- Resilient Persistent Connections and Keepalive: Added periodic WebSocket pings from client to agent, extended agent write deadlines to 25s, increased client heartbeat timeout tolerance to 30s, and streamlined direct WebSocket connections to prevent dropouts across NATs, firewalls, Cloudflare tunnels, and macOS sleep/wake cycles.
- Eliminated Keychain Password Prompts: Replaced repeated macOS Keychain prompts on launch with in-memory fast caching and local persistent storage for server tokens, database credentials, and TLS fingerprints.
- Docker Detection and Null Ports Decoding Fix: Fixed an issue where containers without exposed public ports (e.g. Supabase, private network containers) returning null port arrays caused JSON decoding failures and falsely triggered 'Docker Not Detected'.
- Resilient Container Decoding: The macOS client now gracefully decodes null or missing container metadata fields across Docker engine variants.
- Docker Error State and Retry: Added dedicated failure cards with an actionable retry button when container retrieval encounters network or decode issues.
- Agent Auto-Update Release Binaries: Restored standalone linux/amd64 and linux/arm64 release binary assets on GitHub Releases for in-place updates via 'pulse update'.
- Brute-Force and Port Scanning Defense: Sliding-window rate limiter on the agent that automatically blocks malicious IPs for 15 minutes after repeated failed authentication or pairing attempts.
- Pairing Session Brute-Force Lockout: Immediate revocation and purge of pairing sessions after 5 invalid code attempts.
- CSWSH and HTTP Security Headers: Strict Cross-Site WebSocket Hijacking origin verification, plus hardened HTTP security headers (CSP, HSTS, X-Frame-Options, nosniff).
- Tamper-Resistant Action Audit Trail: Linux agent records all executed actions, scripts, and runbooks with timestamp, user identity, and status to an append-only audit log.
- TOFU TLS Certificate Pinning: The macOS app pins server TLS certificate fingerprints on first connect and alerts immediately if a certificate changes or is intercepted.
- Biometric Security Gate (Touch ID): Optional Touch ID, Apple Watch, or Mac password confirmation before running destructive actions (reboot, service restart, container termination).
- Add Server Screen Redesign: Direct method selection (Direct IP, Cloudflare Tunnel, Tailscale) and mode selection (Root vs. Non-Root) on the primary screen.
- Inline Setup Snippet: Instant copy button for 1-line setup command with helper badges and server connection fields in one view.
- Universal Non-Root Support: Dedicated non-root options for Direct IP, Tailscale, and Cloudflare Tunnel.
- Non-Root User Mode: Standalone support for non-root VPS accounts and shared environments. Installs to ~/.local/bin and ~/.pulse without requiring sudo.
- Cloudflare and Tailscale Non-Root: Dedicated one-line non-root scripts without requiring root or open ports.
- User-Level Systemd and Crontab Fallback: Deploys daemon via systemctl --user with auto-linger or crontab @reboot persistence.
- Unified Pulse CLI: Command line tool (pulse) on Linux nodes for status, pairing, Tailscale, Cloudflare tunnels, logs, and self-updates.
- Network Offline Auto-Reconnect: Real-time network monitor that detects Wi-Fi or Ethernet drops and reconnects servers automatically when online.
- Live Log Streaming Enhancements: Connection-state aware WebSocket log streamer with automatic retry and idle indicators.
- Live Log Viewer and Streaming (Cmd+L): Real-time WebSocket log streaming for Systemd services and Docker containers with regex search, pause, and auto-scroll.
- Outbound Telegram Alerts: Direct Bot API push notifications to user IDs and ops channels with test alert and flapping protection.
- Disk Space Analyzer (Cmd+U): Breakdown of disk usage across /var/log, Docker, cache, and safe cleaners (vacuum journals, docker prune, clean apt).
- Maintenance Runbooks (Cmd+R): Execution shortcuts for reloading web servers (Nginx, Caddy), flushing DNS cache, and checking OS updates.
- Process Network and Disk I/O: Real-time read and write throughput and open socket file descriptor audit in the Process table.
- Server Tags and Environments: Group servers in the sidebar by Production, Staging, Development, and Other.
- One-Command Automated Setup: Automated scripts for Direct IP, Tailscale, and Cloudflare Tunnel with auto-detection of firewall and CPU architecture.
- Human-Friendly Pairing Code: XXX-XXX format code (e.g. 607-019) with 10-minute validity.
- Security and Open Ports Inspector: Real-time socket audit, exposure detection, and UFW firewall checks.
- Sparkle 2 Auto-Updater: Background and on-demand app updates with Ed25519 signatures.
- Custom URL Scheme: Supported pulse://add deep linking for server onboarding.
