serve.zone/onebox
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 38 Wiki Activity

38 Releases 255 Tags

RSS Feed
  • v32.4.1 dca783959a
    Compare

    Onebox v32.4.1
    Release / build-and-release (push) Successful in 28m51s
    Details
    Stable

    jkunz released this 2026-09-22 14:08:30 +00:00 | 0 commits to main since this release

    2026-09-22 - 32.4.1

    Fixes

    • Refuse a backup row that predates the backup archive by name. Restore now states pre-snapshot-backup-row with the backup id before it opens the archive instead of resolving a .tar.enc file path, and deletion of such a row removes the row alone and leaves the file it named on disk. Onebox before 1.24.0 wrote those rows, 32 restores no archive written before it, and their reader is gone together with the tar extractor, the file decryptor, the legacy backups directory and its runtime path. The encrypted tar download export is unchanged. The credential migration the removed reader shared is not legacy — every backup whose service had no stored service secrets reaches it — so it and its two refusals now name the condition they detect instead of a legacy backup.
    • Refuse a backup snapshot whose format this release does not read by name. Restore states unrestorable-snapshot-format with the snapshot id before it creates a temporary directory or restores a single item, and it refuses an untagged snapshot — the file-item format Onebox wrote between 1.24.0 and 6.11.0 — exactly as it refuses a foreign format tag. The untagged reader is gone together with the format discriminator that threaded through restore, platform-resource import and S3 bucket import, so a platform resource that fails to import now fails the restore instead of being downgraded to a warning and no half-restored service is reported as restored. Snapshot creation, the logical-item format and the encrypted tar download export are unchanged.
    • Refuse a backup download by name instead of answering that the backup is missing. The export states backup-not-found, pre-snapshot-backup-row, unrestorable-snapshot-format — it refuses exactly what restore refuses — or backup-password-unset, and the download route answers 404 only for a backup Onebox does not hold, 409 for a refusal about the stored state and 500 for a server-side failure. An install without a backup password no longer receives the service's secret-setting ciphertext and plaintext environment values as an unencrypted tar; the served name .tar.enc is now a fact. The export opens the archive like every other consumer, keeps its restored items, its tar and its encrypted file inside one mkdtemp directory that one finally removes on every path, and streams the deterministic tar through the cipher into that file and the file into the response body instead of holding either in memory. Restore's temporary directory is created and removed the same way. Snapshot verification now proves the snapshot format on every path rather than only when it opens a bundle, and readme.md documents the download's byte layout with the recipe that opens it.
    • Refuse every backup operation by name while the backup archive is not open, and stage a backup creation in a directory Onebox owns. Initialization no longer turns an archive failure into a null archive and a warning: creation, restore, deletion, download export, snapshot verification and the scheduler's run and its prune all state backup-archive-unavailable with the cause the archive failed for, the download route answers 503 for it, a scheduled run is skipped once under that name instead of failing service by service, and a deletion that cannot remove snapshot data leaves the backup row that points at it. An install whose archive does not open keeps serving everything that is not a backup, exactly as before. Backup creation stages its exported contents in an unpredictable mkdtemp directory with mode 0700 that one finally removes after the snapshot is recorded and after every failure, instead of the predictable /tmp/onebox-backup-<service>-<timestamp> whose name also dated the backup row; the row's createdAt is read from the clock. The download body no longer enqueues a chunk that arrives after its reader cancelled, and a failure between a prepared export and its response removes the export directory instead of leaving it behind. A failed open is logged once per state of the archive rather than once per operation, and the archive handle is private: every caller reaches it through the one accessor that opens it or refuses by name.

    Maintenance

    • Remove the startup sweep that deleted the pre-CoreTraffic onebox-smartproxy and onebox-caddy services and the unused backup checksum helper, and type the CoreTraffic service lookup against the Docker service shape instead of any. Correct the comments that described live code as legacy: the dcrouter route target settings, the domain-keyed SSL certificate accessors, the platform-services startup step, and the HTTPS listener adapter.
    • Require the raw secret-setting accessors on the secret settings store and drop the never-taken legacy accessor fallback together with its three casts. The store contract now states one way to reach a secret row, and the test doubles implement it.
    • Pin pnpm 12.4.2 as the release package manager.
    Downloads
  • v32.4.0 3452511dd8
    Compare

    Onebox v32.4.0
    Release / build-and-release (push) Successful in 22m38s
    Details
    Stable

    jkunz released this 2026-09-21 14:56:09 +00:00 | 9 commits to main since this release

    2026-09-21 - 32.4.0

    Features

    • Extend root-local service environment patches with an optional encrypted-alias removal list. The service owner reads both current environment maps under one mutation lock, protects reserved and secret-file sources, preserves unrelated secrets, and skips replacement when neither map changes.
    Downloads
  • v32.3.0 e966a80a91
    Compare

    Onebox v32.3.0
    Release / build-and-release (push) Successful in 21m39s
    Details
    Stable

    jkunz released this 2026-09-21 13:19:15 +00:00 | 11 commits to main since this release

    2026-09-21 - 32.3.0

    Features

    • Add root-local service recovery commands for value-free ownership metadata inspection and bounded JSON environment patches that merge under the existing per-service mutation lock and skip runtime replacement on semantic replay.
    • Preserve exact installed App Store or persisted manual environment templates across Corestore engine credential rotation. Onebox journals the template authority before the first receipt, rejects guessed aliases and partial legacy active journals, delivers canonical encrypted mappings through normal service replacement, and proves the exact stopped replacement runtime before reconciliation advances.
    Downloads
  • v32.2.0 ac6316003b
    Compare

    Onebox v32.2.0
    Release / build-and-release (push) Successful in 35m18s
    Details
    Stable

    jkunz released this 2026-09-20 15:09:45 +00:00 | 14 commits to main since this release

    2026-09-20 - 32.2.0

    Features

    • Replace the exact active Corestore conversion target with the release-pinned image through a journaled, replay-safe ownership handoff that retains every prior runtime and stage proof, expose strict V1/V2/V3 conversion status through SmartDB's bounded stopped-engine inspector as a value-free projection without initializing Onebox, Docker, backups, defaults, or startup migrations, and pin the qualified Corestore 32.2.3 provider-lineage release by its multi-architecture image digest.
    Downloads
  • v32.1.5 f240a918a1
    Compare

    Onebox v32.1.5
    Release / build-and-release (push) Successful in 35m51s
    Details
    Stable

    jkunz released this 2026-09-20 10:18:18 +00:00 | 17 commits to main since this release

    2026-09-20 - 32.1.5

    Fixes

    • Preserve complete internal hardlink groups while copying a stopped Corestore non-database root. The copier accounts every source and target link, rejects aliases outside the copied root or through the excluded legacy database, verifies content and metadata against a stable source identity, syncs staged files and directories, and retains bounded preflight failure diagnostics without weakening exact-stage replay.
    Downloads
  • v32.1.4 6cd9ee678d
    Compare

    Onebox v32.1.4
    Release / build-and-release (push) Successful in 34m47s
    Details
    Stable

    jkunz released this 2026-09-20 08:16:17 +00:00 | 19 commits to main since this release

    2026-09-20 - 32.1.4

    Fixes

    • Permit a release-pinned Corestore converter to be corrected repeatedly before export while preserving every accepted image transition. A retained source-digest proof is admitted only as the canonical private file bound to the exact fenced source; adoption and exact replay rerun authenticated source digests and reject residue, source changes, stages, advanced phases, and concurrent journal changes. Pin the corrected finite, proof-gated exporter from qualified Corestore 32.2.2 by its multi-architecture image digest.
    Downloads
  • v32.1.3 48f10c7244
    Compare

    Onebox v32.1.3
    Release / build-and-release (push) Successful in 34m58s
    Details
    Stable

    jkunz released this 2026-09-20 05:26:10 +00:00 | 21 commits to main since this release

    2026-09-20 - 32.1.3

    Fixes

    • Accept unrelated entrypoint-only Docker containers during Corestore converter inventory while preserving exact container, migration-name, and protected-volume collision checks.
    Downloads
  • v32.1.2 c4ff1489c9
    Compare

    Onebox v32.1.2
    Release / build-and-release (push) Successful in 43m11s
    Details
    Stable

    jkunz released this 2026-09-20 01:35:31 +00:00 | 23 commits to main since this release

    2026-09-20 - 32.1.2

    Fixes

    • Bind offline Corestore conversion to authenticated source digests and protected proof files, and permit explicit adoption of the release-pinned converter only after rechecking the exact checkpoint, stopped owners, and empty pre-export boundary.
    Downloads
  • v32.1.1 03881e357d
    Compare

    Onebox v32.1.1
    Release / build-and-release (push) Successful in 25m13s
    Details
    Stable

    jkunz released this 2026-09-19 22:15:17 +00:00 | 26 commits to main since this release

    2026-09-19 - 32.1.1

    Fixes

    • Declare the release npm registry and verify frozen Deno cache entries by registry identity rather than tarball host, with value-free configuration rejection.
    Downloads
  • v8.8.0 448d258281
    Compare

    Onebox v8.8.0
    Release / build-and-release (push) Successful in 10m34s
    Details
    Stable

    jkunz released this 2026-09-16 11:15:05 +00:00 | 46 commits to main since this release

    2026-09-16 - 8.8.0

    Features

    • Move the dashboard to @design.estate/dees-catalog 10.0.0 and @serve.zone/catalog 4.0.0 (deps)
      • No Onebox call site changes: the dashboard uses neither dees-hint nor the removed
        dees-input-searchselect, dees-search and dees-tooltip modules, binds no
        dees-appui-tabs, and its two dees-input-text fields are untyped text inputs, whose
        value stays a string under the widened string | number | null shape.
      • @serve.zone/catalog 4.0.0 carries the matching @design.estate/dees-catalog ^10.0.0
        range. Both have to move together: the sz-* elements import the catalog package directly,
        so a version skew would install two copies, and the second customElements.define for a
        dees-* tag throws.
      • One inherited behaviour change: a dataActions[].actionFunc that rejects now shows the
        error in a dees-toast instead of vanishing as an unhandled rejection. That affects the
        Refresh actions on the gateway domains and gateway DNS record tables, which propagate a
        failed fetch. Every menuOptions[].action and every other actionFunc already catches
        and toasts its own failure, so no message is shown twice.
    Downloads