Changelog

Per-page first-time walkthrough

• • First-time tour is a short walkthrough on each page instead of one card on the Dashboard
• • Next / Back move between Dashboard, Agents, Offsite, Jobs, Schedules, Restore, Settings, Security, License, and Users
• • Dashboard step includes the populated fleet screenshot from reaverbackup.com; Tour in the page header replays that screen
• • Skip tour still dismisses the whole sequence; existing installs that already have a successful backup are not prompted again
• • CDN package reaver-dashboard-0.3.25 published (bundled agent 0.2.33; agent channel 0.2.33)

Solo plan plus paid-only API and MCP

• • Solo (1 site, 1 offsite destination) is recognized in dashboard entitlement, labels, and telemetry
• • REST API and built-in MCP server require a paid plan (Solo and above); Free and unlinked installs get 403 plan_required
• • Security → API tokens and MCP server show an upgrade prompt on Free; existing tokens stop working if the plan lapses

Discover non-WordPress vhosts as Web sites

• • Discovery adds nginx/Apache vhosts as sites: WordPress or Web (non-WP document roots)
• • Hostname is stored on the site row; manual custom paths keep their display name
• • First backup of a Web site asks whether to include MySQL or SQLite (wp-config is not used)
• • Bundled agent 0.2.33

Discovery reports path + URL for every vhost

• • Agent discovery lists nginx/Apache document roots whether or not they are WordPress, with server_name and TLS
• • Non-WP roots are reported so the dashboard can add them as Web sites; existing custom-path rows keep their name and pick up the hostname
• • CDN agent package reaver-agent-0.2.33 published

Public health URL from nginx server_name

• • Agent discovery reports nginx/Apache vhosts (server_name + TLS) for every document root, not only WordPress
• • Dashboard stores that hostname on matching sites — including custom-path rows like a renamed “WHC Website”
• • Health checks use the vhost hostname (HTTPS when the vhost is TLS); missing URL shows Needs URL instead of Unreachable
• • HEAD that is not 2xx/3xx falls back to GET (WAFs that reject HEAD no longer look down)
• • Bundled agent 0.2.32 (upgrade the agent, then Rescan sites)

Report nginx vhost hostnames for public health

• • Discovery includes vhosts: document root, server_name list, and whether the block is TLS
• • Custom-path sites on the same root pick up a public URL after Rescan

Public reachability checks from the dashboard

• • Optional per-site Public health check (off by default): the dashboard probes the site URL every 5 minutes (HEAD, then GET; 2xx/3xx = up)
• • URL from nginx/Apache server_name reported by the agent (HTTPS when the vhost is TLS), including custom-path sites; optional custom health-check URL override
• • Fleet cards show a public status indicator, response time, and 24-hour uptime %; site detail has last check, last result, toggle, and Check now
• • Email after 15 minutes unreachable (existing PHPMailer); optional per-site recovery notification
• • Clear labeling that this is public reachability measured from the dashboard, not the backup agent
• • Rolling 24-hour check history for the uptime percentage

Public API, built-in MCP server, and outbound webhooks

• • Public control-plane API at /api/v1: hashed rv2_ Bearer tokens with scopes read, backup, restore, and admin (Security → API tokens)
• • Reads for sites, snapshots, jobs, agents, schedules, and destinations (dest_id / name / type only — never dest keys or restic passwords)
• • Queue the same jobs as the UI: validate/backup, backup-all, run a schedule, configure a site repo, restore (confirm_slug required), export, and host preflight
• • OpenAPI 3.1 at GET /api/v1/openapi.json (token required); no cookies; CORS denied
• • Optional chat-app server at POST /api/v1/mcp (off until Security → MCP server). Same permissions as the API token
• • Remote MCP clients (Claude, Cursor, LibreChat, Open WebUI) use OAuth 2.1 + PKCE against this install — sign in, approve a scope, receive an rv2_ token
• • Outbound webhooks (HMAC X-Reaver-Signature, outbox flushed by the schedule runner) for backup.*, restore.*, job.*, and agent.* events
• • Offsite dest list shows summed restic repo size and optional plan size / used %
• • Agent preflight job (dest reachability, local/SSH disk, optional MySQL) via POST /api/v1/preflight
• • Security → MCP server stays closed on load (On/Off badge still shows when enabled)
• • Agent card Update button stays gone after a successful upgrade (version recorded on job complete so it does not look failed)
• • CDN package reaver-dashboard-0.3.20 published (bundled agent 0.2.31; agent channel 0.2.31)

Hung worker self-restarts; no 4-hour backup cap

• • Sibling liveness watchdog kills a frozen worker so systemd Restart=always recycles the service (data/worker.liveness, REAVER_WATCHDOG_STALE)
• • Local restic, mysqldump, mysql import, and ssh df no longer block forever without a timeout
• • Backup/restore have no default 4-hour wall-clock cap; stall detection is idle I/O (~15m of silence) plus the liveness file
• • Preflight job type (dest reachable, local/SSH disk, optional MySQL)
• • CDN agent package reaver-agent-0.2.31 published

Proprietary LICENSE/NOTICE, copyright in UI, first-backup onboarding

• • Ship proprietary LICENSE and NOTICE (Bean Local, LLC) in the repo, dashboard package, and agent package — not open source
• • Footer and auth pages show copyright plus Terms/Privacy links; operator License guide documents software copyright vs account license
• • composer.json marks license as proprietary
• • First-backup walkthrough stays visible until dismissed or a successful backup exists; steps cover agent install, discovery, storage, and first run
• • Clear staged agent packages under data/agent-packages/ when older than the bundled agent/ tree so serving version tracks the install
• • CDN package reaver-dashboard-0.3.19 published (bundled agent 0.2.29; agent channel 0.2.29)

LICENSE and NOTICE ship with agent package

• • Agent tarball and install managed top-level files include LICENSE and NOTICE (proprietary copyright)
• • CDN agent package reaver-agent-0.2.29 published

Schedule retention that actually prunes, timezone-aligned labels, discovery cleanup fix

• • Schedule retention is applied after successful backups (agent 0.2.26–0.2.28): frequency-aligned restic --keep-daily / --keep-hourly / --keep-weekly / --keep-monthly, with days or hours unit in the Schedules UI
• • Site Run with an enabled schedule on that destination acts as a schedule run (same retention + advance last/next so the clock does not double-backup)
• • Backup/snapshot labels, archive timestamps, and export filenames use Settings → Schedule timezone
• • Fixed discovery/board sweep that deleted reachable WordPress sites with no site_repos yet (test sites vanishing after report)
• • Auto-cleanup of discovered WP sites only when gone from host and zero restic bindings remain
• • CDN package reaver-dashboard-0.3.18 published (bundled agent 0.2.28; agent channel 0.2.28)

Frequency-aligned snapshot retention (keep-daily / keep-hourly)

• • Post-backup forget uses --keep-daily / --keep-hourly / --keep-weekly / --keep-monthly from schedule frequency so one period keeps one snapshot
• • Accepts retention_keep_flags from dashboard for multi-schedule destinations
• • CDN agent package reaver-agent-0.2.28 published

Retention keep-within supports hours and days

• • Agent accepts retention_keep_within (e.g. 48h, 10d) and retention_unit hours|days for post-backup forget --prune

Schedule retention actually prunes restic snapshots

• • After a successful backup, agent runs restic forget --keep-within Nd --prune using the job’s retention_days (was stored on schedules but never applied)
• • Manual Run inherits the longest enabled schedule retention for that site + destination so on-demand backups still prune
• • Retention is a day window, not a max snapshot count (hourly jobs keep multiple snaps per day within the window)

Gone-from-host site lifecycle, chunked agent exports, and SMTP recipient guidance

• • WordPress host presence is discovery reachability, not agent online: site cards show Gone from host / Not on host when the path is no longer WordPress, without hiding that state behind a live agent heartbeat
• • Operator Remove on a gone site: destroy every known restic repo for the site (confirm slug), then drop schedules, repo bindings, snapshots, and the sites row when destroys finish (or immediately if no repos remain)
• • Auto-cleanup of discovered (non-custom) WordPress sites with zero restic bindings after repo maintenance, destroy purge, discovery, and board loads so empty inventory cannot stick forever
• • Agents → Rescan sites queues on-demand discovery on all agents; discovery report marks unreachable sites and can remove them when nothing remains to keep
• • Agent archive export is chunked end-to-end (export_start / export_chunk / export_finalize): merge into permanent Stored archives, clearer 413 when PHP discards oversized multipart bodies, agent auth via body or X-Reaver-Agent-* headers
• • SMTP alone does not choose recipients: post-save success text, Settings banner, SMTP card next-step checklist, and docs note that digests/alerts need a notification email (or global recipients) or they are skipped
• • Jobs page summary stats use fleet-style filter chips; Offsite / Schedules / Settings headers aligned with the rest of the shell
• • Search/filter fields use type=search plus password-manager ignore attributes so 1Password/LastPass stop treating site filters as login forms
• • CDN package reaver-dashboard-0.3.17 published (agent channel 0.2.25)

Chunked export upload, faster discovery, and on-demand rescan jobs

• • export_archive always uploads via chunked transfer with per-chunk progress (throttled status lines) and returns structured ok/message/error for accurate job completion text
• • Handles discovery / rescan_sites / site_discovery job types so dashboard Rescan sites runs the same inventory path as the periodic scan
• • Default discovery interval is 5 minutes (was 1 hour; REAVER_DISCOVERY_INTERVAL still overrides, minimum 60s) so removed WordPress installs surface quickly
• • When a backup finds a WordPress path missing or no longer valid, the agent runs discovery immediately so the dashboard can mark Gone from host without waiting for the timer
• • CDN agent package reaver-agent-0.2.25 published

Purge site/repo metadata after successful destroy_repo

• • Fixed handle_destroy_repo_job_completed reading an already-decoded job payload as a string (cast became "Array"), which dropped purge_metadata_on_success and left snapshots/site_repos rows after a successful destroy
• • Destroy jobs still purge metadata when the flag is missing but job_type is destroy_repo
• • Same post-complete purge hook on api/jobs.php status terminal path (webhook complete path unchanged)
• • CDN package reaver-dashboard-0.3.13 published

Fix SSH repository destroy auth and destroy job return type

• • destroy_repo over SFTP now uses the same SSH options as restic backups (IdentitiesOnly=yes, publickey-only, ConnectTimeout) so ssh-agent keys cannot exhaust MaxAuthTries before the destination identity is tried
• • Passphrase-protected Offsite keys unlock via SSH_ASKPASS during destroy (same as backup)
• • execute_destroy_repo_task always returns bool (fixes TypeError: Return value must be of type bool, array returned after a failed destroy)
• • CDN agent package reaver-agent-0.2.23 published

Optional per-repo restic encryption with liability waiver and account backup

• • Configure repository modal before first backup/schedule: choose none or encrypted per site and destination
• • Encrypted mode generates a high-entropy restic key, stores it encrypted on the dashboard, injects it JIT into agent jobs, and includes it in recovery bundle v2
• • Install-wide liability waiver + recovery-bundle ack required before the first encrypted repo; versioned text audited on accept
• • Dashboard POSTs waiver accepts to the linked website account (POST /api/encryption-waiver.php) on accept, license link/refresh, and schedule cron retry; fail-open if the website is unreachable
• • Settings → Restic encryption shows local waiver status and website sync state
• • SMTP: clearer decrypt/auth failure messages when the mailbox password cannot be unlocked
• • WordPress DB dump/restore E2E closed (complete restore on a new host verified)
• • CDN package reaver-dashboard-0.3.12 published (agent channel unchanged at 0.2.22)

Running restic repository size for storage headroom

• • Fleet Size shows restic repository storage (stats --mode raw-data), not only the last snapshot’s logical size
• • Agents measure repo size after each backup and during inventory resync; dashboard stores repo_size_bytes per site+destination
• • Success emails prefer repository size when available
• • CDN packages reaver-dashboard-0.3.11 and reaver-agent-0.2.22 published

Two-phase restore and MySQL setup for clean-host / reassign DR

• • Restore is two-phase: Restore snapshot restores files and checks MySQL; if the database is ready, database.sql is imported in the same job
• • When MySQL is not ready, the job stops after files and surfaces a stable yellow MySQL setup panel under Active job (not only a one-line status)
• • Option A: paste complete MySQL admin SQL built from wp-config credentials (CREATE DATABASE, CREATE USER IF NOT EXISTS, ALTER USER, GRANT) — CREATE + ALTER both included so password matches wp-config even if the user already exists
• • Option B: enter new database name/user/password/host; agent updates wp-config.php (with .reaver-bak.*) then Import database only
• • Import database only job (import_database) finishes phase 2 without a second restic restore; panel clears after successful import or Dismiss
• • Jobs list sorted by job id only (newest first)
• • Site reassign no longer lost to discovery: agents cannot steal ownership of sites assigned to another agent
• • Agents page sites column focuses correctly after reassign (reload then filter; hardened agent_id matching)
• • Agent packages 0.2.12–0.2.21 on the CDN channel (deps install, two-phase restore, full SQL meta, credential rewrite, CREATE/ALTER explanation, inventory JSON safety)
• • CDN package reaver-dashboard-0.3.10 published; operator docs updated (restore-repository, restore-active-job, agents-reinstall, jobs)

Dashboard upgrades preserve job history; safer install overlay

• • Fixed a class of upgrade issues where job history could appear wiped: in-app and install.sh upgrades now hard-exclude live data/, logs/, and backups/, never use rsync --delete on those trees, and refuse to overlay runtime state from the package
• • Before applying a dashboard package, snapshot data/dashboard.sqlite (and WAL/SHM when present) under data/upgrade-safety/; after apply, verify file size and jobs row count and restore from the snapshot if the live DB was clobbered or emptied
• • install.sh upgrade path preserves data/, logs/, and backups/ (previously only data/ was left in place; logs/ and backups/ were moved into .bak.* and not restored)
• • Release tarballs no longer ship an empty data/ tree (or agent/data) — runtime dirs are created on the host only
• • JobQueue and auth always open the same dashboard.sqlite path as the rest of the app ($DATA_DIR / reaver_dashboard_sqlite_path())
• • CDN package reaver-dashboard-0.3.9 published

Independent agent package CDN channel and Spaces file-sync hang fixes

• • Agent packages can ship without a full dashboard release: public CDN layout releases/agent/latest.txt, versioned reaver-agent-*.tar.gz, and SHA256SUMS (parallel to releases/dashboard/)
• • Dashboard checks the agent CDN daily (scheduler) and from License → Software version / Settings → Agent updates; Download & stage stores a verified package under data/agent-packages/ and serves it via download_package when newer than the bundled tree
• • Maintainer tooling: install/build_agent_release.sh and publish_agent_release.php for agent-only publishes
• • Agent 0.2.10: reduce Spaces/S3 mid–file-sync stalls — throttle dashboard progress HTTP during restic backup, short curl timeouts, process idle stall watchdog, explicit restic --stuck-request-timeout, cap retained JSON progress buffers
• • Agent 0.2.11: reliable logging to logs/agent.log and systemd journal (journalctl -u reaver-agent); startup line reports log path and writability; unit sets StandardOutput/StandardError=journal
• • CDN package reaver-dashboard-0.3.8 published (includes agent channel UI); agent packages 0.2.10 and 0.2.11 published on the agent channel

Stable machine-scoped installation identity

• • installation_id is derived from a hash of the host machine-id plus data directory path (when available) so reinstall on the same machine/path reconnects license site usage instead of creating a duplicate install
• • License link/verify reports machine_id host fingerprint; website reconnects the prior install row when the id is new but the host matches
• • Admin → Users → Usage can Remove orphan install rows that inflate site totals after reinstalls
• • Anonymous telemetry install_id uses the same machine-stable derivation when possible
• • Existing license.json ids are preserved; only new installs and wiped data dirs get the deterministic id
• • CDN package reaver-dashboard-0.3.7 published (CDN retains 3 newest releases)

Fix WordPress database backup/restore and agent package upgrade control

• • Fixed WordPress backups omitting the MySQL dump: agent again reads credentials from wp-config.php, runs mysqldump into the site tree as database.sql, includes it in the restic snapshot, then removes the dump from the live web root
• • Fixed restore path that reported database restore while doing nothing: restore now imports database.sql with the mysql/mariadb client using restored wp-config credentials, then removes the dump; job fails if dump or import fails
• • Fixed agent cards showing an update available with no way to apply it: Upgrade queues an agent_upgrade job so the agent can pull the dashboard package and restart (agents that already understand agent_upgrade)
• • Agent package track 0.2.9 bundled with these corrections
• • CDN package reaver-dashboard-0.3.6 published

Repo inventory resync, restic no-password policy, systemd schedules

• • After discovery or reconnect, agents resync local and offsite restic snapshot inventories so restore lists and site_repos repopulate without a blind re-init
• • Product policy: restic client-side encryption is off (--insecure-no-password); offsite at-rest uses provider SSE; legacy REAVER_RESTIC_CLIENT_ENCRYPTION=1 for old password-protected repos
• • Installer prefers hardened systemd timer reaver-schedules.timer for the schedule runner (cron fallback); production profiles under install/profiles/
• • Agent presence: clearer host_ip vs public_ip handling; inventory targets API for resync
• • Agent package track 0.2.8 bundled; docs for reinstall/DR and schedules updated
• • CDN package reaver-dashboard-0.3.5 published

Settings groups, SMTP password mask, and in-dashboard changelog

• • Settings page groups related cards under labeled sections (Your preferences, Backups & repositories, Email & notifications, Agents & jobs, Privacy & diagnostics)
• • SMTP password field shows a filled mask when a password is already saved so operators can see a secret is stored
• • Leaving the mask unchanged keeps the existing SMTP password; typing a new value replaces it
• • License → Software version: Changelog / What's new modal with release notes
• • Dashboard and website share the same live changelog JSON (https://reaverbackup.com/data/changelog.json), with local cache and offline bundled fallback
• • Versions newer than the running install are marked Available so you can read notes before upgrading
• • CDN package reaver-dashboard-0.3.4 republished with these updates

Anonymous product statistics heartbeats

• • Dashboard sends limited anonymous product stats (schema version 2) to the Reaver website API for product prioritization
• • Default on for all editions; opt out anytime under Settings → Product statistics
• • Stable local install_id in data/telemetry.json (separate from the license token)
• • Coarse metrics only: version, PHP/OS family, site and agent counts, destination types, backup success rates, feature flags — no hostnames, paths, emails, tokens, or error text
• • Daily heartbeat via the schedule cron (cli/run_schedules.php); --force-telemetry for testing; fail-open so stats never block backups
• • In-app guide: docs/settings-anonymous-stats.html
• • CDN package reaver-dashboard-0.3.3 published

Hardier dashboard installer and agent package 0.2.7

• • Dashboard install.sh: smarter Debian package install (skip already-installed deps, non-fatal apt update, versioned PHP package fallback)
• • Installer and in-place upgrade path polish for CDN-based dashboard installs
• • Agent package track 0.2.7 bundled with the dashboard release
• • Security hardening test CLI and related dashboard/agent maintenance updates
• • CDN package reaver-dashboard-0.3.2 published

Installer nginx fix, discovery reconnect, package polish

• • Dashboard install nginx template: /shared/fetch_data.php is a top-level exact match so Agents and other UI data endpoints no longer get HTTP 403 under deny rules
• • Discovery report after reconnect no longer rolls back site upserts (undefined payload bug fixed)
• • CDN/package release tooling for dashboard 0.3.1 (install.sh + release tarball build/upload)
• • Agent package track 0.2.6 (identity, upgrades, DB sidecars for custom-path sites)

License linking, agent auto-upgrades, host identity, and install path

• • License page links a dashboard install to a ReaverWeb account (email/password or api_token); verify-license re-check ~every 6 hours
• • Product gates and banners for Free / expired plans; account-wide site and offsite usage across installations
• • License notice emails when plan state changes
• • Agent package upgrades: new agent_upgrade job type, Settings auto-queue toggle + Queue now, enrolled agents download the package with agent credentials
• • Host identity on heartbeats: agent_version, hostname, host_ip, and public_ip (external lookup + 24h cache when no public NIC)
• • Custom web-root sites with optional MySQL dump and external SQLite sidecars (agent 0.2.6+)
• • Jobs cleanup policy in admin Settings (finished-job TTL)
• • Beta Feedback page posts to the website API with the stored license token
• • Dashboard installer scaffold: install.sh, nginx site generator, sensitive-path deny rules (data/cli/agent/vendor/shared)
• • In-app docs and website product docs updated for agents, license, install, and offsite

Destination connect timeouts and retries on agents

• • Agent SSH destinations use ConnectTimeout and server-alive options to avoid hung jobs when a host is rebooting
• • Remote backup/restore probe and transfer wall-clock timeouts (configurable)
• • Connect-like failures retry a few times with backoff, then fail with a clear admin-facing message
• • New agent env vars: REAVER_SSH_CONNECT_TIMEOUT, REAVER_DEST_CONNECT_TIMEOUT, REAVER_DEST_CONNECT_RETRIES, REAVER_DEST_BACKUP_TIMEOUT
• • Documentation updated (in-app guides and website docs)

Light/dark theme, schedule timezone, security hardening

• • Light/dark mode CSS variables with theme toggle
• • Schedule timezone configuration support
• • SMTP save now audits real host address
• • Settings page uses native collapsible cards via details/summary
• • Invite emails use themed template
• • Password reset emails use themed template with ALTCHA rate limiting
• • Recovery bundle for remote restic password notes
• • Audit logging for security events
• • Security questions for account recovery
• • Notification digests runner (cli/run_notification_digests.php)
• • Dashboard queue helpers for archive management
• • Jobs page: file counts, restic JSON progress, elapsed time, keep completed, clear, scroll, recent site filter

Offsite storage, E2E verified backups

• • Offsite storage UI with full admin controls and encryption
• • Backup and restore verified E2E over local, S3, and SSH destinations
• • Scheduled multi-destination backups verified working
• • Chunked upload and restore for archives — queued and unqueued paths
• • Export archive functionality
• • Combined archive list in restore UI
• • Agent pairing and auto-deploy UI
• • Fleet overview and site inventory in Agents page
• • Restic snapshot restore by snapshot ID

Job system, agent polling, and schedule CRUD

• • Job creation, polling, claiming, and status reporting via API
• • Agent polling loop with site-scoped claims
• • Schedule CRUD with run-now support
• • Cron-based schedule runner (cli/run_schedules.php)
• • Job progress tracking with restic JSON output
• • Agent package download and install script generation
• • nginx config scaffold generator

Initial Reaver v2 release

• • Dashboard with status board, site cards, filters, and recent backups
• • Agent architecture with poll-only workers
• • SQLite data layer with unified dashboard database
• • PHP routing with session hardening and CSP security headers
• • User authentication: setup, login, registration, roles, invites
• • Restic integration for deduplicated snapshots
• • REST API endpoints for jobs, agents, archives, schedules, webhooks
• • Email notification templates for backup success/failure and offsite uploads