EgressView v1.6.0

Security and Reliability

• Google OIDC domain allowlists now warn that every matching user becomes a full administrator. EgressView authenticates users but does not separate permissions yet, so any account passing the allowlist can read all captured traffic, change router credentials, rotate secrets, and restore backups. A domain allowlist extends that to everyone in the domain, including accounts created after it was configured. The warning appears in the server log at startup, in Settings while any domain is present — saved or still being typed — and again in a confirmation prompt when an enabled configuration with a domain allowlist is saved. Existing configurations keep working unchanged; EgressView never disables an allowlist for you, because silently locking out remote users would be worse than the risk being reported. Prefer an explicit email allowlist until role-based access control ships.
• Settings now describes the local administrator accurately for the configuration in use: the ordinary sign-in path while Google OIDC is disabled, and the emergency fallback that survives an IdP outage once OIDC is enabled. The account itself is unchanged and remains always available. Wording switches on the saved OIDC setting alone — EgressView does not infer whether it is reachable from the internet, because a port forward or unknown reverse proxy would defeat that guess.
• Completed strict Zod request validation across all 13 endpoint-bearing route modules, rejecting unknown fields, wrong-typed scalars, and oversized values while preserving existing SSRF checks, defaults, limits, and error shapes.
• Made every device-note write path fail closed, restoring the previous runtime snapshot and suppressing success notifications on failure.
• Backup cleanup always protects at least two normal generations and the latest migration generation, never removes corrupt or unverified files, and reverifies the plan immediately before deletion.
• Restored saved ASUS polling automatically after service restarts and coalesced overlapping polls.
• Moved verified backup cleanup to a single-concurrency worker job with progress, cancellation, and timeout so multi-gigabyte integrity checks no longer block collection or HTTP.

Added

• Unauthenticated, minimal /healthz liveness and /readyz bootstrap-readiness endpoints for monitoring and deployment gates.
• Request correlation on every HTTP response through X-Request-Id, with safe caller-provided IDs, UUID fallbacks, and correlated slow/error logs.
• Unified inventory and capacity diagnostics for normal and pre-migration SQLite backups, plus dry-run and confirmed cleanup with configurable storage limits.
• AI list prices moved into a validated, versioned catalog with effective dates and source URLs; added GPT-5.5 pricing, broader OpenAI coverage, and explicit partial-total labels.
• Production Bedrock guidance for least-privilege IAM, invocation logging, PrivateLink, and SDK retry strategy.

Documentation

• Documented the domain allowlist risk and the migration path to an explicit email allowlist in both authentication guides, both READMEs, and the project site.

Verification

• 1,539 unit tests passed.
• 69 browser smoke tests passed.
• Node 22/24, ASH security scan, release safety checks, build, npm audit, and secret scan passed.
• Deployed to EC2 production with the staged rollout, readiness gate, and automatic rollback: schema 9, integrity OK, 285,150 connections preserved, /healthz and /readyz returning 200, Yamaha and Cisco collection active, 0 ERROR and 0 FATAL after start.