> Source: https://docs.nometa.az/changelog/4-2

# SAMURAI 4.2

_Released June 25, 2026._

## Features

- **Changes:** AdvancedFilterBar + per-field URL filtering on the Changes page
- **Changes:** always reflect the time range in the URL (default range=7d)
- **Changes:** animated accordion sections, fixed popover width, Clear on Done row
- **Changes:** calendar date-range picker for custom From/To (react-day-picker)
- **Changes:** changeSearchToMongo DSL->Mongo translator over change_log
- **Changes:** collapse time From/To into the range dropdown (compact toolbar)
- **Changes:** collapsible Quick/Custom time sections (accordion, one open)
- **Changes:** explicit date + time pickers for the custom From/To range
- **Changes:** from/to zone chips + time controls inline in the filter bar
- **Changes:** persist custom time range (start/end) in the URL
- **Changes:** remove client-side triage + reviewed (superseded by server-side filters)
- **Changes:** searchable endpoint-identity + auth-session fields
- **Changes:** single Clear button clears search + time range (drop Reset)
- **Changes:** smooth expand/collapse animation for nested change-detail cards
- **Changes:** Start/End date tabs with sliding animation + auto-advance
- **Changes:** time controls on the filter row + explicit start/end (until bound)
- **Changes:** timeline query parses search DSL, AND-combined with time-range
- **Filters:** searchable field picker in AdvancedFilterBar
- **Proxy:** add proxy.manage permission (admin-only)
- **Proxy:** bind resolve_hostnames in PUT + default ON for legacy configs
- **Proxy:** caching host resolver (DNS) with positive+negative TTL
- **Proxy:** config validation
- **Proxy:** direct + SOCKS5 dialers
- **Proxy:** frontend endpoints + proxy.manage in catalog
- **Proxy:** health probe + status
- **Proxy:** hostname-resolution toggle + resolved-IP in test result
- **Proxy:** persist resolve_hostnames + cache TTL
- **Proxy:** register routes + boot router/health
- **Proxy:** REST handlers + hot-reload
- **Proxy:** route AD/LDAP via proxyrouter
- **Proxy:** route HTTP device connectors via proxyrouter
- **Proxy:** route internet integrations via DefaultDialer
- **Proxy:** route SSH via proxyrouter
- **Proxy:** route vCenter (govmomi) via proxyrouter + scope AD StartTLS
- **Proxy:** router resolves hostname devices to CIDR (lazy, short-circuit-safe)
- **Proxy:** router with pool load-balance, failover, singleton
- **Proxy:** routing config + deterministic resolve
- **Proxy:** settings load/save with encrypted SOCKS passwords
- **Proxy:** Settings Proxy section + wire-in
- **Proxy:** SOCKS5 handshake health check (RFC 1928/1929) instead of bare TCP
- **Proxy:** test endpoint reports resolved IP for hostname devices
- **Proxy:** useProxy hooks
- **Settings:** confirm CORS origin removal
- **Settings:** confirm Telegram bot enable/disable toggle
- **Settings:** roll sticky save bar out to Logging, Network, Notifications
- **Settings:** single sticky save bar per tab (Sync tab)
- **TLS:** accept PKCS#7/.p7b bundles, pick leaf by key match
- **TLS:** add tls.manage permission (admin-only)
- **TLS:** allow re-downloading a pending CSR
- **TLS:** bridge generates cross-platform nginx config (stage B)
- **TLS:** certificate validation + metadata extraction
- **TLS:** cross-platform nginx layout detection (stage A)
- **TLS:** default bridge factory + restore-from-settings
- **TLS:** dropzone accepts .p7b/binary DER (base64) + PKCS7 PEM
- **TLS:** dropzone cert upload + confirm dialogs for enable/disable/regenerate
- **TLS:** encrypted-at-rest settings accessors
- **TLS:** entrypoint TLS seeding, template COPY, ssl tmpfs
- **TLS:** expiry checker with 30/14/7-day alerts
- **TLS:** frontend endpoints + tls.manage in catalog
- **TLS:** http\{}-level root + samurai.d include for generated configs (stage E)
- **TLS:** never expose tls_private_key via the generic settings list
- **TLS:** nginx bridge with rollback-on-reload-failure
- **TLS:** nginx resolver, override setting, status + config endpoints (stage C)
- **TLS:** nginx status alert + folder picker + auto-detect (stage D)
- **TLS:** register /api/settings/tls routes (admin-gated)
- **TLS:** Remove keeps key+CSR; only new CSR replaces the key
- **TLS:** REST handlers for CSR/cert/enable/delete
- **TLS:** restore TLS on boot + start expiry checker
- **TLS:** RSA-2048 key + CSR generation
- **TLS:** Settings TLS/HTTPS tab UI
- **TLS:** show certificate chain + human-readable DNs in status card
- **TLS:** single dropzone auto-splits cert bundle into leaf + chain
- **TLS:** swappable :80 server block (serve vs 301 redirect)
- **TLS:** upload certificate file as alternative to paste
- **TLS:** useTls TanStack Query hooks
- **TLS:** wire TLS tab into Settings (gated on tls.manage)
- **UI:** add shadcn breadcrumb block — slash separator + home icon
- **UI:** add shadcn tooltip block — tooltip-04 rounded
- **UI:** add standard icon to all confirmation dialogs
- **UI:** app tooltips adopt rounded-full style from tooltip-04
- **UI:** Changes date picker → single 2-month range calendar
- **UI:** confirm before Sync All on the dashboard
- **UI:** confirmation dialogs adopt dialog-01 pattern
- **UI:** Dialog primitive adopts dialog-01 header/footer + DialogIcon
- **UI:** dynamic document.title per route
- **UI:** login split-screen, tooltip arrow, Textarea primitive
- **UI:** showCloseButton on DialogContent + adapted dialog-01 block
- **UI:** standardize form dialogs to dialog-01 pattern
- **UI:** Topbar breadcrumb uses slash separators

## Bug Fixes

- **Changes:** bulk-expanded cards use the vendor renderer, not generic
- **Changes:** escape regex meta in search; export honors until; drop dup count
- **Changes:** keep field-scoped quoted phrases intact in the search parser
- **Changes:** write time-range URL params in one effect (start+end, drop range)
- **Database:** add standalone change_log.timestamp index
- **Filterbar:** removing a chip re-applies the filter (updates URL + results)
- **Monitor,sync:** close probe keep-alive leak + route sync gate via proxy
- **Monitor:** route device health checks through the proxy
- **Proxy:** assert literal-IP skips DNS; cover off/override short-circuit; skip DNS when no rules
- **Proxy:** context-wrap errors + testable buildPersistProxy seam (plaintext-never-persisted)
- **Proxy:** defensive-copy resolved IPs + test empty-result negative cache
- **Proxy:** guard health-cancel race; 500 for DB faults; device-not-found + nil-slice view
- **Proxy:** keep focus while editing per-device override id
- **Proxy:** move Save to a sticky bottom bar (was confusing at top of the long tab)
- **Proxy:** probe loop owns health (no dial-path demotion); drop dead mu; cache disabled router; race test
- **Proxy:** reject enforce_all without a pool + empty pools; cover misroute cases
- **Proxy:** route LDAP auth service via proxyrouter; device-id route test without target
- **Proxy:** show pool label (not uuid) in route errors + test results
- **Proxy:** test endpoint resolves device IP like sync (url-host fallback)
- **Proxy:** vCenter DialTLSContext (govmomi bypass), AD SNI hostname, ISE skip-verify
- **Settings:** move Enable-HTTPS toggle out of section header into body
- **Settings:** register SyslogTab + CorsOriginsTab into the tab save bar
- **Settings:** reserve scroll space so content clears the sticky save bar
- **Settings:** Telegram bot-config save button uses "Save Changes"
- **Settings:** wrap SettingsSection tooltip in TooltipProvider
- **TLS:** absolute samurai.d include in nginx.windows.conf (relative glob unreliable on Windows nginx)
- **TLS:** clean nginx restart on Windows (reload leaves stale workers serving old config)
- **TLS:** CN-into-SAN, not-yet-valid check, chain + CertInfoFromPEM tests
- **TLS:** correct nginx rollback for renewal + fresh key perms + tests
- **TLS:** exclude duplicate leaf from chain; surface PEM parse errors
- **TLS:** keep confirm dialogs open during mutation (preventDefault)
- **TLS:** nginx -t config test before Windows restart (don't kill nginx on bad config)
- **TLS:** nil-SAN guard, delegated tls.manage redirect, AlertDialog, error state
- **TLS:** only mark expiry threshold alerted on email success
- **TLS:** preserve pre-mounted certs on boot, Disable rollback, surface CSR, propagate disable error
- **TLS:** propagate cert-subject marshal error
- **TLS:** Remove always clears DB; skip nginx revert when not enabled
- **TLS:** surface Disable error in DeleteTLS + use response envelope for CSR
- **TLS:** try PKCS#7 parse on any DER block that fails x509 (mislabelled .p7b)
- **UI:** FMC AddFTD Dialog shadow-state so exit animation plays
- **UI:** keep tooltip change surgical — arrow only, no app-wide max-width