{"body":"\nWeb serving. Files, directories, adapter documentation and the changelog are\nreachable at node-prefixed addresses on the local server, and an address that\nnames another machine in the subnet is answered by the machine that owns it.\nMessages can carry attachments the receiver pulls on demand, every message\ngets a short ID to show or reply to, and a machine with no spt on it can be\nhanded the binary over the local network. The `XFER` access surface is retired.\n\n### Added\n\n\n- `spt serve add`, `spt serve rm`, and `spt serve list --json` manage live file\n and directory references. Same-name registrations receive stable numbered\n suffixes; removing an entry never deletes its source. Only the same absolute\n path and kind may reclaim a retired name.\n- Every registered adapter gets a core-owned `web/` output directory.\n `[adapter].web_short_path` optionally gives it a short URL alias. Removing\n an adapter stops serving its output without deleting the files.\n- `spt adapter add` names each manifest key it does not know on stderr\n (`manifest: unknown key []. (ignored)`) and still registers;\n a misspelled optional key is no longer visible only by its absence.\n\n- `WEB` joins the access-control vocabulary. It is open by default within the\n subnet, but explicit WEB denies still govern. Existing file transfer is\n unchanged.\n\n- A served resource's URL now works from every machine in the subnet: a\n request for `//…` on the local loopback server is answered by the\n owning node through the local daemon. The body streams and nothing is\n cached; `HEAD` and `Range` requests are honored by the owner. An owner\n that refuses answers 403 naming `WEB`; an owner that cannot be reached\n answers 502 naming the node, within a bounded time.\n- `spt send --attachment ` sends a file with a message. The file's bytes\n are captured as they are at send time, so later edits or a deletion do not\n change what arrives, and the receiver pulls them with `spt fetch` when it\n wants them. `--ttl` sets how long an attachment stays available (default 30\n days, a unit is required); expired attachments answer 404 immediately.\n- Every message now carries a short ID. `spt msg show ` prints a message by\n it, and `spt send --reply-to ` marks what a message answers. Messages\n from another machine resolve through the machine that holds them.\n- `spt serve lan --bootstrap` hands the spt binary to a machine that is not yet\n a node, over the local network on port 5470. It is off by default and off\n again after every daemon restart, serves only the binary, its release sidecar\n and an install command, and refuses to start by name when the applied update\n set is not signed or does not match. It prints a checksum per platform, and\n `spt install` gains `--expect-sha256` and `--release-json` so what was\n downloaded can be compared before it is run. The documentation port is\n untouched and stays on loopback.\n- `[adapter].docs_dir` publishes an adapter's own documentation at the `docs`\n segment of its address, beside the adapter's output directory rather than in\n place of it. A missing key, an unreadable manifest, a path that escapes the\n adapter's directory, and a directory that has since been removed all answer\n the same 404 naming what was asked for.\n- The changelog is now one of the pages the local documentation server offers.\n- A harness is told when a message it receives refers to a file the reader\n cannot open — an attachment to pull, or a path that belongs to another\n machine — instead of leaving the reader to discover it. For a path on\n another machine, that machine can be asked to publish it and answers with a\n link; it honors such a request only for its own endpoints, so no third\n machine can have someone else's file exposed.\n\n### Changed\n\n\n- The loopback HTTP server now has a node-prefixed resource index with HTML\n and `?json` views. `/` redirects to `//`; canonical docs URLs live at\n `//docs/`, while existing bare docs paths remain compatibility aliases.\n\n### Removed\n\n- The `XFER` access surface is retired: attachments replaced the transfer it\n gated, so the entry leaves the access-control vocabulary along with the\n transfer itself. An existing rule that names `XFER` is kept and reported at\n load rather than dropped silently; it no longer governs anything. The shell\n channel's own transfer progress is unaffected.\n\n### Fixed\n\n\n- Messages delivered by `spt api listen` now reach the receiver's incoming-message\n history and last-message state, for both queued backlog and live TCP delivery.\n A later hook poll does not record those deliveries again; filtered notifications\n are not recorded as delivered messages.\n- A node's message and activity history reads back correctly once its log grows\n past a quarter of a megabyte. Positions no longer restart from the beginning,\n so a request for everything since a given point no longer comes back empty or\n repeats entries that were already seen, and an oversized position is answered\n with the current head instead of skipping a page.\n- An agent's own saved context is no longer overwritten, unread, by the\n automatic summary that follows it. The automatic summary is filed directly\n and never writes to the file an agent saves its own context to.\n- `spt api bind` no longer prints an engine-room probe line on a machine that\n has no engine room.\n\n","publishedAt":"2026-09-09T09:36:41Z","tagName":"v0.68.0","url":"https://github.com/BigscreenVR/spt-bs-releases/releases/tag/v0.68.0"}