@puddle-code/cli 0.1.13 → 0.2.1

package/CHANGELOG.md

@@ -7,8 +7,11 @@ Past releases: see docs/changelogs/.
 
 # Changelog
 
-## [0.1.13] — 2026-09-10
+## [0.2.1] — 2026-09-21
 
-### Added
+### Fixed
 
-- Select session ranges in either right-sidebar presentation and archive the selected batch from its context menu or archive drop target.
+- Fix daemon and cockpit startup on legacy installations by migrating owned Puddle homes from `0755` to `0700`, and create fresh installer homes privately.
+- Fix self-hosted application builds with filtered dependencies by separating the production Vite configuration from the development cockpit gateway.
+- Fix remote container builds and static file serving from checkouts with private file permissions.
+- Remove Caddy's unused privileged-port capability so the application container starts with all capabilities dropped.

package/README.md

@@ -34,6 +34,13 @@ puddle launch <user>@<host>
 
 This connects Puddle to the remote host over SSH, bootstrapping the Puddle daemon on first contact and enabling you to begin development.
 
+**To connect from a phone or another browser over the internet:** deploy your own
+[mobile access service and trusted web application](docs/mobile-access.md), then
+use `puddle remote enable` and `puddle remote pair`. The host connects outward;
+there is no public daemon port or VPN requirement. Each browser needs explicit
+host approval. The phone view provides live terminals, prompt input and read-only
+text/diff review over a pinned Noise connection through the relay.
+
 Puddle works using your system `ssh`, so `~/.ssh/config`, agents, and jump hosts apply.
 
 **For development on your own machine:**
@@ -106,7 +113,7 @@ auth prompts unless you use a key).
                                         └───────────────────────────────────┘
 ```
 
-The CLI serves the UI at a stable local origin and reverse-proxies the API to the daemon, directly in local mode, through the tunnel in SSH mode. The daemon is headless and host-agnostic on `127.0.0.1:7434`. UI updates ship with the CLI (`npm update -g @puddle-code/cli` refreshes the cockpit for every host); the daemon only has to update when the versioned protocol breaks, and the CLI does that automatically. A mandatory bearer token plus Host/Origin validation guard the localhost API against malicious web pages.
+The CLI serves the UI at a stable local origin and reverse-proxies the API to the daemon, directly in local mode, through the tunnel in SSH mode. The daemon is headless and host-agnostic on `127.0.0.1:7434`. UI updates ship with the CLI (`npm update -g @puddle-code/cli` refreshes the cockpit for every host); the daemon only has to update when the versioned protocol breaks, and the CLI does that automatically. Short-lived host connection leases, separate browser authorisation and exact cockpit Host/Origin checks guard local access. Launch invitations are single-use; browser login survives cockpit restarts, while forwarded applications use a separate loopback origin. After upgrading from the old token flow, run `puddle launch` once to authorise existing tabs.
 
 Everything lives under `~/.puddle` on the host, installed without sudo — and `puddle remove daemon` takes it apart again.