Novedades

No user-facing changes in this release.

Features

• api: delivery=email on invite and reset, mail error codes, features on /api/me, rate limit on link redemption (a7cf94b)
• auth: e-mail delivery of invite and reset links, revoked when the send fails (bf52ba4)
• config: KUBELATCH_RESEND_API_KEY and KUBELATCH_MAIL_FROM, and mail.from in the chart (42c64f1)
• edition: per-feature gating with email_links as the first Pro feature (5173328)
• mail: invite and reset e-mail (template B) in en and es, logo inline (e87c120)
• mail: stdlib Resend client with inline images and a fixed endpoint (1a952e5)
• server: wire Resend link e-mails when configured (23470a6)
• store: account link delivery, single-link revoke and control event counts (fd29b20)
• web: choose e-mail or link for invitations and resets (ca086da)

Bug Fixes

• auth: count the hourly e-mail limits inside the issuing transaction (7e84e0a)
• auth: issue and send an e-mailed link detached from the request (654c6ce)
• httpapi: an empty chunked reset-link body is the default, not a 400 (3f9d76d)
• httpapi: say when Resend did not answer and when a reset closed sessions (172f06b)
• mail: the footer names the configured base URL (00b36cf)
• web: describe the create sheet as a single-use invitation, which may never be shown (f6e286c)
• web: Spanish text of subject.bad_delivery says correo, not email (e811b69)

Features

• agents: a repeated held write returns its pending request, the retry waits for the decision, and an executed approval says so (32930a3)
• config: KUBELATCH_AGENT_APPROVAL_WAIT, how long a held write's retry waits for the decision (bd9a9f1)
• helm: config.agentApprovalWait sets how long an agent's call waits for a held write's decision (2eb0b3d)
• httpapi: follow in the consent answer and the session views, source on each consent grant (90bfccd)
• mcp: approvals over multi round-trip requests, a retry that waits for the decision, and one tool list for every caller (152a947)
• oauth: the consent chooses what the session takes of later grants (follow) (32ffbbe)
• rbac: sessions that follow their person derive from each grant they receive (5842939)
• store: agent_sessions.follow and the live sessions that follow a subject (3c7d542)
• web: consent merges rows per cluster, scope and role and asks what to do with later permissions (f27b79a)

Bug Fixes

• apierr: an expired approval no longer says it may have been used, now that a run approval has its own code (8ca955e)
• mcp: a waiting retry answers approval_pending when the server shuts down (c728a02)
• mcp: cap the retries of one credential that wait for a decision (bba1c49)
• rbac: a following session derives nothing for a permission the person held at the consent (a6c1f9d)

Bug Fixes

• web: keep the activity and the credentials current with their page open (7ff6df4)
• web: keep the agent pages and the pending count live (2fc7f1f)
• web: refresh the grants after approving an agent's access request (1bfa002)

Features

• edition: check for a new version now, from the Version row (3fe74eb)

Features

• web: fold each cluster of My access, as Permissions does (4e1eade)

Bug Fixes

• web: Home's connection card takes the full width, compact, with the command beside its copy button (89c787c)

Features

• api: grant rows carry their cluster's name, so a member's Home can name the clusters it lists (4344f68)
• web: an access directory grouped by cluster, on the grouped table without folding (f10a3de)
• web: Edition lists the installation's health, each check with its state and where to fix it (8f20871)
• web: Home leads with what needs attention, names the connection in its header and lists access as a directory by cluster (68f21c5)
• web: Home's attention items and access directory as pure helpers (f7d614f)

Bug Fixes

• web: Needs attention drops a credential already reissued with the same name and cluster (3795328)
• web: the health list words a failed GitHub sync by its cause, as Users does (7e38ae8)
• web: the issue sheet opened from the command palette gives focus back to Home's issue button (2ec92fc)

Bug Fixes

• updatecheck: check within 30 s of starting and retry a failed check after an hour (068d6c0)

Bug Fixes

• web: role fields stay aligned, and a cap of 0 says the edition does not include it (2d11d04)

Features

• audit: filter requests by outcome (denied, error, write) (91141bc)
• ci: a trust rule names its repository, resolves it through the GitHub App and knows its last redemption (f4f4106)
• cli: the approval pages learn whether the CLI asked from the browser's network (aee3250)
• clusters: the enrollment status reports its last refused post, and a cluster says since when it fails (a858aa6)
• config: KUBELATCH_ACCESS_CONTACT and the update check variables, exposed to the SPA and the chart (8228ed9)
• credentials: look a whole token up by its hash, and a CI credential names its rule (56e9dfb)
• edition: a daily check for a newer kubelatch, reported by GET /api/edition (254288f)
• httpapi: an account's detail says when it linked GitHub and changed its password, and a member's groups carry that membership (e21659e)
• httpapi: an agent request names the agent that asked, from its session's client name (2c732fd)
• httpapi: GET /api/edition says the audit retention in force, in hours (74b567f)
• httpapi: GET /api/subjects/{id}, and the pending link and last activity of every account (5ba6ee3)
• httpapi: the invite and reset link answers say when the link expires (152a2a0)
• kubeconfig: a downloaded kubeconfig names its contexts kubelatch-<cluster>, as the CLI does (193e81d)
• store: last_error_at, enrollment failures, a CI token's rule and a rule's repository label (9691ac7)
• web: /activity holds my whole activity with its pager, discovery and detail, under Home in the breadcrumb (e384edf)
• web: a card per cluster with its context, the expired card, ask-for-access through the operator's contact, and my credentials with last use and issue-a-matching-one (f9b6cca)
• web: a CLI session or CI token wears an outline pill with its word, not a warning (cfabb3b)
• web: a cluster is Not enrolled, Ready or Error, and a v1 cluster asks to be re-enrolled (530855c)
• web: a figure can apply its segment, and the figures scroll in one row on a phone (9da0e21)
• web: a group opens from its name in the groups list, as an account does in Users (37baa03)
• web: a link opens the grant sheet with the account, the cluster or the namespace already chosen (f312216)
• web: a list row can be muted, and a submit button keeps its reason under it (3a1e52e)
• web: a separator in row menus, a large account cell and the missing-webhook notice in the bell (6495f95)
• web: a trust receipt for the pages that answer a request, with a live clock and the time since it was asked (c1171fd)
• web: a trust rule read as a sentence, the ref a condition writes, the CI figures and a snippet filled for one rule (eecca77)
• web: a write's diff says what it changes in one line and knows the metadata the server manages (a06befd)
• web: Agents shows two cards, approvals first while one waits, with figures that apply their segment and rows on a phone (ce65ec1)
• web: an account combobox grouped Bots and People, the login in mono with the name as the hint (a7190c7)
• web: an agent request as a sentence, its outcome and segments, a session's name and role, its tool calls, and the consent's choices (9b3ad32)
• web: an agent session is named after its agent, lists what waits on it, and reads its timeline by tool call (a1adb8f)
• web: an agent's consent asks its question over a trust receipt, with chips per permission grouped by cluster and a live summary (21fbb51)
• web: an object page names itself in the breadcrumb, and the navigation toggle is 36 px (1da488b)
• web: approve a pending approval from its Agents row, after the decision page's confirmation built from the loaded approval (d445af8)
• web: audit filters gain period, result and verb chips and a Reset beside Apply (65b9483)
• web: audit helpers say a request in one line and one sentence, fold bursts, name groups and days, and the summary says the result (fe51a5c)
• web: CI rules read as sentences, created repository first, with a connect step that fills the workflow for the rule (a918fe5)
• web: each account has its own page, with its sign-in, access, credentials, CI rules, AI agent and activity (2ac6d51)
• web: each cluster has its page, with its figures, its enrollment and health, and the bell leads to it (9b02aad)
• web: Edition says its status in a sentence, the key timeline, the version, and Free beside Pro (8dcacda)
• web: Empty says the way forward, Pager hides without pages and names its snapshot, Notice can take focus (62eb335)
• web: every control-plane event reads as one sentence, with its target's page or the word deleted, and its family (d17c750)
• web: Home's connection as a «Tu conexión» card with a status pill, a list of computer, session and contexts, and its actions in the footer (10966f7)
• web: Home's pure helpers: cards per cluster, recent expiries, setup steps, the inbox, CLI sessions, days and kubeconfig names (f5e7ee4)
• web: Home's Status as compact notice rows with a tone icon, the edition caps folded, and each notice's link named by what it does (7685f1e)
• web: Home's strips (needs you today, setup, status), the connection line with its CLI session, and the recent activity grouped by day (4e2faff)
• web: how an account gets in, as one pill with its word, and the Users figures that count it (fc0e3c8)
• web: hunt a leaked token down to its credential, read a credential in a sheet, and revoke from the row (592ea1a)
• web: in English an agent request is an approval, and a request is a request to a cluster (fdd0c66)
• web: issuing asks for a name, defaults to the shortest duration, takes a note, says what it will issue, picks the account from a grouped combobox and hands a bot its token first (e29a979)
• web: ListRows, a list page's rows under md with the action in view (4f947cd)
• web: LoadFailure, a routed page's load error that keeps its h1 and its way back (e1baa19)
• web: login offers GitHub alone and moves the password to a step of its own (ed056e4)
• web: My account is Account with its sessions, Security and Preferences, closes the other CLI sessions and says why the password cannot change yet (12a4e96)
• web: one Home for everyone: the admin strips, the connection line, a card per cluster, my credentials with their own issue action, and the recent activity (a1478c5)
• web: PageHeader takes a row of facts under the title (2c0fece)
• web: sheets take a phone's width with bodies that shrink, and every tab list wraps, guarded (aaa8083)
• web: SubmitButton keeps focus and says why it cannot submit yet (efba102)
• web: the account link welcomes by name, sums the link up in a short list, and ticks each password rule as it is met (779ef58)
• web: the account page's CI rules, AI agent and activity cards (642082c)
• web: the account page's sign-in and access cards, and the add-to-group sheet pinned on its own (4c28aa1)
• web: the admin credentials table with reach, issuer and Revoke in view, and a credential's detail in a sheet (bde8915)
• web: the API types, client methods and fixtures of the views redesign contract (d79c963)
• web: the audit incident bar keeps account, cluster, period and result in view, with the rest in More filters and the result in the URL (98700d6)
• web: the audit log pivots from each row to only its account, cluster or credential, and its detail links what it names (a2d25c9)
• web: the audit log table heads each day, says What in one line, folds bursts and opens a row anywhere (9cb67c6)
• web: the bell counts decisions only, lists the notices and a new version, and links a single request (9cee3f7)
• web: the CLI sign-in asks its question over a trust receipt that warns when the CLI is on another network (bcdedbd)
• web: the cluster helpers say its health, its figures, its grant link and why an enrollment failed (f714367)
• web: the cluster summary card, whole-card link to its page with three linked figures (17dd352)
• web: the cluster's access by scope and its namespaces, each with a preset grant (431f774)
• web: the cluster's last requests and its details, each in its card (2a6eba8)
• web: the Clusters list is summary cards that lead to each cluster page, where registering lands (6fa33bd)
• web: the control-plane log reads one sentence per event, links its targets or says they are gone, and opens each event with its JSON in a sheet (ce7b7e8)
• web: the decision page is titled by the change, counts down, sums up the diff, folds the server's metadata, and confirms Approve with the sentence (6f17234)
• web: the edition helpers say the status in a sentence, the key timeline, the retention and where to upgrade (d018ccd)
• web: the enrollment and health card polls its link, says the last failure and never closes by itself (215970e)
• web: the one-time link dialog guards an uncopied link and says until when it works (0ca5e24)
• web: the palette groups by entity, offers each account and cluster its ways in, and gives a member their own things (4dac5c9)
• web: the request detail opens on its title with a sentence, copies the Audit-ID and the request, says the groups in words and links what it names (9c641d6)
• web: the sidebar orders Access by daily use, rules its groups on the rail, and leaves Edition to the pill and the person menu (8ac1bea)
• web: the Users list is a directory of five columns leading to each account's page, with the sign-in pill and the help in three lines (096da7b)
• web: what a credential reaches, its kind line, its use from the audit and the whole-token check (0a301d6)

Bug Fixes

• apierr: the English texts of an agent approval say approval, never request (c11655c)
• audit: a credential revoke names its kind, so an agent credential revoked after a lookup never reads as deleted, and a group target reads as a group (20c3bec)
• ci: a renamed repository and a missing installation are 400s, and a label next to the ids must name them (94e0b5d)
• ci: the per-rule workflow snippet quotes the environment, so a colon or a # in its name cannot change which environment it names (cae257f)
• clusters: the enrollment's last failure carries its code and params, so the SPA can translate it (cb7ee7e)
• config: count the access contact in characters and keep a mirror URL's credentials out of the startup error (07d6860)
• credentials: a token lookup that matches nothing leaves a credential.lookup event too (3ee7506)
• credentials: the Spanish credential.unknown says no credential matches the token (2efaf63)
• helm: the chart refuses an update-check mirror URL with credentials, which would sit in plain text in the ConfigMap (3dc9653)
• httpapi: a malformed subject id is a 404 subject.not_found, as every other id (25d9681)
• httpapi: same_network is false when the browser came through a forwarding hop we do not trust (c78ee97)
• httpapi: the consent says whether this request's answer leaves the person's computer (afc1d3d)
• mcp: a Secret value a held write changes to one of the same size reads as changed in the preview (f70c101)
• oauth: consent and approval re-check the redirect, so an authorization made before its scheme was denied never gets a code (1d62ea1)
• oauth: every redirect but loopback http(s) raises the consent's alarm, and browser schemes are refused (aafd8e3)
• store: index credentials by subject and last use, built concurrently, and compute one subject's extras for its detail (3540d21)
• store: migration 00023 drops a leftover index before building it, so an interrupted build never stays invalid for good (a01babc)
• updatecheck: a checked version is the version alone, so no sentence rides along into every admin's bell (4ecb619)
• updatecheck: a failed check never repeats the user of the mirror URL, only the host and the error (6ab3c2d)
• updatecheck: follow two redirects and none from https to http, keep only a link on the check host, and keep credentials out of errors (f7f1022)
• web: a disabled administrator can still be demoted (44a7e4e)
• web: a figure toggles its segment off again, says its number and shows focus on the whole card (44b78b0)
• web: a figure's focus ring shows whole on a phone, and an unnamed hash target announces the page (49bdc49)
• web: a grant preset drops a namespace the cluster does not list, which had no checkbox to clear it (16379f3)
• web: a grant preset from a link drops a disabled account and a pending or missing cluster, which the pickers do not offer (69590b6)
• web: a held write's dry run never names its tool call, and reads as a dry run in its requests (89063ed)
• web: a pasted AI-agent token opens a sheet that names its kind instead of reading undefined (4d41f6c)
• web: a pasted token with capitals finds its credential (a21109b)
• web: a request's what reads the same on Home, the cluster, the agent session and my activity, as it does in Audit (get pods/web (shop)) (3dc6bf8)
• web: a revoke from the credential detail gives its announcement the focus once the sheet has gone (30221b0)
• web: a Secret write never reads as no change or metadata alone on the decision page (8991bbf)
• web: a status read asked before a new enrollment command cannot land over it and hide it (f641d95)
• web: a whole pasted klt_ token finds its credential by its visible prefix (1d4c643)
• web: an agent's delete reads «Elimina el objeto», and the term guard catches «borra» (a618ce1)
• web: an audit burst never folds a failure, another credential, another address or another day under one row (2e4b2d1)
• web: choosing all clusters for a preset cluster without a grant says the one cluster left, which is what it sends (f9ba2de)
• web: closing the credential detail by hand gives the focus back from onCloseAutoFocus, once its trap has let go (88ed5ea)
• web: closing the other sessions tries every one, counts an already-closed session as closed and ignores a second request while pending (f4c96de)
• web: every way of opening the issue sheet starts a new generation, so a late answer of a closed sheet never lands in the next one (b5abb1a)
• web: Home's access row names what its role includes, as the old card did (ce5fe70)
• web: Home's Spanish ask-for-access link reads as its sibling, in the infinitive (e9ea1ff)
• web: issuing another like an expired credential never widens its cluster: the select waits for a choice and the submit says why (5536b77)
• web: open a column gap between a card header's text and its action, with a design guard (df814d3)
• web: sheet forms stay inside a phone and the Users segments wrap (d888da9)
• web: signing out of the CLI session ignores a second request while the first is pending (377ca14)
• web: stack the cluster page's Access and Namespaces cards so the namespaces table is not cut off (53d18e6)
• web: the account card counts CLI sessions open by their own expiry and revocation, not by the server's stale active flag (e5b729c)
• web: the admin switch of a disabled account is off and says why (68f757c)
• web: the audit detail links only a credential the Credentials page can open and says any other by its plain id (5c51a52)
• web: the CI form offers the numeric ids with the GitHub App too (2102997)
• web: the connection line stops loading when my credentials fail to load and draws no session line, keeping the agent link (6be607a)
• web: the consent raises its alarm when the answer goes to an app, naming the scheme that app claims (d31e76a)
• web: the consent's alarm follows where this answer goes, not every address the client registered (425a392)
• web: the control log reads a deleted target in its noun's gender, an approval gone with its cluster, and an agent credential as plain text (356b1fa)
• web: the control log says an administrator closed a person's web sessions, not every session (4a1898b)
• web: the delete hint and the token rotation say «elimina», as the term guard asks (d66536d)
• web: the Edition promise names the daily version check and KUBELATCH_UPDATE_CHECK=false (1f9e9ef)
• web: the enrollment card claims nothing about a link made elsewhere, and offers no Cancel while its command is being created (576678f)
• web: the enrollment card describes the command it shows, not the re-enrollment the menu asks for now (599b71c)
• web: the focus ring of a list row is drawn inside the row, not 4 px past it (ce64e7b)
• web: the manual cleanup after a cluster delete also removes custom roles' ClusterRoles, as the server's cleanup does (b288e98)
• web: the namespaces table fits its half of the cluster page: a short count header, names that wrap, a narrow action column (097e54b)
• web: the pasted tokens JSON goes with its box: on cancel, when the steps close and when a keep-tokens command swaps it (da2ea46)
• web: the route announcer finds a section whose id needs percent-encoding in the hash (1ee888e)
• web: the route announcer names a section and ignores the skip link (a62e7ee)
• web: the searches of MultiSelect and the rule editor's group picker carry an accessible name (7a6e3fd)
• web: the sessions button, its confirmation and its notice say web sessions, since a CLI session stays open (e6aab52)

Features

• rbac: a module names the read capability a write one presumes (reads) (72d5d6e)
• rbac: each violation names the field it points at (7539455)
• rbac: the preview runs the in-use checks of an edit and reports scope changes in its diff (e736667)
• web: a role page at /admin/roles/{id} with its actions, figures and what it grants (c0e81d4)
• web: CapabilityGrid, the capability cards by domain with folds and the write-without-read advice (5175374)
• web: helpers, texts and test viewport for the role builder redesign (0130973)
• web: MultiSelect takes free text as chips (creatable) (29a83c4)
• web: RuleEditor with a group combobox, chips, verb presets and suggestions from a cluster (9a6e01b)
• web: ScopeChoice, the where-it-applies card of the role builder (ff58e20)
• web: the role builder edits advanced rules with chips and suggestions; the API explorer is retired (fd46dff)
• web: the role builder in the order of the decisions, with folds, a status line and a phone bar (211f352)
• web: the role summary leads with problems and what it grants, folds the resources, and lists scope changes (c146409)
• web: ToggleChip and the Start from chips of the role builder (a4e7545)
• web: useMediaQuery and the phone summary bar of the role builder (ee810e6)

Bug Fixes

• web: a late "start from" answer never replaces an edited draft (44bc225)
• web: a rule added after "start from" gets a fresh key, and the summary sheet closes when the screen turns wide (deb8a9e)
• web: multi-group rules are merged back on save (4145909)
• web: the role builder's problem links always land, and a late start no longer wins (fb16125)
• web: the summary sheet's problem links close the sheet and focus their control (d5d4937)

Features

• groups: extend a group permission (PATCH /api/groups/{id}/grants/{gid}) from the group page, with its derived rows and audit event (af04764)
• web: Access column and Add to a group in Users, the origin on Home, a Permissions link per cluster (6b3475c)
• web: audit log labels for the group actions and the grant expiry change (c17f24f)
• web: grant several accounts and scopes in one batch (6ce81df)
• web: group helpers, fixtures, dictionaries and the Groups nav item (f529cd8)
• web: MultiSelect with chips, a shared ExpiryField and the origin pill (e28b024)
• web: permissions by account, by cluster and as a list, with their origin (2481f84)
• web: the group page with its members, permissions and details (8580e2c)
• web: the Groups page, its creation sheet, delete confirmation and palette entries (d06fac6)

Bug Fixes

• web: arrow keys on the permissions view selector, and Add to a group waits for the memberships before offering groups (c175b92)
• web: drop the refused-entry line when the batch changes and tidy the grant form (0f8c830)
• web: group page findings of the milestone 3 review (blocked members, extend guard, limits, pending states) (bd2e5a7)
• web: one copy of the group dictionary blocks, a 24 px chip target and the tinted hover of the group pill (931350e)
• web: permissions overlap over the unfiltered set, guard-clean texts, detail and header coverage (a30d385)
• web: permissions page findings of the milestone 3 review (header a11y, stale refusal, overlaps under a group filter, chip focus) (461569c)
• web: quote logins and names with «» in the Spanish group texts, and cover every overlap rule (af9f91d)
• web: refresh after a late add-to-group response, restore focus to the row menu, grants mock with a source (6533537)
• web: refresh from the mutation hooks and restore focus on the group page (94e058c)

Features

• api: /api/groups, members and group permissions (e8d5569)
• api: grant source and group filter, derived grants revoke from their group, grant batches, tier covers, subject access counts (e6f6ab6)
• groups: agents ceiling regression, SPA API types and reference docs (18728e6)
• groups: the group service, with derived grants synchronised in each transaction (10681d8)
• rbac: tier covers, and deleting or narrowing a role sees its group permissions (f8bddf7)
• rbac: ValidateTarget shared by direct grants and group permissions, and CreateBatch (7a564c3)
• store: group reads, counts and the derived grant synchronisation (bd0bcc6)
• store: groups, members, group grants and the origin of a derived grant (f3538a5)

Bug Fixes

• api: name the batch index on every grant failure (6128e7a)
• groups: prove the group lock with a removal race, event order in Delete, narrower reconcile on expiry updates (d7b0c7a)
• groups: validate on the pool before locking, and re-validate permissions for new and revived members (f48eaed)
• rbac: lock a deleted role's groups before revoking their permissions (31e1b11)
• rbac: validate a grant batch before opening its transaction (ee85c1d)
• store: give the group advisory lock its own class, 12 (575081c)
• store: groups down migration with agent grants, and tests for the sync revoke paths (a4a859d)
• store: pair a derived grant only within one group (28a172e)

Bug Fixes

• release: read the release notes with GITHUB_TOKEN so the public mirror carries them (d9dfab6)

BREAKING CHANGES

• edition: an instance that never had a license key keeps its audit 24 hours instead of 7 days; about a minute after the first start of this version the retention job deletes the older audit. Set KUBELATCH_LICENSE before upgrading, or install a key in Edition right after, to keep it. Nothing that exists is cut: an instance already past 2 clusters or 5 people keeps them and only new registrations are refused.

Features

• edition: Free allows 2 clusters, 5 people and 24 hours of audit (e53bfdc)
• legal: EULA as LICENSE and the terms, privacy and security pages in both languages (7b8eca9)
• license: seed helpers and an exported CurrentKID for the licensing service (a2f6895)
• public: the public repository tree and deploy/public/sync.sh (8d8fb10)
• release: publish-public mirrors each release to picaportelabs/kubelatch; fixed image source (6eaf44a)
• release: the EULA ships in the image and the chart (40f1311)
• web: the sidebar says the edition beside the name (59b9cec)

Bug Fixes

• helm: refresh the chart's EULA copy after the legal fixes (58c5f8b)
• legal: bind trial users to the Pro Subscription Terms in EULA section 5 (d01e84d)
• legal: Free limits per Instance, Pro Seats across Instances, trial customers and (a) clause markers (fe02836)
• release: pass PUBLIC_REPO_TOKEN through workflow_call, sync the public tree for the latest release only and one at a time, mirror the root files with deletion, point the public changelog at the public repository (e569ce1)