Changelog

Added

• Personal AI preferences: a settings entry in the AI panel stores your conversation display level (Compact / Standard / Detailed) and whether the AI may include command snippets. Preferences apply to your account only and sync across devices; the display level takes effect immediately, the command-snippet switch from the next request.

Fixed

• AI file tools were wrongly reported as "file system disabled" because an asset protocol was missing.
• Credential rotation: sudo compatibility, shared-reference validation, and failure recovery, with the generated license configuration updated accordingly.

Changed

• AI conversation view: execution steps collapse or expand according to your preference, with new running states (running, waiting for approval, completed, stopped, failed) and an "N tool calls" summary; tool cards now show the tool name, arguments, explanation, and file content.
• Asset access and groups: the asset access button and action bar share one style, and deleting a host or website asset group now asks for confirmation.

Added

• SMS authentication channels: a Webhook provider (custom JSON body and headers, for your own SMS gateway) and Alibaba Cloud phone-number verification (mainland China numbers only; AccessKey and template required). The SMS settings page can send a test message.
• Email and SMS authentication policies: a new "Verification & messaging" section manages email and SMS verification and the message service in one place, and can be required at sign-in by policy.
• Enable or disable assets: hosts and database assets can be disabled — a disabled asset can no longer be accessed, and the list shows the state consistently.
• Department management: drag to reorder departments and move a department across branches in the tree.
• API access switch and Agent access page: a global API access switch (on by default) and a dedicated Agent access page, with permissions and layout updated accordingly.
• Personal settings: bind an email address and phone number for email and SMS verification, and configure personal notifications per event.

Fixed

• LDAP domain accounts: usernames match case-insensitively, DN changes and existing bindings are handled, and first sign-in can create the user automatically.
• Web assets could not use access-password authentication when no public rule matched.
• Anonymous session share pages no longer redirect to sign-in because they request a license.
• SMS sign-in verification code validation, with a smoother verification-code flow.
• The department dialog in access requests was hidden behind the drawer.

Changed

• Sign-in verification now uses a slide-to-fit puzzle instead of an image captcha, with unified localized copy.
• Asset alias is shown under the name and the separate alias column is gone.
• The access-request approval drawer was refined and can adjust the effective time; close reasons now use unified reason codes, with existing Chinese reasons migrated.
• Approval personal notifications were completed and the notification settings page simplified.
• Business copy in all four languages was polished, with dynamic hints fully localized.

Added

• Agent onboarding and API resource-management client: the access page walks through API key setup, with an English Skill document and install script, persisted instance configuration, interface search, and resource-management calls, plus localized copy.
• Database work-order events and applicant email notifications: creation, approval, rejection, and execution-result events feed the general notification rules; a separate email switch sends the result to the applicant in their language and records delivery failures.
• Access tokens: tokens can be given an expiry time, and creating or editing one now requires a token name; Termark tokens get a generated random name.
• OpenAPI documentation entry for administrators, and the Swagger page is no longer shadowed by the frontend static home page.

Fixed

• AI file operations now use SFTP: file permissions are checked independently and file operations are audited, with command concatenation and the shell fallback removed; SSH restricted-shell and Telnet devices are supported, including input filtering, session isolation, cancellation, and resource cleanup.
• AI conversations no longer leave the input unusable after a connection drop, with WebSocket heartbeat and automatic reconnect added.
• Sensitive operations are restricted to login sessions: two-factor operations, backup file download, and client certificate issuance and revocation; not-found, bad-route, and permission errors now return consistent HTTP status codes; idempotent SSH key deletion and website authorization parameter errors are fixed; the old backup export entry point and the legacy query-parameter token deletion entry point were removed.
• Disk file operations gained security validation and audit records.
• Free licenses no longer run the login access policy, and the system event detail dialog layout is fixed.
• A failed login no longer has its local error message overwritten by the global access-denied redirect.
• An audit administrator's saved name and permissions survive a restart; the system administrator can no longer be edited and built-in roles can no longer be deleted, with roles still in use protected.
• Regular administrators no longer fire unauthorized API requests when crossing pages; the access-request scope-name tree node type error and the virtual-list parameter issue are fixed.

Changed

• Database assets can select a database name, with account permission restrictions documented.
• Access requests support an effective time, event notifications, and resource scoping by department.
• AI interface: conversation rendering, streaming scroll, and tool-execution cards are aligned with the desktop client; the context panel's contrast and hierarchy, the action menu and context-usage percentage, and the reply card and Markdown width were refined, and the copy button moved to the bottom.
• Notification rules: the table layout was refined, with select-all for events and groups plus category preview; the alert-level filter was removed and the security-gateway wording corrected.
• Assets no longer offer an "enable AI" switch — SSH assets have AI available by default.
• Agent permission query and connection constraints were refined, and regular users no longer see the documentation entry.

Fixed

• Remote desktop sessions now report tunnel connection failures and timeouts instead of failing silently.
• Remote desktop shortcuts (F5, Ctrl+S, ...) no longer trigger the browser's default behaviour, and the input box takes focus automatically once the session is connected.
• SQL work orders are no longer executed twice or racing on status changes: approval, rejection and deletion now run under atomic status conditions, and the execution result is saved in the same transaction as its audit record. Work orders left over from an error or a restart are marked as "needs verification".
• Frontend updates take effect immediately: the old Service Worker is replaced by a self-destroying one and is no longer re-registered, cached assets are revalidated before use, and the login page brand name uses the theme foreground colour so it stays readable in dark mode.

Changed

• MySQL and PostgreSQL database proxies intercept fewer protocol statements, so more client statements go through.
• SQL work order and execution log pages now show the work-order ID, the applicant, the approver and the database account used; the "approved" status is displayed as "executing".

Fixed

• Menu permissions: a regular administrator no longer hits "Permission Denied" when opening the settings page, and the global audit menu now covers 13 endpoints that previously had no permission entry.
• Menu permission definitions corrected: the deprecated user-group menu was removed, and the offline session-recording endpoints are now covered.
• The workbench sidebar and top bar now use fixed pixel widths, so the sidebar width no longer scales with the window size.

Changed

• Markdown rendering switched to the react-markdown + remark-gfm libraries, for fuller GFM support (tables and other GFM syntax).
• AI assistant: the message list now scrolls in a dedicated ScrollArea, with the virtualized list and Windows scrollbar styling refined.
• The role list no longer shows the type filter.

Fixed

• Unauthenticated access to /api/license now returns a proper redirect to the login page instead of failing silently (#581).
• Fixed an incorrect parameter type when updating notification delivery records after sending.

Added

• Database proxy: PostgreSQL protocol support, with dedicated policies, TLS configuration, external access address and audit logging.
• MySQL proxy supports TLS encryption between clients and the proxy; proxy certificates are now picked from the certificate list (RDP proxy aligned).
• Database proxy runtime statistics, shown on the proxy settings page.
• MySQL and PostgreSQL proxies can be started and stopped independently, and are now top-level tabs in Settings.
• Credential rotation for SSH assets, including rotation policies and rotation result details.
• Clear Passkey from user settings and via the CLI.
• Access logs now display and support searching by request ID.
• OIDC: id_token response type and offline-access configuration.
• IP sets are now a standalone module and can be referenced by identity access policies.
• Web assets support copy, public status and tags.
• Redesigned resource portal cards with a detail dialog.
• Terminal command recognition upgraded with a bounded line window and OSC 133 layered detection, making command filtering more accurate.

Fixed

• Fixed a database UTF-8 write error caused by byte-truncated AI session titles.
• Fixed SSH authentication failures caused by credentials being encrypted twice.
• Fixed license limits not being loaded after sign-in.
• Fixed PostgreSQL asset connection tests hanging.
• Fixed a BlockDML bypass in the PostgreSQL proxy and improved audit accuracy.
• Fixed proxy statistics requests using the wrong path and hardened error handling.
• Authentication reset now requires second-factor verification.

Changed

• Refined locked-feature descriptions and the boundary between free and paid capabilities.
• Adjusted menu naming and resource ordering, and removed leftover Kubernetes asset code.
• Unified the compact search toolbar and improved multi-condition search layout in tables.
• S3 recording playback is streamed directly instead of writing local temp files.
• Reworked the credential rotation flow and its policy preset localization.
• Improved TLS wording on proxy settings; the certificate selector only renders when TLS is enabled.
• The PostgreSQL proxy listens on port 5433 by default.
• Security tokens are now passed through request headers only.

Added

• Added AI model switching and refined execution-policy settings.
• Redesigned the terminal AI assistant header with full context-usage details.
• Refactored AI host capabilities to reuse the Termark SDK.

Fixed

• Fixed content loss when the AI/metrics monitoring side panel is hidden.
• Fixed unregistered-constraint error on the side panel.
• Fixed AI input box corner-radius styling.
• Fixed the terminal tool side panel being compressed too narrow.

Changed

• Unified the AI and metrics monitoring side panels.
• Streamlined AI header actions and removed the ZMODEM upload button.
• Removed asset info from the terminal AI header.
• Improved terminal AI side panel and input interactions.

Added

• SSH session command audit with remote execution detail view, supporting full command list and remote execution details for each session.

Fixed

• Improved error handling for session disconnect cleanup.

Changed

• Removed manual operation log clearing; logs now expire automatically only.
• Improved two-factor authentication binding and unbinding page interaction.

Added

• S3 recording multipart size, threshold, and concurrency configuration with customizable upload settings.
• S3 recording Region configuration for object storage.

Fixed

• Query cache conflict and real-time connection lifecycle.
• Unified frontend data queries and fixed cache keys.
• Password policy validation and removed sensitive debug logs.
• Background workspace height and responsive sizing.
• Access session content area height.
• S3 Signature V4 compatibility behind proxy forwarding.
• Terminal playback dependency upgrade with critical security fix.

Changed

• Removed frontend dead code and simplified request/state implementation.
• Simplified frontend theme state and cleaned unused dependencies.
• Migrated deprecated Ant Design APIs and simplified settings page styles.
• Unified access protocol runtime and reworked page state and sizing.
• Reworked access page responsive sizing and fixed sidebar toggle.
• Removed bucket validation.
• Optimized create backup modal and reused notification components.

Added

• Dynamic website response header rewrite with URL host and regex rules, supporting website domain variables while preserving the Location path.
• Automatic multipart upload for large S3 objects, improving reliability for backup and object storage.
• Goroutine leak diagnostic endpoint for the main service to aid production troubleshooting.
• Improved backup remarks and filename handling.

Fixed

• Fixed composite form control field binding.
• Fixed an issue where clearing the website IP whitelist could not be saved.
• Fixed backup retention days setting.

Changed

• Reworked the WebDAV client and fixed compatibility issues.
• Improved the public access whitelist with a line-by-line input (StringListInput).
• Reworked the frontend request error handling strategy with unified error classification.
• Improved login failure lockout messaging and version update guidance.
• Optimized the gateway install script update order and permission hints.
• Modernized backend with Go 1.27 (error handling, concurrency, testing), standardized UUID usage and stronger security token randomness.
• Upgraded backend dependencies to Go 1.27, upgraded frontend dependencies and build tooling, migrated deprecated Ant Design APIs and added lint scanning.

Added

• Reusable IP whitelist management — create, reuse and sync IP whitelists across website assets (new ip-whitelist API/model/service, UI pages IPWhitelistPage/Modal, wired into asset drawers and menus; i18n en-US/ja-JP/zh-CN/zh-TW).
• Asset group tree column resize UX improved.

Fixed

• Restored website access log toggle (PublicView).

Changed

• Gateway one-click install scripts optimized for Linux/macOS.
• Tunnel logs unified to English without emoji.
• Latest license URL updated.
• README de-workshopped: default English, support@next-terminal.com, sponsors collapsed, SharonNetworks removed.

Fixed

• Fixed feature not supported error when editing web assets

Fixed

• Fixed upgrade failures in some environments

Added

• HTTP and SOCKS5 proxy support for Agent
• Asset connection methods and proxy server management
• Website and database asset connection methods
• SFTP directory auto-follow and asset tree parameters
• File transfer via lrzsz in web terminal
• Batch editing for web assets
• Multi-factor authentication for asset access with one-time tickets for SSH/RDP
• Mouse cursor recording for RDP recordings
• Session exit policy on browser close
• Path wildcards for public access rules

Fixed

• Fixed cache issue during GEO data online updates
• Fixed white screen in RDP recordings caused by legacy bitmap updates
• Fixed incompatibility between Alibaba Cloud registry and OCI attestations
• Fixed custom request headers for websites not persisting
• Fixed Sidecar crash due to missing codec for compressed bitmap recording
• Fixed unable to reconnect after asset authorization failure
• Fixed browser language not auto-matching on the frontend

Changed

• Reworked file upload tasks and progress management
• Improved asset tree API with AI enablement field
• Improved linkage among restricted shell checks
• Overall UI improvements
• Unified batch connection methods and completed terminal settings
• Added notes to command filter rules
• Improved public access rule configuration
• Added RDP GDI fallback troubleshooting notes
• Improved notification channel layout and enable/disable interaction
• Improved session settings page layout
• Simplified some code paths

Fixed

• Fixed SSH proxy server itself failing to perform port forwarding

Added

• PostgreSQL 18 Docker image with auto-follow upstream builds
• Enhanced origin response logging in access logs
• Recording of upload failures with manual retry

Fixed

• Fixed access policy time config not correctly displayed after edit
• Improved access policy permission checks to avoid restricting super admins

Changed

• Upgraded Docker build environment to Alpine 3.23
• Optimized Docker image build flow, integrated RDP Sidecar build chain
• Improved access policy configuration hints and maintenance UX

Fixed

• Fixed text remaining black in dark theme
• Fixed asset search not matching remarks

Added

• Reworked access control policy system
• Multi-level grouped asset import/export
• HTTPS origin certificate verification for websites
• Termark mobile OAuth callback
• Improved AI capability controls

Fixed

• Fixed session protocol ordering and added protocol filtering
• Fixed deny handling in access control and improved multi-protocol checks
• Fixed nil pointer during access policy migration
• Fixed blank items in dynamic route breadcrumbs
• Fixed dark mode for regular user profile page
• Fixed theme switch spread animation
• Fixed performance during upgrade migration and added DB lock wait protection

Changed

• Improved policy binding UX
• Unified access control copy
• Improved policy form interaction and hints
• Hidden unstable tunnel connection tip to reduce noise
• Improved dark mode for AI settings cards

Added

• Batch editing for assets (bulk update of asset info and gateway settings)
• Third-party account management for users
• Reuse Passkey for identity verification when binding third-party accounts
• Select parent group in asset and website grouping
• Custom error pages for HTTP reverse proxy
• Built-in high-risk command interceptor with low false-positive defaults

Fixed

• Fixed graphical session recording playback window glitch
• Fixed SSHD password login incorrectly affected by global Disable Password Login
• Fixed SFTP file list scroll glitch
• Fixed empty and array handling for asset properties
• Fixed gateway asset status misjudgment and SSH probe timeout

Changed

• Improved batch editing flow and integrated gateway settings
• Reworked asset and website grouping trees for better hierarchy management
• Reworked external identity data model, removed legacy user source field
• Improved backend authentication and authorization
• Skip repeated TOTP second factor after successful third-party login
• Removed enhanced capability license check for offline sessions
• Improved terminal tool drawer layout and UX
• Capped login session max lifetime at 365 days
• Removed custom playback speed for graphical session player

Added

• Facade views for assets and websites with switchable display modes
• Access request tickets with per-asset toggle and approval workflow
• Notifications: rules, delivery history, channel testing and event monitoring
• WeCom app notification channel
• Event system for unified handling of system events
• Upload system backups and session recordings to WebDAV
• Chained multi-level SSH gateway access; gateways can reference assets with gateway chains
• Gateway group scheduling reason logging for troubleshooting
• AI assistant with environment config, context management and tool-call results
• OIDC phone number scope and improved OIDC client configuration
• GEO region candidate config for websites with authorization constraints
• Domain-based licensing as an alternative to machine-code binding

Fixed

• Fixed terminal screen being cleared after disconnection
• Fixed font dropdown display in access settings
• Fixed license settings save validation, binding display and cleanup
• Fixed auth tokens readable via URL query parameters
• Fixed path traversal in disk filesystem API
• Fixed privilege escalation via website access entry
• Fixed potential infinite loop on SSH request errors
• Fixed RDP proxy high-risk process and image handling
• Fixed RDP recording lifecycle and unified remote transcoding
• Fixed RemoteApp connection and upgraded FreeRDP to 3.28
• Fixed GEO matching for Chinese provinces/cities
• Fixed missing role permission menus and i18n strings
• Fixed gateway ordering conflicts on repeated data migrations
• Fixed missing guacenc image build manifest directory
• Fixed RDP session recording compatibility with older server versions

Changed

• Licensing now supports machine-code or domain binding (choose one)
• Improved license settings: update/binding entries, layout and machine-code section
• Access request is now a paid feature
• Improved access-denied page and save interaction in access settings
• Revised system settings menu copy, structure and translations
• Reworked GEO database backend config and online updates
• Reworked AI assistant sidebar and chat interaction
• Reworked RDP proxy recording format to Guacamole
• Unified license user counting, excluding default admin
• Removed in-system online upgrade; upgraded Go dependencies

Fixed

• Fixed watermark configuration error that prevented asset access

Fixed

• Fixed missing dependency data causing errors on asset export
• Fixed missing Chinese fonts during terminal recording transcoding
• Fixed SSH Keepalive causing 100% CPU in some cases

Changed

• Offline sessions can be played back even while waiting for transcoding
• Recording config now allows keeping original files on cleanup
• Video player now uses local static assets to reduce external dependencies
• Backup storage migrated to aws-sdk-go-v2 with new S3 PathStyle option
• Improved terminal settings copy, backup key testing and file naming
• Improved save button interaction for backup settings and SSH gateway timeout handling
• Improved race-related code in SSH proxy
• Removed LLM-related features

Added

• Scheduled database backup and restore with auto upload to S3/SFTP
• Offline session MP4 recording download, playback and manual transcoding
• Transcode SSH/Telnet/RDP/VNC session recordings to MP4 with progress display
• Remote command audit logging
• Asset export
• Reference preview when deleting credentials or gateways

Fixed

• Fixed escaping of complex passwords in RDP proxy
• Fixed missing permission check on asset probe and wake APIs (#573)
• Fixed missing crash log when RDP proxy Sidecar exits unexpectedly
• Fixed authorization group inheritance logic
• Fixed RDP connectivity on some Windows 7 environments

Changed

• Improved .rdp file generation and download naming
• Improved add/edit flows for assets and website assets
• Improved website asset icon, header editing and response rule UI
• Improved authorization list filters, modals and system settings layout
• Improved SSH proxy error messages and logging
• Updated licensing system and related links

Changed

• Improved SSH session environment variable handling
• Adjusted SSH advanced settings semantics with historical data migration
• Added origin timeout for websites

Added

• Termark access to RDP assets
• Session recording for RDP proxy

Fixed

• Fixed gateway selector not rendering when creating an asset group
• Unified list style for user-side resource pages

Added

• RDP proxy Microsoft Remote Desktop direct connection (experimental, recording not yet supported)

Added

• Real client IP for SSH tunnels via PROXY Protocol
• Backspace mode for SSH assets
• Migration command for historical session recordings

Changed

• Improved operation log display and table polling refresh
• Improved SSHD asset menu rendering and interaction
• Improved storage stats in system monitoring
• Removed access log URI hint for a cleaner UI

Fixed

• Fixed inaccurate login/access log IPs after restart
• Fixed auto-allow IP retrieval
• Fixed nil pointer on backup import transaction
• Fixed data migration compatibility
• Fixed dropdown search field config not taking effect
• Fixed duplicate session record on SSH Exec child sessions
• Fixed session status anomalies and removed deprecated terminal entry
• Fixed data inconsistency during rz upload
• Fixed SSHD menu return input issue
• Fixed web asset status field anomaly

Fixed

• Fixed web asset authorization redirect flow

Added

• OIDC client no-auth configuration
• Custom request headers in network settings
• Connection timeout for asset terminals
• Default gateway for asset and site groups
• System monitoring page and metrics

Changed

• Upgraded backend framework to Echo v5
• Reworked auth middleware and request identity context
• Reworked operation log auditing
• Improved OIDC client form and filter list navigation
• Unified system IP retrieval; improved auth forms and search sync
• Frontend quality and stability improvements; updated default copyright

Fixed

• Fixed port forwarding failure
• Fixed Passkey info loss
• Fixed blank login policy detail page
• Fixed frontend i18n fallback
• Fixed license user limit miscalculation

Notes

• SSH gateway and session sharing are now paid features
• Removed concurrent connection limit from licenses

Changed

• SSH proxy server now silently ignores environment variable setup failures

Fixed

• SSH public keys can now be renamed

Added

• VSCode Remote SSH for SSH proxy server
• KeepAlive for SSH proxy server
• WebSocket proxy to reach intranet SSH proxy servers
• Image preview in SFTP
• Credential reference count for assets
• Standalone page mode for asset access
• Multi-line IP rules for public websites

Fixed

• Fixed SFTP Direct asset parsing
• Fixed sz download failure in SSH proxy server
• Fixed website tunnel port cache
• Fixed scrollbar caused by sidebar features
• Fixed OTP step cannot go back
• Fixed access log user and long-text rendering

Changed

• Improved password authentication for SSH proxy server
• Reworked add/edit flows for assets/web/database assets
• Improved mobile SSH terminal layout
• Unified table search style and improved grouping tree and asset modal layout
• Larger OTP input
• Upgraded to Ant Design 6 with broad UI and compatibility cleanup

Fixed

• Fixed panic when executing certain terminal commands
• Fixed terminal stuck in mouse mode after reconnect
• Online update adapted to new version

Added

• mTLS client certificate authentication
• Remote command execution for SSH proxy server
• ID-based connection for SSH proxy direct mode
• macOS Option as Meta in terminal
• Connectivity test for LLM/database connections
• Full file path in file editor

Changed

• User public keys moved to a dedicated settings page
• Asset tree: group search and horizontal scroll
• Terminal tabs: fixed width and Copy Session in context menu
• Disabled autofill when adding assets
• Improved long-field display in access logs and added last heartbeat to gateway monitoring
• Unified Passkey copy, improved web asset logo validation and SSH/Telnet command parsing

Security

• Security gateway no longer uses embed, significantly reducing memory usage
• Web asset public access policy: 4-dimension evaluation (IP/GEO/header/path); allow by default when none configured (caller validates Password), bypass password check on any match

Fixed

• Fixed password change time not updating when admin changes a user password
• Fixed SSH proxy not forwarding environment variables
• Fixed HTTP reverse proxy connection leak
• A failing module no longer blocks subsequent module initialization (now only logged)

Added

• Asset status filtering
• Auto OS detection with icon update for assets
• Wake-on-LAN (WOL) for assets

Changed

• Improved machine-code mismatch message
• Adjusted HTTP reverse proxy log level
• LLM client migrated to official OpenAI SDK with GPT-5.x support

Fixed

• Fixed OIDC Server signature missing kid
• Fixed asset tree not auto-refreshing on the terminal access page
• Fixed permission error when regular users open the database page
• Fixed offline SSH proxy sessions not uploading to S3

Security

• Fixed a long-standing XSS vulnerability — upgrade as soon as possible

Added

• Domain uniqueness validation when saving web assets
• WebAuthn domain auto-detection
• Database assets expose external access info for end users
• License info now includes user identity and supports offline license export
• Auto-retry on file upload failure for database assets

Fixed

• Fixed command group selection not taking effect in scheduled tasks
• Fixed RDP/VNC recordings not uploading to S3

Changed

• Startup no longer exits on data validation failure
• Security gateway: safer Home directory resolution with automatic migration of legacy config
• Upgraded machine-code algorithm (machine code changes after upgrade)
• SSH proxy now requires a private key before it can be enabled
• Improved custom Host field UX

Security

• Fixed an OIDC Server security issue — users of this feature must upgrade

Fixed

• Fixed copy failure triggered by terminal page search
• Fixed MySQL database proxy account not connecting when 2FA is enabled
• Fixed first keystroke not responding in SSH proxy server
• Fixed Enter sending the command twice during batch execution
• Fixed auto-scroll to bottom glitch during batch execution
• Fixed OTP authentication failure in SSH proxy server

Added

• Custom mTLS certificate validity with mTLS flag in the list
• Certificate issuance now supports certificate chains
• AI auditing for reviewing historical SSH/Telnet sessions
• Close a single terminal during batch execution
• Web asset page auto-fetches and displays icons

Changed

• Improved asset search with keyword lookup
• Clicking the logo on the access page returns to home

Fixed

• Fixed CLI not working
• Fixed database password not being echoed
• Fixed SSH terminal session replay style glitches

Added

• CLI now supports downloading the GeoIP database
• Added Database Assets page for regular users
• Login page now supports dark mode
• Batch unbind for user-authorized assets (requires secondary confirmation)
• Web asset public access: request header and route address whitelists

Changed

• Removed status field from database assets
• Improved regular user page structure and interactions
• Improved security gateway list and detail views
• Security gateway config loading now falls back to defaults on validation failure
• Improved AI Ops assistant logging and error display
• Renamed Shell Assistant to Ops Assistant
• Removed deprecated OpenAI configuration

Added

• First v3 stable release: MySQL database proxy, temporary allowlist for Web assets, and HTTPS mutual authentication (mTLS).