@puddle-code/cli 0.1.12 → 0.2.0

package/CHANGELOG.md

@@ -7,10 +7,33 @@ Past releases: see docs/changelogs/.
 
 # Changelog
 
-## [0.1.12] — 2026-09-09
+## [0.2.0] — 2026-09-21
+
+### Added
+
+- Add Settings → Remote access in local and SSH desktop cockpits for enablement, status, QR/link pairing, browser approval/revocation, disablement and host identity recovery; add authenticated cockpit controls in protocol 18.1.
+- Add self-hosted mobile access with Google/GitHub login, optional authenticator MFA, independently supervised host connectors and QR/link browser pairing.
+- Add a single-terminal phone view, native multiline prompt composer, visible terminal keys and read-only text/change review without rewriting desktop layouts.
+- Add remote administration and recovery commands, deployment images and isolated relay/browser acceptance suites.
+- Add lightweight built-process and loopback OpenSSH authentication suites, with separate manual browser and desktop acceptance.
+
+### Changed
+
+- Open remote account registration to every verified Google/GitHub identity; remove the signup allowlist and registration switch while retaining account isolation and explicit host approval.
+
+### Removed
+
+- Remove the TLS contact email setting from the Caddy deployment and environment example.
+- Remove email/password login, verification/reset email delivery, SMTP configuration and Nodemailer; require Google and/or GitHub OAuth, retain verified-email admission and optional authenticator MFA, and retire legacy passwords/sessions. Bump remote protocol to 2 and daemon/cockpit protocol to 19.0 for the changed pairing contract.
 
 ### Fixed
 
-- Paste clipboard images into the focused file-tree directory with timestamped screenshot names.
-- Keep session shell history on its private file when directory, environment, or prompt hooks repoint `HISTFILE` at runtime.
-- Make Option+Left/Right move by word in macOS terminals instead of inserting the unrecognised xterm sequence tail.
+- Reject incomplete remote-origin input without throwing during registration form rendering.
+- Preserve browser login, terminal snapshots and refresh correlation across cockpit replacement and upstream recovery; retain desktop routes when the origin moves.
+
+### Security
+
+- Require exact browser approval at the host, pinned Noise XX transport, bounded forwarding and fresh browser participation in the existing host leases; keep remote protocol 2 independent of the protocol-18 host lease foundation.
+- Persist device revocation and offline remote disable, isolate application delivery from the relay origin, and deny unreviewed remote routes and executable previews.
+- Replace distributed master credentials with private host control, short-lived renewable connection leases and single-use browser invitations; migrate to protocol 18.0 and require existing tabs to run `puddle launch` once.
+- Isolate forwarded applications on a separate loopback origin, bind proxy grants to browser authorisation and revoke active streams when their authority expires.

package/README.md

@@ -34,6 +34,13 @@ puddle launch <user>@<host>
 
 This connects Puddle to the remote host over SSH, bootstrapping the Puddle daemon on first contact and enabling you to begin development.
 
+**To connect from a phone or another browser over the internet:** deploy your own
+[mobile access service and trusted web application](docs/mobile-access.md), then
+use `puddle remote enable` and `puddle remote pair`. The host connects outward;
+there is no public daemon port or VPN requirement. Each browser needs explicit
+host approval. The phone view provides live terminals, prompt input and read-only
+text/diff review over a pinned Noise connection through the relay.
+
 Puddle works using your system `ssh`, so `~/.ssh/config`, agents, and jump hosts apply.
 
 **For development on your own machine:**
@@ -106,7 +113,7 @@ auth prompts unless you use a key).
                                         └───────────────────────────────────┘
 ```
 
-The CLI serves the UI at a stable local origin and reverse-proxies the API to the daemon, directly in local mode, through the tunnel in SSH mode. The daemon is headless and host-agnostic on `127.0.0.1:7434`. UI updates ship with the CLI (`npm update -g @puddle-code/cli` refreshes the cockpit for every host); the daemon only has to update when the versioned protocol breaks, and the CLI does that automatically. A mandatory bearer token plus Host/Origin validation guard the localhost API against malicious web pages.
+The CLI serves the UI at a stable local origin and reverse-proxies the API to the daemon, directly in local mode, through the tunnel in SSH mode. The daemon is headless and host-agnostic on `127.0.0.1:7434`. UI updates ship with the CLI (`npm update -g @puddle-code/cli` refreshes the cockpit for every host); the daemon only has to update when the versioned protocol breaks, and the CLI does that automatically. Short-lived host connection leases, separate browser authorisation and exact cockpit Host/Origin checks guard local access. Launch invitations are single-use; browser login survives cockpit restarts, while forwarded applications use a separate loopback origin. After upgrading from the old token flow, run `puddle launch` once to authorise existing tabs.
 
 Everything lives under `~/.puddle` on the host, installed without sudo — and `puddle remove daemon` takes it apart again.