Changelog

All notable changes to Project Super will be documented in this page. The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Looking for what’s planned next? See the public Roadmap / Backlog (P0/P1/P2 and longer-term directions).

[Unreleased]

[1.7.0] - 2026-09-27

Added

• Cron runtime cap (kill_after_secs). Scheduled runs can now be bounded in wall-clock time: when a run exceeds the cap, the supervisor terminates it through the standard graceful path (SIGTERM, then SIGKILL after stopsecs) and records a cron_overtime_kill event; the schedule keeps firing. Overtime kills are not counted as failures, and cron jobs remain exempt from flapping detection. Set per program via stack files, super add/update --kill-after-secs, the API, or the Dashboard cron section. 0 disables.
• Transactional installs with rollback. install.sh stages binaries beside their destinations and promotes them with same-filesystem renames — the previous pair stays in place until both new names are live. Every config/profile write (instance root, env.sh, login hooks, /etc drop-ins) is journaled for exact restore, and systemd, launchd, and rc.d installs snapshot the prior unit / plist / rc.d state and roll back service, binary, and file changes on any failure. The install smoke injects failures through PATH-local systemctl / launchctl / service doubles and asserts byte-exact restoration.

Changed

• Project Super is production-ready; the public beta is concluded. The public GA checklist is met in full: panic-free handling of malformed config and API input (the remaining startup expects are removed), transactional OTA and installs, fail-closed security defaults, super doctor operability, and a versioned REST API / plugin C ABI — with cargo audit clean on the release branch. The free 90-day Super Pro trial continues unchanged.

Security

• Updated rustls to 0.23.45 (RUSTSEC-2026-0285, TLS 1.3 handshake message validation).

Fixed

• super stop on a cron program now holds the schedule — across daemon restarts. Two defects compounded: the cron tick path never checked the held-stopped flag, so a manually stopped cron program was respawned by the next one-second firing; and the held-stopped mark was in-memory only, so any daemon restart resurrected previously stopped programs. The tick now gates firing admission (and queued firings) on the flag, the flag persists in the snapshot (legacy-format snapshots still load), and every stop/start path — single, group, batch, and the two-phase restart — flushes the state to disk immediately. super start clears the hold and resumes the schedule.
• No known panic paths remain outside tests. Remaining startup expects are gone: signal-handler installation failures (SIGTERM/SIGINT) surface as a startup error instead of panicking inside the shutdown future, an empty [server].auth_secret bails with a clear message, health-probe HTTP client init failures fail the probe instead of the daemon, and a resource-monitor thread spawn failure aborts bootstrap with a diagnostic. Completes the Stability criterion of the production-readiness contract.
• Installer honors --no-start on macOS. The launchd path bootstrapped the job before looking at the flag, and RunAtLoad + KeepAlive started superd immediately despite the message claiming otherwise. The daemon plist is now only written; superd starts at the next login/boot, matching the systemd enable-only path and the documented flag semantics.
• Installer runs on a pristine FreeBSD base system. Downloads fall back from curl to base fetch(1), and checksum verification accepts base sha256 -q alongside sha256sum/shasum; missing-tool errors name the accepted alternatives. The install smoke also passes its fake service command through the documented SUPER_INSTALL_SMOKE_SERVICE_CMD variable (it previously set a name the installer never read) and asserts that --no-start never registers the launchd job.

[1.6.0] - 2026-09-14

Added

• Program provenance labels (source). Every program now carries a source label recording the write path that last created or updated it: cli:add, cli:update, stack:<file> (super apply), include:<file> ([include] stacks at boot/reload), import:<format> (super import supervisor), or any caller-supplied value on direct API use. Shown in the program detail view — super info (Source: line) and the program detail API (config.source); it is intentionally not part of the list summary. Empty string clears, omit leaves unchanged (max 128 chars, no control characters). Makes “where did this program come from?” answerable during migrations and audits.
• super import supervisor <file> — import an existing supervisord.conf as a Super stack. Parses INI (comments, line continuations), follows [include] files= (glob + cycle detection), expands %(ENV_…)/%(here)s/%(program_name)s, and maps the shared field vocabulary (command args, autorestart, stopwaitsecs, priority, numprocs + %(process_num)02d templates, redirect_stderr, …). Everything that cannot map faithfully is reported as a structured warning (rotation-related keys collapse into one warning per program). Safety: imports never prune, --no-start imports everything stopped, --dry-run and --emit-toml <file|-|> work without a daemon. Name collisions are a three-way choice via --on-collision skip|rename|override: skip (default) leaves existing programs untouched, rename imports side by side under {name}-{suffix} (random hex or --collision-suffix <text>, unique against daemon and batch, old→new mapping shown in plan and report — the gray-release path), override updates in place behind a typed confirmation (--yes alone never escalates). The interactive prompt ([y/r/o/N]) offers the same choice when no flag is given. Apply re-checks names after confirmation to avoid mid-prompt races. See Import tool and the CLI reference. A PM2 ecosystem.config.js converter remains deferred (manual mapping on the PM2 migration page).

Security

• Constant-time Bearer compare for OSS auth_secret and the security plugin token path.
• Corrupt tokens.json refuses to start (fail-closed) with recovery steps in the FAQ.
• /metrics requires Bearer when API auth is enabled (no longer scrape-exempt).
• Dashboard session: profile/token mismatch logs out instead of showing a fallback identity.
• Startup warning when conf/super.toml is world-readable and contains auth_secret.

Notes

• Workspace 1.6.0; pair with commercial plugin packages super-plugins-1.6.0-….

[1.5.7] - 2026-09-12

Changed

• Dashboard shell is embedded in OSS superd. Process overview, logs, stack editor, and related shell pages no longer require the ui plugin. The subscription ui plugin now delivers Pro extensions only (Access Tokens UI, Notification Settings including inhibition rules and delivery history, process hot-reload, and matching nav entries). See Dashboard and the feature matrix.
• Dashboard slot contract tests in OSS CI. dashboard runs npm test (vitest) before the production build; tests/slots.spec.ts guards slot names, context.process fields, and mount-site :context shapes. Do not skip or weaken these tests without understanding the plugin UI contract (ui-bridge.d.ts).
• OSS core auth is auth_secret-only under [server]. Non-empty [server].auth_secret enables the single admin Bearer. Non-loopback TCP without a secret (and without the security plugin) refuses to start. Top-level auth_secret keys are rejected (no compatibility). No data/auth.key, no auth_required / allow_insecure_public_bind knobs. Docker OSS image ships a placeholder under [server] (change before public exposure). See Authentication.

Fixed

• Dashboard footer shows Community vs Licensed from runtime edition (OSS no longer always says Licensed).
• Pro UI stylesheet load order: plugin ui.css is inserted before the shell CSS so shared utilities like .hidden cannot override host md:flex and collapse the desktop nav.

Notes

• Workspace 1.5.7; pair with commercial plugin packages super-plugins-1.5.7-….

[1.5.6] - 2026-09-07

Fixed

• Batch restart honors dependency order: super restart @group / restart all (and any multi-target restart) now run as one coordinated two-phase cycle — all targets stop in reverse dependency order, the daemon waits for them to exit, then all targets start in dependency order. Previously each target restarted independently, so a dependent (e.g. an edge proxy) could come back before its dependency was healthy and park in Waiting mid-operation. Group start/stop follow the same ordering; priority breaks ties. Single-name restart keeps its stop-then-start semantics. See Ordered group operations.
• Dependency cycles are rejected up front: configurations that would close a depends_on cycle (including one formed incrementally across separate updates) are refused at submit time with the cycle members listed, instead of leaving both services stuck in Waiting at runtime.
• Flapping no longer fires on dependency waits: start attempts that stop at the depends_on gate do not count toward flapping; only real spawn attempts do.
• Held-stopped dependencies stay stopped: a program stopped with super stop is not revived by a dependent’s auto-start path.
• start_period_secs is a grace window: probes run immediately after start; failures inside the window do not count toward max_failures, and the first success ends the grace early.

Changed

• Positioning and docs: edge / cloud-edge focus (no IoT claim); extension docs corrected for real hook call sites (before_stop reserved, after_stop on exit + remove, after_start fail-secure).
• Roadmap: AI-agent infrastructure under P1; delay_secs and before_stop wire-or-remove under P2; P0 import work sequenced behind a StackFormat parser layer.

Notes

• Workspace 1.5.6; pair with commercial plugin packages super-plugins-1.5.6-….

[1.5.5] - 2026-09-05

Changed

• /go/pro/: primary CTA is Request a free 90-day trial → Portal claim; Afdian checkout is the optional ¥10 / month open-source sponsorship only (no Pro plugins/key).
• Pro beta trial lengthened from 1 month to 90 days (Portal claim + public docs). Purchased annual keys keep the 365-day term.
• License upgrade / renew links (LICENSE_UPGRADE_URL, Dashboard renew CTA fallback) now point to Get Super Pro instead of the feature matrix (matrix remains for edition comparison).
• Feature matrix docs link to Get Super Pro for purchase / renew / trial.
• Docker Hub publish: after a successful Release, native linux/amd64 + linux/arm64 runners pack prebuilt Release binaries via Dockerfile.pack (no in-image cargo build, no QEMU) and merge a multi-arch manifest. Local make docker still builds from source.
• Get Super Pro documents the Super Pro Portal for existing subscribers.
• CI path-filters jobs by changed paths; docs-only pushes skip OSS CI (deploy-docs only); install-smoke is manual; Release is tag-only.

Notes

• Workspace 1.5.5; pair with commercial plugin packages super-plugins-1.5.5-….

[1.5.4] - 2026-09-04

Changed

• OTA timeouts are per-program artifact fields: artifact.download_timeout (default 60s; was [server].download_timeout / briefly [ota]) and artifact.verify_timeout (default 60s; was [server].ota_verify_timeout / briefly [ota]). Configure them on the program stack entry, update payload, dashboard, or CLI (--artifact-download-timeout / --artifact-verify-timeout) — not in super.toml. No compatibility shim. 0 disables each timeout (download_timeout still keeps a 10s connect timeout).

Notes

• Workspace 1.5.4; pair with commercial plugin packages super-plugins-1.5.4-….

[1.5.3] - 2026-09-04

Added

• OTA artifact.extract: download .tar.gz / .tgz / .tar / .zip, verify SHA256 of the archive, safely unpack, and stage a single payload binary to destination.
• OTA artifact.restart_policy: immediate (default), manual (commit without restart), and signal / signal:<hup|int|term|quit|usr1|usr2> (in-place notify; bare signal ≡ signal:hup). Dashboard hot-reload option defaults to signal:hup. CLI: --artifact-restart-policy.
• OTA signal* requires health probe: restart_policy=signal* is rejected unless the program has an enabled health_check (create/update/stack). Dashboard Create/Edit auto-enables Health Check and blocks submit without it. Startup and super check warn on legacy snapshot configs that still lack a probe; exec true / : / /bin/true / /usr/bin/true is accepted but warned as ineffective for hot-reload verify.
• OTA verify without health probe: when no live health_check is configured (non-signal policies), commit waits for startsecs (min 1s) so crash-on-start cannot race the synthetic Healthy signal; the verify timeout is auto-extended if shorter than that dwell.
• tools/scripts/ota-e2e.py: repeatable OTA end-to-end harness (isolated SUPER_ROOT, covers commit/rollback/extract/policies/WAL recovery).

Changed

• Repo layout: packaging assets live under packaging/docker/ (was dockerbuild/) and packaging/contrib/ (was contrib/); demo instance under examples/demo/ (was example/); tools/benchmark/ and tools/scripts/ hold the peer bench suite and install/OTA smoke helpers. Docs site CNAME is under docs/static/. Release tarballs still ship contrib/ at the package root for install.sh.
• Docker Hub image: official image namespace is schiplat/super (was briefly published as containerpi/super).

Notes

• Workspace 1.5.3; pair with commercial plugin packages super-plugins-1.5.3-….

[1.5.2] - 2026-09-03

Added

• Out-of-box install.sh: creates a minimal SUPER_ROOT (/opt/super or ~/.super), wires login env (SUPER_ROOT + PATH), and enables an OS service with boot start — systemd (Linux), launchd (macOS), rc.d (FreeBSD). Flags: --root, --user / --system, --no-service, --no-start, --no-init, --base-url (local/CI smoke). Release tarballs ship contrib/ templates (default super.toml, unit files). Prefer the release asset one-liner: curl -fsSL https://github.com/schiplat/super/releases/latest/download/install.sh | sh.

Changed

• Docs terminology: the licensed browser UI is consistently called Dashboard (still provided by the ui plugin). Path /docs/02-essentials/web-ui/ is unchanged (aliases retained).

Fixed

• super check / super doctor now resolve $SUPER_ROOT/conf/super.toml (and $SUPER_ROOT/super.toml) before cwd//etc probes, matching install.sh layouts.

Notes

• Workspace 1.5.2; pair with commercial plugin packages super-plugins-1.5.2-….

[1.5.1] - 2026-09-02

Added

• SUPER_HOSTNAME: override the hostname used in managed-child / hook env, system stats, and webhook source footers when the OS hostname is not meaningful (containers / K8s).
• Host disk partitions on GET /api/v1/system/stats (disks[] via sysinfo).
• Plugin HTTP host now forwards path + query string to plugins (enables filtered delivery-history APIs).

Changed

• Hostname resolution is centralized (common::resolve_hostname): SUPER_HOSTNAME → OS hostname → unknown.

Notes

• Workspace 1.5.1; pair with commercial plugin packages super-plugins-1.5.1-… (notify delivery history UI/API lives in the subscription plugins).

[1.5.0] - 2026-09-02

Added

• SQLite-backed event history (OSS): lifecycle events are now persisted to a SQLite database ([storage] events_file, default data/events.db, WAL mode) instead of data/events.json. All events are recorded — not just anomalies — including program crashes, exits, recoveries, health restarts, cron runs, queue drops, and daemon startup/shutdown. Retention defaults to 30 days via [storage] events_keep_days (pruned once per day); set 0 to keep everything.
• Event filtering & statistics: super events gains --from / --to (time window), --type, --exit-code, and --q (free-text) filters, plus --stats for retention statistics. New API endpoints: GET /api/v1/events (global query with optional program_id) and GET /api/v1/events/stats. GET /api/v1/programs/{id}/events accepts the same filter query params.
• Millisecond timestamps: every event records ts_ms (Unix milliseconds) alongside ts (seconds) for precise, stable ordering of high-frequency events.
• Cron run events: cron_started, cron_exit (with duration_secs run duration and exit code), and cron_spawn_failed are recorded per firing; super events <name> --type cron_exit audits all runs.
• Configurable event database path: [storage] events_file (default ./data/events.db) sets where event history lives; relative paths resolve under SUPER_ROOT.

Changed

• Event history is written by a background batch writer (dedicated task draining a queue into SQLite transaction batches) — event persistence never blocks the manager actor loop.
• The event database is tuned for high-throughput workloads: batched transactional inserts, indexes aligned with the (ts_ms, id) sort key, and WAL PRAGMA settings (64 MiB page cache, memory temp tables, capped WAL growth) are applied automatically.
• Removed the per-program 100-event cap and the legacy data/events.json store.

Fixed

• Storage paths (log_dir, data_file, events_file, pidfile) now resolve relative to SUPER_ROOT instead of the process working directory, preventing stray log/data files when superd is started from another cwd.

Notes

• Workspace 1.5.0; pair with commercial plugin packages super-plugins-1.5.0-….

[1.4.0] - 2026-08-31

Breaking

• resource_limits.memory_limit is now in MB (binary, 1 MB = 1024² bytes) instead of bytes, and resource_limits.cpu_quota is now in cores (1.0 = one full core) instead of percent. Old configs written in bytes/percent are not auto-converted — update them for the new semantics. Event payloads (usage_bytes, limit_bytes, anon_bytes) keep byte precision. CLI flags --memory <MB> / --cpu <cores> match.
• Plugin ABI PLUGIN_API_VERSION bumped to 2: super_plugin_v1.init now receives a SuperPluginHostV1 callback table (plugins can emit SystemEvents into superd’s pipeline). Third-party plugins built for API v1 must be rebuilt.

Added

• Three-tier memory warning & visibility (licensed isolation plugin, Linux): memory_pressure pre-kill warning (Tier 1) when anonymous memory crosses memory_warn_percent / memory_warn_headroom; optional memory_high kernel soft limit (Tier 2, memory.high throttling); memory_oom_kill post-kill confirmation (Tier 3) that distinguishes a cgroup OOM kill from a manual kill -9.
• Plugin → host event bridge: the isolation plugin emits memory_pressure / memory_oom_kill through the same event pipeline as lifecycle events (event history, OSS event hooks, licensed notifications).
• Readiness-aware reload: super reload --wait [--timeout] (and POST /api/v1/system/reload?wait=&timeout=) waits for every affected program to pass its health checks before reporting success, and exits non-zero if any program is not ready in time. super start/restart also gain --wait-healthy (wait for Healthy rather than just Running).
• Batch operation safety: super start|stop|restart|remove|signal on @group / all targets print the list of affected programs and ask for confirmation before proceeding. Global --yes/-y skips the prompt for scripts, and --dry-run prints the preview list and exits without executing anything. Single-target operations never prompt.
• Cron scheduling policies (OSS): per-program on_overlap (skip / queue / kill), catchup (skip / latest / all), and jitter_sec (random delay in seconds before each trigger). on_overlap=skip is the default and preserves the previous no-concurrency guarantee; queue starts the queued run as soon as the current instance exits; kill terminates the running instance before starting the new run. catchup controls backfilling slots missed while the daemon was down (all caps at 10 backfilled runs), and jitter_sec spreads simultaneous schedule boundaries (e.g. many jobs at 0 2 * * * *) to avoid a thundering herd. Exposed via stack JSON fields and super add/update flags (--on-overlap, --catchup, --jitter).
• Cron concurrency & bounded queue (OSS): max_concurrent (default 1, up to 64) lets a scheduled task run up to N overlapping instances, with on_overlap applied only when every slot is taken. max_queued (default 100, up to 10000) bounds the queue behind a full concurrency limit; firings beyond the cap are dropped and recorded as queue_full events on the program’s event history (super events). New flags --max-concurrent / --max-queued for super add/update.
• Health check tuning & auto-restart (OSS): health probes gain interval_secs, timeout_secs, start_period_secs, and max_failures. After max_failures consecutive failures (default 3, 0 disables) the daemon restarts the program automatically and emits a health_restart event; the restart counter resets as soon as the process reports healthy again, and after retry_limit health restarts the program goes Fatal instead of restarting forever. start_period_secs gives slow-starting services a grace period before the first probe.
• OTA verification window: new [server] ota_verify_timeout (default 60, 0 disables). After an OTA update restarts a program, the new version must pass its health checks within the window; on timeout the daemon automatically rolls back to the previous version (file rollback → WAL recovery → old version restarted), so a bad artifact cannot leave the service down.
• Unix socket transport: [server] socket = "run/superd.sock" exposes the API on a Unix domain socket with owner-only permissions by default (socket_mode = "0600"; "0660" / "0640" grant group access, world-writable modes are refused). socket_only = true disables the TCP listener entirely — zero network exposure for local-only management. The CLI connects via super --server unix:///path/to/superd.sock (REST and super logs --follow WebSocket both ride the socket); when neither --server nor a persisted ~/.super/cli.json endpoint is given, the CLI auto-discovers $SUPER_ROOT/run/superd.sock (a real socket file) and prefers it over TCP, falling back to the default http://127.0.0.1:9002. superd refuses to start on a path that is a symlink, a non-socket file, or a socket held by another live process; stale sockets are cleaned up on restart.
• TOML stack files: declarative stacks (super apply, [include] globs) are now TOML by default — .toml or no extension is parsed with the TOML parser, with comments and inline tables; legacy .json stacks keep working and can be mixed in the same glob. Format is picked by file extension. Parse errors report path:line:col: like JSON. See Declarative Stacks.

Changed

• super update hot-updates memory_warn_percent, memory_warn_headroom, and memory_high on running programs alongside memory_limit / cpu_quota.
• Dashboard create/edit forms expose the three new memory fields; process detail shows MB/cores units.
• Program event history raised from 50 to 100 events per program (oldest dropped); every record carries a Unix ts timestamp (docs now state it explicitly).
• Captured child stdout/stderr lines are now prefixed with a timestamp by default: [YYYY-MM-DD HH:MM:SS] (daemon’s local time). New [child_logging] timestamp = "local" | "utc" | "none" controls the prefix (none restores the previous raw format). The WebSocket log stream still carries the raw, un-prefixed line.
• CLI subcommand aliases: super list → ls, super logs → log, super restart → rs (alongside the existing super remove → rm).
• [include] and examples now use TOML stack files by default (conf/conf.d/*.toml); the example instance ships conf.d/extra-services.toml plus a full resource/stack_all.toml. JSON stacks remain supported everywhere stack files are read.
• super export gains --format toml|json and now defaults to TOML (the default stack format); TOML output round-trips cleanly back into super apply / [include], emitting nested tables for tagged values such as health_check. Pass --format json for the legacy JSON shape.
• PUT /api/v1/stack now accepts a TOML body (Content-Type: application/toml, text/toml), so curl / GitOps pipelines can upload stack.toml directly; JSON bodies remain the default.

Fixed

• Managed children no longer inherit superd’s oom_score_adj=-1000: the kernel can now actually OOM-kill a program that exceeds memory_limit (previously the hard cap turned into a livelock). The daemon’s own OOM protection is unchanged.
• memory_pressure now fires immediately on the first threshold crossing (cooldown no longer swallows the first warning).
• memory_oom_kill is no longer lost when the cgroup is torn down right after the process exits (after_stop does a final synchronous oom_kill counter check).
• super-pro build no longer warns about a missing legacy super/common/keys/public.key when named *.public.key verifying keys are present.

Notes

• Workspace 1.4.0; pair with commercial plugin packages super-plugins-1.4.0-….
• Evaluated, not implemented: secrets passed via -e KEY=VAL (and env_file values at spawn time) reach the child through execve env and so are visible in /proc/<pid>/environ to same-UID processes; existing masking only covers API/CLI display. This matches the posture of other process managers (PM2 keeps env plaintext in dump.pm2; supervisor in its config). A privileged-channel injection (memfd / fd or a credentials directory, opt-in per program) is deferred as a future hardening direction — see SECURITY.md “Known limitation”.

[1.3.3] - 2026-08-31

Added

• OSS webhook event hooks: [[event_hooks]] with type = "webhook" posts SystemEvent JSON (HMAC-SHA256 signed) to external URLs without any licensed plugin. type = "command" hooks also capture the program signal.
• Event history: program lifecycle events are persisted to data/events.json; the new super events CLI shows recent events (--tail, --program, --json).
• Cron jobs are exempt from flapping detection — short-interval schedules no longer flip to Fatal / disable autostart.

Changed

• depends_on now starts non-running dependencies automatically (cycle-safe; waiting/restarting/crashed deps are not forced).
• super remove is the primary command name; rm remains a clap alias. CLI help and docs updated throughout.
• super signal --sig help now lists quit (server already supported it); API reference batch Signal payload aligned.
• Config docs aligned with code: super.toml lookup paths, health-check interval (fixed 5s), and isolation plugin log wording.
• Pro beta trial shortened from 1 year to 1 month (GitHub Issue template + docs); purchased annual keys keep the 365-day term.

Fixed

• super token list no longer fails on deserialization — the CLI now expects the API’s AuthTokenInfo shape (no token_hash).
• Batch-action confirmation prompt (super stop/start/restart/remove/signal all and @group) now shows the real target count.

Notes

• Workspace 1.3.3; pair with commercial plugin packages super-plugins-1.3.3-….

[1.3.2] - 2026-08-29

Added

• super keyring lists license verifying key ids embedded in the CLI binary; super doctor prints the same summary line.
• [license].strict and deployment-intent detection: invalid keys refuse startup when strict = true, plugin libraries are present, auth_secret is set, or bind is non-loopback; otherwise OSS degrade with warnings (SUPER_LICENSE_STRICT env override).

Changed

• Create / update program (HTTP, CLI add/update, dashboard, stack apply) run a shared structural check. Failures return 400 with a message that names the field (command:, health_check.url:), the program or services[i] (name=…), and for TOML/JSON syntax / unknown keys path:line:col: (TOML) or JSON line N column M. super check reports include problems as path:line:col: or path: services[i] (name=…): field:.
• super check reports invalid license as an error when strict or licensed deployment signals apply.
• License verification requires a kid claim on every license; the legacy v1 kid and compile-time fallback are removed. Signing key ids use k_<8hex> (derived from the Ed25519 public key). Re-issue licenses from your vendor if verification fails with “missing signing key id”.
• Docs: Troubleshooting license verification — suggested super check, super doctor, and super keyring for self-service diagnosis.

Notes

• Workspace 1.3.2; pair with commercial plugin packages super-plugins-1.3.2-….

[1.3.1] - 2026-08-27

Added

• CODE_OF_CONDUCT.md (Contributor Covenant).

Changed

• Public beta messaging aligned across README, docs, and GitHub issue templates.
• CI: cargo fmt --check, macOS test matrix, benchmark/ workspace build.
• Docker Hub publishes linux/amd64 and linux/arm64 again; docs use loopback port mapping.
• Document minimum Rust 1.85+; workspace rust-version = "1.85".
• License help links point to the feature matrix and Pro trial.
• Remove unsupported [webhook] from super.toml (use [[event_hooks]] or conf/notify.toml).
• Invalid license: prominent startup warnings; improved super doctor triage.
• /go/pro/ license examples updated for the 1.3.x release line.

Fixed

• h2 and lru RustSec advisories via dependency updates.
• /go/pro/ checkout CTA uses configured purchase URL.

Notes

• Workspace 1.3.1; pair with commercial plugin packages super-plugins-1.3.1-….

[1.3.0] - 2026-08-04

Fixed

• Release CI Manager keyring fetch: require explicit env (no defaults); harden HTTP/JSON errors; upsert verifying keys without deleting existing common/keys/*.public.key (hand-curated git keys + Release-time Manager ring).

Notes

• Workspace 1.3.0; pair with commercial plugin packages super-plugins-1.3.0-….
• Git common/keys/ stays hand-curated; fetch-verifying-keys.sh runs in Release CI only (not routinely committed).

[1.2.5] - 2026-07-26

Added

• superd --daemon / [server] daemon (Unix): optional self-daemonize with pidfile (run/superd.pid by default, overridable via [server] pidfile / --pidfile). Refuses to start under systemd or as PID 1. super doctor reports conflicts and stale pidfiles. Keep foreground under systemd (superd --foreground).

Notes

• Pair OSS 1.2.5 with matching commercial plugin packages (super-plugins-1.2.5-…).

[1.2.4] - 2026-07-26

Changed

• License docs/API wording: version span → version scope.
• Dashboard: tour screenshots refreshed (notify/stack, program config).

Notes

• Pair OSS 1.2.4 with matching commercial plugin packages (super-plugins-1.2.4-…).

[1.2.3] - 2026-07-25

Changed

• Dashboard: dashboard tour screenshots refreshed (overview, program detail/logs, inhibition rules).

Notes

• Pair OSS 1.2.3 with matching commercial plugin packages (super-plugins-1.2.3-…).

[1.2.2] - 2026-07-25

Added

• Notification storm suppression docs and dashboard UX: Webhooks + Inhibition (When → Mute targets → For), Delivery Strategy defaults.
• OSS / notice page points to Get Super Pro.

Changed

• Public docs homepage redesigned (wide layout) for all languages (en, zh-cn, ja, es, ru).
• Get Super Pro: license version coverage (issued line → free newer minors → renew) plus Terms alignment.
• Dashboard Notification Settings tabs renamed to Webhooks / Inhibition rules.

Notes

• Pair OSS 1.2.2 with matching commercial plugin packages (super-plugins-1.2.2-…).

[1.2.1] - 2026-07-14

Added

• Docs CI: offline HTML link check (site-relative crawl) after Hugo build.
• Licensed-mode startup checks: deployments with a subscription key require the security plugin and auth_secret (hard-fail).

Changed

• Public docs messaging aligned with a single subscription plan; documentation URLs use https://super.docs.sconts.com/.
• Removed public “pre-release / not for customer delivery” banners for the licensed plugin model.
• Docker Hub image CI publishes linux/amd64 only (arm64 manifest removed from the publish workflow).
• Open-source edition license is MIT (historically GPL-3.0).

Security

• Stricter defaults for network exposure and configuration validation in OSS deployments.
• Improved validation for user-supplied paths and outbound fetch URLs.
• Reduced sensitive data exposure in API and export responses.

Notes

• Subscription plugin archives remain vendor-delivered (not built from this OSS repository). Pair OSS 1.2.1 with matching commercial plugin packages.

[1.2.0] - 2026-07-10

Runtime plugin architecture merged. Linux cgroup isolation QA (aarch64) signed off.

Added

• Runtime plugin host — superd discovers plugins/*.{so,dylib}, verifies the signed license key, and dlopens authorized plugins.
• HTTP plugin ABI — generic attach_http_plugins() in OSS core; plugins register routes and auth middleware without linking super-core.
• Lifecycle plugin ABI — on_event, after_stop, metrics, and manager hooks via ExtensionStack.
• [license].key in conf/super.toml — replaces legacy license.key file; SUPER_LICENSE env override supported.
• auth_secret typed in OSS config (historical note: early docs listed it under ServerConfig as a root field; it later moved to [server].auth_secret). Enforced for licensed security plugin startup / bootstrap.
• Unified CLI — login / token subcommands in OSS super when security plugin is active.
• common::plugin_async — shared worker for cdylib async boundaries.

Changed

• Commercial capabilities ship as plugins + license, not a separate superd-premium binary.
• Cron scheduled tasks remain in OSS superd (not plugin-gated).

Notes

• Plugin libraries ship with subscription delivery; they are not built from this OSS repository.
• Web dashboard ships as an optional UI plugin with embedded static assets; OSS superd has no built-in Dashboard.
• Linux cgroup isolation signed off on aarch64 (2026-07-14).

[1.1.9] - 2026-07-08

Added

• GitHub Releases multi-platform binaries (Linux amd64/arm64, macOS Intel/ARM, FreeBSD) with README archives and SHA256SUMS.
• Docker image multi-arch publish (linux/amd64, linux/arm64).
• gh-pages branch README (auto-deployed with documentation).

Changed

• Docker image: Debian 13 (trixie) build stages and distroless cc-debian13 runtime.
• Release CI uses native ubuntu-24.04-arm for Linux ARM64 builds.

Notes

• Windows pre-built binaries are not published; use Docker or build on Unix-like systems.

Fixed

• FreeBSD release packaging (version passed into VM).
• CLI check.rs explicit Vec<String> types.

[1.1.8] - 2026-07-07

Added

• Official Docker image schiplat/super with default config under packaging/docker/conf/ (historically dockerbuild/conf/).
• GitHub Actions workflow to build and push the Docker image.
• Documentation homepage with OSS capabilities, licensed plugin features, and API example.

Changed

• Docker image published on Docker Hub as schiplat/super.
• Installation docs, README, and make docker target for packaging/docker/Dockerfile (historically dockerbuild/Dockerfile).

Fixed

• Dashboard ProcessList.vue syntax error breaking vue-tsc build.
• Doc screenshot paths for GitHub Pages (/super/images/...).

[1.1.7] - 2026-07-07

Added

• Event hooks — run scripts on system events.
• post_stop lifecycle hook.
• Supervisor-compatible fields: stopsecs, priority, log file paths, autorestart / exitcodes / startsecs.
• Historical logs API and super logs --tail.
• OTA updates via API and super update --artifact-*.
• System stats API and dashboard metrics panel.

Changed

• OSS API no longer uses auth_secret; bind to 127.0.0.1 or use a firewall for exposure control.
• Documentation updates across config, API, and feature matrix.

Historical (1.1.7): later releases restored optional OSS auth_secret and refuse non-loopback binds without it — today the key lives under [server] (see Authentication and Unreleased notes above).

Fixed

• Historical logs API now reads from the correct log directory when [storage] is omitted.