106 releases 106 tags

RSS feed

• v1.0.0-beta.16 d26b31b204

  Compare

  Morphit v1.0.0-beta.16 Stable

  agorise released this 2026-06-14 03:09:23 +00:00 | 120 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  This release has three threads: it makes the AI-agent (MCP) endpoint actually
  reachable over the network, lands a batch of frontend fixes (chat links, the
  currency picker, RSS filtering, the onboarding flow, and the in-app update
  prompt), and — from a top-to-bottom security and correctness audit — fixes a
  moderation bug that affected operators running a separate operator account.
  Most people simply get the frontend improvements; the MCP and moderation
  items matter only to operators who enabled those features.

  Fixed

  • The MCP server now actually runs as a network service. The persistent
    morphit-mcp service previously started and then stopped within a second
    because it only spoke stdio, leaving nothing on its port and making the
    advertised /mcp discovery URL unreachable. It now serves a real HTTP
    endpoint and stays up.

  • Upgrades roll the MCP forward automatically. morphit-ops upgrade now
    redeploys the MCP's isolated copy and restarts it as part of the upgrade
    (only if you have it installed), so you no longer have to redeploy it by
    hand after every version bump.

  • Operator instance blocks now take effect when a separate operator
    account is configured. If you set MORPHIT_INDEXER_OPERATOR_ACCOUNT_NAME
    to an account different from your official account, accounts you blocked
    were still appearing in your instance's orderbook, live stream, RSS feeds,
    and per-account listings — the block was recorded under the operator
    account, but the public surfaces were filtering by the official account.
    They now all filter by the operator account, so a block applies
    everywhere. The same fix was extended to two further paths: your
    instance's derived (native) price feeds no longer count a blocked
    seller's orders, and morphit-ops block now writes the block under the
    operator account so the CLI command is effective too. Instances that do
    not set a separate operator account were never affected.

  • Links in chat messages are now clickable. http/https URLs that a peer
    sends are rendered as links (opening in a new tab, with no-referrer and
    no-follow), while the rest of the message stays plain, escaped text.

  • The currency picker now reaches every currency. The orderbook's fiat
    filter previously stopped at the 50th currency alphabetically (it cut off
    around Georgian lari); all currencies are now reachable.

  • RSS feeds honor every filter, including on the all-assets feed. The
    global /rss/orderbook.{xml,atom,json} feed now applies the same side,
    currency, region, payment-method, and minimum-trades filters the per-asset
    feeds already supported, and the orderbook's RSS button now appears for
    filtered all-asset views as well.

  • The onboarding "Leave anyway" button now actually leaves. A guard bug
    could re-cancel the navigation so the confirmation did nothing; it now
    navigates as expected.

  • Switching language during onboarding no longer wipes your progress.
    The language switcher now changes locale in place on the onboarding
    screens instead of reloading the page, so your current step, your inputs,
    and any freshly generated keys survive the switch.

  • The in-app "update available" prompt is back. A new version was
    silently auto-activating and reloading the page mid-task instead of
    showing the "Load it now / Later" prompt; updates are once again
    consent-gated. The offline-shell recovery is unaffected (it comes from
    network-first navigation, not from the auto-activation that was removed).

  • The "Back up your keys" help tooltip is fixed. It now flips above the
    icon when there is no room below (so it is not cut off at the bottom of
    the screen), its "Learn more" opens the FAQ in a new tab (so it cannot
    discard your in-progress keys), and tapping the info icon reliably opens
    it on touch devices.

  Added / changed

  • Hardened HTTP transport for the MCP. It binds loopback by default and
    is locked down in depth: DNS-rebinding protection (Host/Origin
    allowlists), a per-client rate limit, a hard request-body cap, a
    concurrent-connection ceiling, slow-client timeouts, and a fail-closed
    bind that refuses all-interfaces or a public address unless you explicitly
    opt in. Local AI tools that launch the server themselves (Claude Desktop,
    Cline, Cursor, and the like) keep using the simpler stdio mode — no change
    for them.

  • Works behind a dockerized reverse proxy (e.g. BunkerWeb). Because a
    containerized proxy cannot reach the host's loopback, you can bind the MCP
    to the Docker bridge gateway instead — set MORPHIT_MCP_HTTP_HOST to your
    bridge address (commonly 172.18.0.1) in /etc/morphit/mcp.env, exactly
    the way the indexer and relay are reached. Private and bridge addresses are
    allowed without any override; only public binds require one.

  • A /health endpoint so you can confirm the MCP is up directly:
    curl http://127.0.0.1:8124/health (or your bridge address). It is also
    reflected in morphit-ops health, alongside a new web-push status line in
    the relay block.

  • Lighter first load on the orderbook. The payment-method filter's data
    now loads on first use instead of shipping in the initial bundle (the
    currency filter already worked this way), so the orderbook page starts
    smaller.

  • Smaller polish. The side, minimum-trades, and sort dropdowns now show
    a pointer cursor; password, key, and seed-phrase fields carry sensible
    maximum lengths that never truncate a valid value.

  Under the hood

  • New behavioral and static smoke tests exercise the HTTP transport end to
    end (protocol handshake, tool listing, and every defense — Host/Origin
    rejection, method/path/content-type guards, body cap, rate limit, and the
    bind guard for all-interfaces and public addresses versus private and
    bridge ones). Operator-block filtering is now guarded too, so a read
    surface cannot drift back to filtering by the wrong account.
  • ADR-0044 records the MCP transport decision (stateless JSON, loopback,
    security posture, stdio retained for local agents).
  • The operator docs (OPERATIONS, run-a-node) were reconciled — they had both
    claimed the MCP was "stdio, no HTTP health endpoint" and, elsewhere,
    described an HTTP /mcp reverse-proxy block; they are now consistent, and
    a manual-install ordering issue (deploying before creating the service
    user) is fixed. A troubleshooting entry was added for broken account
    avatars, which are caused by a stale deploy-side Content-Security-Policy
    rather than by any code change.
  • Peer-sent chat links are made safe without unescaping any peer text, and
    developer-only comments were removed from the served HTML shell.
  • A top-to-bottom security and correctness audit was completed — covering
    forged-field resistance across every chain handler, the fee and feedback
    mechanics, the featured-slot auction, the smoke battery itself, and the
    operator documentation. It surfaced the operator-block account mismatch
    above; a follow-up review then found and fixed the same mismatch in two
    more places — the derived price feeds and the operator CLI — so the block
    now applies consistently across every surface. Each is covered by a
    regression test.

  Downloads

  • morphit-v1.0.0-beta.16.tar.gz
    8 downloads · 2026-06-14 03:48:27 +00:00 · 9.4 MiB
  • morphit-v1.0.0-beta.16.tar.gz.sha256
    7 downloads · 2026-06-14 03:48:25 +00:00 · 96 B
• v1.0.0-beta.15 d503cfc2c6

  Compare

  Morphit v1.0.0-beta.15 Stable

  agorise released this 2026-06-13 05:12:08 +00:00 | 121 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  A large release on top of beta.14, accumulating three batches of front-end
  polish plus a critical mobile fix, notifications and AI-agent discovery
  enabled by default, a relay security hardening, and operator-tooling
  reliability improvements. Recommended for all operators and users — the
  mobile fix in particular resolves a blank-page issue some phone users hit
  after the beta.14 deploy.

  Added

  • Web push notifications, on by default. A fresh install now generates a
    VAPID keypair once and starts the relay's web-push delivery automatically,
    so order and chat notifications work out of the box. Operators who don't
    want it can leave it off; see the run-a-node guide.

  • AI-agent discovery (MCP) enabled by default, kept isolated. The
    read-only MCP server — which lets AI agents discover a node's public
    orderbook with no KYC and hands any actual trading back to the user's own
    device — is now installed, enabled, and started automatically as a separate
    low-privilege service. You can turn it on or off at any time with sudo morphit-ops mcp.

  • The orderbook RSS feed now mirrors your full search. A per-asset feed
    URL can carry the same filters as the orderbook — buy/sell side, fiat
    currency, region, payment methods, and minimum completed-trades — and the
    feed's title spells out the active filters. The feed picker reflects the
    search you're looking at. (Feeds stay newest-first regardless of the sort
    you chose on screen, so a reader never silently misses new matching orders.)

  • A "Payment methods accepted" filter on the orderbook, with an animated
    example of the methods an instance supports and a dropdown that lists every
    method — the previous build silently cut off the end of the alphabet.

  Fixed

  • Mobile: the app no longer shows a blank/black page after an update. The
    service worker now fetches the page shell network-first and self-heals
    cached assets, so a freshly deployed update can no longer leave a stale
    shell pointing at files the server has already rotated away. (This changes
    the worker to serve the latest deployed shell rather than pinning a
    consent-gated bundle; the chain-signed release-manifest check remains in the
    app as a tamper backstop.)

  • Orderbook multi-select filters stay open. The Fiat-currency and
    Payment-method fields no longer close after each pick, so you can select
    several at once; pressing outside still closes them.

  • FAQ search lands in the right place. Clicking a search result now
    scrolls so the question title sits just below the sticky header instead of
    being pushed above the top of the screen.

  • Identicon avatars render everywhere. The generated heart avatars no
    longer appear as a broken-image icon in Safari/WebKit.

  • The "Back up your keys" tooltip is clickable. Its "Learn more" link is
    now reachable by both mouse and keyboard.

  • The printable backup card prints on a single page, instead of with
    large blank bands above and below (sometimes spilling onto extra pages).

  • The login QR code renders correctly — the finder squares now have hollow
    centers.

  • sudo morphit-ops works on systemd deployments. The Status dashboard
    and the rest of the "Check & operate" menu — the database-backed views —
    now load the instance environment, so they no longer error with "No
    database URL configured" on a systemd install.

  • morphit-ops upgrade now refreshes installed systemd unit files. A fix
    to a unit template (for example, a missing RestrictAddressFamilies entry
    that crash-looped a relay) now reaches an already-installed node on the next
    upgrade, instead of leaving the stale unit in place.

  • The relay "not reachable" health message is clearer, naming both the
    loopback and Docker-bridge addresses it tried, with a hint to check the
    relay is running and publishing its port.

  Security

  • Relay HMAC secrets can no longer ship as a publicly-known placeholder.
    The relay's invite-token and Altcha HMAC secrets now refuse a known
    placeholder value and require a minimum length when set; leaving them unset
    still produces a secure random per-boot secret (the intended default).
    Previously a manual-install operator who copied the example environment file
    and deployed it unedited could have run with a publicly-known secret —
    enabling forgeable one-time invite tokens and an Altcha proof-of-work
    bypass. Operators on the Ansible install path were never exposed (those
    values are not templated). Recommended for all manual-install operators.

  Changed

  • The signed-out top-right button now reads "Start" (was "Login /
    Register") and is sized to match the language selector.

  • The orderbook filter card is a single accessible expand/collapse
    control and now stays open until you collapse it (no more auto-collapsing
    on each change).

  • Onboarding polish. The two path cards ("Build Reputation" / "Maximum
    Anonymity") now read and behave as buttons, and a couple of copy lines were
    clarified (the "no account" prompt and the "this is how you appear" note).

  • Barter is now labelled "Barter (goods/services)" with an icon.

  • The animated wordmark sheen was slowed and softened.

  Under the hood

  • A comprehensive security and correctness audit ("deep-deep"). All 17
    indexer transaction handlers were read end-to-end, and the privacy defaults
    (no analytics, no third-party requests, self-hosted fonts), fee arithmetic
    (90/10 BLURT, 100/0 BTC/XMR), and operator docs were re-verified against the
    code. It surfaced the relay HMAC issue fixed above and otherwise returned a
    clean bill of health.

  • Continuous-integration reliability. Three test scripts whose pass lines
    the CI tally couldn't read (they would have been miscounted as failures)
    were corrected, the chunked test runner was repaired so the full test
    battery is runnable end-to-end, and two guard tests were added so neither
    class can recur.

  • Repo cleanliness. Removed hardcoded build-environment paths that had
    leaked into four helper scripts.

  • More install coverage. New tests cover the by-default web-push and MCP
    install wiring and its idempotency, and the media kit's README now documents
    the brand color standards.

  ---

  Upgrade notes

  A drop-in upgrade from beta.14.

  • Web push is generated and started automatically on a fresh Ansible
    install — a VAPID keypair is created once and never rotated (rotating it
    would drop every existing subscription). On an existing node, follow the
    run-a-node guide's web-push section if you want it enabled.

  • The MCP server is deployed and started automatically as an isolated
    morphit-mcp service running from its own restricted directory as a
    separate low-privilege user. Turn it off with sudo morphit-ops mcp if you
    don't want AI-agent discovery on your node.

  • Systemd units now refresh automatically on morphit-ops upgrade — no
    manual re-install is needed for unit-template fixes.

  • Manual-install operators: if you previously set
    MORPHIT_RELAY_INVITE_HMAC_SECRET or MORPHIT_RELAY_ALTCHA_HMAC_SECRET to a
    placeholder value, set them to real secrets (≥16 characters) or remove them
    to use the secure per-boot default; the relay now refuses known
    placeholders.

  • Mobile users affected by the blank-page issue get relief once this
    release is deployed. Until then, the workaround is to clear site data /
    unregister the service worker on the affected device.

  • The front-end and copy fixes appear once the indexer restarts on beta.15 and
    the frontend redeploys; the health-endpoint and tooling changes need no
    further action.

  Downloads

  • morphit-v1.0.0-beta.15.tar.gz
    5 downloads · 2026-06-13 05:52:01 +00:00 · 9.3 MiB
  • morphit-v1.0.0-beta.15.tar.gz.sha256
    6 downloads · 2026-06-13 05:51:59 +00:00 · 96 B
• v1.0.0-beta.14 e015e25efa

  Compare

  Morphit v1.0.0-beta.14 Stable

  agorise released this 2026-06-12 04:39:48 +00:00 | 122 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  A broad release on top of beta.13: operator tooling (a one-command systemd
  installer and a single consolidated node-health view), several front-end
  fixes, and warrant-canary improvements. Recommended for all operators.

  Added

  • A one-command systemd installer. sudo bash ops/scripts/install-systemd-units.sh installs the indexer, relay, and
    matrix-bot units pointed at the directory you actually cloned into —
    /opt/morphit, ~/morphit, or anywhere else — so they start without a
    hand-written systemctl edit drop-in. (The MCP server and the weekly
    mint-acts job keep running from their own restricted directories as
    separate low-privilege users; that isolation is intentional, and the
    installer leaves it alone.)

  • A consolidated "Node health" view. morphit-ops health now reports
    the indexer, the relay, the matrix-bot and MCP service states, and
    warrant-canary freshness on one screen. It also auto-discovers an
    indexer or relay bound to the Docker bridge gateway, so it no longer
    reports "could not reach the indexer" on container deployments where the
    service isn't on loopback — no flag needed.

  • The indexer health endpoint now explains its block lag. GET /v1/health already reported lag_blocks (how many blocks behind chain
    head the indexer is); it now also returns lag_blocks_note — a plain
    hint like 0-30 is normal (~90s behind; Blurt makes a block every 3s) —
    so you can tell whether a given lag is fine without memorising
    thresholds. The morphit-ops health view shows the same context line.

  Fixed

  • The instances list now shows a "Syncing" status. A node that is
    reachable but still catching up to the chain after a restart shows
    Syncing rather than Unreachable, and every status pill has a
    hover tooltip explaining what it means.

  • Consistent form-field focus styling. Every input, select, and filter
    across the site now shows a single consistent focus ring; the
    Fiat-currency and Payment-method fields no longer draw a doubled border.

  • Glossary tooltips on the run-a-node guide. The hover popovers now
    position correctly near the top of the page, stay reachable long enough
    to click through to the glossary, and that deep link now works.

  • Dates display consistently. Absolute dates across the instances
    list, the explorer, profiles, and order details now render in one
    localised "11 June, 2026" format.

  • The "Load it now" update prompt is now verified end-to-end. After an
    upgrade, the tool confirms that the freshly built frontend is actually
    what your site serves, and tells you whether returning visitors will get
    the reload prompt — instead of failing silently when a stale build is
    being served.

  • A malformed line in the matrix-bot systemd unit. The
    morphit-matrix-bot.service unit carried a comment written inline after
    a directive (MemoryDenyWriteExecute=false # ...). systemd only treats
    a line as a comment when it starts with #, so it logged a parse
    warning and ignored that directive — harmless, because the ignored value
    matched the default, but noise in the journal. The comment is now on its
    own line.

  Changed

  • The orderbook filter card collapses once you apply a filter, freeing
    space above the fold; a +/x toggle re-opens it.

  • The warrant canary's news-entropy feed now defaults to Cointelegraph
    (still overridable per operator).

  • The morphit-ops main-menu headings are de-numbered so they no
    longer collide visually with the numbered actions.

  Under the hood

  • New regression smokes cover the systemd installer, the consolidated
    health view's auto-probe and canary-freshness parsing, the "Syncing"
    status path, and the upgrade's frontend-serve verification.

  • Operator-doc cleanup. The "Set up systemd services" section of the
    run-a-node guide now points at the installer, and the old systemctl edit drop-in workaround is retired.

  ---

  Upgrade notes

  A drop-in upgrade from beta.13. After upgrading you can — optionally — run
  sudo bash ops/scripts/install-systemd-units.sh to (re)install the units
  pointed at your checkout; that's useful if you'd previously hand-edited
  paths, or if any service was still running outside systemd. The
  health-endpoint note and the front-end fixes need no action — they appear
  once the indexer restarts on beta.14 and the frontend redeploys.

  Downloads

  • morphit-v1.0.0-beta.14.tar.gz
    8 downloads · 2026-06-12 05:17:32 +00:00 · 9.2 MiB
  • morphit-v1.0.0-beta.14.tar.gz.sha256
    5 downloads · 2026-06-12 05:17:30 +00:00 · 96 B
• v1.0.0-beta.13 8526656108

  Compare

  Morphit v1.0.0-beta.13 Stable

  agorise released this 2026-06-11 18:52:45 +00:00 | 123 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  A fast follow-up to beta.12 that fixes the one thing standing between an
  operator and a genuinely unattended node, plus four front-end bugs you
  would hit on day one. Headline: the relay's systemd service now
  actually starts. beta.12 shipped the relay as a hardened, sandboxed
  systemd unit — but the sandbox restricted network address families to
  IPv4/IPv6 only and left out Unix domain sockets, which the TypeScript
  runtime (tsx) needs for its own internal plumbing. The result was a
  relay that crash-looped at boot with EAFNOSUPPORT. This release adds
  AF_UNIX back to every affected unit, so the relay (and the MCP and
  mint-acts units) come up cleanly. Recommended for all operators, and
  especially anyone who did the beta.12 systemd migration and found the
  relay wouldn't stay up. This release also folds in a comprehensive
  pre-release hardening audit (details under the hood).

  Added

  • A "Forget address history" control. Settings → Privacy now lets you
    clear the crypto addresses Morphit remembers on your device for
    autofill — it shows how many are stored and wipes them on a two-step
    confirm. That list was always local-only and never left your device;
    this just gives you a one-tap way to clear it.

  Fixed

  • The relay systemd service no longer crash-loops at startup. The
    shipped morphit-relay.service (and morphit-mcp.service,
    morphit-relay-mint-acts.service) sandboxed the process to
    AF_INET AF_INET6 and omitted AF_UNIX. The TypeScript runner
    communicates over a Unix domain socket internally, so that socket
    failed to open and the service never came up. All three units now
    permit AF_UNIX. The indexer unit was already correct and is
    unchanged.

  • Footer "Media kit" and "PGP keys" links no longer 404. Clicking
    the media-kit (/morphit-mediakit.zip) or PGP-keys (/pgp_keys.asc)
    links — and the warrant-canary link — used to land on a blank 404 with
    a spurious language prefix in the URL. The client-side router was
    intercepting these file links and mistaking the filename for a locale.
    They now force a real browser navigation and download/open correctly.
    The same fix was applied to the corresponding links on the Security
    and "About this instance" pages.

  • Block-explorer search for an account no longer 404s. Searching the
    explorer for an account (for example @morphit) used to land on a
    blank 404 because the resulting navigation dropped the active language
    prefix from the URL. Account, transaction, and block searches now keep
    the locale prefix and resolve correctly.

  • An instance's "Registered" date now shows the real date. The
    morphit.io card on the Instances page showed Registered: — instead
    of the operator account's on-chain creation date. It now shows the
    real date (18 April, 2026 for @morphit). On upgrade the indexer also
    repairs any directory row that still carries the old placeholder, so
    the date appears after the next indexer start — without overwriting a
    genuine registration date for any real peer.

  • An instance no longer shows itself as "Unreachable." The directory
    probe was firing a real HTTP request at the node's own public URL to
    decide reachability. Many deployments can't reach their own public
    address from inside the box (no hairpin NAT / loopback), so a healthy
    node reported itself Unreachable. The probe now recognises its own
    origin and marks it reachable locally instead of round-tripping over
    the network. Real peers are still probed exactly as before.

  • Some in-app links could land on a blank 404. A sweep of internal
    links found 23 that were missing the active language prefix —
    including two-segment chat and order-detail links (which 404'd) and a
    dead "inbox" link with no destination. All now navigate correctly.

  • The MCP server no longer exposes a lister's fee mechanics to AI
    agents. The read-only get_listing tool (used by AI agents querying
    the public orderbook over the MCP server) returned the raw owner-view
    record, which included the lister's internal fee method and status. It
    now returns the same public-fields-only view as the search tool.

  • The "Can I trade goods and services?" FAQ now matches the full asset
    list. It had enumerated only 10 of the supported assets; it now uses
    drift-proof wording ("BTC, XMR, Blurt, or any other coin Morphit
    lists") that won't go stale as the asset list changes.

  Under the hood

  • Several new regression smokes guard the fixes above: the two from
    the systemd/static-asset fixes (a check that fails if any
    tsx/node/npm unit restricts address families without AF_UNIX,
    and a check that fails if any same-origin static-asset link is missing
    the attribute that forces a real navigation), plus checks that every
    internal link carries a language prefix, that every operator-doc
    section reference in the code resolves to a real heading, that the MCP
    tools only ever return public fields, and that the test battery's
    registration stays internally consistent.

  • A comprehensive pre-release audit. Before this release every code
    path was re-walked: a hostile-operator re-pass of all 17 chain-operation
    handlers (zero new findings), plus passes over navigation, cross-stack
    wiring, error/empty states, regex and SSRF defenses, database fields,
    memory teardown, broken references, the MCP server, dead translation
    keys, the ops-cli command surface, and the privacy claims in the docs
    (no-IP-logging, no-cookies, no-analytics — each verified against the
    code). Findings were fixed in-line; the items above are the
    user-visible ones.

  • The Farsi (فارسی) translation was professionally revised — 114
    strings improved by a native translator (more natural phrasing,
    properly localized UI terms, a corrected right-to-left URL), kept at
    full key parity with the other locales.

  • Broader search descriptions. The orderbook, FAQ, post-order, and
    sign-in pages now signal the full range of supported coins in their
    search-result descriptions — not just the BTC, XMR, and Blurt
    flagships — across all ten languages, so the pages can surface for
    people searching to buy or sell the other listed coins.

  ---

  Upgrade notes

  This is a drop-in upgrade from beta.12. If you did the beta.12 systemd
  migration and the relay would not stay running, this release is the fix:
  after upgrading, re-copy the shipped unit files into place and reload
  systemd (the upgrade pulls the corrected units; copying them is what
  applies the AF_UNIX change). The indexer restart also re-seeds the
  federation directory, which is what corrects the "Registered" date and
  the self-"Unreachable" status on your own instance card.

  Downloads

  • morphit-v1.0.0-beta.13.tar.gz
    4 downloads · 2026-06-11 19:30:43 +00:00 · 9.2 MiB
  • morphit-v1.0.0-beta.13.tar.gz.sha256
    4 downloads · 2026-06-11 19:30:41 +00:00 · 96 B
• v1.0.0-beta.12 7e98f353da

  Compare

  Morphit v1.0.0-beta.12 Stable

  agorise released this 2026-06-11 03:46:02 +00:00 | 124 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  A reliability, operations, and polish release. It supersedes the
  incomplete beta.11 (whose release never finished) and folds in all of
  that work, then adds the headline change: Morphit nodes now run as
  proper systemd services that survive reboots and restart themselves —
  and the relay unlocks its signing key at boot from an encrypted
  credential, so there is no plaintext passphrase on disk and nothing to
  type by hand. Operators no longer need to babysit screen sessions.
  The rest is a guided web-firewall installer, a smarter upgrade that
  won't strand a running node on old code, clearer menu labelling, and a
  round of front-end polish. Recommended for all operators — the
  systemd setup is a one-time migration that makes a node genuinely
  unattended (see the migration note at the end and RUN-A-MORPHIT-NODE.md
  "Set up systemd services").

  Added

  • Proper systemd services for the indexer and relay — unattended,
    reboot-surviving, self-restarting. The shipped
    morphit-indexer.service and morphit-relay.service now match the
    standard /opt/morphit layout, come back automatically after any
    reboot, and restart on failure. No more running the services inside
    screen and re-attaching to fix them. (If you installed somewhere
    other than /opt/morphit, a one-line systemd drop-in points the
    units at your paths — the docs show how.)

  • The relay's signing key is unlocked at boot by an encrypted
    credential — no plaintext passphrase, ever. The relay's active key
    stays encrypted at rest; its passphrase is supplied via a systemd
    encrypted credential (systemd-creds), bound to the host (and the
    TPM, if present) and useless if copied off the machine. The decrypted
    value lives only in RAM and never appears in the process environment
    or on persistent disk. The relay unit refuses to start without it,
    by design, so a node can never silently fall back to a plaintext
    secret.

  • A guided, plain-English BunkerWeb installer in morphit-ops. The
    web-firewall menu entry can now install and bring up the optional
    BunkerWeb WAF for you, with a confirmation at each step, instead of
    only reporting its status.

  • A no-database "is the indexer caught up?" health view in the menu.
    A new menu item checks the running indexer over HTTP (/v1/health) —
    sync state, last indexed block, and lag — and works without database
    or config access, so you can check sync as an ordinary user.

  • Menu items that need elevated privileges now say so. Every
    morphit-ops action that reads the root-owned config, touches the
    database, or runs a privileged system operation now carries a dim
    (needs sudo) on its first line. The only unprivileged actions — the
    HTTP health check and Quit — are left unmarked.

  Changed

  • The upgrade is safer about a running node. morphit-ops upgrade
    now refuses to prune an old backup directory while processes are still
    running out of it, and warns — with process IDs and restart guidance —
    if it finds an indexer or relay still running on the old code after an
    upgrade (the exact situation that can otherwise strand a node on a
    stale tree).

  • Front-end polish. A brighter, wider shimmer on the wordmark; the
    brand gradient now headlines the glossary, explorer, instances, and
    QR-pair-login pages; and the instances list renders each node's
    registration date in a clean "18 April, 2026" form (with a guard
    against placeholder/epoch dates).

  • Clearer privacy wording. The privacy/terms copy that explains what
    is public on the blockchain now reads more plainly — your offers, and
    the feedback and reviews you leave and receive, are public for
    reputation, posterity, and your own research on other traders — across
    all ten languages.

  • A brighter "update available" marker in the upgrade menu, so it
    stays legible on pale terminal themes.

  Fixed

  • The coin carousel renders left-to-right in right-to-left locales.
    The scrolling asset strip is now forced dir="ltr" so the tickers
    don't reverse under the Farsi layout.

  • The upgrade reliably refreshes the front end. The upgrade
    identifies the running front-end container by its build bind-mount and
    restarts it directly, with no assumptions about its compose project or
    container name — so the new build is actually served afterwards.

  • Removed a dead translation key. An unused "welcome" string was
    deleted from the locale files.

  Under the hood

  • systemCheck now recognises Linux Mint and verifies Postgres and
    Docker availability, and the main menu was reorganised into a
    top-to-bottom, newcomer-friendly walkthrough with plain-English
    recommendations and their trade-offs.
  • The relay's key-unlock path gained non-interactive credential-file and
    environment-variable modes — the credential file is the enforced
    production path; the environment variable is dev-only and logs a
    warning — covered by fourteen unit scenarios.
  • New regression coverage: the menu's (needs sudo) tagging is asserted
    against the live menu, so a future command can't silently gain or skip
    the marker.

  ---

  Upgrading an existing node to unattended systemd (one time). After
  you've updated the tree to beta.12:

  1. Create the relay credential, using the same passphrase you already
     use to unlock the relay key:

     echo -n '<relay-passphrase>' | sudo systemd-creds encrypt --name=relay_passphrase - /etc/morphit/relay_passphrase.cred
     

  2. Install and enable the services:

     sudo cp /opt/morphit/ops/systemd/morphit-{indexer,relay}.service /etc/systemd/system/
     sudo systemctl daemon-reload
     sudo systemctl enable --now morphit-indexer morphit-relay
     

  3. Verify: sudo systemctl status morphit-indexer morphit-relay, and
     check the indexer with morphit-ops health.
  4. Once both are healthy, stop the old screen sessions.

  See OPERATIONS.md §3 ("Relay reboot") and RUN-A-MORPHIT-NODE.md ("Set up
  systemd services") for the full details and the threat model.

  Downloads

  • morphit-v1.0.0-beta.12.tar.gz
    6 downloads · 2026-06-11 04:22:41 +00:00 · 9.1 MiB
  • morphit-v1.0.0-beta.12.tar.gz.sha256
    4 downloads · 2026-06-11 04:22:39 +00:00 · 96 B
• v1.0.0-beta.11 57c7ef73c8

  Compare

  Morphit v1.0.0-beta.11 Stable

  agorise released this 2026-06-10 23:06:04 +00:00 | 126 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  A large operator-experience release. The morphit-ops command-line tool
  gains a guided BunkerWeb installer, an API-based indexer-health
  view that works without root or database access, a redesigned
  top-to-bottom setup menu, and broader OS recognition across the
  Debian/Ubuntu family — including hardened, lightweight servers like
  Kicksecure and popular derivatives like Linux Mint and Pop!_OS. It also
  ships the real fix for the post-beta.10 "frontend stale after
  upgrade" problem (now detected by the build-directory mount rather than a
  container name, so custom reverse-proxy stacks are handled too), plus a
  right-to-left display fix on the coin carousel. Recommended for every
  operator.

  Added

  • Guided BunkerWeb installer — morphit-ops bunkerweb. When the WAF
    isn't up yet and you're at an interactive terminal, the command now
    walks you through bringing up the canonical ops/bunkerweb/ stack:
    it confirms before each step, copies the shipped config into
    /etc/bunkerweb (never clobbering an existing one), prompts for and
    validates your domain (SERVER_NAME), guards against the missing-TLS-
    certificate crash-loop (pointing you at morphit-ops ssl first), then
    runs docker compose pull and docker compose up -d and re-verifies.
    Status checks (when the stack is already up, with --json, or
    non-interactively) remain read-only.

  • morphit-ops health — indexer health over HTTP. A new menu view
    that queries the running indexer's /v1/health endpoint and prints a
    one-line verdict — synced, behind (with the lag in blocks), or
    unreachable — plus the healthy/total RPC count. Because it talks
    HTTP rather than reading the database or config, it works as the
    unprivileged morphit user even when the full Status dashboard can't.
    Exit code is 0 synced, 1 behind, 2 unreachable — drops straight
    into a cron health-check.

  • Broader operating-system support. The setup pre-flight now
    green-lights the whole Debian/Ubuntu family as first-class: Ubuntu
    24.04/26.04 LTS and Debian 12+, plus popular derivatives recognized
    automatically from their base codename — Linux Mint, Pop!_OS, Zorin
    OS, KDE neon, elementary OS — and hardened-Debian distributions like
    Kicksecure, which make excellent lean, security-focused nodes. The
    pre-flight also gained PostgreSQL and Docker checks.

  Changed

  • Redesigned morphit-ops main menu. Reorganized into four
    lifecycle groups — Install & upgrade, Configure the instance,
    Secure the server, Check & operate — in a newbie-friendly
    top-to-bottom order, with plain-language blurbs and recommendations
    that state their tradeoffs. Three similarly-named commands (doctor /
    health / status) are now disambiguated by purpose.

  • "● update available" is now bright yellow in the menu, so a
    pending upgrade is easy to spot at a glance.

  Fixed

  • morphit-ops upgrade reliably republishes the web frontend on any
    Docker deployment. The upgrade now finds the frontend container by
    the apps/web/build bind-mount it carries — regardless of the
    container's name (morphit-frontend, bunkerweb-frontend-1, a
    hand-rolled stack, …) — and docker restarts it so it serves the
    freshly-built files. Earlier releases recreated a container matched by
    name through the example compose file, which missed custom or renamed
    stacks; mount-based detection handles them with no manual steps.

  • Coin carousel renders left-to-right in right-to-left locales. On
    the Farsi interface the asset carousel is now pinned to dir="ltr" so
    ticker symbols and prices read in the correct order.

  • Removed a dead, unused translation key left over from an earlier
    release.

  Notes for operators

  • Debian 12+ and Kicksecure are supported via the manual setup
    path (morphit-ops install), not the one-command Ansible playbook —
    the playbook targets the Ubuntu 24.04 "noble" family (Ubuntu 24.04,
    Mint 22, Pop!_OS, Zorin 17, KDE neon, elementary). See
    docs/RUN-A-MORPHIT-NODE.md §3.

  • If a custom BunkerWeb stack left your frontend stale after a previous
    upgrade, beta.11's morphit-ops upgrade detects and restarts your
    container automatically — no by-hand --force-recreate needed.

  ---

  Morphit is non-custodial and no-KYC. As always, verify the release
  signature against the published fingerprint before deploying.

  Downloads

  • morphit-v1.0.0-beta.11.tar.gz
    6 downloads · 2026-06-10 23:56:33 +00:00 · 9.1 MiB
  • morphit-v1.0.0-beta.11.tar.gz.sha256
    4 downloads · 2026-06-10 23:56:31 +00:00 · 96 B
• v1.0.0-beta.10 94922e8c28

  Compare

  Morphit v1.0.0-beta.10 Stable

  agorise released this 2026-06-10 17:09:59 +00:00 | 128 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  A focused operator-reliability release. It fixes a bug in morphit-ops upgrade that left the web frontend stale after an upgrade on BunkerWeb
  deployments — the backend would move to the new version while visitors
  kept loading the old build (and never saw the "Load it now" update
  prompt, because the old build was still being served). Recommended for
  every operator, especially anyone running the BunkerWeb WAF.

  If your site upgraded but still shows the previous version, this release
  is the fix — and you can confirm the stale state with
  curl -s https://<your-host>/_app/version.json (an unchanged build
  timestamp after an upgrade means the frontend wasn't rebuilt).

  Fixed

  • morphit-ops upgrade now always rebuilds and republishes the web
    frontend. Previously the rebuild step only ran when the bare-metal
    web root (/var/www/morphit-frontend) existed. On a BunkerWeb
    deployment — where the site is served by the frontend container from
    a different path, not /var/www — the upgrade silently skipped the
    rebuild, upgraded the backend, and reported success, leaving the
    container serving the old build. The web app is now rebuilt on every
    upgrade regardless of deployment style.

  • The upgrade now publishes the new build to the right place
    automatically. It detects how your site is served and acts
    accordingly: on bare-metal nginx it copies the build into your web
    root (as before); on BunkerWeb it recreates the frontend container so
    it picks up the freshly-built files (a running container otherwise
    keeps serving the pre-upgrade build). If neither is found — a
    non-standard setup — it leaves the rebuilt files on disk and tells you
    exactly where, instead of failing quietly.

  Notes for operators already on beta.9

  If you upgraded to beta.9 with morphit-ops upgrade on BunkerWeb and your
  frontend is stuck on the old version, you don't need to wait for this
  release to recover the current box — rebuild and recreate the container
  by hand:

  cd /opt/morphit/apps/web && npm run build
  docker compose -f /opt/morphit/ops/bunkerweb/docker-compose.yml up -d --force-recreate frontend
  

  (Node 22 is required for the build.) Once you're on beta.10, future
  upgrades do this for you.

  ---

  Morphit is non-custodial and no-KYC. As always, verify the release
  signature against the published fingerprint before deploying.

  Downloads

  • morphit-v1.0.0-beta.10.tar.gz
    5 downloads · 2026-06-10 17:58:06 +00:00 · 9.1 MiB
  • morphit-v1.0.0-beta.10.tar.gz.sha256
    5 downloads · 2026-06-10 17:58:04 +00:00 · 96 B
• v1.0.0-beta.9 cb99b9acea

  Compare

  Morphit v1.0.0-beta.9 Stable

  agorise released this 2026-06-10 07:15:12 +00:00 | 129 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  A security-hardening and correctness release on top of beta.8. Three
  operator-facing fixes lead it: the price-manipulation defenses are now
  fully active and visible on /v1/health; the Content-Security-Policy
  that was breaking in-browser crypto on some deploys is root-caused and
  fixed (and is now identical across every deploy path); and the
  production rate-limiting that could ban a busy instance for an hour is
  fixed. The rest is home/login polish, fresher FAQ and feed metadata, and
  a clean hostile-input audit of every indexer handler. Recommended for
  all operators — especially anyone who saw a blank/broken page behind a
  WAF, or whose instance was getting rate-limit-banned.

  Added

  • The price-manipulation defenses are now fully active and visible.
    Two of the three anti-manipulation detectors were built but not yet
    switched on: the slow-drift detector (catches a "frog in boiling
    water" attack that nudges the price a little each cycle) and the
    native-vs-external detector. Both are now wired alongside the existing
    cross-instance peer detector, and all three report their status in the
    /v1/health response so operators and monitors can see them working.

  • Feed readers now auto-discover all three formats. Every page that
    offers a feed advertises RSS 2.0, Atom, and JSON Feed in its
    autodiscovery tags (previously only RSS), so a reader finds whichever
    format it prefers without you pasting a URL.

  Changed

  • A correct, privacy-clean Content-Security-Policy on every deploy
    path. We root-caused why the CSP was sometimes blanking the site or
    breaking sign-in: it was being emitted as a <meta> tag that browsers
    can't fully enforce and that clobbered the working header. It is now a
    single real header, byte-identical across the nginx config, the
    operator docs, and the BunkerWeb path, and it keeps the QR-login camera
    working while dropping the external price API entirely for privacy. The
    Permissions-Policy is now a real header too. Operators who had been
    hand-editing the policy out should remove that workaround.

  • Production rate-limiting no longer bans busy instances. The WAF's
    per-IP limit on the API was tighter than a single page load, so a
    normal burst of requests could trip it, escalate to an hour-long IP
    ban, and then feed on its own error responses. The ceiling is raised to
    sit comfortably above the app's own fine-grained limiter, and a
    rate-limit burst can no longer escalate into a ban.

  • A lighter home page and a polished login. The "Welcome to your
    instance" banner is gone, the login heading now uses the brand
    gradient, and the wordmark's shine is slower and dimmer. The page shell
    shipped on every request is about a hundred lines lighter.

  • Fresher FAQ and machine-readable site description. The
    AI-crawler corpus that describes Morphit to assistants was out of date
    and is resynced (and now guarded against drifting again). The "follow
    Morphit with RSS" FAQ answer no longer implies that only three assets
    have feeds — every supported asset does.

  Fixed

  • The FAQ accordion opens reliably from a "related" link. Clicking a
    related-article pill at the bottom of an answer now scrolls to and
    opens the target article, instead of scrolling to a still-closed one.

  • The ops CLI no longer writes a placeholder tagline. Pressing Enter
    at the optional "Instance tagline" prompt during morphit-ops init
    used to save the literal text "A Morphit instance" to your config (and
    surface it on the homepage and in the federated directory). The prompt
    is now genuinely optional and writes nothing when left blank.

  • Source-repository labels corrected. The machine-readable site files
    now correctly identify the canonical source as the self-hosted Forgejo
    instance rather than a GitHub mirror.

  • Removed a duplicate database-schema definition. One table used by
    the price-drift defense was declared twice in the schema. It was
    harmless — the database created it once — but the duplicate is removed
    so the two copies can never drift apart.

  Under the hood

  • A complete hostile-input audit of all seventeen indexer message
    handlers came back clean, with one low-severity hardening fix: the
    forbidden-character policy that strips invisible/bidi control
    characters from user input had drifted slightly between handlers and is
    now converged (while deliberately keeping the right-to-left marks that
    the Farsi locale needs), with a new guard so the copies can't diverge
    again.

  • New regression guards were added: one keeps the AI-crawler corpus in
    sync with the source FAQ, and one keeps the Content-Security-Policy and
    Permissions-Policy byte-identical across all four deploy surfaces and
    rejects a weakened-but-consistent edit.

  ---

  Morphit is non-custodial and no-KYC. It never holds your keys and never
  takes custody of funds. As always, verify the release signature against
  the published fingerprint before deploying.

  Downloads

  • morphit-v1.0.0-beta.9.tar.gz
    6 downloads · 2026-06-10 07:50:46 +00:00 · 9.1 MiB
  • morphit-v1.0.0-beta.9.tar.gz.sha256
    5 downloads · 2026-06-10 07:50:44 +00:00 · 95 B
• v1.0.0-beta.8 5af5363530

  Compare

  Morphit v1.0.0-beta.8 Stable

  agorise released this 2026-06-09 07:16:19 +00:00 | 132 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  A front-end, feeds, and operator-tooling release on top of beta.7.
  Every orderbook feed now comes in three formats — RSS 2.0, Atom, and
  JSON Feed — so any reader works, and one click on the orange RSS pill
  copies the feed's URL in whichever format you prefer. The home page
  and orderbook get a round of polish, operators running Linux Mint can
  now provision a node, and the ops CLI restarts the affected services
  for you after a config change. Recommended for all operators.

  Added

  • Every feed now speaks three formats — RSS 2.0, Atom, and JSON
    Feed. The worldwide, per-asset, and per-trader orderbook feeds are
    each available as .xml (RSS 2.0), .atom (Atom 1.0), and .json
    (JSON Feed 1.1), all carrying identical order data — pick whichever
    your reader prefers. Click any orange RSS pill — in the site footer,
    beside a filtered orderbook, or on a trader's profile — to choose a
    format and copy its URL to your clipboard. The picker and its
    confirmation are translated into all ten languages. See the "Can I
    follow Morphit with RSS?" entry in the FAQ.

  • The ops CLI restarts the affected services after a change. After
    you edit your instance configuration or wire alternative-network
    (Tor / Lokinet / I2P) footer addresses, morphit-ops now offers to
    restart the affected services for you, so the change takes effect
    without having to remember the systemctl incantation. Declining
    leaves everything untouched.

  • Linux Mint is a supported node OS. The Ansible provisioning
    playbook now recognises Mint and other Ubuntu noble derivatives
    and provisions them correctly, rather than only bare Ubuntu. See
    RUN-A-MORPHIT-NODE.md.

  Changed

  • A more polished home page and orderbook. "Products" are now
    called "goods" throughout, the home-page hero copy is tightened,
    "global" is now "worldwide," the home-page cards share an even
    height, and the wordmark's entrance animation has been retired in
    favour of a subtle header shine. On the orderbook, the filter
    dropdowns close cleanly the moment you pick an option. Updated in
    all ten languages.

  • The create-order form is easier to follow. The asset, currency,
    and payment fields now show a green focus ring as you tab through
    them — matching the region and "I want to see" fields — and the
    region field types out real place names one character at a time as a
    gentle hint (and stays still if you've asked your system to reduce
    motion).

  • A refreshed batch of FAQ answers for clarity and accuracy,
    across all ten languages.

  Fixed

  • The per-trader feed link now points to the trader's profile. The
    "follow this trader" subscribe link advertised a homepage URL that
    no longer exists; the feed now links to the trader's /@handle page,
    the same canonical profile URL used everywhere else on the site.

  Downloads

  • morphit-v1.0.0-beta.8.tar.gz
    4 downloads · 2026-06-09 07:35:27 +00:00 · 9 MiB
  • morphit-v1.0.0-beta.8.tar.gz.sha256
    4 downloads · 2026-06-09 07:35:25 +00:00 · 95 B
• v1.0.0-beta.7 dffd12b705

  Compare

  Morphit v1.0.0-beta.7 Stable

  agorise released this 2026-06-07 03:44:20 +00:00 | 134 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  A front-end and operator-tooling release on top of beta.6, capped by
  a full pre-release security and quality audit. The orderbook is much
  easier to filter — search coins, currencies, and payment methods as
  you type, and narrow to barter (products & services) listings. Operators
  get a new control to enable or disable individual payment methods, a
  single-host deploy recipe that is now correct out of the box, and a
  moderation fix so a seller you've blocked can no longer sway the price
  your instance computes. This release is recommended for all operators.

  Added

  • A much richer orderbook filter row. The asset picker now shows
    each coin's icon and lets you pick "Barter (products & services)";
    the currency filter is a type-ahead that accepts one or more
    currencies by name or ISO code (and the indexer matches any of
    them); and the payment-method filter is a type-ahead too. All three
    behave like the FAQ search — type, pick, and your choices become
    removable chips. The currency list loads only when you tap the
    field, so it costs nothing for visitors who never use it.

  • Operators can enable or disable specific payment methods. A new
    MORPHIT_INDEXER_DISABLED_PAYMENT_METHODS setting (mirroring the
    existing disabled-assets control) lets you turn individual payment
    methods — including Barter — on or off for your instance. The setup
    wizard has a step for it, your /about-this-instance page shows
    your policy, and the admin setup-wizard page gives you a checklist
    with a copy-paste env line. An order is only rejected if every one
    of its payment methods is disabled; mixed orders are kept. Default:
    every method enabled. See the "Payment-method configuration" section
    of OPERATIONS.md and the "Payment methods" section of
    RUN-A-MORPHIT-NODE.md.

  Changed

  • Clearer, friendlier orderbook filter wording in all ten
    languages (for example "I want to see" / "Everything", "Highest
    rated users first", "Most experienced users first"), plus an
    animated example placeholder in the region field that cycles through
    real place names.

  • Buttons use the brand teal with legible white text. The primary
    button face was retuned to a deeper teal so white labels meet the
    WCAG AA contrast bar, while the vivid teal stays in the animated
    border and accents.

  • A wider, dismissable FAQ search. The search field is full-width
    on phones and centered on larger screens, dims the page behind it
    while open, and clears when you press Escape or tap outside.

  • A simpler, more honest Get-Morphit page. A no-KYC directory
    that isn't a code mirror was removed from the mirrors list, and the
    "update available" prompt now says, plainly, that reloading the page
    applies the update.

  • A bigger homepage wordmark, with all three logo dots visible and
    orbiting as intended.

  • Single-host nginx configs reconciled. ops/nginx/web.conf is now
    the colocated single-server config — it serves the site and proxies
    /v1/, /rss/, and /relay/ to the local indexer and relay — and
    the split-subdomain configs are clearly labeled optional/advanced. An
    operator who copies the shipped nginx files now gets a working
    single-host deploy. See RUN-A-MORPHIT-NODE.md §8 (Configure nginx).

  Fixed

  • Instance-local moderation now also covers your price feed. When
    you block an account, its listings were already hidden from your
    orderbook; now its orders are also dropped from the median behind
    your instance's own derived morphit_native / depeg price, so a
    blocked seller can no longer skew the price your instance computes
    from its orderbook. Blocking remains instance-local, reversible, and
    off-chain. See OPERATIONS.md §6a and RUN-A-MORPHIT-NODE.md §9.1.2.

  • The mobile language picker is no longer clipped, and the
    duplicate "Login / Register" link that showed on small screens has
    been removed (the avatar menu is the single sign-in entry point).

  • The security page no longer says "(in Phase 5)."

  Upgrading

  Use morphit-ops upgrade (or the Upgrade menu item). Your
  configuration, signing key, and per-network keys are carried forward
  automatically, and the services restart on the new code. There are no
  database migrations and no required configuration changes. If you want
  to disable any payment methods, set the optional
  MORPHIT_INDEXER_DISABLED_PAYMENT_METHODS (it defaults to all methods
  enabled). Most of this release is front-end, operator tooling, and
  documentation, but upgrading via a release is still the cleanest path.

  Downloads

  • morphit-v1.0.0-beta.7.tar.gz
    6 downloads · 2026-06-07 04:22:15 +00:00 · 8.8 MiB
  • morphit-v1.0.0-beta.7.tar.gz.sha256
    4 downloads · 2026-06-07 04:22:14 +00:00 · 95 B