From b08c0b7cd4f6172c5824dff4e643b0b7950ca603 Mon Sep 17 00:00:00 2001 From: Tugcan Topaloglu Date: Thu, 5 Mar 2026 12:35:58 +0300 Subject: [PATCH] docs: v3.0.0 release notes --- RELEASE_NOTES.md | 227 ++++++++++++++++++++++++++--------------------- 1 file changed, 126 insertions(+), 101 deletions(-) diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md index dd0f81c..7bb9eeb 100644 --- a/RELEASE_NOTES.md +++ b/RELEASE_NOTES.md @@ -1,112 +1,137 @@ +# OpenClaw Dashboard v3.0.0 - Release Notes + +## 🎨 UI & Theming + +### 🌙 Dark/Light Theme Toggle +- One-click toggle button (top-right, next to notification bell) +- Comprehensive CSS overrides for all cards, inputs, sidebar, modals +- Persistent preference via localStorage +- Light theme with clean white cards, subtle shadows, and adjusted text colors + +### 📱 Crash Counter Labels +- Crash widget now clearly labeled with "💥 Crashes" header +- "today" and "7-day" labels next to values for clarity + +### 📋 Memory Files Collapse +- Overview memory files limited to 5 items by default +- "Show all (X files) ↓" button expands the full list + +## 🛡️ Security & System + +### 🛡️ System Security Dashboard +- New "Sys Security" page in sidebar +- 5 panels: UFW rules, open ports, fail2ban status, SSH login logs, OpenClaw audit +- **Re-authentication required** — password + TOTP before access +- All command outputs HTML-escaped to prevent XSS + +### ⚙️ Config Editor +- Edit `openclaw.json` directly from the dashboard +- Client-side JSON validation before save +- Automatic `.bak.timestamp` backup before overwriting +- Gateway restart after save with confirmation dialog +- **Re-authentication required** + +### 🔒 Re-authentication Gate +- Security, Sys Security, and Config Editor pages require password + TOTP re-verification +- One verification per browser session +- Uses existing `verifyPassword()` and `verifyTOTP()` functions +- Failed attempts logged to audit trail + +## 🐳 Docker Management +- New "Docker" page in sidebar +- Container list with status indicators (🟢/🔴), image, ports +- Start/Stop/Restart buttons per container with confirmation +- Image list with repository, tag, and size +- `docker system df` overview +- Prune stopped containers and unused images +- Container ID validation: only `[a-zA-Z0-9_.-]` accepted (injection protection) +- Whitelisted actions only: `start`, `stop`, `restart`, `prune-containers`, `prune-images` + +## 🔔 Notification Center +- Bell icon opens dropdown panel with recent audit log events +- Event types: login, logout, reauth, config changes, docker actions, security views +- Icons per event type for quick scanning +- Unread badge counter with 30-second polling +- Click outside to dismiss panel +- Last-seen timestamp persisted in localStorage + +## 📊 System Monitoring + +### Temperature & Disk Sparklines +- TEMP and DISK gauges now have mini history graphs (like CPU and RAM) +- Health history saves `temp` and `disk` values every 5 minutes +- 24-hour data retention (288 snapshots) + +## 🔧 Infrastructure + +### Claude CLI Usage Scraper +- `scripts/scrape-claude-usage.sh` and `scripts/parse-claude-usage.py` included in repo +- Uses persistent tmux session for fast scraping +- Lock file prevents concurrent runs +- Fixed: `/usage` command typed fully instead of `/u` + autocomplete (Claude CLI v2.1.69 change) + +### install.sh Updates +- Removed token-based auth references (dashboard uses username/password now) +- Added `jq` and `tmux` dependency checks +- Copies scraper scripts to workspace during install +- Updated first-time setup instructions + +### Documentation +- README updated with all new features and API endpoints +- Optional dependencies table added +- "No External Dependencies" updated to "Minimal Dependencies" +- 10 new API endpoints documented + +## 🆕 New API Endpoints + +| Endpoint | Method | Description | +|----------|--------|-------------| +| `/api/reauth` | POST | Re-authenticate for sensitive pages | +| `/api/openclaw-config` | GET | Read OpenClaw configuration | +| `/api/openclaw-config` | PUT | Save config with backup + restart | +| `/api/sys-security` | GET | UFW, ports, fail2ban, SSH logs | +| `/api/docker` | GET | Containers, images, system usage | +| `/api/docker/action` | POST | Container/image actions | +| `/api/services` | GET | List systemd services | +| `/api/services/action` | POST | Start/stop/restart services | +| `/api/notifications` | GET | Audit log events | + +## ⬆️ Upgrade from v2.x + +1. Pull latest: `git pull origin main` +2. Install optional dependencies: `sudo apt install jq tmux` +3. Restart service: `systemctl restart agent-dashboard` +4. New pages appear automatically in sidebar +5. Clear browser cache if theme toggle doesn't appear (`Ctrl+Shift+R`) + +--- + +*Previous versions:* +- *[v2.0.0 — Authentication & Security Hardening](#v200)* +- *[v1.0.0 — Initial Public Release](#v100)* + +--- + # OpenClaw Dashboard v2.0.0 - Release Notes ## 🔐 Authentication & Security Hardening Major security release — the dashboard now requires authentication and includes enterprise-grade security features. -**Repository:** https://github.com/tugcantopaloglu/openclaw-dashboard +### 🆕 New Features + +- 🔑 Username/Password Authentication with PBKDF2 hashing +- 🛡️ Multi-Factor Authentication (TOTP) +- 🔒 Password Recovery via recovery token +- 🌐 HTTPS Enforcement for non-localhost connections +- Security headers (HSTS, CSP, X-Frame-Options, etc.) +- Rate limiting (5 soft / 20 hard lockout) +- Audit logging with auto-rotation + +See git history for full v2.0.0 details. --- -## 🆕 New Features - -### 🔑 Username/Password Authentication -- First visit shows a registration screen to create your account -- Passwords hashed with PBKDF2 (100,000 iterations, SHA-512, random salt) -- Server-side session tokens — passwords never stored in browser -- "Remember me" option: 3-hour persistent session vs browser-session only -- Credentials stored in `data/credentials.json` - -### 🛡️ Multi-Factor Authentication (TOTP) -- Optional MFA with any TOTP app (Google Authenticator, Authy, etc.) -- QR code scanning for easy setup -- 6-digit codes with ±1 window tolerance for clock drift -- TOTP verification required before MFA is activated -- Enable/disable from the Security page in dashboard - -### 🔒 Password Recovery -- "Forgot password?" flow using recovery token (`DASHBOARD_TOKEN` env var) -- Change password from Security page (invalidates other sessions) -- Complete account reset via SSH if needed - -### 🌐 HTTPS Enforcement -- HTTP blocked for non-localhost connections -- Localhost access allowed for local development -- `DASHBOARD_ALLOW_HTTP=true` env var to override -- Works seamlessly with Tailscale HTTPS proxy - -## 🛡️ Security Hardening - -### Critical Fixes -- **Timing-safe token comparison** — `crypto.timingSafeEqual` prevents timing attacks -- **IP spoofing protection** — only `req.socket.remoteAddress` used (no X-Forwarded-For trust) -- **No token leakage** — login response doesn't expose sensitive data - -### Security Headers (all responses) -- `Strict-Transport-Security: max-age=31536000; includeSubDomains` -- `Content-Security-Policy` with explicit directives -- `X-Frame-Options: DENY` -- `X-Content-Type-Options: nosniff` -- `X-XSS-Protection: 1; mode=block` -- `Referrer-Policy: strict-origin-when-cross-origin` - -### Rate Limiting -- Unified rate limiter for login attempts only -- 5 failed attempts → 15-minute soft lockout -- 20 failed attempts → 15-minute hard lockout -- Lockout calculated from last failed attempt - -### Other -- **CORS** — same-origin only, no wildcard -- **OPTIONS preflight** handling (204 response) -- **Audit logging** — all auth events and destructive actions logged to `data/audit.log` (auto-rotates at 10MB) -- **Atomic log rotation** — uses tmp file + rename -- **Scoped tmux kill** — only kills claude-persistent session, not all tmux -- **CSP documented** — `unsafe-inline` explained as necessary for single-file architecture - -## 🔧 Infrastructure - -### Reverse Proxy Support -- Automatic API base path detection for subpath deployments (e.g., `/dashboard`) -- Works with Tailscale serve, nginx, and other reverse proxies - -### Environment Variables - -| Variable | Default | Description | -|----------|---------|-------------| -| `DASHBOARD_PORT` | `7000` | Server port | -| `DASHBOARD_TOKEN` | Auto-generated | Recovery token for password reset | -| `WORKSPACE_DIR` | `~/clawd` | OpenClaw workspace path | -| `OPENCLAW_DIR` | `~/.openclaw` | OpenClaw config directory | -| `DASHBOARD_ALLOW_HTTP` | `false` | Allow HTTP from non-local IPs | - -### install.sh Updates -- Token setup during installation (custom or auto-generated) -- Token saved to systemd service environment -- Displays login instructions after install - -## 📝 Documentation -- Comprehensive README with MFA guide, password recovery, and troubleshooting -- Security features documented in detail -- API reference for authenticated vs unauthenticated endpoints - -## ⬆️ Upgrade from v1.x - -1. Pull latest: `git pull origin main` -2. Restart service: `systemctl restart agent-dashboard` -3. First visit will show registration screen — create your account -4. (Optional) Enable MFA from Security page -5. Share recovery token with yourself (check `journalctl -u agent-dashboard`) - -**Breaking changes:** -- Authentication is now required for all API endpoints -- Old bookmarks to dashboard will show login screen -- `DASHBOARD_TOKEN` env var is now used as recovery key (not login token) - ---- - -*Previous: [v1.0.0 — Initial Public Release](#v100)* - # OpenClaw Dashboard v1.0.0 -Initial public release with session management, cost analysis, live feed, memory viewer, system health monitoring, and more. See git history for details. +Initial public release with session management, cost analysis, live feed, memory viewer, system health monitoring, and more.