# Changelog
All notable changes to JoeSSH will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
## [Unreleased]
## [0.1.0-beta.30] - 2026-10-24
> Microsoft Store maintenance candidate for `1.1.30.0`. Protected source build,
> native qualification, certification and publication remain separate gates.
### Fixed
- Recover native startup from a stale PWA Service Worker cache without clearing
saved connection profiles or host-key trust; retain browser offline support.
- Update both Rust lockfiles to `crypto-bigint 0.7.6` for
RUSTSEC-2026-0387's constant-time arithmetic fixes.
- Patch Happy DOM and Puppeteer/Zod v4 tooling dependencies; backport Zod's
oversized-collection early rejection to Expo CLI's v3 API with pinned source,
original-identity audits and separate exact advisory verification.
- Preserve terminal sizing and forwarding lifetimes across workspace changes,
reject duplicate starts, and bound editable PTY input before dispatch.
- Validate release artifact paths, dependency audit reports and vendored source
identity before accepting release evidence.
- Update the compatible Vite, Vitest, nanoid, ctutils and Tokio dependencies.
Backport the public node-forge RSA verification fix for Node build tooling,
retaining the original registry identity and strict checks for other findings.
- Close manually created E2E browser contexts on failure and retain failure
traces without reducing assertions, timeouts or retry requirements.
### Changed
- Advance application metadata to `0.1.0-beta.30` / MSIX `1.1.30.0` for new
immutable package bytes. Earlier candidate artifacts and evidence stay historical.
## [0.1.0-beta.29] - 2026-09-24
> Store reissue candidate for `1.1.29.0`. Microsoft Store rejects changed
> bytes under the already used `1.1.28.0` package full name, so this candidate
> advances the deterministic package version while preserving the beta.28
> behavior and verification boundaries.
### Changed
- Advance every application and runtime version surface to
`0.1.0-beta.29`, mapped to MSIX `1.1.29.0`, so Submission 8 can accept the
corrected package as a new immutable package identity.
## [0.1.0-beta.28] - 2026-09-16
> Corrective Microsoft Store maintenance candidate for `1.1.28.0`; Store submission and certification remain pending.
### Fixed
- Keep built-in sample hosts out of real connection onboarding and preserve a user's explicit Quick Connect target, including sample-address collisions.
- Discard late host-key probe results after Connect closes and preserve invalid explicit ports for validation.
- Serialize SFTP transfers per session, require a complete listing before overwrite checks, and keep file pickers bound to their original session and path.
- Preserve PTY exit status reported after SSH EOF and treat transport loss, signal termination, or missing status as failure.
- Keep inactive terminal transcripts scrollable and searchable without resetting their reading position.
- Add Store release E2E coverage and exact Store-surface hash protection for these onboarding boundaries.
## [0.1.0-beta.27] - 2026-09-11
> Microsoft Store maintenance candidate for `1.1.27.0`, following the verified
> published `1.1.26.0` package. Source preparation is not Store publication.
### Fixed
- Preserve live terminals, SFTP state, and forwards across tab switches and
unrelated connections; bind prepared input and uploads to their original
active connection, and retain the actual connected target after config edits.
- Bound SSH establishment with one deadline, isolate each PTY's input and
cleanup, and handle early/late output events with consumption backpressure.
- Coordinate known-hosts writes and revocation across processes without changing
the main JSON format; add an explicit, tested metadata recovery tool.
- Patch xmldom and js-yaml dependencies; replace yanked `der 0.8.0` and
`wnaf 0.14.0` with `0.8.2` and `0.14.1`. Report failed audit details in CI.
- Update the Vitest test-tool packages to `4.1.11` to fix development-server
redirect-mock file disclosure, and explicitly declare the root test runner.
### Changed
- Advance application version metadata to `0.1.0-beta.27` / MSIX `1.1.27.0`.
No separate Web, Sync, or Mobile distribution is included.
- Add lifecycle and failure-path regression coverage while preserving the
existing 95% coverage and strict online audit gates.
## [0.1.0-beta.26] - 2026-09-02
> Replacement Microsoft Store maintenance candidate. The beta.25
> `1.1.25.0` qualification run ended with a required WACK Requirement 26,
> TEST 92 `DPIAwarenessValidation` warning. That package and its evidence are
> immutable, superseded, and ineligible for submission or reuse. This entry is
> not evidence that `1.1.26.0` has been built, certified, or published.
### Fixed
- Bypass `tauri-winres` inline-manifest serialization and let Windows Resource
Compiler embed the reviewed UTF-8 application manifest bytes directly as the
sole `RT_MANIFEST` resource at ID 1, removing the strict-parser risk created
by beta.25's leading whitespace. A clean full WACK rerun is still required to
confirm that the Sandbox warning is gone.
- Add a raw PE resource gate that requires exactly one `RT_MANIFEST/#1`
en-US resource, rejects a BOM or leading byte, and proves byte-for-byte
equality with the reviewed source manifest before and after the MSIX
pack/unpack round trip.
### Changed
- Advance every application and runtime version surface to
`0.1.0-beta.26`, mapped to MSIX `1.1.26.0`, without changing the historical
beta.25 changelog or release notes.
## [0.1.0-beta.25] - 2026-08-31
> Replacement Microsoft Store maintenance candidate. The beta.23 and beta.24
> qualification evidence remains immutable, and neither package may be
> submitted or reused. This entry is not evidence that `1.1.25.0` has been
> built, certified, or published.
### Fixed
- Remove the unused Windows self-relaunch path from the Store desktop build
through a checksum-bound Tauri compatibility patch, eliminating its process
launch imports without changing normal startup or shutdown behavior.
- Give the embedded Windows application manifest a valid definition identity
and validate both compiled and packaged manifests with the same Windows SDK
manifest tool used by the build.
- Reject downloaded or decoded content piped into any remote program, while
keeping unrelated commands outside the same pipeline valid.
- Replace Expo Router's vulnerable URI decoder with the official linear-time
`0.5.0` implementation through a checksum-bound CommonJS compatibility
entry, preserving deep-link and query-string behavior.
### Changed
- Advance every application and runtime version surface to
`0.1.0-beta.25`, mapped to MSIX `1.1.25.0`, without changing historical
beta.23 or beta.24 records.
- Bind the vendored Tauri source, exact upstream archive, compatibility patch,
licenses, and advisory identity into the existing fail-closed supply-chain
checks.
## [0.1.0-beta.24] - 2026-08-31
> Replacement Microsoft Store maintenance candidate. The rejected local
> `1.1.23.0` qualification attempt and its evidence remain immutable and must
> not be submitted or reused. This entry is not evidence that `1.1.24.0` has
> been built, certified, or published.
### Fixed
- Remove the obsolete Windows App Runtime package dependency from the MSIX
manifest while retaining the app's actual WebView2 bootstrap contract.
- Preserve exact MSIX bytes across the source-build artifact transfer path and
keep Rust tool diagnostics out of executable-path discovery.
- Embed a Windows application manifest that preserves Common Controls v6 and
declares Per-Monitor V2 DPI awareness for WACK and high-DPI operation.
### Changed
- Advance application and runtime version metadata to `0.1.0-beta.24`, mapped
to MSIX `1.1.24.0`, without changing historical beta.23 records.
- Bind the native build script and Windows application manifest into Store
source provenance so either input changing during a build fails closed.
## [0.1.0-beta.23] - 2026-08-30
> Maintenance version prepared for a separate Microsoft Store update. This entry
> is not evidence that the new binary has been built, certified, or published.
> The intended GitHub prerelease remains source-only with zero uploaded assets.
### Fixed
- Stop active connections and pending dials when a local port forward closes.
- Preserve SSH exit status after output EOF, and reject command termination
without a reported status or with an exit signal.
- Preserve leading and trailing spaces in valid remote SFTP entry names while
continuing to reject blank paths and control characters.
- Remediate dependency findings, verify the official GLib backport by content,
and require complete online RustSec and yanked checks for both Rust lockfiles
and the vendored package's original registry identity.
- Isolate Windows Authenticode checks from inherited PowerShell modules and
compare Git worktree identities correctly across Windows 8.3 path aliases.
### Changed
- Advance application and runtime version metadata to `0.1.0-beta.23`, mapped
to MSIX `1.1.23.0`; keep beta.20, beta.21, and beta.22 release records intact.
- Put the free Microsoft Store install and first-connection guide near the
beginning of the README.
- Enabled GitHub's Sponsor button with the repository-owned voluntary-support
notice as its only custom destination. The link remains separate from product
checkout and does not claim payment-recipient, small-payment, or payout
verification; the public warning and both QR asset hashes are CI-locked.
## [0.1.0-beta.22] - 2026-08-11
> Microsoft Store package-language correction. The GitHub prerelease remains
> source-only with zero uploaded assets.
### Fixed
- Bound the MSIX manifest language list to the 15 complete application UI
locales instead of allowing MSIX Packaging Tool's `en-us` default to reach
Partner Center unchanged.
- Added a MakeAppx finalization step that proves every non-manifest payload file
remains byte-identical and rejects a Store candidate with missing, duplicate,
invalid, or unreviewed package languages.
- Changed unknown system-locale fallback to English while preserving all 15
explicit language choices.
### Changed
- Advanced runtime and package version surfaces to `0.1.0-beta.22`, mapped to
Store package version `1.1.22.0`.
- Kept the 80 localized Store listings separate from package UI support: all 80
may remain discoverable, but only the 15 complete UI locales are declared by
the package.
## [0.1.0-beta.21] - 2026-08-09
> Microsoft Store replacement candidate. The GitHub `0.1.0-beta.20`
> prerelease remains permanently source-only and unchanged.
### Changed
- Advanced every runtime and package version surface to a distinct Store
candidate that maps to MSIX version `1.1.21.0`.
- Aligned Mobile Vitest and coverage tooling at `4.1.9` so a clean npm install
no longer resolves an invalid mixed test-runner pair.
- Require the Store handoff to bind the final protected-main source revision,
exact Partner Center package identity, and generated MSIX hash instead of
reusing the older `1.1.12.0` submission as evidence for current code.
### Security
- Preserved the automated accessibility fixes and the explicit no-formal-
conformance boundary; no paid service, EAA conformance, or manual device
review claim is introduced by this candidate.
## [0.1.0-beta.20] - 2026-08-09
> Final source-only GitHub prerelease for the current maintenance closeout.
> Public Desktop installers remain blocked on external signing and notarization
> evidence.
### Fixed
- Made the horizontally scrollable Desktop inspector keyboard-focusable at the
supported 900 × 480 minimum viewport.
- Changed Desktop and Web Admin Axe gates to reject every tested WCAG A/AA
violation instead of filtering by severity, and locked the minimum viewport
into the accessibility-readiness contract.
- Removed the Web build's extensionless config import before Vite switches its
native config loader to the future default.
### Added
- Recorded a bounded agent-assisted accessibility review with explicit
screen-reader, physical-device, and representative-user limitations.
- Made future paid releases fail closed until EU consumer-market and EAA/local
accessibility applicability are explicitly reassessed.
## [0.1.0-beta.19] - 2026-08-09
> Source-only GitHub prerelease. Public Desktop installers remain blocked on
> external signing and notarization evidence.
### Fixed
- Normalized Markdown whitespace while validating source-release boundaries and
bound the release contract test to the repository's actual versioned notes.
## [0.1.0-beta.18] - 2026-08-09
> Remote tag-only preflight checkpoint. Its dry run failed before any GitHub
> Release or release asset was created. The tag remains immutable and must not
> receive a Release page or be reused.
### Added
- An EAA-oriented accessibility assessment status, safe barrier-reporting
form, and WCAG 2.2 target-size and focus-not-obscured release checks without
making an unverified conformance claim.
- A production UI system across Desktop, Mobile, and Web Admin with responsive
light/dark themes, accessibility coverage, Windows scaling checks, and
visual-regression baselines.
- A commit-bound Windows invite pipeline for private Stage A dogfood, including
immutable handoff evidence and clean-VM promotion checks.
- Separate Microsoft Store NSIS EXE and external-MSIX candidate contracts that
fail closed on signing, publisher identity, hashes, silent installation, and
Store-certification claims.
- A built-product Microsoft Store runtime gate that exercises narrow-window,
light/dark, shortcut, command-palette, hidden-surface, and overflow behavior
with Playwright in CI and the formal hosted verifier.
- A resumable three-step Desktop first-use guide covering local profile
creation, explicit host-key verification in Connect, and entry points for
Terminal, SFTP, and loopback-only forwarding; Help can reopen it at any time.
- An 80-locale Microsoft Store discoverability draft backed by the 15 shipped
application UI locales; Store listing locales that share a UI pack are kept
distinct from the app's actual translation coverage.
- Support, privacy, refund, sale, trademark, third-party notice, pricing, and
funding drafts that keep all unverified seller and checkout data blocked.
- A bilingual voluntary-support page with maintainer-supplied Weixin Pay and
Alipay QR codes, explicit non-purchase/privacy safeguards, and a fail-closed
GitHub Sponsor button pending live recipient, payment, platform-rules, and
payout verification.
- A read-only remote release-control audit for repository visibility, protected
`main`, vulnerability reporting, release environments, Actions artifacts,
caches, and externally confirmed billing readiness.
- A redacted full-history Gitleaks gate with exact historical fixture
fingerprints and tests that reject broader rule or ignore configuration.
### Fixed
- Sync now rejects future base cursors without mutation, records unique device
registration audit IDs, keeps Mobile response-body reads under the request
timeout, and reports malformed JSON without echoing response content.
- The dependency audit now limits the temporary `image-size` exception to the
exact non-public Mobile Expo/Metro graph, while the `nanoid` override resolves
its high-severity advisory.
- Cross-platform dependency-lock portability, Desktop async interaction races,
SFTP path and transfer safety, PTY lifecycle behavior, forwarding cleanup,
Mobile sync behavior, Web Admin localization, and responsive UI states.
- Public vulnerability disclosure links, workflow secret scope, dependency
auto-merge boundaries, and high-privilege workflow permissions.
- Windows Store automation is now hosted-verification-only: externally produced
EXE/MSIX bytes require a URL and SHA-256, while build signing, OIDC,
self-hosted runners, local handoffs, and signing secrets stay outside the
workflow.
### Changed
- Froze speculative feature development after this closeout; maintenance,
security, compatibility, accessibility barriers, and bounded community
contributions continue until documented external-demand thresholds are met.
- Rolled the candidate forward without moving the existing
`v0.1.0-beta.9` tag.
- Made Windows Desktop the first adoption and revenue-validation lane while
keeping Community functionality MIT-licensed and keeping paid, hosted, and
unsupported-platform promises unavailable until their evidence gates pass.
- Prefer a time-boxed Microsoft Store MSIX feasibility spike for the free
Community build, with public-CA-signed Tauri NSIS retained as the fallback.
- Pinned CI actions to reviewed commit SHAs and disabled persisted checkout
credentials.
## [0.1.0-beta.9] - 2026-06-23
### Added
- Public Beta dogfood evidence template and verifier covering the top Desktop,
Web Admin, Sync, rollback, and release-evidence review tasks without allowing
open P0/P1 findings.
- Internal-only unsigned Desktop staging handoff report that records artifact
path, SHA256, Git ref, and Windows Authenticode status while keeping unsigned
builds out of `reports/release`.
- Repository release handoff playbook for moving reviewed work from a damaged
`.git` planning workspace into a healthy checkout before Public Beta tagging,
checksums, SBOM generation, or GitHub Release drafting.
- Web Admin proxy public-bind operator authentication guard so non-loopback
proxy deployments fail closed unless a distinct inbound operator token is
configured and verified before the upstream admin token is injected.
### Fixed
- Desktop host-key probing now ignores stale results when the connection form
changes mid-probe.
- Desktop SFTP listing, download, and overwrite flows now pin the directory
context so slow listings or pending overwrite confirmations cannot target the
wrong folder.
- Tauri SFTP IPC now rejects unsafe remote paths with traversal, control
characters, bidi controls, or backslashes before reaching the SFTP backend.
- Desktop port-forward runtime cleanup now stops active native forwards when
the backend session changes and ignores stale start results.
- Invalid Desktop connection-import files now surface an error toast instead of
silently reporting zero imported connections.
### Changed
- Release readiness now requires the dogfood verifier, native SFTP path guard,
forward lifecycle cleanup evidence, and unsigned-staging handoff guard.
- Public release readiness now requires the repository handoff playbook and
blocks stale fixed test-count or absolute coverage claims in the changelog.
- Desktop known-host Settings actions now require confirmation before removing
one host key or clearing all stored host keys, and failed updates surface as
errors instead of being silently treated as success.
- Desktop interactive PTY sessions now resize the existing remote PTY when the
terminal container changes size, show open/closed/error state, retain exit
codes, and offer reconnect without rebuilding the xterm instance.
- Pull request checklist wording now references the test gate without a fixed
test count.
## [0.1.0-beta.8] - 2026-06-23
### Fixed
- Public Beta release notes now include the Sync Service and SHA256 evidence
language required by the release readiness gate.
### Changed
- Rolled the Public Beta candidate forward from `0.1.0-beta.7` to
`0.1.0-beta.8` without moving the already-published beta7 tag.
## [0.1.0-beta.7] - 2026-06-23
### Added
- Desktop formal evidence diagnostics for the Public Beta release handoff,
including tag/HEAD state, remote ref publication, staged artifact coverage,
signing secret names, workflow visibility, CI runs, and check-run annotations.
- Desktop formal evidence preflight now validates that the requested release
ref resolves to the current healthy checkout `HEAD` and is published to the
canonical remote before it can dispatch the formal evidence workflow.
### Changed
- Public Beta release docs now treat Desktop diagnostics and signing-secret
templates as handoff-only local artifacts, separate from the final
`reports/release/` upload tree.
- The beta7 candidate preserved `0.1.0-beta.5` as the last pushed candidate
while local release evidence was refreshed.
## [0.1.0-beta.5] - 2026-06-22
### Added
- Fixture-backed Public Beta release gate wrapper so release machines can run
the full `qa:release:public` command under a local OpenSSH dogfood fixture
while still writing real Desktop SSH smoke evidence first.
## [0.1.0-beta.4] - 2026-06-22
### Added
- Public Beta release gate with release QA, Rust workspace checks, Tauri shell
build check, production audit risk register validation, self-hosted Sync
smoke, and visual QA.
- Desktop distribution guide covering Tauri bundle metadata, signing,
notarization, Linux artifacts, checksums, and GitHub Release drafts.
- Web Admin static deployment guide for `_headers`, CSP, admin snapshot URL,
bearer token configuration, cache behavior, and rollback.
- Sync Service self-hosting guide with Dockerfile, systemd example, required
tokens, CORS, storage, rate limit, and JSON ledger single-process limits.
- Public Beta privacy note requiring opt-in telemetry and forbidding collection
of SSH hosts, usernames, commands, paths, file names, keys, tokens, and
terminal output.
- Dependency risk register for documented moderate production audit findings
that do not block the Desktop + Web Admin + self-hosted Sync Public Beta.
### Added
- Service worker update notification with `sw-update-available` custom event and auto-reload on controller change
- Periodic service worker update checks (every 60 minutes) for both desktop and web apps
- Offline page `aria-live="polite"` region for screen reader announcements when connection restores
- Offline page `focus-visible` styles for keyboard navigation
- Offline page `prefers-reduced-motion` support to disable transitions
- RFC 9116 `security.txt` in `.well-known/` for responsible vulnerability disclosure
- `` for native dark mode form controls and scrollbars
- `scrollbar-color` CSS custom properties for themed scrollbars in both desktop and web apps
- CSP directive `object-src 'none'` to block plugin content injection
- CSP directive `upgrade-insecure-requests` to auto-upgrade HTTP to HTTPS
- `setTag()` in error-monitor now accepts `string | number` values for numeric context (retry counts, latencies)
- Custom `404.html` error page for web app with consistent dark theme design
- `humans.txt` credits file in both desktop and web public directories
- Twitter Card meta tags (`twitter:card`, `twitter:title`, `twitter:description`) for social sharing
- PWA shortcuts for Team Access, Port Forwarding, and Settings in desktop manifest
### Fixed
- Removed stale `/sitemap.xml` reference from web `robots.txt` (no sitemap existed)
- i18n check script (`scripts/check-i18n.cjs`) now reads from separate locale files instead of the monolithic `index.ts`
### Changed
- ARCHITECTURE.md with system design, data flow, security layers, sync protocol, and testing strategy
- Documentation section in README linking all project docs
- Cross-reference from CONTRIBUTING.md to ARCHITECTURE.md
- Automated accessibility E2E tests with @axe-core/playwright (WCAG 2.0/2.1 AA)
- Comprehensive CONTRIBUTING.md with development workflow, code style, and commit conventions
- Enhanced SECURITY.md with security headers verification details
- CHANGELOG.md for tracking changes
- i18n manual chunk splitting in both desktop and web vite configs
- Security headers verification script (scripts/check-security-headers.mjs)
- Security headers check in CI pipeline
- Build artifact upload in CI for debugging
- PWA shortcuts for quick actions (Quick Connect, SFTP, Team, Devices, Audit)
- PWA manifest `id` field for stable app identification
- Breadcrumb support in error monitor for debugging context
- `visibilitychange` listener in error monitor to flush on tab hide
- Dependabot auto-merge workflow for minor/patch updates
- Service worker cache size limits (100 entries max) to prevent unbounded growth
- Stale-while-revalidate strategy for static assets in service workers
- Keyboard shortcuts overlay now has proper dialog ARIA role, modal, and label
- Error monitor health report API (`getHealthReport()`) for monitoring dashboards
- Error monitor web vitals API (`getWebVitals()`) for performance dashboards
- SFTP panel file list `role="list"`, `aria-label`, and per-file `aria-label` for screen readers across all 15 locales
- Sync service rate limiting via `tower::limit::RateLimitLayer` (configurable with `ATLASTERM_SYNC_RATE_LIMIT`, default 100 req/s)
- E2E accessibility tests for settings panel and team access panel
- Exported `HealthReport`, `WebVitalsReport`, `ErrorGroup`, and `WebVitalEntry` types for consumer dashboards
- CI Rust job with `cargo fmt --check`, `cargo clippy -- -D warnings`, `cargo test`
- CI i18n release gate (`qa:i18n-release`) in build job
- CI sync API docs contract check (`qa:sync-api-docs`) in build job
- `aria-label` on icon-only buttons in GroupManagerModal (4 new i18n keys across 15 locales)
- `aria-current` on current group item in ContextMenu
- `aria-label` and `role="search"` on TerminalPane search bar
- `aria-hidden="true"` on decorative icons in StatusBar, Sidebar, CommandPalette
- `role="contentinfo"` on StatusBar footer
- Sidebar `` changed to `