Skip to content

chore(release): v0.2.1 #74

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kerdofficial merged 1 commit into from
Oct 23, 2026
Merged

chore(release): v0.2.1 #74

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,16 @@

Published changes are recorded in [GitHub releases](https://github.com/kerddotdev/inbot/releases), with notes generated from merged pull requests. This file summarizes each release.

## 0.2.1 - 2026-10-22

- Breaking: browser fill and capture now connect only to browsers the owner trusts. Register a local browser under Settings > Trusted browsers or with `inbot vault settings set --cdp-endpoints http://127.0.0.1:9222`; until then local fill and capture fail with `missing_permission`. Loopback is no longer trusted by default. Remote browsers still need an allowlisted HTTPS or WSS host.
- Credential use approvals show the browser endpoint and field selector, and capture now needs approval and serializes with fill like any other credential use.
- Inbot still cannot authenticate a CDP peer: a process that takes over a registered browser's port while that browser is stopped can receive fills. Keep registered browsers running and remove stale entries.
- With trusted authserv-ids, only the topmost trusted `Authentication-Results` header decides the `unauthenticated` label. The label still relies on the receiving provider adding its own header and stripping forged ones.
- Release archives ship Node.js 24.22.1, verified against SHA-256 pins in the packaging script.
- On Windows, the updater extracts releases with the system `tar.exe` instead of the first `tar` on PATH.
- Release updates are still verified by checksums published beside the archive and, on macOS, the Node signature. There is no independent publisher signature yet.

## 0.2.0 - 2026-10-15

- A credential vault stores logins for each inbox in the encrypted database. Agents see names and `inbot://credentials/<id>/<field>` references, never values, and every use is authorized again against the key's `credential_*` permissions and inbox scope.
Expand Down
2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "inbot-workspace",
"version": "0.2.0",
"version": "0.2.1",
"private": true,
"description": "Self-hosted, privacy-first email for AI agents.",
"keywords": [
Expand Down
Loading