Reframe docs, OpenAPI registries copy, and License trial/expiry helpers
so Community is the full AGPLv3 product and Admiral leads with current
assurance (Hardened Build, Recovery Vault, support, governance).
Mesh, Secrets, and Host Console stay limited-availability without
Admiral sales framing.
* docs: align README and overview docs with current AGPLv3 tier model
Community is now described as the complete free product, with a single
consolidated Admiral section replacing scattered per-bullet tags that had
drifted out of sync with the actual gates (security scanning, private
registries, and most of RBAC/audit moved to Community over time). Remove
promotion of Sencho Mesh, Fleet Secrets, and Host Console, which are no
longer discoverable by default. Align the Fleet Secrets, Host Console, and
Sencho Mesh sections in the features overview with the limited-availability
framing already used elsewhere on that page.
Refresh every README screenshot to the current UI and add new captures for
Security, Blueprints, Scheduled Operations, and Compose Doctor.
The introductory tier-framing sentence and docs navigation placement for the
now-hidden surfaces are intentionally left for a later, dedicated pass once
the Admiral positioning work settles.
* docs: restructure README around the open-source Community product
Drop "What Sencho is not (yet)", fold its known-limitations pointer into
the Documentation section. Rewrite Telemetry and data handling to drop the
Admiral license-validation detail, since this file is the open-source
entry point and Admiral customers work from their own agreements. Move
the Admiral section to just before Documentation, community, and license
so the README leads with the Community product throughout.
* docs: relicense Sencho to AGPLv3 and reframe Community positioning
Replace BSL with AGPLv3 for the public Community product, update contributor
and licensing copy for Community-focused contributions, and surface source
and license links in Settings About.
* docs: clarify CLA scope and Community contribution framing
* fix(ui): split About link constants and harden AboutSection test selectors
* feat: move core Blueprint orchestration to Community tier
Blueprints CRUD, reconciliation, and drift modes are now available on
Community. Pin remains Admiral-only via Federation placement controls.
* feat: move Federation placement controls to Community tier
Remove requirePaid from cordon, uncordon, and blueprint pin routes. Ungate the Federation tab and gate cordon UI on node:manage only. Update licensing and fleet docs for the new tier split.
Adds the github key to FUNDING.yml and links GitHub Sponsors from README and SUPPORT so both channels are visible; the org still needs to complete GitHub's Sponsors onboarding for the button to render.
Sencho exits public beta after a clean v0.92.0 QA pass. Replace the global
"public beta on the path to v1.0" callout with scoped maturity language across
the README, KNOWN_LIMITATIONS, quickstart, troubleshooting, upgrade, and the
security-architecture reference. The copy stays honestly pre-1.0 and avoids a
blanket "stable" claim.
Reframe the Scale limitations to credit QA, audit, and end-to-end validation
while keeping the honest caveat that large-scale performance is not yet
benchmarked.
Fold the new v0.92.0 capabilities into the README sections: Compose Doctor
preflight checks, health-gated updates with stalled-update recovery, file
move/rename in the explorer, ordered multi-file Compose for Git sources, the
Security overview, on-demand node-wide scans, the Compose network inspector
with an exposure-intent guard, scan policy packs, documentation-drift flags,
and configurable image-update cadence with registry/source links.
* feat(pricing): collapse to two tiers (Community + Admiral)
Collapse Sencho's pricing from three tiers (Community / Skipper / Admiral)
to two: a generous free Community tier and a single paid Admiral tier. The
Skipper tier is removed.
Now free in Community: auto-heal, auto-update, scheduled operations,
webhooks, notification routing, Fleet Actions and bulk operations, SSO
preset providers (Google / GitHub / Okta), unlimited users with admin and
viewer roles, and deploy safety (atomic deploys, auto-rollback, and
one-click rollback).
Admiral (paid) is focused on running and governing a fleet: blueprints,
Fleet Secrets, deploy enforcement, vulnerability report export, audit log,
host console, private registries, mesh networking, node cordon, managed
cloud backup, LDAP / Active Directory SSO, and the advanced RBAC roles
(deployer, node-admin, auditor) with per-resource scoped assignments.
Internally the license variant distinction is removed so tier is binary
(community / paid). License validation still verifies the Lemon Squeezy
store and product before granting paid status.
Docs and the contributor guide are updated to the two-tier model.
* docs(pricing): correct licensing page to two-tier pricing and tidy stale tier wording
The licensing docs page kept the old Admiral pricing plus a Founder
Lifetime column and an Enterprise paragraph after the two-tier collapse.
Update it to $12/month or $99/year, drop the lifetime and Enterprise
content, and link to the pricing page for current pricing.
Also fix stale "Skipper" wording in CLA.md, SUPPORT.md, one test title,
and three test comments. Historical CHANGELOG entries and the
retired-Skipper license-guard test are intentionally left as-is.
* docs: align licensing and SSO pages with the two-tier model
Correct the SSO overview so the Google, GitHub, and Okta presets read as
available on every tier, matching the provider table; only LDAP and Active
Directory require Sencho Admiral. Remove the lifetime-plan references from the
licensing, settings, and troubleshooting pages so they reflect subscription-only
Admiral pricing.
* fix(rbac): omit scoped permissions from /me on the Community tier
Scoped role assignments only take effect on the paid tier, but GET /api/permissions/me returned them unconditionally, so a downgraded instance with leftover assignments rendered per-resource affordances the API then rejected with 403. The endpoint now mirrors the permission middleware and includes scoped permissions only on the paid tier. Adds a regression test covering the downgrade case.
* docs: use custom-pricing wording on the contact page
The two-tier model has no Enterprise tier; reword the contact page's enterprise pricing/deals to custom pricing/deals so it does not imply a tier that no longer exists.
Add a consolidated Recovery page that answers "what do I do if Sencho
breaks?" in one place. It covers getting back to a working state when
Sencho itself fails, a stack deploy fails, an admin is locked out of
sign-in, Docker is unavailable, or a remote node is unreachable, and
summarizes each path with a link to the authoritative detail page rather
than duplicating it.
The page opens by stating the core safety fact: Sencho keeps its state in
DATA_DIR and COMPOSE_DIR and treats compose files on disk as the source of
truth, so recovery is mostly file-level and running containers are
unaffected by a Sencho outage. It points to Backup & Restore as the
prerequisite.
Link the guide from the README documentation section, the quickstart
"where to next" cards, and the top of the troubleshooting page.
Close the trust-blocking items from the pre-v1.0 readiness audit so the
repository is ready for the first public posting. No backend or
frontend code changes; no tier gates move.
README:
- Add a single beta-status GitHub [!NOTE] callout below the dashboard
image. Beta status also appears in selected install-flow docs
(Quickstart, Known Limitations, Security Architecture, Upgrade,
Troubleshooting) so install-flow readers are not surprised.
- Add a "Before you install" subsection that names the docker.sock
privilege model with the Portainer / Dockge / Komodo comparison.
- Fix the docker run example: add the missing /opt/docker:/opt/docker
mount that COMPOSE_DIR=/opt/docker depends on.
- Reword the two "no exposed Docker socket" sentences so the claim is
scoped to remote / cross-node exposure.
- Reword "transparent HTTPS proxy" to "authenticated HTTP and WebSocket
proxy" with a TLS / VPN reminder.
- Fix the RBAC bullet: the role set is admin, viewer, deployer,
node-admin, auditor. There is no "editor" role.
- Add tier markers to the Capabilities list (matrix sentence plus
per-bullet (Skipper) / (Admiral) markers), verified against the
route guards in backend/src/routes/.
- Fix the broken notification-routing link to point at the existing
alerts-notifications#notification-routing anchor.
- Soften the BSL paraphrase to point at LICENSE plus the license FAQ.
- Add a "Telemetry and data handling" section: no telemetry, no
analytics, no crash reports; license validation only when a paid key
is activated.
- Add a "What Sencho is not (yet)" section so the scope boundaries are
visible above Capabilities.
Templates:
- PR template: drop the contradictory CHANGELOG checkbox; release-please
owns CHANGELOG.
- Bug report template: update the stale 0.2.2 version placeholder to
0.86.6 and add fields for compose snippet, container logs, browser
console, and an involved-subsystems checkbox.
Docs:
- docs/operations/trivy-setup.mdx: replace both sencho/sencho:latest
occurrences with the published image saelix/sencho:latest.
- docs/reference/settings.mdx: rewrite the API Tokens Note (no tier
gate in code; admin role only) and the Stack Labels Note (basic
CRUD is free; only bulk actions require Skipper or Admiral).
- Add the shared beta-status Note callout to docs/getting-started/
quickstart.mdx, docs/operations/upgrade.mdx, docs/operations/
troubleshooting.mdx, and docs/reference/security.mdx.
CONTRIBUTING:
- Replace the public link to the in-repo coding-rules file with a
pointer to docs.sencho.io for architecture deep-dives.
- Fix the sample clone URL case (Sencho.git becomes sencho.git).
New files:
- SUPPORT.md: where to ask, response-time expectations, in / out of
scope.
- KNOWN_LIMITATIONS.md: scale, platform, architecture, and feature
limits documented for the beta audience; scale numbers marked "not
benchmarked yet" pending real benchmarking.
New hero with light and dark logo via <picture>, fresh production
screenshots (dashboard hero plus four-image gallery covering stacks,
editor, fleet, and logs), tighter capability list grouped by surface,
compose-first quick start with TLS reverse-proxy callout, dedicated
remote-nodes section, and a combined documentation/community/license
footer. Also adds .github/FUNDING.yml pointing at the Buy Me a Coffee
page so the Sponsor button surfaces on the repo page.
README: rewrite to lead with differentiation rather than a flat
feature list. Add "Why Sencho?" section covering the four key
competitive advantages (Pilot Agent NAT traversal, auto-heal
self-healing, atomic deployments, automation-first model). Expand
feature coverage from 8 bullets to six grouped domains reflecting
the full 38-feature surface. Add architecture note, docker run
one-liner, tier comparison table (Community/Skipper/Admiral), and
docs link section. Drop stale CI badge; add Docker Pulls badge.
CONTRIBUTING: add project layout reference, tier-gate usage guide,
TypeScript strictness reminder, and pointer to CLAUDE.md for full
coding standards.
SECURITY: update supported versions table from stale "0.2.x+" to
current "latest release" policy with a note on self-hosted update
cadence.
Updates the backend listen port, Vite dev proxy target, Docker EXPOSE,
compose port mapping, .env.example default, GitHub Actions smoke-test
default, healthcheck URLs, and every doc/example reference. Test fixtures
that include example URLs were updated for consistency, though their
assertions are port-agnostic.
The rate-limit value of 3000 in middleware/rateLimiters.ts and the
3000 entry in WEB_UI_PORTS (which detects user containers like Grafana)
are intentionally untouched.
* feat: add RBAC viewer accounts, atomic deployments, and fleet-wide backups (Pro)
Introduces three Pro-tier features:
- RBAC: Multi-user system with admin/viewer roles, user management UI,
automatic migration from single-admin credentials, viewer restrictions
across the entire UI (read-only editor, hidden action buttons)
- Atomic Deployments: Pre-deploy file backup to .sencho-backup/, automatic
rollback on health probe failure, manual rollback button, health probes
added to stack updates, webhook-triggered deploys use atomic rollback
- Fleet-Wide Backups: Point-in-time snapshots of compose files across all
nodes (local + remote), stored centrally in SQLite, per-stack restore
with optional redeploy, graceful handling of offline nodes
* fix(settings): use correct ProGate prop name in UsersSection
* fix(settings): remove unused isPro prop from UsersSection
* fix(auth): fetch user info after login and setup so isAdmin is set correctly
* feat(pricing): revise pricing strategy and enforce variant-based seat limits
Raise Personal Pro from $49/yr to $69/yr with 3 viewer seats (up from 1).
Add $15/mo billing option for Team Pro. Mark lifetime pricing as a
90-day early-adopter offer. Store Lemon Squeezy variant_name on
activation/validation and enforce seat limits server-side per variant.
* feat(licensing): add Lemon Squeezy checkout, webhook, and billing portal integration
Server-side checkout URL generation (POST /api/checkout) with admin email
pre-fill and instance_id custom data. HMAC-SHA256 verified webhook endpoint
(POST /api/webhooks/lemonsqueezy) handling order, subscription, and payment
lifecycle events for automatic license activation. Customer billing portal
link stored from webhook events and exposed via GET /api/billing/portal.
In-app checkout buttons in Settings with manual license key fallback.
* fix(licensing): exempt Lemon Squeezy webhook from auth middleware
The catch-all auth middleware on /api/* was blocking the public webhook
endpoint. Added /webhooks/lemonsqueezy to the exemption list alongside
/auth/* and /webhooks/:id/trigger.
* feat(pricing): update pricing to final live rates
Personal Pro: $7.99/month, $69.99/year, $249 lifetime.
Team Pro: $49.99/month, $499.99/year, $1,499 lifetime.
Added personal_monthly checkout variant across backend, frontend, and website.
* refactor(licensing): remove server-side checkout/webhook for self-hosted model
Sencho is self-hosted — each user runs their own instance, so there is
no central server to receive webhooks or hold the store API key. Replaced
in-app checkout buttons with a "View Pricing" redirect to sencho.io and
kept manual license key activation as the primary flow.
- Delete LemonSqueezyService (checkout, webhook, HMAC verification)
- Remove POST /api/checkout, GET /api/billing/portal, POST /api/webhooks/lemonsqueezy
- Remove raw body parser and auth exemption for webhook route
- Remove all LEMONSQUEEZY_* env vars from .env.example
- Replace checkout buttons in SettingsModal with single "View Pricing" button
- Simplify LicenseContext checkout to open sencho.io pricing page
- Update licensing docs to reflect website-based purchase flow
* chore: normalize em-dashes to hyphens across codebase (linter)
* chore: remove accidentally tracked directories from index
* chore: add comprehensive .gitignore
* ci: update CI workflow for GitHub Flow
- Change triggers from develop to main (PRs to main + pushes to main)
- Add concurrency controls to cancel stale runs
- Update docker/build-push-action to v6
- Add descriptive job names for branch protection status checks
- Update screenshot refresh and docs sync to trigger on main pushes
* ci: update docker-publish for GitHub Flow
- Remove develop branch trigger (no more dev tag)
- Keep v* tag trigger for releases
- Update docker/build-push-action to v6
* docs: add community and governance files
- CONTRIBUTING.md with dev setup and PR guidelines
- SECURITY.md with vulnerability reporting policy
- CODE_OF_CONDUCT.md (Contributor Covenant v2.1 reference)
- PR template with conventional commits checklist
- Issue templates for bug reports and feature requests
- CODEOWNERS defaulting to @AnsoCode
- Dependabot config for npm (root, backend, frontend) and GitHub Actions
* docs: add README with badges, quick start, and contributing section
* chore: add LICENSE placeholder and open license decision issue (#100)
* docs: update CLAUDE.md for GitHub Flow branching model
- Replace develop-based Git Flow with GitHub Flow (main only)
- All branches now created off main, PRs target main
- Simplify release checklist (no develop-to-main merge step)
- Update testing strategy to reference Vitest and Playwright
- Fix docs.json reference (was mint.json)
* chore: track CLAUDE.md in version control
Remove CLAUDE.md from .gitignore so project workflow instructions
are versioned alongside the code they govern.
* docs: add MANUAL_STEPS.md for GitHub settings that require UI configuration
Anso