hostit changelog

The recent releases of hostit, newest first. Dates are the release date. Anything that changes a config default or on-disk state is called an Upgrade note.

v0.41.0 – 2026-09-14

Conversations: standalone chats with the built-in assistant, separate from apps, plus an always-on app gallery and sharper admin and CLI tooling.

• A new “Chats” page. A conversation is a chat with the assistant that is not a hosted app: no port, no public URL, no SSH, no deploy. It costs almost nothing when idle (its container is built on the first turn and released between turns), and it converts into a real app in place when it outgrows a chat.
• Separate limits. chat-limit (default 20) caps conversations per user; chat-expiry (default 30 days) auto-deletes an idle one unless it’s pinned.
• Owner-only preview and file export. A chat can build pages under public/ that only its owner can see, and its files can be downloaded as an archive.
• The public app gallery is always on. The “Explore” gallery (public apps whose owners chose to list them, visible only to signed-in members) no longer has an on/off switch.
• Admin and CLI. The admin “All apps” table is click-to-sort with an active/deleted/all filter; hostit control app list and hostit node status gained RAM, disk and kind columns, --sort and --deleted.
• Snapshots take less room by default (every 6 hours, keep the last 10), and a chat’s deleted remains are reaped after a shorter grace.
• Upgrade note: two schema migrations run at first start (one recreates the app table to allow port-less chats); the app soft-delete grace dropped from 7 days to 3; the removed app-listing setting can be deleted from control.yml.

v0.40.0 – 2026-09-08

A security fix for app egress that had never actually worked, plus GitHub, Stripe and GitHub App connections. Upgrading is strongly recommended for any instance running untrusted apps, and required on a cloud host with a metadata service.

• App containers could reach the cloud metadata endpoint and every other app on the box; now they can’t. Per-app nftables egress rules block private space (including 169.254.169.254) by default, whitelistable narrowly.
• GitHub connections ask for only the access they need, plus a github-app provider for per-repository access and a Stripe provider (a pasted restricted key).

v0.39.1 – 2026-09-04

Security fixes from a review of the whole codebase. Recommended for any instance where people share or hand over apps.

• A transferred app no longer carries its previous owner’s credentials.
• Credentials are redacted before the assistant streams them.
• The screenshot sandbox no longer shares uid space with apps.
• An app can no longer exceed its memory cap through swap, and front doors no longer forward a client’s forwarding headers.

v0.39.0 – 2026-09-04

A public app gallery, a Google Drive connection, an instance default for the assistant’s model, and a substantially more reliable app preview.

• Explore gallery (opt-in per instance), Google Drive (read-only) alongside Calendar, a default-assistant-model setting, and much less blank/half-rendered previews.
• Upgrade note: a schema migration adds the app-listing column; the gallery stays off until an admin turns it on.

v0.38.0 – 2026-09-03

Deferred app deletion (a delete you can take back), plus assistant reliability and SSH-relay improvements.

• Soft delete: deleting an app shelves it for a grace period before it is really gone.
• Assistant turns no longer cut off at five minutes; the SSH relay can hide the node’s host so ssh <app>@apps.example.com reaches any app on any node; Go builds work in low-memory containers.

v0.37.0 – 2026-09-02

Connections gain permission checkboxes, editable and genuinely narrowable permissions, token revocation, and richer provider configuration.

• Scope checkboxes in the add dialog; edit and narrow a connection’s permissions after the fact; removing or re-scoping a connection revokes the old token; providers can forbid a second connection on the same account.