Start9Labs/start-technologies start-os/v0.4.3-rc.1

StartOS v0.4.3-rc.1

on GitHub

[0.4.3]

Added

• Allow reassignment of a binding's external port through the CLI while preserving address enable/disable settings and preferred ports. Keep the server UI's SSL port fixed at 443.

• Stop listing router port forwards for disabled single-port bindings.

• Monitor a UPS from System > UPS Monitor, connected directly or through a network NUT server over IPv4 or IPv6, view its live status, and shut down StartOS automatically when the battery runs low.

• Share data between services, or with other devices, using local folders, folders on external drives and CIFS shares in System → Shared Volumes, with separate No Access, Read and Read/write grants for each supported service. Format a drive while adding it as a volume, update a CIFS share's connection details, and see each volume's availability, free space and source errors on the same page. Managed local folders and backup targets survive server restarts on the data drive. Deleting a volume permanently removes managed local data but preserves external-drive and network-share contents.

• Attached-drive lists update automatically. Shared-volume status, free space and source errors refresh after drive and network changes, with mounted shares following the kernel's connection state and periodic free-space checks. Service and backup mount requests reject disconnected shares without tearing down active mounts. Services refresh shared-volume mounts after drive replacement, older attachment cleanup leaves replacement mounts usable, and healthy idle shares avoid repeated network connections.

• Keep unsaved names, folder edits and discard warnings while volume, backup-target or drive updates arrive. Clear vanished drive or partition choices without automatically selecting formatting; removal or changed drive details during erase confirmation require a fresh choice. CIFS connection changes notify reactive services; existing mounts keep their source until remounted or restarted.

• Services can treat missing registered folders as unavailable without accepting invalid mount requests.

• Manage volumes and backup targets by name, with source error messages highlighted in red and a loading state while backup history is fetched. Partitions that already contain a StartOS backup are marked when adding a drive; stored CIFS targets and credentials carry forward automatically.

• Back up volumes independently of services and restore them as new local copies without overwriting existing data. Backup destinations cannot overlap source folders through case variations or local directory aliases. Local volumes and targets support fast deletion and remain registered for retry if deletion fails.

Changed

• Manage backups from a single System → Backups page: add local folders, external drives and CIFS shares as backup targets, see each target's status, last backup and free space, create and restore backups, and review past backups with their reports in a paginated history. Saved CIFS targets retain their connection details and IDs. Removing a local target deletes its folder and backups; external-drive and CIFS contents are preserved.

• Keep network-share backup writes independent of concurrent target reads. Registered target status follows drive and network changes, including active backup-write mounts. Missing selected folders remain unavailable even when their backing filesystem is healthy. Recover target details automatically when a share returns; keep invalid backup metadata visible as an error until revalidation succeeds.

• Enable a private plain-HTTP address for a client that cannot trust the server's Root CA without marking an entire gateway secure. Enabling requires an explicit --allow-insecure acknowledgement through CLI/RPC/MCP; enabled addresses appear in the UI and can be disabled there. Plaintext traffic, including passwords, can be read and altered by devices on that network.

• The marketplace registry picker lists registries other than the Start9 and Community registries below a divider.

• Keep connected registries synchronized over one automatically authenticated, encrypted WebSocket per registry for package listings, signing-key changes, and StartOS updates. Poll registries without WebSocket RPC support every 15 minutes using their existing HTTP API. Cached listings remain available when a registry is offline.

• Show an Unreachable registry between the marketplace registry selector and search, followed by an icon-only retry, as a status dot when collapsed. Registry management gives every registry's connection status a dedicated column, with an Unreachable-only retry. Select Unreachable to read synchronization failure details; retain cached listings or loading placeholders while unavailable.

• Show green update counts, replacing the Updates navigation count with a warning while any registry errors. Registry sidebar rows retain their counts alongside warnings; an Unreachable selected registry shows its status and a retry without resetting the selection. An unavailable empty catalog keeps loading placeholders instead of claiming every service is up to date.

• Skip malformed saved registry URLs independently, preserving synchronization and listings from valid sources.

• Preserve deployment URL prefixes when diagnostic updates query a registry.

• Retrieve private package and dependency icons using the server's registry identity, limited to saved registries' content-addressed icon endpoints.

• Refresh any saved registry from its registry-management More menu, regardless of connection status, to discover later private-access grants or poll legacy hosts immediately without changing signing-key trust; retry failed icons when refreshed listings arrive. Unsaved registry links offer an explicit connection action rather than waiting for a catalog that is not being synchronized.

• Reject invalid encrypted-admission CBOR representations before native or browser field interpretation.

• Encrypt normal browser and keyed CLI RPC, backend registry queries and WebSocket continuations after signed ephemeral-DH admission, without mode-based downgrade.

• Name the server-owned signing key server_identity_key, preserving its value and existing database and backup formats.

• Preserve explicit serialized field and variant names in PatchDB accessors, including combined serde attributes.

• Encrypt browser setup, initialization, diagnostic RPC and continuations without enrolling or persisting a missing device key; preserve legacy HTTP callers and invalidate old RPC sessions when the active startup context changes.

• Retain encrypted startup on ordinary LAN HTTP without a browser secure context.

• Send setup and recovery secrets inside encrypted RPC without duplicate password encryption; retain legacy encrypted-password compatibility.

• Preserve HTTP resource/header, foreign-origin and legacy-client contracts, including consecutive browser RPC calls as prior connections finish closing.

• Reject unsupported parameter shapes without dropping an authenticated connection.

• Remember the browser's verified normal-server identity and warn on changes without blocking the connection, with fingerprint details for verification; startup peers do not enter that history.

• Cancel pending device-key acquisition and enrollment across logout, replacement and rollback.

• Bound replay-cache memory when clock synchronization is unavailable.

• Preserve request IDs on middleware errors.

• Prevent duplicate operations when a Unix RPC fails or loses its response.

• Keep encrypted browser RPC available over HTTP/2 connections.

• Cancel timed-out or disposed WebSocket requests without interrupting sibling calls, and release pending handlers when the socket closes.

• Log decrypted browser RPC requests and replies to the developer console for 30 minutes after rpcLog.enable(), or a chosen number of minutes, until it expires or rpcLog.disable().

Removed

• View backup results in History instead of receiving backup notifications. Old-backup reminders remain on the backup target.

Fixed

• Honor service-declared TCP and UDP forwarding restrictions for single ports and port ranges, including automatic router mappings. Show each StartOS-managed address’s forwarding transport on the Interfaces page; TLS and HTTP proxy listeners show TCP. Legacy ranges show both before service initialization.

• CIFS share backup targets connect with their own configured credentials.

• Initialization progress reports the actual initialization outcome. The initializing screen checks server state after success or failure and cancels observation when closed.

• Retire accepted initialization observations through terminal transport flush or cancellation before changing routers, bounded by the existing RPC write deadline; reject late bindings without delaying for unopened GUIDs.

• Report actual journal process outcomes through typed log observations while preserving legacy log streams and reject out-of-range or fractional boot selectors.

• Cancel portal and initialization/setup log observation and reconnect waits when their views are disposed.

• Keep log streams active while their initial backlog waits for database synchronization.

• Fixed StartOS using more and more memory the longer it ran, until the server ran out of memory.

• Stop pending and live metrics observation and reconnect attempts when leaving the metrics page or signing out.

• Identify backup and volume partitions by their filesystem labels, falling back to device paths for unlabeled partitions.

• Preserve removed registries when migrating already-repaired 0.4.2.1 servers to the typed registry catalog.

• Publish per-call database synchronization metadata independently of HTTP response headers, preserving legacy HTTP clients.

• Release pending database synchronization waits when logging out or closing a streamed observation.

• Preserve floating-point RPC parameter precision when decoding requests.

• Reject invalid encrypted network-backup credentials rather than attempting anonymous access.

• Hide network-backup passwords in diagnostic formatting.

• Setup progress reports the setup operation's failure rather than completing at 100%. The setup wizard waits for the operation's result before finalizing setup and reconnects progress observation without restarting setup work. Concurrent setup requests cannot start work that was rejected.

• Report late sideload installation failures instead of premature success.

• After StartOS restarts unexpectedly, service containers from before the restart are stopped instead of running alongside the new ones.

• Poll shared-volume and backup-target observation futures on one RPC-owned task using tiered loops. Preserve pending I/O and per-source backoff across observer-session retries. Bound invalidation-triggered health scans to once per second while slow CIFS probes remain pending.

• Accept terminal command arguments from JSON clients while preserving native CLI arguments, including non-UTF-8 bytes.

• Confirm OS updates from their actual completion result, including diagnostic mode, instead of treating progress or a closed connection as success.

Security

• Prevent foreign-server probe errors from logging out the local session.

• Prevent canceled RPC replies from invalidating a replacement login.

• Stop authenticated observations, terminal connections and file continuations when their access is revoked, including during asynchronous initialization.

• Bound incoming JSON-RPC request bodies before authentication and decoding to prevent unbounded memory use. Oversized-request errors remain readable by browser clients.

• Bound anonymously available WebSocket continuation input and blocked writes while preserving bulk authenticated container and terminal traffic.

• Prevent startup RPC admission attempts from spawning clock-check subprocesses.