keeporg (0.6.0) unstable; urgency=medium

  * Security hardening: the tray and CLI open only the server's own 
    approval page at sign-in; database names that differ in case, or match 
    a file left by a database you lost access to, no longer share a file; 
    renames never replace a file; a save made during a pull is never 
    overwritten; https is required except for this machine 
    (allow_insecure_http); the event stream sends its token in a header; 
    bounded reads from the server; escaped notifications; control 
    characters stripped from terminal output; escaped autostart entries.

 -- Azer Abdullaev <github@reactorcoremeltdown.anonaddy.com>  Mon, 02 Nov 2026 15:26:52 +0100

keeporg (0.5.0) unstable; urgency=medium

  * KeepOrg is now a system tray application: started without a command (or 
    from the applications menu) it shows a padlock whose menu signs in 
    through the browser, lists each database's state, opens the mirror 
    folder, the web interface, the settings and the log, and starts at 
    login. The configuration file now holds every setting (device_label, 
    request_timeout_seconds, ca_file, log_file, notifications), is written 
    in full on first start, and is reloaded when saved. Only one agent 
    synchronizes a mirror directory at a time.

 -- Azer Abdullaev <github@reactorcoremeltdown.anonaddy.com>  Mon, 02 Nov 2026 11:22:07 +0100

keeporg (0.4.0) unstable; urgency=medium

  * keeporg db -delete now asks for your account password

 -- tiredsysadmin <rcmd@garage.rcmd.space>  Fri, 30 Oct 2026 12:54:05 +0100

keeporg (0.3.0) unstable; urgency=medium

  * New `keeporg passwd` command, which changes the account password.
  * Prompts no longer discard typed-ahead or piped input. Every prompt made
    its own buffered reader, so the first one swallowed the rest of stdin
    and any command that asked twice was unusable from a script.

 -- tiredsysadmin <rcmd@garage.rcmd.space>  Fri, 30 Oct 2026 10:45:31 +0100

keeporg (0.2.0) unstable; urgency=medium

  * Server-side merging. A vault the server can open has its two concurrent
    saves folded together in memory, by KeePass's own synchronization rules,
    instead of one being refused. The losing version of an edited entry is
    kept in that entry's history.
  * New vault creation: a web interface at /web, and `keeporg vault -create`,
    both of which build the KDBX file and set its password.
  * Vault keys are stored encrypted under a master key in
    /etc/keeporg/master.key, created on first start. Back it up separately
    from /var/lib/keeporg.
  * The KDBX 4 codec, its merge engine, and the ChaCha20, BLAKE2b and Argon2
    it needs are part of the package; they carry no new dependencies.

 -- tiredsysadmin <rcmd@garage.rcmd.space>  Thu, 29 Oct 2026 17:28:45 +0100

keeporg (0.1.0) unstable; urgency=medium

  * First release.
  * keeporgd: synchronization server with nested group access control,
    invite-link and OIDC registration, built-in TOTP second factor,
    versioned KDBX blobs and server-sent update notifications.
  * keeporg: desktop client that mirrors assigned databases as ordinary
    .kdbx files, pushes every save and applies remote changes, with
    server-wins, client-wins and manual merge strategies.

 -- tiredsysadmin <rcmd@garage.rcmd.space>  Thu, 29 Oct 2026 12:00:00 +0000