Compared to `v2.2.22`. - Added remote MCP support with OAuth-based access control. - Reworked permissions from list-style scopes to view/detail based discoverability. - Hardened daemon enrollment, daemon transport, OAuth, setup, rate limiting, and update trust. - Added signed update artifact verification for Gateway and daemon updates. - Improved Docker deployment/container management, registry auth hardening, cleanup behavior, and mobile UX. - Reworked Settings into Preferences, Gateway settings, and Features tabs. - Added broad API E2E coverage for existing-deployment validation. - Enforced strict pinned node enrollment: daemons verify the Gateway gRPC certificate fingerprint before first enrollment. - Enforced TLS for daemon gRPC server connections and tightened daemon stream authorization. - Bound daemon control/log streams to authenticated node identity. - Added signed update trust using repository-stored public trust anchors and CI-provided signing keys. - Hardened Gateway and daemon update verification from checksum-only workflows to signature-verified artifacts. - Changed Redis-backed rate limiting to fail closed on limiter/storage errors. - Added client IP source controls for direct, reverse proxy, and Cloudflare deployments. - Added trusted proxy CIDR handling and request IP validation. - Hardened OIDC account binding and OAuth callback handling. - Locked setup endpoints after Gateway setup is complete. - Hardened unauthenticated/public endpoints to fail closed when protective dependencies are unavailable. - Hardened Docker registry bearer realm exchange and trusted auth realm handling. - Added raw nginx validation bypass as an explicit permission-gated capability. - Added Docker socket mount guardrails and permission checks. - Removed legacy global nginx management surfaces and kept node-specific nginx management paths. - Removed stale security audit artifacts from the repository. - Removed canonical `*:list` scopes. - Lists now derive visibility from `view`/`details` access. - Resource-scoped view/detail grants now list only visible resources. - Added missing view-oriented scopes for domains, proxy templates, Docker resources, logging tokens, and related surfaces. - Added folder-management scopes for proxy folders and Docker container folders. - Added startup cleanup for invalid/stale scopes in permission groups. - Added migration cleanup for stored obsolete list scopes. - Updated backend/frontend scope implication logic and tests. - Updated API token and OAuth scope metadata to match the new model. - Updated route guards, sidebar visibility, command palette visibility, and page guards for resource-scoped access. - Added OAuth PKCE application support and consent/error pages. - Added OAuth client registration restrictions with loopback defaults and extended compatibility setting. - Added consent-screen warning for external callback URLs. - Added remote MCP server routes, prompts, resources, tools, and auth middleware. - Added MCP enable/disable Gateway setting. - Added MCP audit integration for AI/tool activity. - Added OAuth applications management in Settings. - Improved API token scope selector behavior and mobile layout. - Added stricter programmatic API surface validation and tests. - Added shared daemon update trust verification package. - Added update trust anchor config and sync script. - Added daemon-side signature verification for self-updates. - Added Gateway-side update artifact trust verification. - Added stricter daemon enrollment certificate and identity handling. - Added gRPC server certificate helpers and tests. - Updated nginx, Docker, and monitoring daemon lifecycle/config behavior. - Updated daemon setup scripts with secure defaults. - Added daemon tests for enrollment, update auth, lifecycle, and TLS behavior. - Added Docker image cleanup settings separate from webhook settings. - Added cleanup support after manual recreate and deployment update flows. - Added cleanup websocket update events. - Improved Docker webhook settings and removed unnecessary webhook enable/disable toasts. - Added Docker registry trusted auth realm support. - Hardened Docker registry auth challenge handling. - Added Docker mount editing scope and socket-mount protection. - Improved Docker task state handling. - Improved Docker container/deployment settings tabs and mobile detail headers. - Added responsive header actions for Docker detail pages. - Improved Docker folder visibility and folder-management permission behavior. - Improved Docker pages for view-scoped access. - Added Docker API and service tests for registries, cleanup, mounts, tasks, folders, and scoped access. - Added raw nginx visibility and validation-bypass permission handling. - Improved proxy config permissions. - Updated proxy host list/detail/folder visibility to use `proxy:view`. - Added scoped visibility behavior for proxy grouped/folder APIs. - Added proxy template view/edit/delete scope support. - Removed legacy global nginx monitoring/config routes and frontend page. - Preserved node-specific nginx monitoring/config/log behavior. - Added proxy route, folder, template, and raw visibility tests. - Improved database console permissions and query gating. - Added database tags with optional predefined colors via `color:tag` syntax. - Improved database list tag display with responsive tag count and `+N` tooltip. - Stabilized database list ordering. - Improved PostgreSQL explorer mobile controls. - Improved database detail mobile header actions. - Added database route/schema/service coverage. - Improved logging cleanup behavior. - Improved logging token UI and permission checks. - Updated logging list routes to use view scopes. - Improved audit controls and mobile layouts. - Improved audit context handling. - Updated notification list access to view/manage scopes. - Updated status page access checks and settings behavior. - Added logging rate-limit and route tests. - Added optional AI assistant improvements for tools, websocket behavior, and audit/MCP integration. - Added AI access modal and tool access updates. - Added AI setting placement under the new Features tab. - Added AI store/session reset hardening. - Added AI route, websocket, and tool tests. - Reworked Settings page into three tabs: - Preferences: profile, preferences, API tokens, OAuth applications. - Gateway settings: Gateway settings, Docker registries, about/update, license. - Features: AI settings, status page, housekeeping. - Split Gateway settings into smaller blocks: - Identity provisioning. - OAuth and MCP access. - Network trust. - Outbound webhook policy. - Added reusable responsive header actions. - Fixed mobile confirmation dialog availability. - Fixed tab switching so page-level loading/animation does not replay unnecessarily. - Improved mobile layouts across Docker, database, audit, tokens, OAuth apps, and detail pages. - Added stable URL-tab behavior helpers. - Improved session reset behavior for auth-sensitive client state. - Removed stale root gateway image and updated NOTICE. - Updated Gateway logging SDK API. - Bumped logging SDK release to `1.1.1`. - Improved logger queue behavior and tests. - Updated logging SDK README/package metadata. - Adjusted CI so logging SDK build/deploy runs only when that package changes. - Refreshed README files and roadmap. - Added/updated docs for security, operations, installation, development, capabilities, nodes, and licensing. - Updated `SCOPES.md` for view-based permissions and removed list-scope documentation. - Added update trust documentation. - Added backend API E2E README. - Removed stale workflow/spec docs that no longer describe the current implementation. - Added backend API E2E suite for broad existing-deployment validation. - Added focused backend coverage for auth, OAuth, MCP, setup, permissions, Docker, proxy, PKI, logging, nodes, rate limits, updates, and gRPC. - Added frontend tests for scope lists, OAuth consent, auth/session reset, Docker node access, mobile/detail behavior, and related pages. - Added health history compaction migration and tests. - Updated CI, package scripts, dependency audit fixes, and lockfile state. New migrations included in this release: - `0026_permission_scope_cleanup.sql` - `0027_oauth_mcp.sql` - `0028_programmatic_api_surface.sql` - `0029_compact_health_history.sql` - `0030_remove_list_scopes.sql` - `0031_docker_registry_trusted_auth_realm.sql` - `0032_docker_image_cleanup_settings.sql` - Existing stored `*:list` grants are removed, not converted to view grants. Administrators should review custom permission groups after upgrade. - Daemon update trust now requires signed artifacts. CI/CD must provide the configured update signing private key for release artifact signing. - Existing enrolled nodes can continue operating, but future daemon update/enrollment paths use the hardened trust model. - Setup endpoints return unavailable/not found behavior after Gateway is configured. - OAuth clients default to loopback callback restrictions unless extended compatibility is enabled. - Legacy global `/api/monitoring/nginx/*` management routes are removed; use node-specific nginx routes instead. - Docker image cleanup is now a separate setting from webhook configuration.