Changelog

All notable changes to this project will be documented in this file.

[Unreleased]

Custom Domains: Added expose --domain plus sealtun domain set/clear; custom domains are attached only after CNAME ownership verification.
Certificate Resources: Custom-domain tunnels now create cert-manager Issuer and Certificate resources and keep the Sealos host as the CNAME target.
Custom Domain Diagnostics: inspect --remote and sealtun domain verify report DNS CNAME, Ingress host/TLS, and custom-domain certificate status.
Domain Readiness Wait: Added expose --wait-domain and sealtun domain verify --wait for explicit DNS, Ingress attachment, and certificate readiness waiting.

Custom Domain Safety: Reject IP/custom domains that point at generated or reserved Sealos hosts, require verified CNAME before writing custom hosts to Ingress, validate wait timeouts, and include Ingress host/TLS plus certificate DNS names in readiness checks.
Cleanup Reliability: Tunnel cleanup now always attempts Sealtun-owned Certificate, Issuer, and TLS Secret deletion by tunnel ID, even if local custom-domain session metadata is missing.

Region Management: Added sealtun region list, sealtun region current, and sealtun region use for built-in Sealos Cloud regions.
Sealos Domain Discovery: Login now fetches Launchpad init data and stores SEALOS_DOMAIN for ingress host generation.
Diagnostics Controls: Added list --check for local target port probing and inspect --remote for opt-in Kubernetes diagnostics.

Session Health Model: inspect and doctor now report degraded tunnels when the tunnel owner is alive but the local target port is unreachable.
Legacy Migration: First-run migration from ~/.sealos now copies only auth and kubeconfig files, not old tunnel session records.
Region Contract: Login now accepts only built-in regions to avoid partially supported custom region endpoint combinations.

Login Browser URL Handling: Device authorization URLs are selected before printing and are restricted to safe http/https schemes.
Doctor Reliability: Remote diagnostics now use bounded worker scheduling to reduce noisy timeout cascades on slow clusters.
Cleanup Safety: Cleanup paths use session-scoped kubeconfig data and avoid broad app-deploy-manager label deletion.

Session Management: Added sealtun status and sealtun logout commands for inspecting and clearing the local login session.
Structured Status Output: sealtun status now supports --json output and reports kubeconfig context, cluster, namespace, and local warning conditions.
Test Coverage: Added unit tests for expose validation, auth config lifecycle, and tunnel unavailable responses.

Configuration Directory: Standardized auth storage under ~/.sealtun and added automatic migration from the legacy ~/.sealos path.
Expose Validation: sealtun expose now validates the local port and protocol before provisioning remote resources.
Readiness Handling: Added a configurable --ready-timeout for waiting on the remote tunnel pod.

Tunnel Error UX: When the local app is not listening, public requests now return a Sealtun-branded status page explaining that the local port is offline.
Kubernetes Apply Semantics: Resource reconciliation now distinguishes NotFound from real API errors when creating or updating Deployments, Services, and Ingresses.

Authentication: Fully aligned login flow with sealos-auth.mjs using OAuth2 Device Grant.
Browser Integration: Automatic browser opening for a seamless authorization experience.
Configuration Management: Unified storage under ~/.sealos directory, consistent with the Sealos ecosystem.
Workspace Identification: Robust automatic detection of private workspaces (supports both numeric and string nstype).
Release Automation: Integrated GoReleaser for automated multi-platform binary builds (Linux, Windows, macOS).

Ingress Logic: Resolved TLS certificate verification issues by ensuring one-level subdomains with the .sealosgzg.site suffix.
Protocol Mapping: Optimized backend-protocol rendering to default to HTTPS and only apply special mappings (like GRPC or WS) when explicitly requested.