Changelog

[1.1.1] - 2026-02-26

Added

• Full macOS Support: ClawBridge is now officially compatible with macOS (Intel/Apple Silicon).
• Service Management (Launchd): Support for macOS launchd via .plist agents for background execution and auto-restart.
• Cross-Platform CI: Automated tests and lint now verify stability on both Linux and macOS.

Fixed

• Network Compatibility: Resolved issues with hostname -I by implementing a multi-fallback logic (ip route -> hostname -> ifconfig), ensuring reliability on Alpine Linux, WSL, and macOS. (Special thanks to @StewartLi666 for the feedback)
• Sed Compatibility: Fixed script errors caused by sed -i differences between GNU/Linux and BSD/macOS.
• VPN & Networking: Fixed VPN interface detection and service restart logic for macOS.
• Quick Tunnel Reliability: Improved reliability when fetching and displaying Cloudflare Quick Tunnel URLs after updates.
• Systemd Log Hint: Corrected journalctl command hints to accurately reflect user-level vs system-level services.

Added

• parse git history for omitted commits in changelog generation
• New Full-screen Login Page with modern UI and breathing background.
• Notice overlay for legacy magic link attempts.
• Brute-force protection: max 10 login attempts per IP per 60s.
• Mandatory confirmation for high-risk endpoints (/api/kill).
• Rate limiting for destructive endpoints.
• Jest + Supertest test suite with unit and API integration tests. (Thanks @yaochao for suggesting #7)
• ESLint + Prettier code style enforcement. (Thanks @yaochao for suggesting #7)
• GitHub Actions CI workflow running tests and lint on every push. (Thanks @yaochao for suggesting #7)
• Split public/index.html into separate public/css/dashboard.css and public/js/dashboard.js for maintainability. (Thanks @yaochao for suggesting #3)
• Display dashboard URL as terminal QR code after installation for instant mobile scanning. Uses qrencode CLI if available, falls back to qrcode-terminal npm package, silently skips if neither is present. (Thanks @斯图超哥 for suggesting #12)

Fixed

• Security: Replaced URL query auth with HttpOnly cookie-based sessions. (Thanks @yaochao for reporting #1)
• Security: Added safeguards for remote endpoints. (Thanks @yaochao for reporting #2)
• Bug: Improved error handling and removed silent catch blocks. (Thanks @yaochao for reporting #4)
• Bug: Removed hardcoded paths for better environment portability. (Thanks @yaochao for reporting #5)
• Bug: Improved stability in context reading when session files are missing.

Changed

• Refactored installer (setup.sh) to remove magic link output in favor of secure login.
• Refactored: split monolithic index.js (~600 lines) into modular src/ directory. (Thanks @yaochao for suggesting #3)
• Replaced wget with Node.js native https module for binary downloads. (Thanks @yaochao for reporting #6)
• Cleaned up unused dependencies to reduce footprint.