RedFlag/CHANGELOG.md

Changelog

All notable changes to RedFlag are documented here.

Format: version, date, then grouped by category (Added, Changed, Removed, Fixed, Security).

Status: alpha. Every release before v0.3.0 ships as a prerelease. Schema, APIs, and config can still change without backward-compatibility shims (there are no live field clients yet). v0.3.0 is the planned first stable release.

---

v0.2.9.3 (July 2026)

Added

• Native Windows installer (RedFlagSetup.msi) — installs the server binary as a Windows service with a forward-only upgrade guard. Built with wixl (msitools), not the official WiX Toolset .NET CLI, which does not work when the compiler runs on Linux. CI (release.yml) builds it via apt-get install msitools && wixl.
• Native (non-docker) server config loading — the server previously only read OS environment variables, which only ever worked because docker-compose's env_file: injected them. A native install now reads a flat config file (REDFLAG_CONFIG_FILE or a per-OS default path), additive and inert for existing docker deployments.

Changed

• Registration-token expiry ceiling raised from 7 days to 90 days (matching the existing refresh-token precedent); the "Agents & Enrollment" settings page is unified into one enroll flow instead of toggled panels, and the server signing-key section moved out of the per-token detail pane (it wasn't per-token).
• Release manifest correctly catalogues the server binary as kind: binary instead of kind: docker — every release was already building and packaging it, it just wasn't gate-checked or documented as a real install artifact.

Fixed

• The release build's server compile step (and three Makefile targets) passed cmd/server/main.go as a single-file argument, silently excluding wire.go (added 2026-06-11) from the build. Broken since v0.2.9.1. Now builds the package directory (./cmd/server/), matching how CI's own build-verification step already did it correctly.

Security / Design

• Windows privileged-mutation helper (SEC-030) elevation model decided: a Scheduled Task run once as SYSTEM, ACL-delegated to the agent's service account, provisioned at agent-install time — mirrors the Linux systemd-run transient-unit pattern. Design of record in RAF/components/04-helper.md. Implementation not started.

v0.2.9.1 (June 2026)

Added

• Arch Linux (pacman) update scanner wired into the agent loop. The scanner (checkupdates from pacman-contrib) was implemented but never registered — now resolves subsystem config, circuit breaker, and orchestrator registration matching the apt/dnf pattern. Server-side support (scheduler, subsystem defaults, repology aliases, capability gate) was already present.

Known limitations

• pacman updates skip OSV.dev supply-chain checks — Arch Linux is not yet a supported OSV ecosystem. Tracked as GATE-006 in supply_chain.go. Install safety relies on the capability gate + hash verification until OSV adds Arch.

v0.2.9.0 (June 2026)

Added

• Desktop tray ships for Windows — cross-compiled via cargo-xwin, installed by the Windows installer with per-user autostart (registry Run key).
• Standalone tray actions: trigger_scan and approve_update Tauri invoke commands wired to the local API (/v1/actions/trigger-scan, /v1/actions/approve-update).
• Unified settings page (Agents & Enrollment) replaces separate Token and Agent Management pages.

Changed

• Desktop tray no longer child-spawned by the agent service on Linux — relies solely on XDG autostart, killing the double-launch.
• Self-update staging paths are platform-aware (constants/paths.go) instead of hardcoded /var/lib/redflag/....
• Consumer helper invocation platform-gated: sudo systemd-run on Linux, direct child process elsewhere.
• Desktop server route expanded to /desktop/:platform/:arch for multi-OS binary serving.
• Windows tray reaches the server image by fetching the signed exe from the newest release (hash-verified against the manifest), not by cross-compiling Tauri-for-Windows in every from-source build — that drags in the ~9GB MSVC sysroot. CI builds it once; from-source servers download the verified artifact. Absent/offline degrades to no tray (optional component).
• signalDesktopRestart works on Windows (taskkill /F /IM) instead of no-opping.

Fixed

• Desktop tray window_open now correctly tracks visibility: set false on close-to-tray, set true on left-click tray icon.

Removed

• Dead NewEnforcer (nil-logger wrapper) in kernel package — refactor droppage from the LoopContext migration.
• Dead NewMigrationExecutorWithEvents — the log-only constructor is the intended one for early-boot migration.
• Orphaned service methods in service/windows.go (renewTokenIfNeeded, reportSystemInfo, reportLogWithAck, getConfigPath).

v0.2.8.4 (June 2026)

Security

• Supply chain: RedFlag now gates its own dependencies and ships the verdict signed — self-attestation posture covering dep-scan, build provenance, and an install guard.
• Crypto: forward-only key-path ceiling; the privileged helper compares artifact hashes in constant time.
• /admin route group latched behind RequireAdmin (SEC-026) — inert under the current single-admin model, live the moment RBAC lands.

Added

• Desktop tray updates route through the privileged helper like every other install path.
• RedFlag self-tracking: startup seeds a default upstream row for codeberg.org/Fimeg/RedFlag, tracks prereleases during alpha, and surfaces a dashboard update banner with the operator-run rebuild command.

Changed

• Web: interactive/brand surface recolored to steel blue, split cleanly from danger so red reads as error again (the red scale is unchanged under danger).
• Web: client errors log at the boundary (axios interceptor, ErrorBoundary, global handlers) instead of through a toast-coupled wrapper.

Removed

• Premature drift-to-update apply hooks: tracked-software drift remains an identification surface until the operator install path is scoped.

Fixed

• Web: 15 dashboard correctness/UX defects from the UI/UX audit — Docker filter cards that matched nothing, duplicated retry/cancel hooks, WebSocket reconnect leaks, notification dedup, and non-navigable notifications among them.
• OSV resilience and capability-token serialization hardening.

---

v0.2.8.2 (June 2026)

Security

• Agent-facing URLs (install scripts, registration responses, fleet-join) no longer trust the request Host header. The operator-configured REDFLAG_PUBLIC_URL wins; the Host header is only a logged fallback for unconfigured installs.
• Setup wizard reads the bootstrap database password from its environment instead of a hardcoded literal (shipped default kept as fallback).

Fixed

• Malformed agent-supplied metadata could panic handler goroutines (rapid-polling fields, buffered event metadata, timeout params) — all assertions now guarded.
• Scanner-timeout admin endpoints panicked on every call: user_id was asserted as a UUID but the auth middleware stores a string.
• Route auditor now sees the auth middleware instances (AUDIT-002); retention sweep wired onto the background runner (RETAIN-001 wiring).
• Offline-agent and refresh-token cleanup tickers moved onto the managed task runner (shutdown, panic isolation, /health/tasks visibility); upstream syncer and reconciler are now stopped on shutdown; Stop() is idempotent on all three.
• Manual sync-now reports real failures instead of unconditional success; an OSV vulnerability parse failure is logged and still fails closed.

Removed

• ~760 lines of never-wired lifecycle/build service scaffolding (AgentLifecycleService, ConfigService, BuildService, ArtifactService, AgentBuildHandler).

v0.2.8.1 (June 2026)

Added

• Retention sweep (RETAIN-001): scheduled pruning of aged rows from append-only history tables. Three operator-tunable horizons (metrics/events/audit), 0 = keep forever.
• Web: shared FilterBar with URL-synced filter state on the Agents and History pages; vitest + jsdom test infrastructure.

Security

• Fleet-join TOTP seed stored as AES-256-GCM ciphertext at rest instead of a SHA-256 hash (migration 058) — hash-only storage could never verify a time code without treating the seed as a second cleartext shared secret.

Fixed

• Process scan commands were created without a Source and hit a database check constraint every time (thanks QiTechCo).
• 12-finding code-review fan-out across server, agent, and web: URL filter sync race, NULL handling for absent machine IDs at registration, config upgrade merging for nested keys, route-audit recorder replacing unsafe reflection.

v0.2.8.0 (June 2026)

Added

• Process explorer: on-demand /proc scanning with osquery-parity detail (command line, cwd, environment size, open sockets with inode correlation, capabilities, namespaces), plus a dedicated settings page with lazy route loading.
• Inventory scanner interface with a Docker inventory path; inventory and security-event report handlers on the server.
• Self-update capability tokens for the agent, helper, and desktop binaries — binary self-upgrade now flows through the same Ed25519-signed, hash-pinned token gate as package installs.
• Setup accepts an operator-supplied signing keypair (with validation) instead of only generating one — supports bring-your-own-key deployments.
• TeeLogger wired through the agent loop, migration executors, and validator: structured dual-output logging (local + server event stream) on previously local-only paths.
• CI cross-compilation matrix: linux-arm64, windows-amd64, darwin-arm64. Helper skipped on Windows (Unix-only APIs), darwin via cargo-zigbuild, aarch64 linker pinned through helper/.cargo/config.toml.

Fixed

• rpmEVRAhead returned true for equal versions when only an explicit epoch-0 prefix differed (0:2.0-1 vs 2.0-1) — packages already at target were perpetually flagged upgradeable on every DNF check.
• Desktop self-update burned its replay token before install, so a transient failure (disk full, backup error) permanently blocked further desktop updates. Replay check now runs before install; the token is recorded as consumed only after success.
• Orchestrator constructor could carry a nil logger on the Windows service scan path; it now defaults to a log-only TeeLogger.
• /proc/stat field index bug and ProcessCaps data-collection limits; process scan dedup; NaN guards and safe parsing in the process explorer UI.
• Security event insert path corrected; GetAgentByID signature mismatch.

---

v0.2.7.1 (June 2026)

Added

• CI/CD pipeline via Gitea Actions: ci.yml (go vet, go test -race, cargo test + clippy, web build, AI-attribution check, action-pins check) and release.yml (version gate, binary self-report verification, Docker image verification, Gitea-native release API).
• Release gate enforces tag == versions.go == docker-compose == Cargo.toml, CHANGELOG entry exists, forward-only tag ordering, and tag ancestry on public.
• Guided release script (scripts/release.sh): interactive, verifies every assumption before tagging or pushing.
• Supply-chain consumer and OSV coverage: 10 new tests for agent/internal/supplychain/.

Fixed

• Screenshot capability now granted via AmbientCapabilities=CAP_SYS_PTRACE in the service template — survives binary self-upgrade. File-cap restoration alone was insufficient for units that predated the template line.
• Helper self-upgrade reconciles the unit drop-in (10-capabilities.conf) before restarting the agent, so fleet units that only ever self-upgrade still get the capability grant. Never adds CapabilityBoundingSet — that strips setuid caps from sudo inside the unit and kills package discovery.
• Tray socket access chain (/var/lib/redflag → agent → localapi) now enforced on upgrades, not just fresh installs.
• Web UI is built and staged into server/internal/webui/dist before the server compile in the release pipeline — previous tarballs shipped a server with an empty embed.
• CI typescript-check job replaced with web-build (full npm run build), so bundle failures surface in CI, not at release time.

Removed

• Dead version-consistency CI job (could never trigger on branch-only push events).
• scripts/polkit/ and scripts/redflag-screenshot.sh (abandoned pkexec approach).
• scripts/build-secure-agent.sh and its Makefile target (bare go build, no version injection, misleading name).

---

v0.2.6.6 (June 2026)

Fixed

• Windows process logging now writes agent.log before the console stream, so service-mode runs still produce file diagnostics when stderr is unavailable or invalid under Windows Service Manager.
• Agent startup logs a process_logger_initialized marker after the durable log sink is configured.
• Windows CPU telemetry fallback now parses PowerShell CIM JSON structurally, restoring core/thread counts on hosts where wmic is unavailable.

---

v0.2.6.5 (June 2026)

Fixed

• Windows agent startup now wires the standard logger to C:\ProgramData\RedFlag\logs\agent.log, so service-mode diagnostics are available without relying on Event Viewer rendering.

---

v0.2.6.4 (June 2026)

Fixed

• Windows one-liner self-authenticates again (irm | iex path repaired).
• Install script served as CRLF for Windows compatibility.
• Install script bakes reachable host into URL, not server bind address.
• Agent install URL preserves port for non-localhost hosts.
• Windows installer tolerates missing Ed25519 verifier on cold start.

---

v0.2.6.2 (June 2026)

Changed

• OSV scanning moved from approval to detection — enqueueOSVChecks runs on the scan-report path, writes results to metadata. Approval reads persisted verdict instead of re-scanning inline.
• Soak gate (GATE-005) promoted to a real policy: supply_chain.soak_window_days and soak_enforcement resolve env → config → DB → default. Was env-only.
• Age gate (package_age.go) wired to DB config via GetSupplyChainGateConfig. Added opt-in block_unknown_age (default false = sovereignty).

Removed

• Dead soak override scaffolding: dropped soak_window_hours_override column, version_soak_overrides table, and SoakWindowHoursOverride model field. Migration 053.

---

v0.2.6.1 (June 2026)

Added

• RECONCILE-001: scan-set closure (close-by-absence) reconciler. Packages that vanish from a successful scan are closed as not_applicable, fixing out-of-band false positives.

---

v0.2.6.0 (June 2026)

Added

• FEAT-002: metadata pipeline — agent → server → metadata transport for upstream intelligence, CVE details, and package provenance.
• GATE-005: version soak-gating configuration.
• BRIDGE-001: auto-discovery bridge (Repology, container registry, exact match).
• Docker enrichment pipeline: container image detail, update history pagination.
• Filter/search primitives — composable UI components and hooks.

Fixed

• SPA nav hygiene + history crosslinks.
• Code review batch 1 + dead store setting cleanup.

---

v0.2.5.2 (June 2026)

Added

• SETTINGS-001: reversible token encryption + one-liner restore.

Fixed

• Heartbeat auto-queue treats duplicate-pending as benign (ETHOS #4 — idempotency).

---

v0.2.5.1 (June 2026)

Added

• Lifecycle history section on update detail page: shows update_version_history entries with status badges, version transitions, failure reasons, timestamps.
• Failed state recovery: failed is no longer terminal — transitions to pending (reopen), installed (resolve), or ignored. IsTerminal() means scan-stable, not transition-locked.
• Reopen/resolve endpoints: POST /updates/:id/reopen and POST /updates/:id/resolve. Replaced broken RetryUpdate which was structurally blind to capability-token installs.
• Failure metadata on live row: failure_reason and failed_by stamped on transition into failed state.

Changed

• History page renamed to Fleet Activity, uses GetFleetActivity endpoint.

Fixed

• History 500 error on load.
• Dead unified history substrate removed.

---

v0.2.3.5 (June 2026)

Added

• Unified agent + helper upgrade: closure carries both binaries, helper installs agent on verify.
• update_logs.result extended with started/partial/running states — fixes agent-report badge semantics.

Security

• Path traversal fixes across file-serving endpoints.
• File permissions tightened (result files 0644 so agent can read back from root-owned helper).
• Sudoers and polkit scope narrowed.
• Staging cleanup.

Fixed

• Self-update and gated installs work on fresh hosts (first-time registration path).

---

v0.2.3.1 (June 2026)

Security

• Supply chain gate hardened: a known vulnerability anywhere in the resolved dependency closure is a full stop at approval time. ApproveUpdate returns 409 and mints nothing. Override requires an explicit operator reason in the request body — waives the vulnerability judgment only; signing and hash verification stay non-negotiable. Every override journaled as a supply_chain_override security event.
• Auto-confirm shares the ClosureCleared predicate with manual approval — the two paths cannot drift on what counts as a clean closure.

Fixed

• Ack tracking: acks clear on result-recorded, not command lifecycle status. Eliminates 34-deep recycling loops on long-running command chains.
• Timeouts, cancels, dropped acks/receipts, and failed actions all land in unified history instead of dying on stdout.

---

v0.2.3.0 (May 2026)

Changed

• OSV checks switched to batch endpoint (/v1/querybatch, 100 per POST) with global concurrency cap (4 concurrent batches). 300 packages = 3 HTTP calls instead of 300.
• Auto-confirm frisks the whole dependency closure for CVEs, not just the top-level package.

Fixed

• DNF dry-run success detection: --assumeno exits non-zero even on a clean resolve. Gate on Transaction Summary presence; reject Nothing to do / No match / Error: explicitly instead of trusting exit code.
• Web logout clears zustand persist key alongside tokens, fixing stale JWT survival across server reinstalls (JWT_SECRET rotation).

---

v0.2.2.0 (May 2026)

Added

• Package state machine enforced across all transitions: typed PackageStatus, ValidateTransition guards, guarded UPDATE with WHERE status = $current. Migration 047 aligns all existing rows. (LIFECYCLE-001)
• Lifecycle orchestrator foundation: timer-driven auto-advance, stuck-state recovery for checking_dependencies and installing, auto-approval policy support. (LIFECYCLE-003)
• Vulnerability dashboard: per-agent and fleet-wide OSV finding visibility.

---

v0.2.1.1 (May 2026)

Added

• Agent self-upgrade via helper: the privileged helper now performs agent binary swaps (backup, install, chmod, systemctl restart) under an agent-self capability token. The agent stages the verified binary; the helper re-verifies the hash before installing. No agent sudo for cp/chmod/systemctl.
• OSV.dev supply-chain checks at discovery time: async, deduped per server lifetime. Results written to current_package_state.metadata for immediate UI visibility.
• OSV.dev startup backfill: unchecked packages get queried on server boot (best-effort).
• apt and dnf added to OSV.dev ecosystem mapping (Debian, AlmaLinux).
• Docker handler uses dedicated DockerQueries with proper image/container separation.
• Staging page: LiveOperations renamed to Staging, shows packages awaiting dependency review alongside in-flight operations. Loading and error states added.
• Server-side status filter for the Updates package list (HAVING clause on aggregation).
• Docker severity displayed from actual data instead of hardcoded "medium".

Changed

• apt discovery runs unprivileged: sandbox opts redirect lists/cache/state/log to an agent-writable temp dir, matching dnf's model. No apt sudo grants in sudoers.
• Docker commands no longer prefixed with sudo (agent uses docker group membership).
• Sudoers template: removed all Docker grants (docker group), all self-update grants (helper does it), and apt discovery grants (unprivileged). Agent's only sudo is the single systemd-run --pipe helper invocation line.
• Polling loop recalculates interval after processing commands, not before (rapid-polling takes effect in the same cycle it's enabled).
• UpdateCurrentStateInTx exported for single-row writes outside batch transactions.
• Update result values normalized: updated -> success, rollback -> success.
• Drift-to-update bridge writes UpdateEvent via UpsertCurrentState instead of the removed UpsertUpdate/UpdatePackage path.
• AgentDockerImage model fields aligned with agent's DockerReportItem JSON tags.

Removed

• UpdatePackage model and its UpsertUpdate/ListUpdates query methods (dead code from the pre-state-table era).

Security

• Agent holds zero sudo for self-upgrade, Docker, and apt discovery. The helper is the only privileged path and it verifies capability-token signatures and artifact hashes before every operation.

---

v0.2.1.0 (May 2026)

Added

• Helper privilege split: redflag-helper invoked via sudo systemd-run --pipe as its own transient service, escaping the agent's ProtectSystem=strict sandbox.
• Token-is-the-command: all package-manager operations routed through discovery (DiscoveryRunner) or mutation (consumer.go -> systemd-run -> redflag-helper).
• EcosystemConfig registry: adding a new ecosystem means one config entry + discovery interface. Mutation is automatic via the token path.
• Hash verification fail-closed: empty expected hash returns error.

Changed

• Installer interface shrunk from 7 methods to 4: IsAvailable, GetPackageType, DryRun, VerifyHash.
• apt-get replaced with apt throughout.
• Sudoers narrowed: agent can only run discovery commands + helper invocation.

Removed

• SecureCommandExecutor (replaced by DiscoveryRunner + helper).
• Direct mutation methods from DNFInstaller and APTInstaller.

---

v0.2.0.7 (May 2026)

Security

• Refresh-token rotation with accept-previous-once crash-recovery grace.
• Machine-bound renewal: stolen config.json replayed from another host -> 403.
• Typed sentinel errors for auth failures in polling loop.
• Revoked refresh tokens and machine-ID mismatches surface as critical events.
• Signing-disabled path removed from orchestrator; unsigned fallback removed.

---

v0.2.0.6 (May 2026)

Added

• Agent cold-start trust root: signed release manifest verified before first execution.
• Supply-chain hash registry (Layer 1): expected SHA-256 stored server-side, verified by agents before install.
• Drift-to-UpdatePackage bridge: drifted bindings automatically create pending updates.
• Upstream tracking UI with release-source adapters (GitHub, Gitea, GitLab, Bitbucket).
• Attention panel: surfaces offline agents, failed updates, EOL drift, upstream movement.

---

v0.2.0.0 (May 2026)

Added

• Maintenance windows for scheduling/gating installs.
• Docker image scanning and update management.
• Multi-agent fleet overview dashboard.