Skip to main content

Changelog

Notable user-facing changes to noBGP, newest first.

Entries are named after the agent version, which nobgp version reports. Each entry covers one agent release on stable and the router work that shipped with it. Router and agent versions are independent, so the same number in both means nothing.

Entries below 0.4.116 are named after the component that changed.

When a router release adds a tool or a field, reconnect your MCP client to see it. A client keeps the tool list it read when it connected.

0.4.126 — September 2026​

The Windows Firewall rule is named after the profile​

  • The agent's inbound rule is now noBGP-<profile>, for example noBGP-default. Before, it was named after the tunnel adapter (noBGP-nobgp0), whose number can change. Details
  • At the next agent start, the old rule is renamed and keeps your edits. ⚠ A rule with duplicates left by a crash, or a rule whose rename fails, is replaced by a new rule without your edits. Check the rule after the upgrade if you edited it.
  • nobgp remove now removes the rule of the profile it removes. nobgp uninstall removes every profile's rule and any device-named rule left by an earlier release.
  • If the agent cannot read the firewall rules, allow-overlay now leaves the rule as it is.

nobgp mcp install no longer overwrites another nobgp entry​

  • If a nobgp entry in your Claude configuration is not a local node's, for example the public server, install now stops and asks you to rename it, for example to nobgp-public. --yes does not skip this. Details
  • uninstall leaves that entry in place, and nobgp mcp status reports it as not registered.

A refusal that asks you to elevate now offers admin: "auto"​

  • Where "auto" would elevate on that node, the refusal now names it and the account it would run as. One retry then covers a whole fleet. Details

The Windows install command no longer contains your key​

  • register_node now returns a Windows command that asks for the key at a hidden prompt, and the key in a new registration_key field. Give the person who installs both (router 0.4.151).
  • ⚠ The command waits at the prompt when nobody is at the console. For an unattended install, set NOBGP_KEY_FILE. Details
  • If you pasted the old Windows command, the key can be in that machine's shell history, and in its Windows security log where process-creation auditing is on. Rotate the key if that matters to you.

Stopping a machine tells you whether its name starts it again​

  • task_stop now returns restartable_by_name (router 0.4.151). false means that provisioning the name does not bring this node back, and notes[] says why.

A command waiting on stdin is explained​

  • The command tool description now says that a command that reads stdin waits until the session ends, and how to redirect stdin on each platform. Details
Router 0.4.151 · agent 0.4.126

0.4.125 — September 2026​

A name in use no longer drops​

  • A name no longer drops while a connection uses it. The agent now renews the name in the background and keeps the address served. Details
  • If noBGP no longer knows the name, a running connection keeps running. Only new lookups stop.
  • If noBGP is slow or unreachable, nothing changes. The agent tries again later.

A LAN name nobody uses is forgotten in a day​

  • A name discovered on a member's LAN is now deleted about a day after the last confirmation (router 0.4.150). Before, it stayed for a week. A name in use is not affected.
  • The member that holds the name is told that it is gone. The next lookup discovers it again if a member can still reach the device.
  • ⚠ Upgrade every member that is below agent 0.4.125. On an older agent, a busy name can drop once a day.
Router 0.4.150 · agent 0.4.125

0.4.124 — September 2026​

You can keep the registration key off the command line​

  • nobgp register can now read the key from --key-file, NOBGP_KEY_FILE or --key - (standard input). The file holds the key on one line. Details
  • If you give two key sources, the command stops with an error. A UTF-16 key file is refused. Save it as ASCII or UTF-8.
  • The install scripts now keep NOBGP_KEY off the command line too. --key still works, but other accounts, the shell history and, on Linux and macOS, the system log can see the key.

A Windows machine can keep its own firewall policy​

  • Set windows-firewall: respect-windows, or run sudo nobgp config --windows-firewall respect-windows. The agent then installs no inbound firewall rule and removes the old one. Details
  • The default is allow-overlay, so an upgrade changes nothing. The command tool, the file tools and published services work without the rule. Without it, another machine cannot connect directly to a port on this host over the overlay.
  • The rule is now created once and kept, so your edits to it stay. nobgp uninstall removes it.
  • You cannot set this with node_config_set.

The install script completes registration on RHEL-family hosts​

  • The install script now completes registration on RHEL, Rocky Linux, AlmaLinux, Oracle Linux and CentOS Stream. sudo nobgp … also works by name there now.
  • ⚠ If the script stopped part way on a machine, run sudo /usr/local/bin/nobgp register. See the troubleshooting entry.

A provisioned machine says which image it started from​

  • /etc/nobgp-image names the image and its version. /usr/share/nobgp-image/packages.tsv lists its packages. The image version is not the agent version. Details
  • The image now includes common network tools: ping, ip, dig, ps, an SSH client and more.
  • network_directory now reports task_image_name and task_image_version for each running provisioned node (router 0.4.149).

You can now stop a machine and keep its node​

  • task_stop stops a provisioned machine and keeps its node, name, labels, grants and node storage area (router 0.4.149). ⚠ The machine's local disk is destroyed. In the web app it is Stop. Details
  • Provision the same name again to start a new machine on that node. Stopping a stopped machine returns already_stopped: true.

More included compute on every plan​

  • From 15 September 2026, included compute goes up: Free from $0.50 to $1 a month, Pro from $1 to $5, Business from $20 to $50. Plan prices and rates do not change. Details
  • ⚠ The allowance is an amount of money, not hours. $5 is 250 small hours or 83 medium hours.
  • The launch promotion compute goes from $5 to $10.

A node answers to its own hostname​

  • You can now reach a node by its hostname, for example nas, even when its noBGP name is different (router 0.4.149). Details
  • A hostname that two of your nodes share answers for neither. A node stops answering its hostname about an hour after it goes offline.

Smaller things​

  • provision_node now takes network_id as well as network_name. Send one, not both.
  • The register_node one-liner no longer uses sudo. Run it as given. ⚠ Before, the sudo form wrote the full registration key to the system log of each machine installed with it.
Router 0.4.149 · agent 0.4.124

0.4.123 — September 2026​

Traffic no longer goes to a LAN device that moved​

  • When a member refuses a LAN name it can no longer reach, it now stops delivery at once. Before, traffic could go on to the old address, which may belong to a different machine.
  • The name keeps its overlay address. Delivery comes back at the next sync that resolves it. The member writes a log line, which you can read with node_logs.
  • Known issue: nobgp status still shows the old LAN address for such a name.

A command with lost output no longer reports success​

  • A command session that lost output no longer reports an exit code. The next poll returns resource_exhausted. Sending input to it is refused the same way.
  • ⚠ How much output was lost is not known. Write the output to a file on the machine and read it with fs_read, or use command_subscribe. Details
Router 0.4.147–0.4.148 · agent 0.4.122–0.4.123

0.4.121 — September 2026​

Large files are copied and read in full​

  • fs_copy and fs_read no longer cut a file after the first 1 MiB and report success.
  • A copy that cannot complete now writes nothing. A read that overruns returns what it received and the offset to resume at. To resume, ask for base64.
  • ⚠ Before, a truncated file looked complete and its digest matched. Copy again any file over 1 MiB that matters.

Transfers and long commands​

  • A slow reader now pauses the sender. The transfer no longer disconnects.
  • Polling now keeps a command alive. A long, quiet command is no longer ended after one hour.
  • A poll now returns in time, so you always get the command_id.

GPU fields​

  • A Windows machine no longer reports "kind": "none". It now sends no gpu block, because it does not check for a GPU yet. A Windows node below 0.4.121 shows none until it upgrades and reconnects.
  • unified is now absent when the machine could not check. false now means the accelerator has its own memory.

Node identity and cleanup​

  • An unclean reset no longer empties the token file and de-registers the machine.
  • Temp files left by a crash, including the private key and token, are now removed by nobgp remove, by uninstall and at agent start.
  • A refused copy or a lost cancel no longer leaves temp files or open files on the destination.

Other fixes​

  • On macOS, bare LAN names resolve again while the agent runs.
  • The local MCP event resource delivers events again. events is now always a list.
  • event_tail now accepts wait as well as wait_seconds.
  • A KVM now publishes the attached machine under the hostname from its DHCP request. --name is repeatable, and --no-lease-name publishes only your names.
  • Write tools now state that a write to a router-served tree replaces the whole file. Send the file in one call.
  • redact now covers every place the router could write command text.
Router 0.4.146 · agent 0.4.121

0.4.120 — September 2026​

You can now see how big each machine is in the network directory.

What a node reports​

  • cpu_count (logical CPUs), total_memory (RAM in bytes) and disk_free_bytes (free space where the agent runs). On a container, CPU and memory are the host's figures.
  • A gpu block with the interface (cuda, rocm, metal, rknpu or none), the device count, memory_bytes and unified.
  • ⚠ none means the machine found no accelerator. No gpu block means the machine did not answer. Do not read a missing block as "no GPU".
  • When unified is true, the capacity for a large job is total_memory. Otherwise memory_bytes is the card's own memory. rocm and rknpu nodes report no memory figure. An Intel Mac reports none.
  • A node reports a GPU device that it can see, even if the agent's account is not allowed to open it. Let the job prove access.

Provisioned machines keep to the size you bought​

  • A provisioned task now has a memory limit and a CPU share for its size.
  • ⚠ A task that uses more memory than its size is now stopped. Choose the size you need.

Commands to many machines accept more​

  • workdir and environment variable values now accept ", %, carriage return and line feed. A variable name with = or a null byte is still refused, and so are the variables that load a library into another program.

Other fixes​

  • A normal terminal session end on Linux no longer logs an ERROR.
  • A failed file-worker start no longer leaves a dead process.
  • Send expected_sha256 only on a chunked upload, not on a single-call write.
Router 0.4.144–0.4.145 · agent 0.4.120

0.4.118 — September 2026​

You can reach a device that one Linux member sees on its LAN​

  • Traffic now reaches a device that a Linux member vouches for on its own LAN, such as a printer or NAS. You configure nothing on the member. Details
  • Known issue: a member that runs macOS or Windows cannot carry this traffic yet.

A LAN name survives a reboot of its member​

  • A LAN name no longer stops working after the member that serves it restarts. The member resolves its names again when it starts.
  • If a name no longer answers, the member keeps its address reserved and writes a log line. Read it with nobgp service logs or node_logs.
  • A member that was up for more than a week no longer loses these names at restart.

Other fixes​

  • A LAN name that answers only over IPv6 is now refused, with the remedy: publish the device by IPv4 address, or give the name an A record.
  • One bad packet no longer takes down a node's overlay. The agent drops it and logs it.
  • A node now logs which directory entries it could not register.
agent 0.4.118

0.4.117 — September 2026​

An update no longer fails because /tmp is full​

  • If the temporary directory has no room, the agent now downloads the update to its configuration directory, when that directory has more room. Details
  • ⚠ A node that is stuck now needs its /tmp freed once, or a reinstall from the install script. After that, it upgrades on its own.

Saving refill settings again waits before it charges again​

  • After a save tries a charge, the next save waits about five minutes before it tries again (router 0.4.140). Details

A name on your network now means one thing​

  • A device found on a member's LAN can no longer share a name with one of your nodes (router 0.4.141). The node's name wins. Details
  • The week-long wait from 0.4.116 is over. When you rename or delete a node, its name can be discovered on a LAN again.

Tool descriptions​

  • admin goes inside session on command, inside source and destination on fs_copy and on file with op: "copy", and at the top level everywhere else. Details
  • Set a command's idle_timeout to the total wait you accept, not to the gap between lines.
Router 0.4.139–0.4.143 · agent 0.4.117

0.4.116 — September 2026​

Usage past your plan is now paid from credit and never invoiced. noBGP's own traffic no longer counts as yours. A LAN name stays on the machine that found it.

A discovered LAN name reaches only the machine that found it​

  • A name that one node resolves on its own LAN is no longer pushed to every node in the network. Other machines resolve their own bare names again.
  • On the machine that found the name, the name now resolves to the device, not to the machine itself.
  • The name is not broadcast any more, but a machine that asks for it still gets it.
  • Your agent now asks its own LAN first. If this machine can resolve a bare name itself, the overlay steps aside. See A name this machine reaches itself. nobgp resolve still prints the overlay address.
  • ⚠ Reaching the device through another member still times out in this release. Use the name on the machine whose own network sees the device. See A name one member reaches on its own LAN.
  • A machine can keep a stale entry for about a week. A restart does not remove it. A fresh install removes it at once.

Platform traffic is not metered​

  • Keepalives, the metrics push, token refreshes and subscription pushes are no longer measured. An idle node can now show zero traffic, as the pricing page says.
  • ⚠ The control_receive and control_transmit figures are removed from the usage breakdown. A client that reads the usage API by axis name no longer receives them. Older periods are not changed.

An old period's traffic reads its real bytes​

  • The bill, the usage bar, the ring and the chart now read the same record. A period older than about four months no longer shows 0 B and $0.00. The current period was never affected.

The card you last chose is charged​

  • A card that you change in the billing portal is now the card that is charged. A completed checkout also sets it. See Payment method.

A warning before your credit balance empties​

  • You now get the 80% and 100% allowance alerts before your credit balance empties and when it does. Each names the axis that runs out.
  • If you hold credit, the alerts now measure your included amount plus what your balance buys. See the restriction basis.
  • The 100% alert matches the condition that refuses creation. See When credit runs out.
  • An account with no spend cap is no longer told that it reached one.

A failed automatic refill tells you​

  • A new mail tells the account owner when the card refuses an automatic refill. Only a real card refusal sends it.
  • A declined refill now backs off. It no longer retries every fifteen minutes.

The smallest automatic refill is $5​

  • An automatic-refill rule below $5 is refused when you save it. A truncated refill does not buy less than $5.
  • A one-off credit purchase keeps the 50¢ minimum. An existing rule below $5 keeps its amount.
  • ⚠ An armed rule cannot buy when your maximum has less than $5 of room, and the default is $0. If you arm automatic refills, raise your maximum too.

Raising your spend cap buys the refill at once​

  • When you save a higher maximum or arm a rule, the refill is now tried at once. A slowdown now lifts in about eight minutes, not twenty-three.

New nodes are accepted at the start of the month​

  • At midnight UTC on the 1st, paid organizations are no longer refused with credit_empty for up to five minutes.

Usage is paid from credit, not invoiced​

  • ⚠ noBGP no longer invoices usage. Usage past your included amounts is drawn from your credit balance at your plan's rate. Rates and included amounts do not change. Enterprise is still invoiced against its contract.
  • Your spend cap now only limits automatic refills. An empty balance is what refuses, stops and slows.
  • A draw from credit is exact. Traffic is no longer rounded up to the whole gigabyte.
  • set_spend_cap and credit describe this. Do not build on credit_billed. It always reads true and will be removed.
  • A crafted sign-in link can no longer put your tokens in a published service's address. Other hosts get a cookie sign-in only.

A node logs its control-channel transport​

  • One info line now names the transport that carries the control channel and its address. The losing connection logs its close. See Log levels.

Smaller changes​

  • Checking out with a new card makes it your default.
  • A mid-period plan change is invoiced at once.
  • Switching from annual to monthly re-anchors your billing to the 1st.
  • A cancellation now always writes its audit log entry. ⚠ Earlier cancellations have no entry. Ask support if you need one.
  • Billing audit entries now include the amount. billing.credit_buy includes it on a refused charge too. Older entries are not backfilled.
  • The your subscription is active again mail now arrives after a recovered payment.
  • If your included allowance rises mid-period, the credit it covers comes back and spent_this_period_cents falls. Expired credit stays spent.
Router 0.4.130–0.4.138 · agent 0.4.116

Agent 0.4.114 — September 2026​

At the default log level, a node now logs only about itself.

  • An idle node no longer logs peer registrations, peer lifecycle, per-flow and per-ping lines, or the DNS re-arm probe at info. These are now debug. A NAS can let its drives sleep again. See Log levels.
  • To see peer presence, use network_directory or presence_subscribe.
  • node_logs and nobgp service logs can show older lines on an idle node. The log is not broken.
  • On a busy directory-joined host, the unelevated account check no longer reports that the node has no usable account.

Agent 0.4.113 — September 2026​

  • You can now set the address family that a node's connections try first: transport-family: auto | v4 | v6, --transport-family or NOBGP_TRANSPORT_FAMILY. See Address family.
  • auto is the default and does not change behavior. v4 and v6 try one family, then fall back to the other. Use this on a machine whose uplink breaks on IPv6. See when a machine's uplink breaks on IPv6.
  • You can set it remotely with node_config_set.
  • ⚠ The shared drive's transfers and the CLI's router calls do not follow it yet. On a host that must send no IPv6, also set fs: off or block IPv6 on the interface.
  • When the preferred family is dark, each connect waits a few seconds before it falls back.

Router 0.4.129 — September 2026​

You can change plan in the billing portal​

  • The billing portal now offers both Pro and Business, at both intervals. See Changing plan once you already have one.
  • Checkout is still refused while a subscription is live. A cancelled subscription can use checkout again.
  • Each plan card now shows its included traffic, rate, storage and compute hours from the plan catalogue.
  • A plan switch now removes the old plan's metered lines. Organizations on noBGP's own routers were never affected.
  • ⚠ A self-hosted deployment on its own Stripe account must configure its own portal.

Billing emails describe the spend cap correctly​

  • The cap mails now say that the spend cap only limits automatic refills. They offer two remedies: raise the maximum, or buy credit. See the emails.
  • The your subscription is active again mail now says only what a lapse withdrew.
  • Allowance mails now speak about their own axis only.

You can read usage per day​

  • Bandwidth and compute are now reported per UTC day, and the days add up to the period total. The usage screen draws the period from this. Old periods keep their chart.
  • Storage and nodes stay period figures.

Router 0.4.128 — September 2026​

macOS ._name sidecars are stored​

  • The share now stores a Mac's ._name files, so extended attributes, Finder tags and resource forks survive. See What travels with a file.
  • cp from a Mac no longer prints could not copy extended attributes and exits 1.
  • ⚠ A folder that a Mac wrote to now lists about twice the entries. .DS_Store, desktop.ini, Thumbs.db and autorun.inf are still discarded.
  • A sidecar follows the case rule.

An empty credit balance stops running machines​

Router 0.4.127 — September 2026​

Buying credit clears a creation refusal​

  • On a paid plan, creation is now refused only when an allowance is used up and the credit balance is empty. The error is resource_exhausted with limit_type: "credit_empty". See an empty balance is what refuses creation.
  • Under credit billing, the spend cap no longer refuses creation or stops running machines. A self-hosted deployment that invoices overage still refuses with limit_type: "spend_cap".
  • Agent enrollment refusals now say what is exhausted and how to clear it.

Your card charges leave a record​

  • credit op=purchases lists this period's purchase attempts, failed ones included. Use period (YYYY-MM) for another month.
  • Stripe now emails a receipt for each credit purchase to the organization's first Owner. A missing receipt does not mean a failed purchase.
  • credit status shows pending_purchase_cents and oldest_pending_purchase_at. Do not add the pending figure to purchased_this_period_cents. It is already included.

Cancelling clears auto-reload and the spend cap​

  • ⚠ Cancelling now clears the auto-reload rule and the spend cap. A new subscription does not re-arm them. Set them again if you subscribe again.
  • The old values go to the audit log as billing.credit_auto_reload_cleared and billing.spend_cap_cleared. org_audit_list returns them.
  • A lapsed payment keeps both settings.

Smaller changes​

Router 0.4.125 — September 2026​

You can extend a running machine with task_deadline_set​

  • You can now give a running provisioned machine more time, or less, with the task_id from provision_node.
  • ⚠ max_hours counts from now, not from when the machine started. Omit it to reset to your plan's default. 0 removes the deadline, except on Free.
  • A shorter deadline does not stop the machine now. Use deprovision_node for that.
  • You can change only a running machine. Provisioning the name again while it runs takes the next free name and starts a second machine.
  • The tool is not available when provisioning is revoked.

The directory shows each machine's deadline​

  • network_directory now shows task_deadline_at per node. Do not cache a remaining time. The deadline can change.

Enterprise machines have a deadline​

Router 0.4.124 — September 2026​

  • Allowance warning emails now have their own switch. Turning off billing no longer silences them.

Router 0.4.123 — September 2026​

Credit purchases complete​

  • credit op=buy and automatic refills now complete. Failed attempts charged nothing, and their reservations are released.

Usage is paid from credit on noBGP's own routers​

  • credit_billed now reads true. Usage past your allowance is drawn from your credit balance. Your invoice is the flat plan fee.
  • ⚠ An empty balance now slows traffic, not the spend cap. Buy credit to clear it.
  • Free does not change. Its traffic stops past its allowance.

Router 0.4.122 — September 2026​

The spend cap limits automatic refills only​

  • The maximum no longer refuses credit op=buy by an Owner. The maximum only limits auto-reload.
  • An automatic refill that does not fit is now reduced to what is left.
  • auto_refilled_this_period_cents is new on credit status. Headroom is spend_cap_cents minus this field.

An auto-reload trigger of zero is refused​

  • ⚠ credit op=auto_reload now refuses a trigger of 0. To refill when the balance is empty, use 1 cent.
  • reload_cents must be at least 50 cents.

Agent 0.4.112 — September 2026​

  • A node that cannot pick an overlay address now starts without one. command, file, the shared drive and nobgp status keep working, so you can repair the machine remotely. Before, agent 0.4.111 exited and restarted again and again.
  • nobgp status now shows the reason under network.overlay. See nobgp status.
  • ⚠ To bring the node back onto the overlay, free space in 100.64.0.0/10 or pin overlay-cidr to a free /20, then restart the agent. What to check, and what to do.
  • If the agent cannot read the routing table, it no longer takes 100.64.0.0/20 by default. It keeps a pinned or previously recorded /20 with a warning, and reports the error under network.overlay.
  • A pinned overlay-cidr must still be a /20 inside 100.64.0.0/10 and must not overlap a carrier-grade NAT gateway's /20.

Agent 0.4.111 — September 2026​

  • On Linux the agent now reads every routing table when it picks its overlay /20, not only main. A node no longer takes a range that another VPN, such as Tailscale, already routes, so it no longer registers and then reaches no peer. See Overlay addressing.
  • On every platform, a route that claims the whole 100.64.0.0/10 is no longer ignored as the agent's own leftover route.
  • If another product claims only part of the range, the agent now picks a free /20 elsewhere.
  • If another product claims all of 100.64.0.0/10, the agent logs no free /20 slice available in 100.64.0.0/10 (host is fully claimed). Free space in the range to use the overlay. Pinning overlay-cidr does not override this. What to check, and what to do.
  • Carrier-grade NAT uplinks, such as Starlink, work as before.

Known issue: on 0.4.111 a fully claimed host stops at startup and keeps restarting. 0.4.112 starts it without an overlay.

Router 0.4.120 — September 2026​

You can now rename a node from your assistant​

  • node_rename changes a node's name and keeps its node_id, labels, grants, services, public URLs and storage. Give the new name in new_name. Owner or Admin only.
  • ⚠ Connected peers resolve the old name until they reconnect. See what is stale.
  • After a rename, the old name provisions a new machine with provision_node, and the new name brings this one back.

Deprovision, then provision the same name, works in one step​

  • deprovision_node now waits up to 35 seconds for the node to go offline. A re-provision no longer gets a suffixed name and an empty storage area.
  • Read node_offline on the response. If it is false, poll network_directory until the node is gone before you provision.
  • ⚠ The call can now take up to 35 seconds. A client with a shorter timeout loses the answer, but the node is still deprovisioned.
  • If the deprovision cannot record its result, the call now fails. Retry it.

Credit buys charge the method Stripe charges​

  • credit op=buy now uses the subscription's payment method, then the customer default, then the only attached method. The billing summary shows the same method, with its type and, for Link or a bank, an account.
  • If several methods are attached and none is the default, the purchase is refused. Set a default in Account → Billing.

Router 0.4.118 — September 2026​

  • credit status now has credit_billed. It tells you if this deployment spends the credit balance on overage. On noBGP's own routers it is false: overage is invoiced, and op=buy returns failed_precondition. See Usage credit.
  • The balance is spent only when both credit_billed and credit_enabled are true.
  • Every credit call now writes an audit entry that names the operation: billing.credit_status, billing.credit_buy, billing.credit_auto_reload or billing.credit_spending. A refused charge is also recorded.

Agent 0.4.110 — September 2026​

  • On macOS the agent no longer switches on the pf packet filter. Before, it could enable pf and leave it on.
  • ⚠ Upgrading does not turn pf off again. How to check, and how to turn it off.
  • An idle node no longer writes a metrics line every minute. ⚠ Log lines about peers still keep NAS drives awake; 0.4.114 stops those. Use --log-level debug to see the line, or read net_metrics.
  • You no longer need to lower log-level to stop these writes. See Log levels.

Router 0.4.117 — September 2026​

  • A provisioned machine now stops at a deadline. provision_node takes max_hours and returns deadline_at. If you omit max_hours, the machine stops after 24 hours on Free, Pro and Business. The maximum is 8760 (one year). See How long it runs.
  • On Pro and Business, max_hours: 0 runs one machine with no deadline. Free refuses it. Enterprise machines have no deadline.
  • At the deadline the machine becomes an offline node. It keeps its identity, labels, grants and storage, and loses its local disk. Provision the same name to start it again.
  • ⚠ Machines provisioned before this release have no deadline. They run until you deprovision them.
  • There is no idle timer. A machine runs until its deadline, also when it is idle.

Router 0.4.116 — September 2026​

  • sudo nobgp register now works on a node whose noBGP name differs from its hostname. noBGP matches the machine's key first, then its name. The node comes back as itself, with its labels, grants, services and storage. See nobgp register.
  • You no longer need --name as a workaround.
  • A key conflict now names the node that holds the key, instead of enrollment failed. See enrollment failed.

Router 0.4.115 — September 2026​

  • You can now set whether your organization spends its credit balance with credit op=spending. It is Owner only, on the REST surface. enabled is required. With enabled: false, noBGP keeps the balance and slows the organization at its allowance.
  • credit status now returns credit_enabled, spent_this_period_cents and period_end.
  • On noBGP's own routers, the balance is not spent today. Overage is invoiced. See The meters.
  • create_checkout no longer says that Business is not on sale. You could buy Business before, and you still can. See Plans.

Agent 0.4.108 — September 2026​

Router 0.4.114 — September 2026​

Published services no longer see noBGP session cookies​

  • A published service no longer receives the visitor's noBGP cookies. Its own cookies pass through.
  • A service can no longer set a noBGP cookie. A Domain= attribute is removed, so its cookies stay on its own hostname. This also stops 400 Request Header Or Cookie Too Large errors from other services.
  • ⚠ Script on a service's page can still set domain-wide cookies. See Cookie isolation.

You can now read your plan, card and invoices in one call​

  • billing is a new Owner-only read on the REST surface. Page invoices with invoice_limit and invoice_starting_after. See Your plan, your card and your invoices.
  • ⚠ Read cancel_at_period_end with the status. A cancelled subscription stays active until the period ends.
  • create_billing_portal takes an optional flow: payment_method_update, subscription_update or subscription_cancel.
  • Allowance and spend-cap emails now give the reset date. They go to the organization's Owners. See The alert is emailed too.

Agent 0.4.107 — August 2026​

  • When no network interface is usable at startup, the agent now waits and retries instead of exiting. It starts when a link appears. See Waiting for an interface at startup.
  • ⚠ While it waits, nobgp status lists the profile as unavailable. An interface: name that does not exist makes the agent wait indefinitely.

Agent 0.4.106 — August 2026​

Router 0.4.113 — August 2026​

A contested name costs the name, not the connection​

  • A second machine with the same name now connects under a suffixed name, such as web-1, instead of being refused. A revoked node is still refused. See A contested name costs the name, not the connection.
  • ⚠ The machine does not learn its new name. Check the directory for unexpected suffixes, and give machines distinct names.
  • provision_node also suffixes a contested name. Read readopted_node_id to see what was re-adopted.

Other changes​

  • node_logs now says how many lines your filters removed and which filters were active. See How much your filters removed.
  • A deleted peer now stops resolving on a node that was offline when it was deleted. See Peer targets.
  • A mid-month subscription includes the whole month's allowance the first time only. A later subscription is prorated, but never lowers the allowance you hold. Free is never prorated. See One billing day.
  • A node's traffic and storage now count for the organization that owns the node.
  • A node that cannot report its boot time no longer shows 1970. Its health reading uses the connection-based rule.

Agent 0.4.105 — August 2026​

Router 0.4.112 — August 2026​

A node now has three states: online, offline and deprovisioned.

A stopped machine is an ordinary offline node​

  • When the platform stops a provisioned machine, the node keeps its node_id, name, labels, role grants and storage area. To start it again, provision the same name.
  • suspended_at is removed from network_directory. Read online and offline_at instead.
  • An offline node is no longer deprovisioned after a timer. It stays until you remove it, within the plan's storage limit.

A gigabyte is 1,000,000,000 bytes​

  • All bandwidth and storage allowances and per-GB rates now use decimal units: 1 GB = 1,000,000,000 bytes, 1 TB = 1,000 GB. This matches the pricing page. Nothing was charged against the old figures.
  • Machine memory stays in GiB. For a short time, the web app usage screen can read about 7% low. Details.

Provisioning a name a live node holds gets you a suffix​

  • provision_node no longer refuses a name that is online or has an open provisioning task. It uses the next free name, <name>-1 to <name>-8.
  • ⚠ Read node_name in the response. It is the only place that shows the suffix. Details.
  • A revoked node's name is still refused.

Renaming a node needs Owner or Admin​

  • Only Owners and Admins can rename a node now. A refused rename returns 403. Registering, provisioning, deprovisioning, picking a release channel and removing a node stay at Member. Roles & Permissions.
  • info.health and the host block of net_metrics no longer disappear when a node reconnects. Only a reboot hides the sample, for about 90 seconds.

Router 0.4.111 — August 2026​

  • task_id in network_directory now stays on a provisioned node after you rename it. You can deprovision a renamed node.
  • Provisioning a name again is refused while a container still runs behind a renamed node.
  • An old deprovision task no longer removes the node that a newer container runs as.
  • ⚠ A node that you rename before its replacement connects shows its previous task id. Wait for ready before you rename, then read the directory again. Details.

Router 0.4.110 — August 2026​

Every account can provision​

  • Provisioning is generally available on every plan, with no allowlist. If you were refused before, try again. Provisioning Nodes.
  • Limits come only from included compute, the spend cap and a lapsed subscription. These return resource_exhausted.
  • forbidden now means provisioning was revoked for your account. You can still use deprovision_node.

net_metrics health belongs to the current session​

  • The host block no longer shows a sample from an earlier connection. It is absent for about a minute after a reboot or reconnect. net_metrics.

node_logs says all three things unreachable can mean​

  • unreachable now names each cause: the log mechanism's reach, your since bound, or a log file that the running agent does not write. Details.
  • The one-line summary now says the answer is incomplete on every page that has the field.

A node's identity is its key, not its name​

  • A reconnecting agent is matched on its key. If you edit node-name on the machine, it no longer renames the node or creates a second node. Node Identity.

Router 0.4.109 — August 2026​

Every subscription bills on the first of the month​

  • New subscriptions bill on the first. A mid-month start pays a prorated fee and gets a full month's allowance.
  • The spend cap now bounds the invoice. On an annual plan, the cap is still per month. One billing day.

A billing alert stops naming a limit that has moved​

  • Allowance and spend-cap alerts clear when you upgrade or raise a limit. A later real crossing now alerts you again. Allowance alerts.

network_directory health belongs to the current session​

  • An online node no longer shows a health sample from an earlier connection. It is absent for up to about 60 seconds after a reboot or reconnect. An offline node keeps its last sample. network_directory.

Two things worth knowing before you trust a log​

  • Known issue: A log file can come from an earlier agent process. Check source and path first. Details.
  • Known issue: A since bound uses the node's clock. On a machine with no real-time clock, read a boot with since omitted. Details.

feedback_submit is not only for unattended sessions​

Router 0.4.108 — August 2026​

  • network_directory now reports online_at, the start of the node's current connection. A value later than your action means the node came back.
  • ⚠ online_at is not a liveness flag. An offline node keeps the start of its last session. Read it with online.
  • To wait for a node you disrupt, subscribe to presence events first. network_directory.

Router 0.4.106 — August 2026​

No plan caps devices any more​

  • Free's 25-node cap is removed. Every plan has unlimited nodes. limit_type: "nodes" no longer occurs. Plan limits.

On Free, passing the bandwidth allowance stops the traffic​

  • A Free organization over its 50 GB now has data traffic stopped until the period rolls over or it upgrades. On a paid plan nothing is stopped: a reached spend cap or a lapsed payment still throttles to 1 Mbit/s per node. Details.
  • Nodes stay online. Listing, stat, mkdir, delete, rename and lock still work. Transfers, service traffic, new command sessions and file reads and writes stop.
  • Drive URLs and mounts return 402 Payment Required. Tools return resource_exhausted with limit_type: "bandwidth". file op=fetch_url still works.
  • ⚠ After an upgrade or period roll, traffic comes back within a few minutes, not at once.

Router 0.4.103 — August 2026​

Compute is metered, and every plan includes some​

  • Provisioned nodes bill by the minute. Included compute: 25 hours on Free, 50 on Pro, 1,000 on Business. A medium hour uses three hours, a large hour six. Provisioned compute.
  • New classes: large (2 vCPU / 4 GiB) at $0.12/hour and xlarge (4 vCPU / 8 GiB) at $0.24/hour.
  • Known issue: a large or xlarge request can be accepted and then fail to start.
  • Any member can read usage per class with compute_usage on the REST surface.

Reaching a limit suspends a machine, it never destroys one​

The spend cap starts at $0, and covers compute too​

  • An organization with no cap now has a $0 cap. The cap covers bandwidth and compute. Allowance alerts now include compute. The spend cap.

Control-channel traffic is no longer billed​

  • Keepalives, metrics pushes, token refreshes and subscription pushes are no longer billed as bandwidth. An idle node can now show zero traffic. The meters.

Plan changes​

  • Pro is $20/mo ($200/yr). Allowances do not change.
  • Business is $200/mo ($2,000/yr): 1 TB bandwidth then $0.10/GB, 1 TB storage, 1,000 compute hours, unlimited nodes. Plans.
  • An account can own at most three Free organizations. Details.

Router 0.4.102 — August 2026​

  • Networks and services are now unlimited on the Free plan, as on every plan. No action is necessary. Plan limits.

Router 0.4.101 — August 2026​

One meter: bandwidth​

  • Nodes and storage are no longer billed. They are plan limits. Bandwidth over the allowance costs $0.12 / GB on Pro.
  • Free: 50 GB bandwidth, 25 nodes, 10 GB storage. Pro $19/mo ($190/yr): 100 GB bandwidth, unlimited nodes, 100 GB storage. Plans.
  • The $99 Business plan is retired. Existing organizations on it keep it.
  • The storage cap now applies on paid plans too. Delete always works. At the storage cap.

provision_node is sized by class​

  • Use class: small (0.25 vCPU / 0.5 GiB) at $0.02/hour or medium (1 vCPU / 2 GiB) at $0.06/hour. The default is small. Compute classes.
  • ⚠ cpu and memory now return invalid_args. Send class instead. provision_node.

Router 0.4.99 — August 2026​

  • The audit log records entries again. On router 0.4.98 it recorded nothing.
  • ⚠ Entries for calls made on 0.4.98 cannot be recovered. No tool call failed because of this. Audit log.

Router 0.4.98 — August 2026​

  • The audit log now records calls that address a node: command, file and fs_*, node_logs, node_config_get / node_config_set, net_* and the subscribe tools. Failed and denied calls are recorded too.
  • The entry goes to the organization that owns the node. Arguments and command text are not recorded.
  • ⚠ The log now grows with activity. Each fs_read call adds one entry. Audit log.

Agent 0.4.104 — August 2026​

  • An expired, idle leased overlay address is now reserved, not released. Quiet connections keep working, and packets no longer go to the wrong machine. Overlay Addressing.
  • A jump in the machine's clock no longer makes addresses in use look idle.

Agent 0.4.103 — August 2026​

  • On firmware that keeps /var/log in RAM, the agent log now survives a reboot. The agent writes <config-dir>/nobgp.log, up to about 20 MiB. Linux only. Details.
  • node_logs now says when your since bound removed lines, and when the lines come from a file the running agent does not write.
  • A node with no usable non-root account now says so, instead of telling you to configure one. Details.
  • Known issue: This release releases an expired, idle leased overlay address. Upgrade to 0.4.104. Overlay Addressing.

Agent 0.4.102 — August 2026​

  • After a router deployment, nodes now reconnect at spread times (±25%), not all at once. Backoff, exit codes and router.control_reconnects do not change.

Agent 0.4.101 — August 2026​

  • On an overlay-root Buildroot appliance, the agent now starts at boot. The boot link goes to /etc/kvmd/user/scripts/S99nobgp.
  • ⚠ If 0.4.100 is installed on such a machine, run nobgp upgrade, then nobgp service restart. Details.

Agent 0.4.100 — August 2026​

  • On a packageless Linux with busybox init, nobgp service install now works and the agent starts at boot.
  • ⚠ If 0.4.99 left the service half-installed, run nobgp service start or nobgp service restart. Details.

Agent 0.4.99 — August 2026​

Packageless Linux images install​

  • The one-line installer now installs on a Buildroot image with no package manager. The binary goes to /usr/bin/nobgp, config to /etc/nobgp/. nobgp upgrade works.
  • On a read-only rootfs, set INSTALL_DIR to a writable path that survives a reboot.
  • No shared drive backend is installed.

A busybox-init box gets a service — but not in this release​

  • Known issue: The service install fails on busybox-init images. Use 0.4.100.

Windows: a webdav drive cannot read a file over ~47 MiB​

  • Known issue: Windows' WebDAV client refuses files over 50,000,000 bytes with Permission denied. The write succeeds, but that machine cannot read the file. Use winfsp, or raise FileSizeLimitInBytes and restart WebClient. Details.

Agent 0.4.98 — August 2026​

A node now remembers the key of each peer and warns you when that key changes.

  • A node records the public key of a peer the first time the two nodes talk. It checks every later session against that key. The check is on by default.
  • ⚠ The check finds a key that changes after the first contact. It does not find a key that was wrong from the first contact.
  • To confirm a fingerprint, compare it with registration.agent_key_id in nobgp status on the console of the peer.
  • The new nobgp peers command lists the pinned keys. Add --json for scripts. It also works when the agent is not running.
  • The new peer-key-pinning setting takes warn (the default: log at ERROR and continue), enforce (refuse the session) or off. A refusal stops one session. It never stops the control channel of the node.
  • ⚠ A rebuilt node gets a new key under the same node ID. With enforce, its peers refuse it until you accept the new key on each peer. Use enforce only on a fleet where you do not often rebuild nodes.
  • To accept a rebuilt peer, run nobgp peers --forget <node-id-or-name> on each node that talked to it. You do not need to restart. --forget-all resets all peers.
  • With warn, the node reports the mismatch on every session until you resolve it.
  • The pins are in a <profile>-peerkeys.json file beside the profile. If the agent cannot read the file, it keeps the pins that it has. If you delete the file, the pins are cleared.
  • ⚠ You cannot change peer-key-pinning with node_config_set. Set it on the machine with nobgp config --peer-key-pinning.

Agent 0.4.97 — August 2026​

This release completes the QUIC change and fixes Windows upgrades, mount status and a shared-drive setting.

A slow machine keeps its QUIC connection​

  • The QUIC idle timeout of a node is now 120 seconds, up from 60. A healthy connection no longer drops when a keepalive is a little late. Nodes on wss do not change.
  • On QUIC, router.connected in nobgp status can now take up to 120 seconds to show a silent outage.
  • On QUIC, the offline short-circuit of the shared drive now starts after about three minutes, not two.

Fixes​

  • ⚠ On Windows, an upgrade no longer makes nobgp fail with Access is denied for accounts that are not Administrator. The next upgrade repairs a machine that has this problem. See the troubleshooting entry.
  • info.mount_readable in network_directory now changes when a mount fails. The node checks it on every cycle, also while it retries the mount.
  • ⚠ webdav-proxy-owners cannot be enforced. A node with this key now refuses all callers to the shared-drive proxy and logs an ERROR. If you set this key on a node, clear it. ⚠ Local processes on the node can still reach the proxy.
  • When the install script runs itself again under sudo, it now writes to a temporary file and checks it first. The curl … | sudo sh form is not affected.

Router 0.4.97 — August 2026​

A node that is gone no longer shows as online, and QUIC connections get more margin.

A node that is gone no longer reads online​

  • A node that disconnected while its router restarted no longer shows online: true in network_directory. A sweep closes these records every hour.
  • For a record that the sweep closes, offline_at is the time of the sweep, not the time of the disconnect.
  • presence_subscribe sends no offline event for such a node. If you must not miss a departure, also check the directory.

A slow machine keeps its QUIC connection​

  • The QUIC idle timeout of the router is now 120 seconds, up from 60. It takes effect when the node runs agent 0.4.97. The router still finds a dead node within 90 seconds.
  • The router no longer sends its own QUIC keepalives. The 25-second keepalive of the agent does not change, so nodes behind CGNAT are not affected.

Agent 0.4.96 — August 2026​

Both known issues of the previous span are fixed.

nobgp status shows a lost router connection​

  • router.connected in nobgp status now changes to false when the node loses the router.
  • The new router.since field shows when the current state started. The new router.offline_for_secs field shows how long the link is down. Both fields are also in the local MCP status tool.
  • A silent link failure shows within 68 seconds on wss. On QUIC it shows within about 60 seconds, and within 120 seconds from agent 0.4.97.
  • While the link is down, router.transport and router.remote_addr show the last connection.

The shared drive fails fast when the node is offline​

  • After about two minutes offline, a shared-drive operation now fails at once. It no longer waits for a network timeout. The node retries the work when it reconnects. See a node that already knows it is offline.

Fixes​

Router 0.4.96 — August 2026​

Searches report what they did not search, and Windows copies over WebDAV work.

  • ⚠ fs_grep and fs_grep_subscribe now return unreadable_paths and unreadable[]. Each path has a reason: not_found, permission_denied (retry with admin: "true") or unreadable.
  • Trust a zero result only when skipped_files and unreadable_paths are both 0. A node below agent 0.4.96 always reports 0, so check its info.agent_version. See A zero is only a zero.

Tool descriptions warn about Windows script encoding​

  • fs_write, fs_edit and file write UTF-8 without a byte-order mark. Windows PowerShell and cmd.exe do not read such a script as UTF-8, so characters outside ASCII break.
  • ⚠ Keep a .ps1, .bat or .cmd script to ASCII. Or send it through command's script field with shell: "powershell".

Fixes​

  • A copy onto a Windows webdav drive no longer fails with 0x80070021. Copy-Item, cmd.exe copy and an Explorer drag now work. A lock on a directory is still refused with 423.

Agent 0.4.94 – 0.4.95 · Router 0.4.94 – 0.4.95 — August 2026​

The shared drive and the log tools now report errors correctly. Router 0.4.94 fixes the known issues of the span below.

The shared drive reports what the server refuses​

  • ⚠ A rename that the server refuses now fails, and the file stays where it was. The same applies to a new folder whose parent is gone.
  • A drive that cannot reach the server no longer shows folders as empty. A listing now waits for the connection.
  • A rename made while the node is offline, or while the file uploads, is kept. The node sends it in order when the connection returns.

Known issue: while offline, a listing or rename on the shared drive can block for up to a minute, and nobgp status can show a lost connection as healthy. Agent 0.4.96 fixes both.

Log searches end with a clear answer​

  • node_logs with a pattern that matches nothing now returns an empty result, not an error.
  • Each page now has a scanned count of the lines it examined.
  • When the log goes back no further, the search ends with success and an unreachable note. To read more, run nobgp service logs on the node.

The known issues of the previous span are fixed​

  • A strict client can now use the flat node reference on all 16 tools.
  • node_config_set now writes only operational keys. It refuses all other keys, including router, insecure, quic-cert-pin, encrypt and auto-upgrade.
  • Files in a renamed folder on a fuse mount can be read at once. node_logs paging always ends. A trailing slash in an NFS mount point no longer causes remounts. org_display_name() no longer answers a caller who is not a member.

Fixes​

  • An orderly restart no longer logs reading from TUN: file already closed as an error.

Agent 0.4.84 – 0.4.93 · Router 0.4.82 – 0.4.93 — August 2026​

The MCP tools get one result shape and six new tools, with many fixes for fleets, files and the shared drive.

Every tool result has one shape​

  • ⚠ Every result is now one envelope. call_id, op, done and duration_ms are on the outside, and the payload is under a key with the tool name. This breaks a client that reads fields at the top level. See The result envelope.
  • An MCP failure now carries code, message, call_id, retryable and details. An error names its node, for example target_unreachable with details.offline_at.
  • admin on the tools that run something is now a string: "true", "false" or "auto". "auto" runs at the identity that the node can offer. Every result reports admin_used.
  • You can name the node with node_id, or network_name + node_name, at the top level of the arguments. Do not also send the nested form, or you get invalid_args.

New tools​

  • node_logs reads the agent log of a node. It takes lines, since, min_level, pattern and cursor.
  • service_check tells you if a service backend is up: reachable, unreachable or not_applicable.
  • fs_copy copies one file between two nodes in one call. Neither node needs a route to the other.
  • node_config_get and node_config_set read and write the settings of a node over its control channel. Each key returns live, restart_required or refused.
  • feedback_submit sends free-text feedback to the noBGP team, up to 50 per organization per day.

Commands on a node and on a fleet​

  • You can read command output again. Send next_output_offset back as output_offset. The newest 1 MiB is kept. idle_timeout is limited to 100 s.
  • command_subscribe takes script, shell, workdir and env, so one dispatch runs on Linux, macOS, Windows and OpenWrt.
  • A signal result now shows signal_delivered, signal_mechanism and signal_target. stderr is now separate from output.
  • Output from Windows with characters outside ASCII now comes back as UTF-8.
  • ⚠ On macOS, an admin: "true" call uses the PATH of root, which does not include /usr/local/bin. If you get exit 127, use the absolute path.

Files​

  • ⚠ The default max_bytes of fs_read is now 32 KiB, down from 256 KiB. Use truncated and next_offset to read the rest.
  • transfer: "url" gives a short-lived /xfer/ URL that a browser, CI or op=fetch_url can fetch. It works from router 0.4.87.
  • expected_sha256 is now checked on the shared drive and on node storage areas. A mismatch returns precondition_mismatch and does not change the file.
  • A failed write now removes the parent directories that it created.
  • fs_grep returns its matches again when you send a progressToken.
  • A recursive delete inside /tmp, /var/tmp or C:\Windows\Temp no longer needs force: true.

Watching a fleet​

  • fs_subscribe and presence_subscribe take keep_seconds, up to 24 hours.
  • presence_subscribe adds a ready event when a session holds for 5 s. Wait for ready after a provision.
  • A noBGP write shows in fs_subscribe as create, not write.
  • net_metrics now reports host.cpu_percent, mem_free_bytes, load1 and at. load1 is not available on Windows.
  • network_directory now shows info.fs_mount and info.mount_readable.

The shared drive​

  • When you rename a folder, its cached files move with it, and a queued save uses the new name.
  • nobgp status shows an fs.unreadable line when the agent cannot read its drive, with the remedy. On macOS it names the Full Disk Access grant.
  • A Mac that cannot mount after a change to fs: now repairs itself.
  • A refused write-back is kept and listed under fs.conflicts in nobgp status.
  • File locks now survive a router deploy.
  • A delete now answers at once. The names .nobgp-trash and .nobgp-upload-* are reserved.
  • The Free storage allowance is enforced: 507 Insufficient Storage on the drive, and resource_exhausted on fs_write, fs_mkdir and fs_copy. Deletes and moves are always allowed. This is off until enforcement is switched on.

Staying connected​

  • A sleeping laptop no longer counts as a flapping node, so its agent no longer restarts.
  • A dropped control connection reconnects without a restart. In nobgp status, router.quic_reconnects is now router.control_reconnects.
  • A node whose DNS fails stays reachable.
  • nobgp service restart now schedules the restart and returns. Exit 0 means that the restart is scheduled.
  • A change to fs in the config no longer reloads the agent. Restart the agent to apply it.
  • A deleted name leaves the directory of every node at once.

Billing and limits​

  • Per-call rate limits apply: 600 calls a minute with a burst of 120, per caller and per target node. A refusal is rate_limited with details.retry_after_ms.
  • The spend cap now limits only overage. A cap of 0 means no overage.
  • Allowance alerts at 80% and 100% now reach every plan, including Free.
  • Bandwidth throttling starts only when enforcement is on.
  • A personal organization shows the name or email of its owner instead of an ID.
  • MCP calls now appear in the audit log of the organization. The router no longer sends command text, stdin, output or caller emails to product analytics.

Smaller changes​

  • nobgp status adds fs.no_fallback, fs.locking, fs.conflicts and fs.unreadable. network_directory adds info.health and info.writable_roots.
  • /mcp and /api/v1 support gzip.
  • Provisioned node images run tini as PID 1, so a package install no longer hangs.
  • The router and the agent use Go 1.26.7.

Known issue: a code review found defects in this span, for example the flat node reference on 12 tools and the keys that node_config_set could write. Agent 0.4.94 and router 0.4.94 – 0.4.95 fix all of them.

Agent 0.4.83 — August 2026​

You can now restart a node remotely​

  • ⚠ nobgp service restart now schedules the restart outside its own process tree and returns about two seconds before the restart. Exit 0 means "scheduled", not "back up". Confirm with nobgp service status.
  • A restart from a noBGP command session no longer leaves the node down until someone reaches its console.
  • If the host cannot schedule the restart, the command tells you. In a noBGP command session it refuses and names a local console or a reboot. In a local shell it warns and restarts in place.

Nodes stay connected​

  • A node on WebSocket now reconnects inside the running process after a dropped control connection, as a QUIC node already did. It no longer exits and rebuilds its tunnel and shared drive.
  • nobgp status renames quic_reconnects to router.control_reconnects. Read it beside router.transport.

The shared drive​

  • nobgp status shows a new fs.no_fallback line on a host that can run only one filesystem backend. Where a fix exists, the line names it, for example installing WinFsp on a Windows node.
  • A busy answer that outlasts the retry budget now reports the status it saw, not context deadline exceeded.

Diagnostics​

  • net_interfaces now returns an overlay block: the tunnel interface, its slice, and the address the node's own name resolves to. It needs this agent release and router 0.4.81.
  • A name the router withdraws, for example a deprovisioned peer, now stops resolving at once. Its address stays reserved.

Fixes​

  • Installing a database server, for example mysql-server, on a provisioned node no longer hangs. A container provisioned before this keeps its old image. Provision the name again to move it to a current image.
  • An unelevated file operation no longer fails with fs worker is gone.

Router 0.4.81 — August 2026​

You can now send a whole script to a node​

  • command takes a script: a whole script body with real newlines and no escaping. Send command or script, never both. On Windows the body runs as a batch script, or as PowerShell with shell: "powershell", without the 8191-character line limit.
  • script is refused on a node that never reported its OS. Send command, or set shell: "powershell". A body over the platform limit (about 9 KiB batch, 12 KiB PowerShell, 117 KiB shell) is also refused. Write it with fs_write and run its path.
  • A Windows call that exits 255 with no output and no shell now returns a hint with the two ways through.

Diagnostics​

  • ⚠ net_interfaces now returns an overlay block with the node's TUN interface, its /20 slice, and the address its name resolves to on that node. The node must run agent 0.4.83. Do not use the interface's addrs for this.
  • The router now withdraws a deleted or deprovisioned node's name from the other nodes' directories. A node needs agent 0.4.83 to act on it.

Searching and moving files​

  • fs_grep_subscribe now takes admin, as fs_grep does. A node whose owner refuses elevation reports that as its own event, and the search continues.
  • A file transfer no longer breaks when a follow-up call reaches a different server. Listings, stats and other one-shot operations are not forwarded. If one names the owner, retry the call.

Agent 0.4.79 – 0.4.82 · Router 0.4.77 – 0.4.80 — August 2026​

Windows nodes change how they mount the drive. Read the first section if you run one.

Windows nodes now mount the drive with WinFsp​

  • ⚠ From agent 0.4.82, fs: auto selects WinFsp on Windows where the driver is present, instead of WebDAV. This happens without notice, also where rclone, sshfs-win, Cygwin or MSYS2 installed WinFsp. Set fs: webdav to keep WebDAV, or fs: off for no drive.
  • Renaming a file is slower on WinFsp than on WebDAV. Agent 0.4.82 should reduce the gap; it has not been measured again.
  • Renaming a file to a different capitalisation, for example report.txt to Report.txt, now works.

File locks on the shared drive​

  • An interrupted copy no longer makes a file unwritable. Copying a file such as an .msi in Explorer no longer fails with 0x80070021. From router 0.4.80, every lock expires after at most ten minutes.
  • From router 0.4.80, a lock applies across the whole service and is released when the node that holds it disconnects.
  • A drive LOCK and a file op=lock now contend on the same file. Locks stay advisory.
  • ⚠ From router 0.4.80, a lock on a whole folder is refused with 423. Lock the files you write instead.

What the drive does not carry​

  • ⚠ The drive does not carry the extra streams Windows attaches to a file. A file copied through it loses its mark-of-the-web without a prompt, so Windows treats it as locally created.

Deleting and mount health​

  • From router 0.4.77, a delete answers at once, and every server sees it at once.
  • From agent 0.4.82, an nfs mount that disappeared no longer reports healthy. The node mounts it again.
  • From agent 0.4.82, a refused write can no longer overwrite the winner's bytes. The conditional write holds.

Nodes that go quiet stay reachable​

  • From agent 0.4.80, a node whose DNS lookups fail stays reachable. It uses the address its connection last reached.
  • From router 0.4.79, a session that failed because the node could not reach the service is retried once.
  • From agent 0.4.82, an upgrade download that ran out of disk can start again.
  • From router 0.4.77, a write that was not delivered is no longer reported as delivered.

Writes are verified end to end​

  • A file written through the tools is now verified end to end, so a corrupted transfer fails. Send expected_sha256 to fs_write to also check the leg between you and the service.

Accounts and sign-in​

  • From router 0.4.78, a name that Google or SSO provides after sign-up fills an empty profile name at your next sign-in. An existing name is not overwritten.
  • After an email-code sign-in, the sign-in page prefills your address on your next visit.
  • A name of only spaces is no longer stored. An invitation with a stray tab no longer creates two grants.

For MCP clients​

  • From router 0.4.77, clients can cache the tool list.

Agent 0.4.56 – 0.4.78 · Router 0.4.57 – 0.4.76 — August 2026​

The shared drive now mounts in the way the machine supports. No action is needed beyond upgrading.

Your node picks how it mounts the drive​

  • The agent tests FUSE, NFSv4, WebDAV and WinFsp on the machine and uses one that works. nobgp status and nobgp show report the result.
  • New fs config key: auto | off | nfs | fuse | webdav | winfsp. auto is the default. The agent uses an explicit choice or refuses it, and never replaces it.
  • fs: off mounts nothing and logs why once.
  • nobgp show reports the fs selection, fs-backend and fs-error.

The drive is faster​

  • Listings and file bytes are cached for every backend. Repeat reads of an unchanged file are served locally.
  • ⚠ Set fs-cache-ttl (flag, NOBGP_FS_CACHE_TTL, or profile) with a unit, for example 30s. The default is 30s, the range 0–10 minutes. The agent ignores a value without a unit and keeps the default.
  • NFS writes on Linux now run at full speed.

Your data is safer​

  • Two nodes that create the same file at once no longer destroy one copy. The second writer fails, and its bytes stay on the node.
  • From router 0.4.76, a conditional write is checked again when the upload completes. A losing write gets 412.
  • A queued save now survives an agent restart, including an automatic upgrade.
  • An append now writes at the correct offset.
  • Names are stored exactly as written and are unique without regard to case, so case.txt and CASE.TXT cannot both exist.
  • Deleted or overwritten files are recoverable for 7 days. Contact support.

Errors on the drive are clearer​

  • From agent 0.4.77, a short busy answer (429, 502, 503, 504) is retried for up to 5 seconds and no longer shows as Input/output error. Details
  • From agent 0.4.78, a mount left by a killed agent is removed at startup, also on a node with fs: off. Linux and macOS only.
  • From agent 0.4.78, the agent no longer restarts when it writes its own profile file.
  • A busy mount point now names the process that holds it. The agent does not stop that process. A mount path that contains a space now works.
  • fs_locking in network_directory shows what file locks a mount guarantees.
  • macOS now mounts over NFS, where a lock that cannot work fails instead of reporting success.
  • ⚠ On macOS, the agent service cannot read the node's mount. Grant the nobgp daemon Full Disk Access on that Mac. Or address the storage through the router: a network's drive by network name, or the node's area with storage: true.
  • WebDAV needs davfs2, which some Linux distributions do not install and Synology does not offer. Without FUSE or NFS, such a node runs without the drive.

Windows​

  • WinFsp 1.10 or newer is available as an opt-in backend. Set fs: winfsp to use it.
  • Editing a file through the file tools now works on Windows.
  • Explorer now shows the drive as noBGP.

macOS​

  • Correction: WebDAV on a Mac works. See the numbers. nfs stays the default.
  • The macOS binaries are now signed with a Developer ID certificate, so a Full Disk Access grant survives an upgrade.

Storage and billing​

  • The usage screen now shows node storage per node, beside the per-network view.
  • A network deleted mid-period that was billed now shows on the usage screen.
  • A deprovisioned node's storage is released after 30 days.
  • network_directory shows which backend each node mounted with.

See Plans and billing and What the mount contains.

Nodes​

  • A network rename now reaches mounted nodes at once.
  • Provisioning a name that is in use now replaces the node that provisioning created. A node you registered by hand is still refused.
  • nobgp register now re-registers a node whose token expired.

Reliability​

  • A restarted agent no longer stops its node accepting sessions with destination recently closed.
  • fs_read now reads files larger than 1 MiB on the shared drive and a node's storage area. A partial page returns done: false. Continue from offset + size.

Agent 0.4.55 — August 2026​

Files that went missing from the mounted drive on macOS and Windows are back.

  • Listings under node/ and networks/<name>/ no longer lose entries on macOS and Windows, at any depth.
  • A network name that contains a space now lists correctly.

See What the mount contains.

Agent 0.4.54 — August 2026​

The mounted drive holds two folders now: the machine's own storage, and one per network.

  • ⚠ The mount root now has two folders: node/, this machine's own storage area, and networks/, one folder per network. A file at /mnt/nobgp/report.pdf is now at /mnt/nobgp/networks/production/report.pdf. Storage, URLs and the dashboard do not change.
  • node/ is the same path on every node and needs no URL or token. Reading it from elsewhere needs Owner or Admin.
  • The root and networks/ are read-only.
  • A move between the two trees is a copy. A program that only renames gets a "cross-device" error.
  • The layout is the same on Linux, macOS and Windows.

See What the mount contains.

Router 0.4.56 — August 2026​

Your assistant can read and write noBGP's own file storage, without going through a node.

  • file and the fs_* tools can now reach a network's shared drive (a network and no node) or a node's own storage area (storage: true with the node id). The node does not need to be online.
  • A network's share needs Member. A node's storage area needs Owner or Admin.
  • read, write, list, stat, mkdir and delete work on storage, up to 1 MiB per call. For a larger file, use the tree's HTTPS URL.
  • storage: true requires the node id, not its name.
  • ⚠ On storage, delete always removes the whole subtree, and admin is ignored.

See Addressing storage instead of a node.

Router 0.4.54 — August 2026​

The shared drive has a URL you can actually open.

  • You can now open a network's share at https://files.nobgp.com/networks/<network-id>/ with any WebDAV client and your noBGP bearer token.
  • files_url in network_directory now resolves to that URL.
  • Each node has its own storage area at https://files.nobgp.com/nodes/<node-id>/. It needs Owner or Admin in the organization that owns the node. ⚠ A write to it passes none of the vetoes the node's owner sets on the box. A node reaches only its own area.

See Reaching a share directly and the role matrix.

Agent 0.4.53 — August 2026​

The local proxy behind the shared drive can tell who is calling it.

  • The new webdav-proxy-owners key limits the local WebDAV proxy on 127.0.0.1:19840 to a list of numeric uids. The empty default only logs the uid of the first caller. Linux and macOS only.

⚠ Correction, agent 0.4.97: this key cannot work on any platform, and the logged uid is not the caller's. Leave the key unset. If you set it, the drive goes offline.

See Shared drive proxy keys.

Router 0.4.53 — August 2026​

The shared drive is now a real filesystem, and file names are case-sensitive because of it.

  • ⚠ README.md and readme.md are now different names. A request with the wrong case returns 404. Router 0.4.71 later made names unique without regard to case.
  • An upload that stops part way no longer replaces the file, when the client declares the length.
  • A file rewritten within one second is no longer served stale.
  • A lock in one network no longer blocks the same path in another network.

Agent 0.4.52 — August 2026​

Turning off a node's last way in now takes a deliberate answer, and stopping the service is bounded.

Node settings​

  • ⚠ Removing command from allow-tools now asks for confirmation. A non-interactive run, including nobgp config over MCP, is refused unless you pass --yes. Undoing the change needs console, RDP or SSH access.
  • --yes answers these prompts for one run. It is not saved.
  • To clear the configured account, run sudo nobgp config --user "". On a node whose agent is the superuser, admin: false calls are then refused (unelevated never means root). A reinstall or registration sets the account again.
  • The allow-admin: false warning now states which effect it has on this node. See Confirmed before it is written.

Stopping the agent​

  • Stopping the service now takes at most seventeen seconds on Linux, macOS and Windows, however many profiles run. One stuck agent no longer holds up the others.
  • Every unmount on Linux and macOS now stops after five seconds per attempt and escalates.

Agent 0.4.51 — August 2026​

The shared drive now mounts on Linux nodes that had no FUSE helper.

  • The .deb, .rpm, .apk and .ipk packages now declare the FUSE helper (fuse3, or fuse-utils on OpenWrt). On RPM hosts it is a recommendation, so an EL7-class host still installs and runs without a shared drive.
  • On OpenWrt, install.sh now installs kmod-fuse and fuse-utils.
  • If the helper is missing, the agent now logs one error that names the package to install. It no longer repeats a warning every minute.
  • ⚠ Before, /mnt/nobgp could stay empty. On an affected node, install the helper and restart the agent:
opkg install kmod-fuse fuse-utils   # OpenWrt; elsewhere install fuse3
sudo nobgp service restart

Router 0.4.50 — August 2026​

  • network_directory now reports offline_at for each node that is down. It is the time of the most recent disconnection, in RFC3339 UTC.
  • The field is absent when the node is connected, has never connected, or has no recorded disconnection. Absent does not mean "long ago".
  • offline_at is also returned with brief: true. You do not need to upgrade any agent.

Agent 0.4.50 — August 2026​

  • The agent now checks the router's QUIC certificate pin on every connect, including a resumed session. After a certificate rotation, the node re-pins on the next connect and does not fall back to WebSocket.
  • You do not need to configure anything. quic_pin in nobgp status is unchanged.

Router 0.4.49 — August 2026​

  • The MCP endpoint's metadata now names one authorization server, noBGP's sign-in service. An MCP client that chose the second entry can now sign in.
  • The router no longer serves authorization-server metadata of its own. Clients that already sign in, such as Claude Desktop and Claude Code, are unaffected. If you write your own client, see the discovery contract.

Agent 0.4.49 — August 2026​

  • The agent no longer exits when the network is briefly absent after a wake from sleep. It retries in place for up to five minutes, on Windows too. Stale nobgp volumes on macOS no longer result from these exits.
  • A revoked node or a refused connection still stops the agent at once.
  • Peer sessions now come back at once after a reconnect that needed a retry.

Agent 0.4.48 — August 2026​

The filesystem mount survives a network blip​

  • A mount is no longer remounted after one failed health probe. It must fail three probes in a row, about one minute. Duplicate nobgp drives no longer appear in Finder.
  • An orderly stop no longer delays the next mount by ten minutes.
  • On macOS, the agent now gives the unmount 15 seconds to finish at shutdown.

Other changes​

  • A node that cannot switch to its configured account now returns failed_precondition (HTTP 403, not retryable). Before, it returned a retryable internal. Retry with admin: true.
  • An auto-upgrade on slow hardware no longer logs auto-upgrade failed after it succeeds.

Agent 0.4.47 — August 2026​

  • A node now reports a permission denial as permission_denied (HTTP 403, not retryable) on Linux, macOS and Windows, in any system language. Before, it could arrive as a retryable internal.
  • The result is the same at both identities. What a node permits did not change.

Router 0.4.48 — August 2026​

  • An ACL denial on a Windows node now returns permission_denied (HTTP 403, not retryable), as on Linux. Before, it returned a retryable internal.
  • The router matches the English message. On a Windows node in another language, upgrade the agent to 0.4.47.

Agent 0.4.46 — August 2026​

A Windows node runs everything as its configured account​

  • On a Windows node with a configured user, command, terminal sessions and bus commands now run as that account with admin: false. They no longer refuse. See A second identity on Windows.
  • allow-admin: false on such a node now narrows it to that account instead of switching it off.
  • The first unelevated command for an account creates its profile folder, and nobgp uninstall keeps it. That account has no network credentials, so a command that reads a file share needs admin: true.

Security​

  • ⚠ On 0.4.44 and 0.4.45, on a Windows node whose user was an administrator, an unelevated fs_read could read files that the account had no permission to read. This no longer happens. Other nodes were not affected.

Other changes​

  • network_directory now shows whether the unelevated account is an administrator (info.user_is_admin, router 0.4.47). nobgp status shows unelevated_is_admin. Absent is not false.
  • A terminal session on Windows older than 10 1809 now returns an error instead of crashing the agent.
  • A Linux node no longer runs out of overlay interfaces because of stuck subprocesses.
  • A stuck filesystem mount no longer blocks startup.

Router 0.4.47 — August 2026​

  • network_directory now returns info.user_is_admin. When it is true, admin: false runs as an administrator on that node. It has three states, and absent is not false.
  • The admin guidance no longer says that Windows nodes have no unelevated identity. A Windows node has one only where its owner configured an account.

Router 0.4.46 — August 2026​

  • When you omit network_name, the call now uses your personal network, even if you belong to team organizations. The call asks you to choose only when you have two personal networks, or none.
  • To use a shared organization's network, name it. This applies to command, file, fs_*, the selector fields, provision_node, register_node and network_delete.
  • A network_id now always selects that exact network. Before, it could select your personal network with the same name.

See Which network a call lands in.

Agent 0.4.45 — August 2026​

  • network_directory now shows the machine model as info.hardware_model, for example DS918+ or Macmini9,1. It can be empty on a VM, a container or an older agent.
  • fs_write, file op=write and op=fetch_url now create missing parent folders. You no longer need fs_mkdir first.
  • The new folders belong to the identity that admin selects. allow-roots still applies.

Agent 0.4.44 — August 2026​

Execution identity​

  • A configured user now gives a Windows node its second identity. The windows-user-identity key is retired, and the upgrade removes it. See A second identity on Windows.
  • A Windows node that recorded an install account now runs unelevated file calls as that account. command and terminal sessions still refuse an unelevated call.
  • nobgp config --user <account> now works on Windows. network_directory shows the account.

Provisioning​

  • A provisioned node now accepts admin: false from its first boot.
  • NOBGP_USER now also works on an installed agent, and overrides the config file. See Environment Variables. nobgp config --user tells you when NOBGP_USER overrides the value you saved.

Installing and upgrading​

  • The Windows installer no longer reports a registered node as failed. It names the command that fixes the service.
  • Re-running the installer over a running agent no longer reports a failed install.
  • Errors print once, and flag mistakes now print a message.

Router 0.4.45 — August 2026​

Provisioning​

  • provision_node now tells you how to wait for the new node, and returns network_name and the normalized node_name. It still returns no node_id.
  • resource_summary now shows the CPU and memory actually allocated.
  • deprovision_node now succeeds on a task that is already stopped.

Directory and services​

  • A filtered network_directory no longer returns networks with no matching node. A network you name with network_name is still returned.
  • Brace expansion in a glob, such as {web,db}*, now returns invalid_args instead of zero nodes.
  • service_publish now tells you how to check that the backend is alive.

Stale tool lists​

  • A boolean sent as a string ("true", "false", "1", "0") is now accepted.
  • A validation error now tells you to refetch the tool list and names the router version. See When your client's tool list is stale.

Agent 0.4.43 — August 2026​

  • A Windows node can now run fs_* and file calls with admin: false as a configured account. Set windows-user-identity: true and a user. No password is stored. The key is off by default. See A second identity on Windows.
  • On such a node, an unelevated command or terminal session returns failed_precondition. Send admin: true.
  • nobgp config --user <account> works on Windows when the key is on. A Windows install records the signed-in desktop account in user.
  • network_directory shows that account when the key is on.
  • A node that fails during startup now records the reason when it closes its connection.

Agent 0.4.42 — August 2026​

Router 0.4.43 — August 2026​

  • whoami now returns can_elevate. When it is false, every admin: true call returns forbidden. A node with allow-admin: false still refuses. See two gates.
  • whoami also returns orgs[], with your role and can_elevate for each organization. If your roles differ, there is no top-level can_elevate.
  • network_directory now returns org_id on each network, to match orgs[].
  • Send admin: true for work that needs the superuser, and omit it otherwise. See Choosing which to send.

Agent 0.4.41 — August 2026​

  • A node now refuses admin: false when that call would run as root (uid 0). This includes a service install with no user, a bare-root container, every Windows node, a deleted user, and user: root. The refusal is failed_precondition. See Unelevated never means root.
  • ⚠ To serve unelevated calls, run sudo nobgp config --user <account>, or send admin: true.
  • An agent that already runs unprivileged still serves admin: false.
  • nobgp config --user root is now refused. --allow-admin=false now reports the node's actual case.
  • network_directory info.user is now empty when the configured account does not resolve.

Router 0.4.42 — August 2026​

  • The router now returns a node's refusal of admin: false as uid 0 as failed_precondition (not retryable). To fix it, configure an account (sudo nobgp config --user deploy) or retry with admin: true. See Unelevated never means root and the tool descriptions.
  • Each node enforces the rule when its agent upgrades. Privilege does not change: root work now needs an explicit admin: true.
  • network_directory info.user now has three states: a name, empty (no account), and absent (the agent does not report it).

Agent 0.4.40 — August 2026​

  • A node now refuses a one-shot answer over 64 MiB with too_large. This can affect a recursive fs_list or a very large fs_glob. Narrow path or drop recursive, because limit and offset do not help.
  • A large answer no longer uses twice its size in memory.
  • A search now reports files skipped for size. See A zero is only a zero when skipped_files is 0.

Router 0.4.41 — August 2026​

  • fs_grep now returns skipped_files, the count of files over the 16 MiB limit that it did not read. fs_grep_subscribe reports it in each completion event.
  • ⚠ Check skipped_files before you trust a zero. An agent below 0.4.40 always reports 0.

Router 0.4.40 — August 2026​

Organization roles now apply to the tools that write a node or a service. Solo accounts and personal organizations do not change.

  • The Member role is now checked on service_publish, service_update, service_delete, service_share, register_node, provision_node, deprovision_node and node_label. A Member keeps all operational actions: nodes, services, command and the file tools. See Roles & Permissions.
  • ⚠ Only an Owner or Admin can now turn off a service's authentication (auth_required: false) on service_publish or service_update, or run node_label. A Member gets forbidden (HTTP 403). If a Member does either step as routine, raise their role or move the step to an Owner or Admin.
  • Turning authentication on, editing a service that is already public, and passing authorized_emails need no extra role.

Agent 0.4.39 — August 2026​

  • File walks (fs_list, fs_glob, fs_grep, fs_stat and the file ops) now report results under the path you sent, not under the resolved symlink target. fs_stat of a link describes the link again.
  • A walk now starts at the same path that the allow-roots check approved.
  • Windows: a finished stderr line no longer waits behind an unfinished one. Prompts and progress lines now show at once.

Router 0.4.38 — August 2026​

  • An fs_grep or fs_grep_subscribe pattern that is not valid RE2 now returns invalid_args (HTTP 400). Before, it returned a retryable internal.
  • Text you send, such as a pattern or a file name, is no longer read as a node refusal. It no longer causes a false permission_denied, not_found or too_large. See When the failure came from the node.

Agent 0.4.38 — August 2026​

File tools​

  • One large reply no longer breaks later file calls on a node until a restart. Large replies are now sent in parts.
  • The same size limit now applies with and without admin: true. Going over it returns too_large, not internal.
  • macOS: a recursive walk of /tmp, /etc or /var now finds the files. Before, it returned an empty success.
  • An operation now acts on the path that its permission check approved.

Errors and commands​

  • A node now sends its own error code for a refusal. An unknown refusal no longer arrives as a retryable internal.
  • A command stopped by a signal now reports 128 + the signal number, for example 143 for SIGTERM. Windows still reports 1.
  • Windows: quotes now reach cmd.exe unchanged, as at a Command Prompt.
  • Windows: shell: "powershell" output is now plain text, without CLIXML. Error text is kept.

Router 0.4.37 — August 2026​

  • A node owner's refusal now returns permission_denied (HTTP 403, not retryable), not a retryable internal. This covers allow-admin: false, a path outside allow-roots, a domain removed from allow-tools, and the agent's own configuration directory.
  • A reply too large to send returns too_large (413). A node that cannot switch to the requested account returns failed_precondition. See When the failure came from the node.
  • A refusal gets the same code whether it occurs at the start of a call or partway through it.

Agent 0.4.37 — July 2026​

Execution identity​

  • An elevated file call is no longer limited by allow-roots. It still needs both an Owner/Admin (or a manage grant) and the node's allow-admin. See Node Access Control.
  • The agent's configuration directory stays refused at both identities.
  • On Windows, allow-roots still applies to unelevated file calls.

File search and containment​

  • ⚠ fs_grep and fs_grep_subscribe now work. On older agents they fail with path must be absolute: "". Upgrade the agent to use them.
  • fs_grep now checks every entry in paths against allow-roots.
  • A recursive fs_list, fs_glob or fs_grep no longer lists or reads the files in the agent's own directory.
  • fs_glob with follow_symlinks no longer reports targets outside allow-roots.
  • On a node with a configured user, walks now apply the owner's allow-roots.

allow-roots still does not limit command. To limit execution, remove command from allow-tools or set allow-admin: false.

Router 0.4.36 — July 2026​

  • ⚠ admin: true now needs an org Owner or Admin. A Member gets forbidden. Retry without admin to run as the node's configured account. See Execution identity.
  • On a node's local MCP server, the node's grant decides: manage can elevate on peers, observe cannot.
  • An elevated command_subscribe is refused for the whole cohort or runs on all of it.
  • The fs_* tools now accept admin. fs_grep_subscribe does not.
  • Updating a service that runs elevated needs the same role as creating one. Lowering it needs no role.

Agent 0.4.36 — July 2026​

  • An upgraded node now cleans its config file at startup. No effective setting changes. See Configuration File.
  • The agent writes the file only when its contents change.

Router 0.4.35 — July 2026​

  • You can now call fs_grep over MCP to search a node's files with an RE2 regex. ⚠ It needs agent 0.4.37 or later.
  • Send a progressToken to get each match as a progress notification. Without one, the response holds all hits in matches[]. Read count to know if the search found anything.
  • fs_grep also works on a node's local server at the observe tier. There it always returns the full result.
  • New tool: fs_grep_subscribe searches a whole cohort through the event bus. Read matches with event_tail. outstanding: 0 means the search is complete. See Searching a fleet.
  • event_subscriptions now reports the grep kind.

Agent 0.4.35 — July 2026​

  • The config file now holds only values that differ from the default. Defaults show as commented lines. Hand-written comments do not survive a rewrite. Retired keys are removed with a note that names the new key (event-sources → allow-tools, event-watch-roots → allow-roots). See Configuration File.
  • The config file is now replaced atomically. A restart or power cut during a write no longer loses the overlay slice, the local MCP token or the QUIC endpoint.
  • fs_grep works again on nodes with a configured user. There, matches arrive when the search finishes.

Agent 0.4.34 — July 2026​

Execution identity​

  • ⚠ This agent release makes admin work on command, command_subscribe, file and terminals. On an older agent, admin: true runs as the configured user.
  • File operations now run as the chosen account, with that account's ownership and permissions.
  • An agent that does not run as root now refuses file operations as user. Run the agent as root or clear user.

Node access control​

  • The file tools and fs watches never serve the agent's own directory, for example /etc/nobgp. allow-roots and admin: true do not open it. See Node Access Control.
  • ⚠ allow-admin: false now refuses all work that runs as uid 0. On a node where the agent or user is root, remote execution stops on upgrade. Set an account with sudo nobgp config --user=<account> first.
  • Windows: allow-admin: false now also refuses file operations.
  • The nobgp config warning and allow.warning in nobgp status now say that terminal services are refused too.

Router 0.4.33 — July 2026​

  • ⚠ admin replaces username on command, command_subscribe, service_publish and service_update. false (default) runs as the node's configured account. true runs as the node's ambient identity. A call with username returns invalid_args. Replace username: "root" with admin: true, and remove the field in all other calls. See Execution identity.
  • To run as another account, use su or runas in the command.
  • file now takes admin, and file operations run as the chosen identity. Use file for elevated file operations.
  • A terminal published with username: "root" now has admin: true. A terminal with another account now runs as the node's configured user. To elevate it, set admin: true with service_update.
  • network_directory now shows user and allow_admin for each node. An empty user means admin: false runs as root.

Agent 0.4.33 — July 2026​

  • ⚠ allow-tools and allow-admin now also apply to published terminal services. Plan on-device access before you restrict a node behind CGNAT. See Node Access Control.
  • ⚠ Windows: allow-admin: false now refuses all remote execution on the node.
  • nobgp config now refuses a --user account that does not exist, and refuses --user on Windows. --allow-admin=false now tells you its effect, and asks for confirmation when it turns off remote execution.
  • The --user help text is corrected. --user is the default account for commands and file operations. See the CLI reference.

Router 0.4.32 — July 2026​

  • username: "root" now requests elevation, and admin is removed from command and command_subscribe. A call with admin returns invalid_args. Replace admin: true with username: "root". See Execution identity.
  • Opening an API host in a browser now goes to the docs, for example mcp.nobgp.com goes to the MCP section. MCP clients and API callers do not change.

Agent 0.4.32 — July 2026​

  • nobgp service logs now needs root and shows all agent logs. On Linux and macOS it runs itself with sudo. See Root privileges.
  • Windows: a privilege refusal now names the command to run from an Administrator terminal. For read-only state, use the local MCP server's status tool.
  • nobgp list now reports an unreadable profile directory, not No profiles found.

Agent 0.4.31 — July 2026​

Installation​

  • brew install nobgp/tap/nobgp works again on macOS. Run the install command again.
  • ⚠ The latest download path is removed. Agents older than 0.3.80 cannot upgrade manually. Reinstall them with the install script.

Other changes​

  • Certificate errors caused by antivirus or a proxy now name the product and link to Security software and VPNs.
  • nobgp status now shows TLS interception in router.tls_intercepted, and other VPNs and security products in an environment block.
  • Windows: the network drive no longer disconnects every 30 seconds.
  • Linux: Node.js and Bun now resolve public names on hosts where the agent is the first nameserver. See DNS & hostname resolution.
  • DSL, mobile broadband, Teredo and ISATAP adapters are no longer reported as tunnels. nobgp status no longer waits on the Windows security-product query.

Router 0.4.31 — July 2026​

  • One message the router cannot process no longer disconnects a node. The router logs and skips it.
  • An operational disconnect no longer looks like a credential rejection, so the agent reconnects. Real rejections do not change. See revoked credentials.

Agent 0.4.28 – 0.4.30 · Router 0.4.28 – 0.4.30 — July 2026​

  • A whole-filesystem allow-roots entry now works on Windows.
  • Node grants no longer expire. A grant stays until you revoke it.
  • The Windows installer works again. Run the one-line installer again.
  • ⚠ The install.cmd installer is removed. Use the powershell -NoProfile -Command "irm ... | iex" line in any Windows shell.
  • RPM-based installs now use dnf when available.
  • One offline peer no longer disrupts other nodes' control channels.

Agent 0.4.19 – 0.4.27 · Router 0.4.24 – 0.4.27 — July 2026​

A node's owner can limit what it serves​

  • allow-tools sets which domains (fs, command) the node serves. It replaces event-sources, and existing values migrate.
  • allow-roots sets which roots the fs tools and watches can use. It replaces event-watch-roots.
  • allow-admin sets whether work can run as root or Administrator. On Windows, allow-admin: false is refused at startup.
  • All three are permissive by default and show in nobgp show and nobgp status. See Node Access Control.

Commands and event bus​

  • command and command_subscribe now take admin or username.
  • ⚠ command_subscribe now runs as the node's configured user, not root. Add admin: true if you need root.
  • Scripts run by the event bus can call nobgp notify.
  • Subscribe calls now return the matched node list, and a selector that matches nothing says so.
  • arch selectors accept arm64/aarch64 and amd64/x86_64.
  • Command results always include exit_code, also for zero.

Tools and platforms​

  • Claude Code can now call tools that take lists or numbers.
  • A failed event_tail no longer loses events.
  • You can use a node name without a network name when it is unambiguous.
  • fs_stat accepts allow_missing, and fs_delete accepts force.
  • whoami no longer returns an empty email for calls through a node.
  • nobgp show no longer prints allow-* settings twice or shows an old quic-router value.
  • On macOS, fs event paths are symlink-resolved, and commands run through the login shell on Unix.
  • macOS service installation, Windows installer elevation and headless Linux installs are fixed. An unpublished version now says so on upgrade.