Skip to content

v0.2.0 Release Notes

Release Date: 2026-08-02

This release adds the JSON API and WebSocket server planned in docs/specs/ui, giving other tools (a future TUI, editor extensions, dashboards) remote read access to daemon state and the ability to terminate processes without shelling into the CLI. It also cleans up the HTTP server configuration and restricts CI to macOS, matching what the module can actually build on.

Highlights

  • JSON API & WebSocket: Remote status, policy, and process visibility with real-time updates
  • Single --addr flag: --metrics and --api now share one HTTP server address instead of two overlapping, easily-confused flags
  • macOS-only CI: Go CI, lint, and SAST now run on macos-latest only, matching the module's darwin-only build constraints

Breaking Changes

  • --metrics-addr and --api-addr are removed. Use --addr for both --metrics and --api — see CLI Reference. Previously --api-addr defaulted non-empty and always won, so --metrics-addr was silently ignored outside an undocumented --api-addr "" workaround; the new single flag removes that trap entirely.

Added

  • JSON API server: GET /api/status, /api/policies, /api/policies/{name}, /api/processes, /api/processes/{name}, POST /api/terminate — see the JSON API Guide
  • WebSocket endpoint (GET /api/ws) broadcasting status updates every 2 seconds and termination events
  • --api flag to enable the JSON API server
  • Daemon Snapshot/Decisions/IsOnCooldown accessors and a Terminate method backing the API
  • Executor.Term/Kill helpers for direct SIGTERM/SIGKILL by PID
  • /health liveness endpoint, now registered whenever --metrics or --api is enabled (previously gated behind --metrics only)

Changed

  • --metrics and --api now share a single http.Server and ServeMux instead of a dedicated metrics-only server

Fixed

  • Diagnostic and config file writes restricted to 0600 permissions
  • gosec false positives on integer-derived exec args suppressed with justification comments
  • Unused error return removed from captureSamples
  • Widened the diagnostics timestamp test tolerance to reduce flakes on slow CI runners

Dependencies

  • Added github.com/gorilla/websocket for the WebSocket API
  • Bumped github.com/prometheus/client_golang to v1.24.1

Build

  • Go CI, Lint, and SAST workflows restricted to macos-latest — internal/platform (and everything importing it) is darwin-only with no Linux/Windows implementation

Documentation

  • UI PRD, TRD, PLAN, and ROADMAP specs for the JSON API/WebSocket/TUI work (docs/specs/ui/)
  • JSON API section in the README and a new JSON API Guide
  • MkDocs documentation site scaffolded under docs/, published at plexusone.dev/workloadguard

Upgrade Guide

If you run WorkloadGuard with --metrics-addr or --api-addr, switch to --addr:

# Before
workloadguard run --metrics --metrics-addr :9090
workloadguard run --api --api-addr :9090

# After
workloadguard run --metrics --addr :9090
workloadguard run --api --addr :9090
# or both on one server:
workloadguard run --metrics --api --addr :9090

Learn More

See README.md or the documentation site for full documentation including configuration examples, CLI reference, and architecture overview.