feat: ship 0.6.32 transport and remote mesh review updates

Author: kwalus

CHANGELOG.md

@@ -8,6 +8,33 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
 
 ## [Unreleased]
 
+## [0.6.32] - 2026-04-17
+
+### Changed
+- **Introduced peers from other meshspaces now require an explicit Connect-page review step instead of blending into routine contact introductions** - introduced cross-mesh peers are separated into a dedicated remote-meshspace section, blocked from the quick-connect path unless the operator explicitly confirms the bridge, and require instance-admin approval before the connection can proceed.
+
+## [0.6.31] - 2026-04-17
+
+### Changed
+- **Sidebar connected peers now deep-link into the right review surfaces instead of behaving like inert labels** - clicking an individual connected peer in the left rail now opens the matching Trust Network card, the header peer-count link now jumps to the Connected Peers section on Connect, and both destinations add target highlighting so operators land on the right peer state immediately.
+- **Notification bell filters now support multi-toggle adjustment without collapsing the menu after every click** - Mentions, Inbox, DMs, Channels, Feed, and Reset now keep the dropdown open while the user refines filters, without changing normal notification-item navigation or clear behavior.
+
+## [0.6.30] - 2026-04-16
+
+### Changed
+- **Admins can now configure secure mesh transport from the UI instead of hand-editing shell environment** - the Admin page adds a Transport Security panel for self-signed local TLS, provided certificate paths, external TLS terminator declaration, restart-required state, and secure-invite readiness so VPS and tunnel setup is much easier to understand and operate.
+- **Generated invites and handshake advertisements now stay honest while transport changes are pending restart** - saving a future TLS mode no longer causes Canopy to advertise `wss://` listener endpoints before the running mesh listener has actually restarted into secure mode, and stale external endpoint intent is cleared when operators switch back to non-external modes.
+
+## [0.6.29] - 2026-04-16
+
+### Changed
+- **Explicit public WSS invites now stay clearer from generation through live transport state** - public `wss://` invites no longer co-advertise same-host plain `ws://` fallback unless the operator explicitly opts in, active peer rows/diagnostics now distinguish the current live transport from other known endpoints, and operator-selected public endpoint intent no longer lingers after invite generation returns to the default/local path.
+
+## [0.6.28] - 2026-04-16
+
+### Changed
+- **WSS invite handling is now safer and clearer for VPS/public operators** - explicit `wss://` peer endpoints no longer silently downgrade to `ws://` when TLS fails, Connect now shows transport-security posture and secure-vs-plain advertised endpoint counts, and the docs explain how Canopy currently handles TLS, reverse proxies, self-signed certificates, and strict verified-WSS mode.
+
 ## [0.6.27] - 2026-04-13
 
 ### Changed

README.md

@@ -11,7 +11,7 @@
 </p>
 
 <p align="center">
-  <img src="https://img.shields.io/badge/version-0.6.27-blue" alt="Version 0.6.27">
+  <img src="https://img.shields.io/badge/version-0.6.32-blue" alt="Version 0.6.32">
   <img src="https://img.shields.io/badge/python-3.10%2B-blue" alt="Python 3.10+">
   <img src="https://img.shields.io/badge/license-Apache%202.0-green" alt="Apache 2.0 License">
   <img src="https://img.shields.io/badge/encryption-ChaCha20--Poly1305-blueviolet" alt="ChaCha20-Poly1305">
@@ -102,6 +102,9 @@ Recent end-user improvements reflected in the app and docs:
 - **Preview-only review before sync** — first contact can connect for review while channels and history stay paused until an admin explicitly approves peer or mesh sync from the Trust page.
 - **Safer cross-mesh review** — invite import can keep a mismatched peer connected long enough for an admin to decide whether to treat it as the same mesh or keep an intentional bridge.
 - **Device Profile now drives peer-facing identity** — the name, avatar, and node hint shared during connection review now come from **Settings -> Device Profile**, and preview-only peers can refresh stale identity hints without approving sync.
+- **Admin transport setup is now first-class** — instance admins can configure self-signed TLS, provided certificate paths, or an external `wss://` terminator from the Admin UI and see whether secure invite generation is actually ready before sharing a public endpoint.
+- **Sidebar peer navigation is more useful** — connected peers in the left rail now open the matching Trust card, and the header peer count jumps directly to the Connected Peers section on Connect instead of dropping you at a generic page top.
+- **Remote meshspace introductions are now visually separated on Connect** — peers introduced through your contacts but advertising a different meshspace now appear in an explicit review section and require an intentional admin-approved bridge action instead of looking like routine same-mesh introductions.
 - **Meshspaces for safer local multi-mesh operation** — One Canopy install can now manage multiple isolated local Meshspaces with separate runtimes, ports, and operator controls instead of relying on manual repo clones or copied data directories.
 - **Bookmarks for durable memory** — Save important channel messages, feed posts, and DMs as private local bookmarks with notes and tags, then jump back to the original source later.
 - **Reposts and lineage variants** — Bring high-value sources forward again or publish a derivative version while preserving provenance back to the original instead of copying content blindly.
@@ -361,7 +364,7 @@ Agent account first-run guide: [docs/AGENT_ONBOARDING.md](docs/AGENT_ONBOARDING.
 Each Canopy instance is a self-contained node: it holds its own encrypted database, runs a local web UI and REST API, and connects directly to peer instances over encrypted WebSockets. There is no central server because the network is the peers themselves.
 
 - Direct connections: peers on the same LAN can discover and connect automatically.
-- Remote connections: use invite codes to link peers across networks and port-forward mesh port `7771` when needed.
+- Remote connections: use invite codes to link peers across networks and port-forward mesh port `7771` when needed. Public VPS/tunnel endpoints can be advertised as `wss://...`; explicit `wss://` endpoints are not silently downgraded to plain `ws://` if TLS fails, and same-host public plain fallback is opt-in rather than automatic.
 - Relay routing: when no direct path exists, a mutually trusted peer can relay targeted traffic.
 - Inside each node, the web UI, REST API, local database, file storage, and P2P engine all live together as one local-first application surface.
 
@@ -517,6 +520,7 @@ Full reference: [docs/API_REFERENCE.md](docs/API_REFERENCE.md)
 | A peer shows as preview-only after first connect | Transport is up, but sync/history are intentionally paused until review is complete. | Open **Trust** and decide whether to allow peer sync, allow mesh sync, or keep the peer pending. |
 | Cross-mesh warning during invite review | The remote peer advertises a different mesh identity than the current workspace. | An instance admin should connect it for review, then choose **Treat as same mesh** or **Keep bridge** in **Trust**. |
 | You are behind a router and peers are remote | LAN `ws://` endpoints are not directly reachable from the internet. | Port-forward mesh port `7771`, then use **Regenerate** with your public IP or hostname. |
+| You need to prove an invite uses WSS | The Connect page **Transport security** panel shows the mesh listener, certificate mode, outbound verification mode, and secure/plain advertised endpoint counts. | Use a full `wss://...` external endpoint backed by a real TLS tunnel, reverse proxy, or TLS mesh listener. |
 | "API key required" or auth error popup on Connect | Usually browser session expiry or auth mismatch. | Reload, sign in again. For scripts and CLI, include `X-API-Key`. |
 | Peer imports invite but cannot connect | Endpoint not reachable because of NAT, firewall, or offline peer. | Verify port forwarding, firewall rules, peer online status, or use a relay-capable mutual peer. |
 

canopy/__init__.py

@@ -8,7 +8,7 @@
 License: Apache 2.0
 """
 
-__version__ = "0.6.27"
+__version__ = "0.6.32"
 __protocol_version__ = 1
 __author__ = "Canopy Contributors"
 __license__ = "Apache-2.0"