Rig Community

Cloud v0.18.0 Security batch: XSS hardening, email HTML escaping, path containment on static serving, non-root Docker, and dependency bumps. Shipped 12 Aug 2026 · Full changelog Added Profile URL scheme allowlist (http/https/mailto) in public profiles and API sanitize Stripe hostname allowlist before billing redirects Non-root USER node in API and web Docker images Path containment for web static file serving (safePath.mjs) Fixed Account dashboard $ helper renamed to byId (Aikido jQuery false positive) Legacy marketing HTML no longer assigns untrusted strings via innerHTML Invitation / welcome / change-email HTML escapes untrusted fields @hono/node-server bumped to 2.x; jose / fast-uri / better-auth resolved to patched versions Posted by Rig when this cloud release hit userig.app/changelog. Feedback welcome in Bugs / Feature ideas — private tickets still go to Support.

v1.0.0-beta.54 Security hardening for MCP auth, process spawn, and the local Express dashboard. Shipped 12 Aug 2026 · Full changelog · Download for Mac Added Helmet security headers on the local desktop Express dashboard Fixed Process spawn no longer uses shell: true for package-manager scripts; Procfile/compose/artisan lines run via fixed /bin/sh -c MCP Bearer token compare uses crypto.timingSafeEqual Posted by Rig when this build hit userig.app/changelog. Feedback welcome in Bugs / Feature ideas — private tickets still go to Support.

Cloud v0.17.0 Security headers on userig.app (CSP, HSTS, clickjacking protections) plus a Resolved badge on the changelog Bugs hub for closed Aikido findings. Shipped 12 Aug 2026 · Full changelog Added Marketing web responses now send Content-Security-Policy, Strict-Transport-Security, X-Frame-Options: DENY, X-Content-Type-Options, and Referrer-Policy Changelog Bugs hub shows a Resolved badge when a forum topic is locked or tagged resolved Forum POST /api/rig/resolve for version-transparent bug closures (reply + resolved tag + lock) Fixed Aikido surface monitoring: CSP header not set on https://userig.app (GH #2) Aikido surface monitoring: HSTS header missing on https://userig.app (GH #3) Aikido surface monitoring: Missing anti-clickjacking header on https://userig.app (GH #23) Posted by Rig when this cloud release hit userig.app/changelog. Feedback welcome in Bugs / Feature ideas — private tickets still go to Support.

v1.0.0-beta.53 Browse data matches 22b density and Adminer skin — system-ui/slate, no outer scroll. Shipped 12 Aug 2026 · Full changelog · Download for Mac Added Adminer design CSS (adminer.css) matching the 22b artwork mock Fixed Browse plane fills the viewport; only Adminer scrolls inside the embed Posted by Rig when this build hit userig.app/changelog. Feedback welcome in Bugs / Feature ideas — private tickets still go to Support.

v1.0.0-beta.52 Browse data (22b) Rig chrome matches the artwork — header actions, embed frame, and the three info cards. Shipped 12 Aug 2026 · Full changelog · Download for Mac Added 22b bottom cards: How it starts, Same tool both engines, Guard rails Fixed Browse data header matches 22b (meta + Snapshot first + Open in browser; no extra back button) Hide Setup & more under the Database / Browse plane Escape returns from Adminer to the Database panel Posted by Rig when this build hit userig.app/changelog. Feedback welcome in Bugs / Feature ideas — private tickets still go to Support.

v1.0.0-beta.51 Database panel matches artwork 22a exactly — full plane, not a stacked block under the workspace. Shipped 12 Aug 2026 · Full changelog · Download for Mac Added Full-screen Database plane for WordPress (replaces Command Deck content while open) ⌘K “Open Database panel” for the 22a manage screen without jumping into Adminer Fixed 22a composition: header typography, status strip, Connection grid (incl. Socket), Snapshots table, Danger zone + Automatic snapshot toggles, Engine / Tables / Used by / Not in Continuity aside 22b Browse data chrome (title, Adminer tag, embed bar) matches the artwork Removed Nested panel-block Database chrome under the WP workspace Posted by Rig when this build hit userig.app/changelog. Feedback welcome in Bugs / Feature ideas — private tickets still go to Support.

v1.0.0-beta.50 WordPress control plane matches the artwork: workspace rail, process Browse, Database panel, and ⌘K database actions. Shipped 12 Aug 2026 · Full changelog · Download for Mac Added 21b WordPress workspace layout (web / mysql / https, WP-CLI, rail cards, log source filters) 23a entry routes that fit Command Deck: process Browse, rail Browse data, ⌘K Browse / Snapshot / Copy DSN / Reset Detected vs Rig-managed badges and empty-state copy for Valet-style sites Fixed Database panel Start & browse when the container is stopped Install spine labels, Docker failure side-cards, and done stack bullets (21a) Posted by Rig when this build hit userig.app/changelog. Feedback welcome in Bugs / Feature ideas — private tickets still go to Support.

v1.0.0-beta.49 Adminer data browser no longer dumps a PHP session warning over the layout. Shipped 12 Aug 2026 · Full changelog · Download for Mac Fixed Stop starting PHP sessions before Adminer — that caused ini_set(): Session ini settings cannot be changed and scrambled the embedded UI Auto-login uses Adminer's own auth path, then redirects once into a clean table view Posted by Rig when this build hit userig.app/changelog. Feedback welcome in Bugs / Feature ideas — private tickets still go to Support.

v1.0.0-beta.48 WordPress database opens from the main project deck with Adminer already logged in — no password prompt. Shipped 12 Aug 2026 · Full changelog · Download for Mac Added Browse data on the WordPress workspace control plane (embedded Adminer) Full Database panel sits above the fold for WordPress projects Fixed Adminer auto-login with managed MySQL/Postgres credentials (password via env, never the URL) Wrong WordPress admin username is no longer used for the data browser — uses DB root / project DB user Collapsed “Database, setup & more” no longer hides the primary DB path on WordPress projects Posted by Rig when this build hit userig.app/changelog. Feedback welcome in Bugs / Feature ideas — private tickets still go to Support.

v1.0.0-beta.47 WordPress installs get a default theme and a working /wp-admin/ route under the PHP built-in server. Shipped 12 Aug 2026 · Full changelog · Download for Mac Added Installer activates Twenty Twenty-Five after --skip-content core download Local HTTPS tries brew install mkcert when missing so Chrome can trust site certs Fixed Front page no longer renders blank after one-click install (missing default theme) router.php serves directory indexes so /wp-admin/ opens admin instead of the front page HTTPS proxy strips hop-by-hop headers that can break streamed responses Posted by Rig when this build hit userig.app/changelog. Feedback welcome in Bugs / Feature ideas — private tickets still go to Support.

v1.0.0-beta.46 WordPress sites open on a branded local HTTPS host instead of bare 127.0.0.1, so Open wp-admin no longer hits HTTP on the TLS port. Shipped 12 Aug 2026 · Full changelog · Download for Mac Added Local HTTPS hostnames use {slug}.rig.localhost (still resolves without /etc/hosts) Fixed Open wp-admin after install no longer opens http://127.0.0.1:{httpsPort} (ERR_EMPTY_RESPONSE) HTTPS proxy forwards the public Host / X-Forwarded-Proto so WordPress keeps generating https://… URLs wp-config.php pins WP_HOME / WP_SITEURL for Rig-managed installs and trusts the local HTTPS proxy Posted by Rig when this build hit userig.app/changelog. Feedback welcome in Bugs / Feature ideas — private tickets still go to Support.

v1.0.0-beta.45 WordPress / managed DB installs find Docker Desktop and OrbStack even when Electron’s PATH is incomplete. Shipped 12 Aug 2026 · Full changelog · Download for Mac Added Shared Docker CLI resolver (dockerCli) with Docker Desktop, OrbStack, Homebrew, and login-shell PATH lookup Fixed WordPress install no longer fails at the docker step with spawn docker ENOENT when Docker Desktop is installed but not on the GUI app PATH Managed MySQL / Postgres / Redis and DB snapshots use the same resolved Docker binary Posted by Rig when this build hit userig.app/changelog. Feedback welcome in Bugs / Feature ideas — private tickets still go to Support.

Cloud v0.16.0 Cloud releases now email users, push in-app cloud.release events, sync What’s up next, and verify the live changelog Cloud tab before announce. Shipped 12 Aug 2026 · Full changelog Added Cloud release email (notify-release with product: cloud) to waitlist + registered users In-app / account cloud.release events for every signed-up user (Mac toast without Sparkle) What’s up next forum sync on every ./scripts/release-cloud.sh ship Live releases.json cloud.version check before forum announce (fails if changelog Cloud tab would stay stale) Fixed Cloud ship path covers email + account notify + up-next, not only What’s shipping Posted by Rig when this cloud release hit userig.app/changelog. Feedback welcome in Bugs / Feature ideas — private tickets still go to Support.

Cloud v0.15.9 Mandatory 2FA and passkeys on Cloud, community forum boards on the marketing site, and a dual-track releases railguard so Mac Sparkle cannot drift Cloud changelog again. Shipped 12 Aug 2026 · Full changelog Added Authenticator 2FA enrollment, sign-in challenge, and enforcement policy on Cloud accounts Passkey enroll / sign-in for Cloud (Touch ID / Face ID path on Mac Settings) Public community topic boards on userig.app (forum surfaces wired to NodeBB) Scheduled community content posts (weekday tip / how-to / prompt cadence) Umami analytics SSO gate for staff Bio character counter (600) on the public profile edit field Fixed Cloud changelog + forum What’s shipping stay in lockstep with releases.json cloud track Dual-track railguard: Mac releases refuse to ship if CLOUD_VERSION drifts from releases.json, and refuse to wipe cloud / cloudHistory Public profile About bio uses the full card width Posted by Rig when this cloud release hit userig.app/changelog. Feedback welcome in Bugs / Feature ideas — private tickets still go to Support.

v1.0.0-beta.43 Passkeys on Mac: Touch ID / Face ID enroll and sign-in via a secure Cloud window. Shipped 11 Aug 2026 · Full changelog · Download for Mac Added Sign in with Touch ID / Face ID / passkey from Settings → Cloud account Add and remove passkeys on this Mac (synced with Rig Cloud) Platform-authenticator enrollment for this device’s biometrics Posted by Rig when this build hit userig.app/changelog. Feedback welcome in Bugs / Feature ideas — private tickets still go to Support.

v1.0.0-beta.44 Database panel, bundled Adminer, and deeper WordPress workspace tooling — plus forum announce on Mac releases. Shipped 12 Aug 2026 · Full changelog · Download for Mac Added Database panel for managed MySQL, Postgres, and Redis — snapshots, baseline, table stats, and mid-flight engine switcher Bundled Adminer 6 in the DMG for SQL browsing (loopback-only, per-session token) Redis key browser (SCAN, preview, delete) in the database panel Daily snapshot scheduler while a project database is running WordPress install spine with live progress and retry in New Project WordPress workspace extras: WP-CLI chips, admin creds, plugins/themes, search-replace with dry-run Mac release script posts to community What's shipping again (forum announce + changelog sync) Fixed Public profile About bio uses the full card width Bio edit field shows the 600-character limit with a live counter Posted by Rig when this build hit userig.app/changelog. Feedback welcome in Bugs / Feature ideas — private tickets still go to Support.

Cloud v0.14.1 Cloud Projects show Mac sidebar groups, and the account dashboard ships the Industry paper/ink shell. Shipped 10 Aug 2026 · Full changelog Added Catalog rows expose and persist group id, name, order, and sort order for the Projects table Industry shell across Cloud dashboard tabs (overview through help) Fixed Mac Sparkle releases no longer wipe the cloud changelog track in releases.json Projects table “Ungrouped” until Mac push — API accepts group fields; Mac push on assign/regroup/sync Posted by Rig when this cloud release hit userig.app/changelog. Feedback welcome in Bugs / Feature ideas — private tickets still go to Support.

v1.0.0-beta.8 More MCP linkers and cloud activity. Shipped 24 Jul 2026 · Full changelog · Download for Mac Added MCP linkers for Windsurf & VS Code Activity feed + audit events in cloud Fixed Group start now respects health checks Posted by Rig when this build hit userig.app/changelog. Feedback welcome in Bugs / Feature ideas — private tickets still go to Support.

v1.0.0-beta.9 Share links, fleet update status, safer port reclaim. Shipped 2 Aug 2026 · Full changelog · Download for Mac Added One-click share links with QR (Cloudflare tunnel) Fleet view shows per-device update status Fixed Port reclaim no longer kills unrelated PIDs Posted by Rig when this build hit userig.app/changelog. Feedback welcome in Bugs / Feature ideas — private tickets still go to Support.

v1.0.0-beta.13 Automatic update push: Rig checks for new builds on launch and pings open apps when a release lands. Shipped 28 Jul 2026 · Full changelog · Download for Mac Added Automatic update push on launch Ping open apps when a release lands Posted by Rig when this build hit userig.app/changelog. Feedback welcome in Bugs / Feature ideas — private tickets still go to Support.