Skip to main content

0.2.2

Security hardening for the local daemon, a simpler rule for which environment a command runs in, web setup for chat bots, and a lighter, safer install.

Install​

curl -fsSL https://github.com/ElanvitalAI/elanous/releases/latest/download/install.sh | bash   # one line

npm had not been updated for 0.2.2; the one-line installer above is the way to install this release.

Security​

  • The daemon no longer hands out its admin token over HTTP. connect-info returns no token; a new device pastes its token once.
  • Every /v1 route now requires authentication by default. Previously a few read routes (including the notes vault search) and several settings/control writes could be reached without a token.
  • Telegram and Discord bot tokens are stored once, in the secrets store, and referenced from config — no more plaintext tokens in config.json.
  • Isolated (test) environments no longer receive copies of production secrets: plaintext secret fields are stripped, outbound credentials (chat bot tokens, web-push keys) are left out of the copied secrets file, and copies are written 0600.
  • elanous doctor reports configuration and secret files that other users could read, and elanous doctor --fix --yes tightens them (the folder to 700, files lose group/other bits; nothing is read).

Changes​

  • Which environment am I in? The rule is now: an explicit root (--test, --config-dir, ELANOUS_STATE_DIR) wins; otherwise the installed copy is production and any source checkout is an isolated environment. The old "leader tree" setting is gone. elanous where shows the answer and why.
  • Web setup — connect Telegram and Discord bots from the web app (token check, secrets store, allowed users), pick the Obsidian vault and skills, and choose the answer depth. A device that is not yet connected now says so once instead of failing silently.
  • Install and update — installing or updating from a source checkout builds the web app first and stops if the build fails, so the installed web app always matches the code.
  • Test daemons never take production ports. A test daemon started without --port leases a port from the test band; production ports are never chosen.
  • Resource coordinator (preview) — elanous control serve runs a small coordinator that answers "where is this resource running?" (elanous resources list|where), bound to loopback or a tailnet address, with per-machine scoped tokens.
  • Codex accounts — the shared default account is used only up to 60% by default (a stricter global threshold still wins), and rotation moves to the next account with room.
  • Intake — a daily intake pipeline collects items (videos, saved Telegram messages, trending GitHub repositories), queues them with a daily cap, and absorbs them into notes.
  • Many fixes found by installing on bare Ubuntu 26.04 and macOS machines.

Notes​

  • If you set dashboard.uiMode or used --rich, they still load without error; the terminal UI is being simplified to a single essential layout in upcoming releases.