caioricciuti/dev-cockpit v3.0.0

on GitHub

Four months of catch-up, taken as one release.

Install

curl -fsSL https://raw.githubusercontent.com/caioricciuti/dev-cockpit/main/install.sh | bash

Existing users can run devcockpit update. Both paths verify the published SHA-256 checksum and now refuse to install if it is missing, unreadable or does not match.

Security

• install.sh verified checksums fail-open. A missing .sha256, an unreadable one, or no hashing tool on the system all installed the binary anyway. All now abort.
• The download piped curl into grep, so the error branch tested grep's exit status and could never fire on a failed download.
• A hard-coded LATEST_TAG="v2.1.0" fallback meant a transient network failure silently installed a stale release. It now stops and says so.
• Temp files moved to mktemp -d with a cleanup trap, away from a predictable /tmp path.
• The release workflow dropped a third-party action that held contents: write in favour of the preinstalled gh CLI, and the release tag no longer reaches the shell through string interpolation.

Upgrades

gopsutil v4 reads Apple Silicon CPU data through pure-Go FFI, dropping a cgo dependency and the build warnings that came with it.

Fixes

• CLI output is plain text when piped or redirected again. lipgloss v2 removed the global renderer, so devcockpit status > report.txt was embedding colour escapes.
• The footer no longer wraps or collides on narrow terminals. It degrades through shorter hint tiers, then drops the clock, instead of running the hints into it.
• Tab labels are no longer truncated when there is room. Dashboard used to render as Dashb... even at 160 columns.
• The dashboard no longer reports 0.0% before it has measured anything. CPU, memory and disk now show — and ○ measuring until real data arrives, rather than looking like an idle machine.
• --help listed a keyboard shortcut that did not exist. It claimed number keys 1-9 jump between modules; there is no such binding. The shortcut list now matches the code.
• Network target validation accepted / through an unintended character range.

Documentation

devcockpit.app gains full CLI, Modules and Configuration references, all derived from the source. Writing them turned up several things the old docs got wrong, including that non-existent 1-9 shortcut, a module list with the wrong count and order, and a claim that configuration needed no setup.

The site palette now matches the TUI's own theme, with contrast verified to meet WCAG AA in both light and dark.

Under the hood

First test suite: 111 tests, covering checksum verification, version comparison, module navigation, footer and tab layout, and the dashboard's loading state. CI now runs go mod tidy -diff, go mod verify, gofmt, vet, test -race and build on macOS and Linux for every pull request.

Full changelog: v2.1.0...v3.0.0