-helper discovery for macOS Finder/Dock
  launches when the SDK path is configured in fish. Iceon now recognizes literal
  SDK paths in config.fish, bounded conf.d snippets, and saved
  fish_user_paths, including custom locations such as
  $HOME/Kerjaa/google-cloud-sdk/bin. A persisted fish declaration no longer
  requires launching Iceon from a terminal with a manually exported PATH.
• Preserve OS search order for an explicit kubeconfig PATH, including relative
  entries. Automatic discovery does not replace an explicit helper command or
  modify kubeconfig, shell configuration, or the application's global environment.
• Keep discovery bounded and non-executing: shell startup commands are never run,
  unsupported expressions are ignored, and existing helper deadlines and
  cancellation remain enforced. A PATH change made only in an open terminal
  cannot be recovered by a Finder-launched app; custom paths must be persisted.

Verification and distribution

Local checks passed 357 Rust tests and 848 browser fixture tests, plus frontend
build, formatting, strict Clippy, and an unsigned macOS release bundle build.
Fixtures cover fish discovery, saved paths, sibling SDK commands, explicit PATH
precedence, malformed syntax, read limits and cancellation. Real credentials,
live clusters, and native installation/update smoke tests were not used.

Full CI, both platform packages, signed updater verification, and uploaded-byte
checks gate publication. Working 0.0.4 installations can receive this patch
through automatic updates. If 0.0.3 crashes at startup, or when upgrading from
0.0.1/0.0.2, install the new package manually. macOS remains ad-hoc signed and not
notarized; Windows has no Authenticode certificate. See
installation and automatic updates.

Iceon 0.0.4

Fixed

• Fix a startup SIGABRT in supported release builds, reported on macOS 27.0.1.
  The updater could construct reqwest's HTTPS client before a rustls crypto
  provider was initialized. Release-mode panic handling then aborted the app on
  a Tokio worker. Iceon now initializes the ring provider before Tauri startup
  and also ensures initialization in the updater transport constructor.
• Add fresh-process negative and positive regression controls using the actual
  HTTP client constructor, plus concurrent initialization and startup-order tests.
  These checks make no network requests and do not launch the native app.
• Keep certificate verification, pinned updater signatures, signed-version
  enforcement, icons, colors, and existing Kubernetes behavior unchanged.

Installation and verification

If 0.0.3 crashes immediately, install 0.0.4 manually: the affected build aborts
before its automatic updater can retrieve a patch. Versions 0.0.1/0.0.2 also
require manual bootstrap because they shipped without the updater verification
key. Supported working builds continue to use signed GitHub update assets.

Apple Silicon macOS DMG and Windows x86 setup.exe packages are gated by full CI,
platform builds, signature/version verification, and uploaded-byte checks. The
app is not Apple notarized or Windows Authenticode signed. Only for a trusted
macOS download installed in /Applications, use:

xattr -dr com.apple.quarantine /Applications/Iceon.app

Do not disable Gatekeeper or SmartScreen. Native installation and live-cluster
smoke tests are not claimed. See installation and
automatic updates.

Iceon 0.0.3

Included changes

• Automatic application updates from the public GitHub stable feed, with a pinned
  embedded minisign public key and authenticated package-version checks. Rust
  bounds downloads and uses the official Tauri bundle/installer update path;
  unsigned packages, invalid signatures and mismatched versions are rejected.
• Safe automatic installation and restart after every admitted window freezes
  interaction and acknowledges its current preparation ID. New-window admission
  closes during preparation. Dirty editors, dialogs, active mutations, terminals
  and port forwards defer installation; backend session work drains before install.
  Preparing and Restarting are reported without saving or changing user drafts.
• A Windows 32-bit x86 NSIS setup route alongside the Apple Silicon macOS DMG.
  Windows updates use quiet, current-user installation. WebView2 is downloaded
  if missing, which requires a network connection.
• macOS credential-helper discovery first resolves a canonical executable from
  the helper's child PATH. After a not-found result, bounded fallback reads
  /etc/paths, at most 32 /etc/paths.d entries and five startup files for
  literal Google Cloud SDK source hints only. Files are never executed; reads
  are limited to 8 KiB per file and 32 KiB total. No helper download or automatic
  cloud login is performed; genuinely missing helpers remain errors.

Verification and distribution

Local checks passed 348 backend tests, 16 release-tool tests, and 252 updater,
authentication and active-work UI regressions, plus build and strict Clippy. Full
CI and both platform packages gate publication. Native installation/update smoke
checks remain outstanding; this entry makes no Windows-native or real-credential
provider success claim. Existing RBAC behavior, SIGHUP credits,
branding, icons and record colors are unchanged by this release.

The release publishes exactly seven assets: Iceon_0.0.3_aarch64.dmg,
Iceon_0.0.3_aarch64.app.tar.gz, its .sig, Iceon_0.0.3_x86-setup.exe,
its .sig, latest.json and SHASUMS256.txt. SHA-256 checksums and GitHub
asset digests detect transfer corruption; updater trust comes from the package
signature and its authenticated version, not the checksum file.

First installation and OS warnings

Install 0.0.3 manually once, including when upgrading from 0.0.1 or 0.0.2:
those versions shipped without an updater trust key and cannot acquire automatic
updates retroactively. Subsequent verified versions install automatically when
safe, without a separate manual installation step.

macOS is ad-hoc signed, not Developer ID signed or notarized. Only for a trusted
download installed in /Applications, use
xattr -dr com.apple.quarantine /Applications/Iceon.app if macOS blocks launch.
Do not disable Gatekeeper globally. Windows has no Authenticode certificate;
SmartScreen may report an unknown publisher. No SmartScreen bypass is provided.
See installation and automatic updates.