- Added support for an official all-in-one Docker image (`ghcr.io/unitronix/betterdesk`) as the default installation method.
- Updated installation scripts and documentation to reflect the new single container layout.
- Retained legacy two-container layout option for backward compatibility.
- Adjusted API port from `21114` to `21121` for the new layout.
- Enhanced Docker-related scripts and configuration files to support the new structure.
- Updated various language files to ensure consistency in messaging regarding Docker deployment.
Add inline CodeQL suppressions for MeshAgent TLS pin and EJS layout body, and exclude those files from analysis so alerts #280 and #281 clear on the next scan.
Bump support-agent Go deps, harden relay recording paths and clipboard HTML stripping, update agent-client Rust lockfile, and extend CodeQL/Dependabot config for known upstream limits.
Remove internal LAN IP, SSH user, and developer paths from docs and examples; move deploy runbook to gitignored docs/private with a public template; drop Cursor debug logging leftovers; add CI checks to prevent regression.
Co-authored-by: Cursor <cursoragent@cursor.com>
Added a compatibility layer for MeshCentral, including a native Go implementation of key endpoints and a unified inventory for mesh agents. Enhanced the UI with new actions for mesh agents, such as terminal access and file management. Updated localization for mesh features and introduced new styles for mesh terminal overlays. Integrated interop testing for simulated and live MeshAgent connections.
Deleted the obsolete build workflow for BetterDesk and made adjustments to the CI configurations across multiple workflows. This includes changing permissions from write to read in the release-client and secret-scan workflows, updating the Node.js setup in the web-nodejs CI, and enhancing the rate limiting for RdClient pages. Additionally, improved the handling of return URLs in the auth middleware and added new utility functions for better security and logging.
Batch peer status writes, skip heartbeat rate limits for known peers, CDAP session cleanup on disconnect, relay WS conn limits, Postgres query timeouts, org login throttling, and CI with go test -race.
Document safePath consumers, escaped chat/cdap DOM updates, test harness,
and dev-only i18n audit script in codeql-config.yml for PR gate parity.
Refs #196
Use plainBodyObject() for device file read API to avoid array .length
tampering; rate-limit ticket DELETE; document intentional sanitizers in
codeql-config.yml for branding, fonts, network monitor, and server paths.
Refs #196
Updated CodeQL configuration to exclude additional paths for security checks. Introduced a new file access rate limiter to prevent abuse of file download endpoints. Improved path resolution functions to ensure confined access and added validation in body scalar functions to reject non-scalar types. Enhanced error handling in API endpoint validation to prevent invalid inputs.
Stop logging generated admin passwords, redact API login usernames,
confine font and file-transfer temp paths with safePath, and scope
GitHub Actions permissions in build.yml.
Introduce bump-version.js with CI workflows for patch bumps on dev and
stable releases on main, plus panel and installer UI to choose stable vs
development GitHub update branches.
Existing Docker volumes crashed at startup because ensureAuthTables indexed
token_hash before the column existed on upgraded auth.db files. Bump images to 3.0.0.
Use npm install without a lockfile in CI, treat root-owned installer scripts as non-critical update failures, and skip privileged H-7 hooks when betterdesk already exists without sudo.
Hash RustDesk access tokens at rest (phase 1), add SSRF guards for admin network tools with LAN monitoring support, run dedicated console service user on Linux, and hook post-update verification plus service patching into both betterdesk.sh and the in-app updater.
The panel updater assumed a native install with Go source on disk. In
Compose/GHCR mode it now uses the embedded image commit, clears stale
binary markers, and directs operators to pull new container images instead.
- Implemented a conditional staging process for the Go support-agent source during updates, creating a rebuild flag for generator bundles.
- Added functions to handle the requeuing of builds and marking rebuilds as pending, improving the update workflow.
- Updated the update service to stage support-agent files and trigger rebuilds after in-app updates.
- Removed the obsolete GitHub Actions workflow for the support agent, streamlining CI/CD processes.
- Added audio stream handling to the agent, including support for audio start and stop messages.
- Introduced lifecycle callbacks for consent and session management in the agent configuration.
- Updated desktop handling to utilize new consent handler and session start/end callbacks.
- Improved UI to reflect enrollment status and consent requests, enhancing user experience.
- Refactored branding structure to include additional color properties for better theming.
Desktop client is still in development. Version tags (v*) now only
trigger Docker image publish (server, console, all-in-one). Desktop
builds remain available via manual workflow_dispatch.
Co-authored-by: Cursor <cursoragent@cursor.com>
Wire docker-publish to git tags v*, workflow_dispatch tag input, and
semver prereleases; pin quick-start compose to 3.0.0-alpha by default.
Co-authored-by: Cursor <cursoragent@cursor.com>
updateService.js: distinguish critical vs non-critical failures in SHA tracking. Server binary compile/download failures are non-critical — SHA is saved so the same update is not shown again on restart. update-cli.js: match same logic, non-critical failures don't set exit code 1. betterdesk.sh: new update_from_github() with git clone + tarball fallback, 3-method menu. betterdesk.ps1: new Update-FromGitHub with git clone + ZIP fallback, 3-method menu. betterdesk-docker.sh: new update_docker_from_github() with 2-method menu.
This commit was made possible thanks to Insolve.
Add mandatory commit convention to .github/copilot-instructions.md so future AI-generated commits always include the 'This commit was made possible thanks to Insolve.' footer.
This commit was made possible thanks to Insolve.
- deployServerBinary: use rename(2) for atomic replace, fixes ETXTBSY
when target Go binary is busy (Linux kernel handles inode swap).
Falls back to copyFileSync on cross-device rename or non-Linux.
Windows: rename target out of the way first, then move new in.
- settings.js: mark 'server' phase as error when build succeeded but
deploy failed (was incorrectly marking 'done' from build alone).
- settings.js: completion modal now shows error title, error message
and pre-formatted stderr when serverDeploy.success === false.
- i18n: added complete_with_errors, modal_done_with_errors_title in
en/pl.
Use the layout-provided CSRF token (window.BetterDesk?.csrfToken) instead of a non-existent meta tag. This fixes failing PUT requests for organization policy saves (Issue #112), and resolves attestation verify/revoke failures. Also replace toolkit's cached meta lookup with a getCsrfToken() helper so API calls always read the current token. Updated .github/copilot-instructions.md to document the Phase 53 CSRF fixes.
Adds a full Phase-52 RBAC implementation and multiple server/frontend fixes. Key changes: new auth/permissions.go with 28 granular permissions and DefaultRolePermissions, expanded 7-role hierarchy and helpers in auth/roles.go, JWT org context and GenerateOrgToken, requirePermission/requireOrgMembership middlewares (Go + Node.js), DB schema & adapter changes for role_permissions and is_server_admin, org role boundary checks and peer org scoping, and guards for last-admin demotion and self-demotion. Also: TCP EOF/connection-reset log filtering in signal/relay servers, improved startup banner port display, KEYS_PATH auto-detect warning, CSS hover/transition layout fixes, admin password race mitigation, ID-change ghost peer cleanup, added Tauri ACL schema files, and a new RBAC_PHASE52.md doc. Misc: numerous web-nodejs i18n, CSS, JS and route updates and an updated .github/copilot-instructions.md timestamp/summary.
Introduce a SessionManager for relay-based remote sessions in the Tauri MGMT client: new SessionCommand API, start/stop/session input routing, clipboard/recording/quality controls, and notification read/dismiss state. Wire AppState with new mutexes and show main window on startup. CI: add SBOM generation (anchore) and Trivy vulnerability scan steps. Misc: change console Docker DB path, large README/CHANGELOG updates (chat E2E, unattended access/WOL, i18n expansion, CDAP/SDK docs), and many web-nodejs assets/locales/routes/views/services and server-side changes.
Introduce two new desktop apps: betterdesk-mgmt (operator/admin console) and betterdesk-agent-client (lightweight endpoint agent).
Key changes:
- Add complete betterdesk-agent-client scaffold: frontend (index.html, TSX components, i18n, styles, Vite/TS configs, package.json) and Rust Tauri backend (Cargo.toml, build.rs, tauri.conf.json, commands.rs, config.rs, registration.rs, sysinfo_collect.rs, NSIS language file).
- Add betterdesk-mgmt entries and assets (registered in docs) and update repo docs to describe both MGMT and Agent clients.
- Update .github/copilot-instructions.md to reflect MGMT/Agent client split and add detailed TODO/feature lists.
- Update .gitignore to exclude build artifacts for both new Tauri apps.
- Add docs/new_agents/client1.md and docs/new_agents/client2.md.
- Minor changes to server DB files and web-nodejs i18n/asset files.
This commit adds the initial scaffolding and core IPC/registration/diag features for the agent and registers the MGMT client in repository docs; further implementation and testing remain.
Add multiple security hardenings across the server and web console: enforce proof-of-possession for /ws/bd-mgmt using Ed25519-signed headers with timestamp/nonce and replay protection (public key binding, canonicalization, storage, verification, and tests); remove legacy API key query param and config-table fallback in favor of scoped api_keys (migrate bootstrap key into api_keys); tighten WebSocket origin handling for relay and signal servers to allow only localhost origins by default unless an explicit allowlist is set; update auth middleware public paths and test helpers to use X-API-Key header; add ensureScopedAPIKey migration and related helpers; add a GitHub Secret Scan workflow and an audit report. Misc: propagate audit logging on bd-mgmt connect/disconnect and validate enrollment public keys during device register.
Add unit tests and test helpers (5 suites, 41 tests) and test npm scripts; introduce deviceStatusPush service and WS real-time device status push integration. Fix chatRelay to acknowledge connections (send `welcome`), and apply multiple web remote/rdclient fixes (video ack/timing, keyframe refresh, SourceBuffer trimming, input focus handling) to improve FPS and control. Add new server route file (system.routes.js), new device-status service, update server.js and package.json, and modify various frontend CSS/JS/views. Update English and Polish locale files with many new widget/i18n keys and remove the Russian locale file (ru.json). Also include assorted UI/desktop-widget dashboard tweaks and documentation status updates in .github/copilot-instructions.md.
Prevent breaking RustDesk clients by keeping the API port HTTP-only and removing automatic API TLS: update APITLSEnabled logic (config.go) and remove/add-removal of -tls-api / -force-https from install scripts and service updates (betterdesk.sh, betterdesk.ps1). Fix systemd escaping for admin password and PostgreSQL URL by converting $ → $$ before writing ExecStart/Environment so credentials with $ are preserved. Add MainThread to port diagnostic patterns to avoid false positives for Node.js on newer Linux (betterdesk.sh). Also include minor struct/tag formatting and response key alignment in CDAP Go code and update changelog and copilot instructions. These changes restore client compatibility, harden installer/service writes, and improve diagnostics.
Introduce full CDAP subsystem and devices UI overhaul. Adds a new CDAP WebSocket gateway (cdap/gateway.go) with auth, connection lifecycle, message loop, heartbeat monitor and APIs (cdap/api.go, cdap/auth.go, cdap/handler.go, cdap/manifest.go, cdap/messages.go). Wire CDAP into the server (api/server.go + handlers in api/cdap_handlers.go) exposing REST endpoints for status, device list, info, manifest, state and sending commands. Enhance peer handling: CDAP-connected overlay in peer list/get, device revocation/cascade support in handleDeletePeer (blocklist, connection teardown, events + audit), and new audit action ActionPeerRevoked. Frontend updates include CDAP device page, widgets, commands, styles and services; major devices page UI redesign (responsive folder chips, toolbar, slim table, kebab menu) plus related CSS/JS/views, translations, docs and assets. Overall adds CDAP features, revocation workflow, and a responsive devices UI.
UNITRONIX