v1.4.0

Changed

• Quitting the TUI no longer asks about the daemon when it attached to one that was already running, such as a service or runwisp tui. The keep running / shut down choice only appears when the TUI started the daemon.
• Release binaries and Docker images are now built with Go 1.27.1, and the bundled SQLite driver, Docker client and other dependencies are on their latest releases.

Fixed

• Web UI pages now show loading skeletons while data arrives, instead of flashing a blank screen, a false “No runs yet”, or the task you just left.
• The TUI shows run and next-run times in the daemon’s timezone, even when it runs in a container or under a service user in another zone.
• The TUI sorts task groups by group name and shows a task’s description in its detail view (i).
• The TUI reconnects to the run-event stream when the daemon was not ready at the first retry, search results jump to the matching log line, and older log lines load when you scroll to the top with the mouse wheel or on a rotated log.
• Changing the run list’s status filter in the TUI now clears the run selection, so bulk actions only touch runs you can see.
• Stopping a run, or a selection of runs, now follows manual_trigger = false the same way stopping its task does.
• /metrics follows runwisp reload, and answers 500 when the run totals can’t be read instead of reporting zeros.
• A log or event stream past the connection limit now gets 503, and a log stream for an unknown run gets 404.
• Unknown /api/ paths now return a JSON 404 instead of the web UI page.

Security

• Behind trusted_proxies, the client IP is now the first address from the right of X-Forwarded-For that isn’t a trusted proxy, so the login and hook rate limits apply per real client.
• With RUNWISP_AUTH=off, state-changing requests that a browser marks as coming from another origin are now refused.
• Compose-backed services no longer hang on start when the Docker engine stops responding; the leftover-container check now gives up after 10 seconds.