v0.6.57
latest May 2026- fixmacOS auto-update self-relaunch — fixed SingleInstanceLock race that left the app gone after update; goes through LaunchServices via `open` now so the new bundle gets proper Dock + signature registration
- featureTray icon as proper macOS menubar template — pure black silhouette, auto-tints for light/dark menubars instead of the previous metallic-on-white that read as a white square in dark menubars
- featureRounded-square app icon for Dock + Start Menu + Linux launcher + MSI installer — Apple HIG compliant; Wails build regenerates .icns + Windows resource ICO from the new master
- featureNew "M" brand mark across favicons (meshr.to, app.meshr.to, docs.meshr.to), tray icons, in-window header — PNG-embedded SVG to preserve the 3D metallic gradient
- fixmacOS DMG ship — signed + notarized + stapled releases for v0.6.54 through v0.6.57; fixes the "Update failed — DMG 404" stalled auto-update
- featureBinary-only update fallback when the macOS DMG is missing — patches CLI + daemon in place via per-arch artifacts, atomic rename via sibling .tmp file
- featureSSH connect gated on mesh-tunnel ready state — SSH icon + "Connect via SSH" CTA disabled with a tooltip while the tunnel is connecting; prevents the "ws dial timeout" confusion on first launch
- fixWiX MSI build — dropped invalid Return="asyncNoWait" from WixShellExec custom actions; every package:windows-msi job since c700ee4 had been failing with WIX0038
- fixWindows GitLab build pipeline thawed — pre-committed Wails bindings + -skipbindings flag works around a Windows-runner-only hang in `wails generate`; build:windows green again after months of 1h timeouts
v0.6.52
May 2026- featureSSH window status bar — live latency, bytes transferred, and cols×rows pulled from HealthMonitor + WG peer stats every 2s
- featureSTUN endpoint discovery — agent runs a 10-min STUN probe and reports its public WG socket on every heartbeat
- featureControlplane stores devices.public_endpoint — Phase 2 prep for direct peer-to-peer routing without dataplane relay
- improvementGranular SHOW_* feature flags replace the all-or-nothing SHOW_WIP toggle in the SSH window UI
v0.6.51
May 2026- securitySFTP jail-to-home — every file op now resolves under the SSH user's home dir; /etc/shadow style escapes blocked
- securityDocumented Windows SYSTEM-level shell as a known limitation; per-session warning log added until S4U + CreateProcessAsUser fork lands
- featureWindows ConPTY now prefers pwsh.exe → powershell.exe → cmd.exe so users get tab completion + colour by default
- featureLive progress on SSH window Upload/Download — 250ms throttled events, "Sending… 47%" button label
- improvementSFTP session cache per (host, login) — repeat transfers skip the 300-500ms cert-mint round-trip, retry-on-stale handles peer reboots
- fixWireGuard PersistentKeepalive defaults to 25s when controlplane omits it — defends against silent NAT-mapping death on self-hosted setups
- improvementSSH window WIP UI hidden behind feature flags (Forward port, Info, More, Split, key fingerprint) until each backing feature lands
v0.6.50
May 2026- featureIn-app SSH terminal — xterm.js inside the meshr window with tab strip, theme tokens matching the design source, and per-session recording
- featureSFTP-based Upload / Download buttons in the SSH window via direct mesh dial (port 2022) with cert auth — no controlplane WS proxy hop
- featureWindows ConPTY support — real interactive shells with line editing, ANSI colour, and resize forwarding (replaces the no-PTY fallback that left typing dead)
- improvementSettings adds an SSH client picker — "meshr built-in" vs "system terminal" so users on macOS / Linux can keep their existing iTerm / Terminal.app workflow
- improvementCustom dark window header replaces the white macOS title bar — consistent with the main meshr panel
- fixapt upgrade over SSH-via-mesh no longer breaks the dpkg session — daemon restart is detached via systemd-run
- fixSSH session recordings no longer bloated by 0×0 bogus resize events from hidden tabs
v0.6.46
April 2026- featureNAT mapping auto-recovery — HealthMonitor pings every 10s, majority-down triggers a full disconnect+connect cycle with 60s cooldown
- improvementmacOS UX polish — menubar absorption, traffic light inset for the new SSH window, BTM database recovery on uninstall
- fixWindows update path — MSI uninstall hygiene + watchOwnExecutable self-relaunch on binary mtime change
v0.6.45
April 2026- featureWails main window — native desktop panel replaces the tray-only UX; live WG telemetry, Diagnose modal, and in-app update flow
- featureMesh-SSH end-to-end — open SSH from the Devices list, runs through the controlplane WS proxy with cert auth, RBAC, and recording
- featureCGNAT collision detection — refuses to bring up the tunnel when 100.78.0.0/16 conflicts with the host's existing range
- featureNotification bridge — daemon emits update / connection events to the system notification center
- fixTUN MTU reduced 1280 → 1200 to fix fragmentation behind certain GPON modems
- fixNAT-NAT silent-drop fixed by routing all traffic through the relay until per-peer endpoints land in Phase 2
- fixCLI 401 auto-refresh — `meshr ssh` now transparently refreshes stale access tokens before retrying
- fixmacOS controlplane proxy default switched to api.meshr.to; LAN traffic bypasses the tunnel by default
v0.5.25
April 2026- featuremacOS DMG installer — drag-to-install, SMAppService daemon registration, notarized + signed
- featureSigned Windows MSI — ARPNOMODIFY hygiene, Defender quietness via reputation submit, browser sign-in flow
- featureBrowser sign-in — controlplane redirects to a local agent callback so users authenticate in their existing browser session
- featureIn-tray sign-in dialog + log viewer — operators can paste a token or watch live daemon logs from the menubar
- securityWindows IPC named-pipe ACL — only the local user (or admin) can talk to the daemon via the meshr pipe
- improvementsshserver shell resolution — picks /etc/passwd login shell first, falls back to /bin/bash → /bin/sh chain
- fixWiX MajorUpgrade no longer fights ARPNOMODIFY — clean uninstall of older versions before the new one lands
v0.5.10
April 2026- featureUninstall tracking — agent's preremove hook reports UninstalledAt + reason so the dashboard can group permanently-gone devices
- fix5-layer DNS chain fix — resolver upstream → systemd-resolved → meshr DNS → fallback chain now consistent across distros
v0.4.2
April 2026- featureWindows MSI installer — WiX v5, auto-creates service, PATH, firewall rule
- featureWindows ARM64 support — native builds for ARM-based Windows devices
- featurePowerShell install script — irm https://get.meshr.to/install.ps1 | iex
- featureGDPR cookie consent banner — Accept/Decline with PostHog opt-in/opt-out
- featureCookie Policy page — transparent cookie and third-party documentation
- featureDownload redirect API — /download/windows-msi, /download/windows-zip with version auto-detection
- featureProduct Roadmap — public roadmap document with quarterly milestones
- improvementWindows install page redesigned — dropdown with x64/ARM64 MSI/ZIP options
- improvementiOS, Android, Docker tabs — "Coming Soon" with notify button
- improvementCI/CD Windows pipeline — native shell runner, WiX MSI + ZIP packaging
- improvementR2 publish — all release artifacts uploaded to Cloudflare R2 CDN
- improvementDocs installation guide — expanded Windows section with MSI + PowerShell methods
- improvementFooter updated — Cookie Policy link added to Legal section
- fixSystemd service — removed namespace hardening for ARM kernel compatibility (OrangePi, Rockchip)
- fixSystemd sleep path — /bin/sleep replaced with PATH-based sleep for cross-distro support
- fixWindows CI GOPATH — fixed Linux path override on Windows shell runner
v0.4.1
April 2026- featureKeycloak identity provider — Google, GitHub, Microsoft social login
- featurePlan & quota system — Free, Pro, Team, Enterprise tiers with resource limits
- featureBilling dashboard — plan management, usage tracking, upgrade flow
- featurepricing.md — single source of truth for pricing across all frontends
- featureQuota enforcement — HTTP 402 with upgrade prompt on limit exceeded
- featureTrial management — 30-day free trial for Pro and Team plans
- featureAudit retention cleanup — automatic per-plan retention policy
- improvementLogin & register pages redesigned — animated mesh background, glassmorphism
- improvementMarketing site consolidated — 41 pages reduced to 34, duplicates removed
- improvementCTA standardization — consistent "Get Early Access" across all pages
- improvementInstall script URLs fixed — all pointing to get.meshr.to
- improvementSidebar plan badge — shows current plan, trial countdown
- improvementPostHog analytics — event tracking across marketing, dashboard, and docs
- improvementCI/CD pipelines — Docker build + registry push + SSH deploy for all services
- improvementProxy nginx — resolver-based lazy upstream resolution, independent startup
- improvementRegister form — company name and team size fields for lead qualification
- improvementURL standardization — APT repo: pkgs.meshr.to, install: get.meshr.to
- securitySSO feature gate — SSO restricted to Team+ plans via quota service
- fixKeycloak HTTPS requirement disabled for development mode
- fixDocker deploy — --no-deps flag prevents dependency container conflicts
v0.4.0
March 2026- featureHTTP & TCP tunneling — expose local services through the mesh
- featureInternal DNS server — access devices by name (device.meshr)
- featureZero Trust Network Access (ZTNA) — policy engine for every connection
- featureAccess Matrix — visual grid of who can access what
- featurePolicy simulator — test access rules before applying
- featureTunnel authentication — basic auth, bearer token, or custom headers
- improvementBandwidth tracking for tunnels and SSH sessions
- improvementgRPC mTLS — encrypted agent-controlplane communication
- securityHMAC-signed recording URLs (no tokens exposed in URLs)
- securityPassword hashing for tunnel auth (bcrypt + SHA-256)
- securitySecurity headers middleware (CSP, HSTS, X-Frame-Options)
- securityRate limiting on authentication endpoints
v0.3.0
March 2026- featureWeb-based SSH terminal with xterm.js
- featureSSH session recording (asciicast v2) with encrypted playback
- featureSSH Certificate Authority — per-organization User CA + Host CA
- featureJIT privilege elevation with admin approval workflow
- featuregRPC bidirectional SSH tunnel (controlplane ↔ agent)
- improvementTerminal resize support (window-change forwarding)
- improvementWebSocket keep-alive with ping/pong
- fixSSH session duration tracking for terminated sessions
- fixSSH cert serial overflow (uint64 compatibility)
v0.2.0
February 2026- featureMulti-tenant organization system with role-based access
- featureInvite system — link-based and SMTP email invitations
- featureAccess Control Policies with direction control (ingress/egress/bidirectional)
- featureSetup Keys — reusable, usage limits, ephemeral peers
- featureGroups with user, peer, and resource assignment
- improvementArchitecture split: controlplane + dataplane
- improvementgRPC migration for agent communication
v0.1.0
January 2026- featureSvelteKit dashboard with dark theme
- featurePeers management with online/offline status
- featureNetwork and DNS management pages
- featureAudit event logging
- featureLinux packaging (deb/rpm) with systemd service
- improvementCross-platform agent builds (Linux AMD64/ARM64, macOS, Windows)
v0.0.1
December 2025- featureInitial release — encrypted mesh VPN with relay
- featureGo agent with CLI and daemon mode
- featureDocker Compose deployment
- featureJWT authentication with user management