v2.28.0rc2

What's Changed

• fix(runtime): correct pipx updates, terminal launch and relay errors by @zoltanam in #138
• fix(config): keep backups beside their config, and isolate the test suite by @zoltanam in #166
• fix(mcp): enforce guard tiers and keep standard-tier commands read-only by @zoltanam in #146
• fix(ssh): never read a remote command, path or host as a local ssh option by @zoltanam in #160
• fix(ssh): connect to a custom server's own port everywhere by @zoltanam in #152
• fix(relay): bound the listener's shutdown and release its lock reliably by @zoltanam in #153
• fix(aws): correct CloudWatch time windows and filters, and CloudTrail row selection by @zoltanam in #157
• fix(relay): stop on an expired session and refresh a rejected hub token by @zoltanam in #161
• fix(auth): revoke a session only on the API's verdict, and share refreshes safely by @zoltanam in #165
• fix(mcp): audit every call to the OVH read tools by @zoltanam in #172
• fix(app): stop a Settings crash, fix CLI hints and add endpoint overrides by @zoltanam in #151
• fix(scan): scan custom servers, and fix notes, the ssh command and the log browser by @zoltanam in #163
• fix(ai): keep chat turns alive through tool prompts, and say what happens by @zoltanam in #168
• fix(config): make config backups and restores reliable, and keep cache ages sane by @zoltanam in #169
• fix: memory sharing, saved database profiles and cached instance lookups by @zoltanam in #176
• fix(providers): stop manager crashes, report failed refreshes, and confirm disruptive power actions by @zoltanam in #178
• fix(demo): hide real identifiers on every screen, act on the real servers, and scrub bug reports by @zoltanam in #179
• fix(ssh): verify server host keys, trusting a server on first connection by @zoltanam in #167
• fix(auth): refuse API, MCP and relay URLs that would send tokens in clear text by @zoltanam in #175
• fix: stop screen headers and voice stops from failing mid-transition, and steady timing-sensitive tests by @zoltanam in #181
• fix: redraw fleet table rows once column widths are known, and steady the end-to-end journeys by @zoltanam in #184
• ci(release): cut release candidates and publish only after approval by @zoltanam in #182
• fix(ui): fit CloudWatch filters, Top IPs and server actions on small terminals by @zoltanam in #186
• docs: install release candidates, and installer fixes by @zoltanam in #187
• fix(voice): download speech models from pinned, checksum-verified sources by @zoltanam in #190
• fix(ui): usable Settings, memory and IP Ban screens on small terminals by @zoltanam in #191
• fix(ui): dim behind dialogs, fit the fleet table and footer, accurate help keys by @zoltanam in #189
• fix(install): install only released versions; attach the install scripts to releases by @zoltanam in #200

New Contributors

• @dependabot[bot] made their first contribution in #143

Full Changelog: v2.27.0...v2.28.0rc2