Start9Labs/start-technologies start-wrt/v0.1.0-beta.4

start-wrt v0.1.0-beta.4

on GitHub

What's Changed

Added

• --version flag. startwrt --version now reports the StartWRT version (e.g.
  0.1.0-beta.4); the CLI previously exposed no --version.

Changed

• OpenWrt base upgraded 25.12.4 → 25.12.5 (r33051-f5dae5ece4), picking up
  the upstream stable-branch fixes. All three Start9 build-infra patches apply
  unchanged, and no upstream path collides with the Start9 overlay.

• The OpenWrt image now builds from pristine upstream OpenWrt (the release
  tarball pinned by sha256 in build/openwrt-version) with the Start9 delta
  applied at build time from in-repo openwrt-patches/ (3 build-infra patches)
  and openwrt-overlay/ (the SpacemiT K1 target + boot packages). The
  Start9Labs/openwrt fork and the monorepo's last git submodule are retired;
  cloning no longer needs --recursive, and the openwrt/ build workspace
  contains no git repo at all. The prepared tree is byte-identical to the
  former fork (verified by git tree hash), so image contents are unchanged.

Fixed

• Changing the admin password now enforces the 12-character minimum. The
  Settings → Password form and its auth.set-password backend endpoint (also
  reached via the startwrt auth set-password CLI) accepted passwords shorter
  than 12 characters, even though first-time setup required it and the docs
  documented the minimum. Both the frontend form and the backend now reject
  passwords under 12 characters on change, matching initial setup.

• Changing the Router IP can no longer strand the network on a colliding subnet.
  The LAN IPv4 page exposed a "Router IP" (3rd-octet) field that duplicated the
  Admin Security Profile's subnet field but, unlike it, had no collision guard —
  so setting the router onto a subnet already used by another profile put two
  interfaces on the same /24, producing overlapping routes that silently broke
  all access to the router (unrecoverable even by a keep-settings reflash). The
  duplicate field is removed (the LAN page now only selects the /16 network
  block; the Admin profile is the single source of truth for the 3rd octet), and
  the backend now rejects profiles.create/profiles.edit requests whose /24
  collides with an existing profile (including the admin LAN). The lan.ipv4-set
  endpoint (reached via the CLI) is covered by the same guard, so a direct
  RPC/CLI call can't strand the router either.

• The Settings → General Build field no longer goes stale after new commits.
  build.mk had lost the wiring that refreshes build/env/GIT_HASH.txt on every
  build and treats it as a prerequisite of web/config.json, so the UI's gitHash
  froze at whatever it was when config.json was first generated. build.mk now
  refreshes GIT_HASH.txt at parse time and re-stamps config.json whenever HEAD
  moves.

• The Build field now shows the -modified marker on a dirty build. It shortened
  the 40-char hash with slice(0, 12), which dropped the trailing -modified suffix;
  it now preserves any trailing marker (matching the -dirty indicator the
  startwrt verify CLI already shows).

• Adding an Outbound VPN no longer silently does nothing. On submit the dialog
  called tuiMarkControlAsTouchedAndValidate, which re-ran the WireGuard .conf
  async validator and left the form stuck PENDING (the in-flight validation is
  cancelled when the file input remounts during the pending phase), so the create
  request was never sent. Submit now completes directly when the form is already
  valid, and only marks fields touched — without re-validating — when it isn't.

• Web-only changes are now re-embedded into the startwrt binary on rebuild. The
  UI is baked in at compile time via include_dir!, which does not register the
  embedded files as cargo dependencies, so ctrl's build.rs now emits a
  cargo:rerun-if-changed for the web dist directory. Previously a changed web
  bundle was silently ignored unless a .rs file also changed, shipping a stale
  UI.

Changed

• Relocated into the start-technologies monorepo as the start-wrt product. The
  three backend crates (startwrt-core/ctrl, uciedit, uciedit_macros) are now
  members of the root Cargo workspace and build against the shared start-core
  crate (shared-libs/crates/start-core, pulled in aliased as startos), the
  vendored rpc-toolkit, and the vendored imbl-value — replacing the previously
  embedded start-os submodule and the git/crates.io copies of those deps.
• openwrt is now the monorepo's only git submodule; the embedded start-os
  submodule was removed.
• Build orchestration moved from the standalone product Makefile to
  projects/start-wrt/build.mk (included by the root Makefile): make start-wrt,
  make start-wrt-image, make start-wrt-update.
• The Angular web UI is now a project (start-wrt) in the root Angular workspace
  instead of a standalone app. It shares the root package.json/node_modules/
  tsconfig.json and builds via npm run build:wrt (serve npm run start:wrt,
  type-check npm run check:wrt) — and so upgrades in lockstep with the other Start9
  Angular apps. RELATIVE_URL, pauseFor, and the markdown pipe now come from
  @start9labs/shared. The HTTP/RPC/connection stack (its aborting-timeout, code-0
  reconnect flow is deliberately different from shared's), the bespoke error surfacing,
  WorkspaceConfig, the WebSocket progress types, and the i18n-routed validation-errors
  provider stay local where the shared code would regress behavior or the shapes don't fit.
• @start9labs/shared is now marked sideEffects: false so importing a few symbols from
  its barrel tree-shakes cleanly (start-wrt's embedded UI bundle would otherwise pull in
  ~875 kB of unused shared code). This also shrinks the other apps' bundles.
• Restored the release CI that the monorepo migration had dropped, then folded StartWRT
  into the monorepo-wide release tool: start-wrt.yaml again has a deploy job, but it
  now only uploads the built images to S3 (s3://startwrt-images) — the CDN the registry
  serves from. To match startos-iso.yaml, it is workflow_dispatch-gated on a deploy: release input (rather than the old standalone workflow's v*-tag push) and reads the
  version from backend/ctrl/Cargo.toml (the standalone workflow read the now-removed
  web/package.json). Tagging, cutting the GitHub release, and the registry publishing are
  now driven by the top-level scripts/manage-release.sh (a new wrt project kind alongside
  os/cli/deb/npm), which replaces the standalone
  projects/start-wrt/scripts/manage-release.sh. Registry publishing mirrors the OS's staged
  flow: register start-wrt indexes a CI build into a beta registry, where beta routers
  (UCI startwrt.system.registry pointed at it) soak the version as a normal OTA update, and
  release start-wrt then promotes it into the production registry — both deliberate local,
  developer-key-gated steps. Releases are cut on Start9Labs/start-technologies with the
  monorepo's <project>/v<version> tag convention (start-wrt/v<version>), since the
  monorepo hosts every product's releases on independent cadences. Release assets follow the
  startos naming convention —
  startwrt-<version>-<git hash>_spacemit-k1-{sdcard.img.gz,sysupgrade.img.gz} — instead
  of the raw OpenWrt output names, which carried no product, version, or hash; the sdcard
  image is now gzipped (it was previously published raw), and balenaEtcher flashes the
  .img.gz directly.
• Restored the OpenWrt download-cache keying the migration had narrowed: the image job's
  cache key again includes build/feeds.conf (so changing the feed set busts the cache) and
  carries a restore-keys fallback (so a partial older cache can seed a fresh run).

Image Downloads

• SD card image (fresh install)
• Sysupgrade image (OTA update)

StartWRT Checksums

SHA-256

BLAKE-3