Changelog

Improvements

• Windows now gets the same one-click zero-config experience: double-click romp-zero.cmd (or run romp-zero.ps1) and your otter fleet boots and Romp opens already connected — no backend URL or API key to enter.
• On Windows the shared romp-core is linked with a directory junction (no administrator rights needed), so each otter reads your romp.json correctly — the Windows counterpart of the v1.3.4 install fix.

Fixes

• Self-hosted installs now symlink the shared romp-core into each otter instead of letting npm copy it — so every otter correctly reads your romp.json (custom ports, API-key enforcement, license tier). Previously the copied library made each otter resolve its config path to the wrong directory and silently fall back to defaults.

Improvements

• Bundled a zero-config launcher: on macOS double-click romp-zero.command (Linux: bash romp-zero.command) and your otter fleet boots on 127.0.0.1 and Romp opens already connected — no backend URL or API key to enter.
• Generates a local API key on first run, honors your license via the usual romp.sh flow, and stops everything on Ctrl-C. Manual control (./romp.sh start) is unchanged.

Improvements

• Self-hosted installs can now drive the otter fleet straight from the browser: romp-core adds local-mode CORS so the Lite app served on one localhost port can reach its otters on the sibling ports (:4000–:4800).
• Hardened by design — the CORS allowance reflects only 127.0.0.1/localhost origins, so an otter is never reachable from an arbitrary website (same stance as Romp's validateTarget() scope guard).

Fixes

• Regenerated the per-otter package-lock.json files so a clean npm ci installs correctly — previously the pinned romp-core version was stale and only npm install would succeed.

Added

• Public storefront at romp.domainless.fun with live demo widget.
• Three-tier model: Lite (free, 5/hr), Subscription ($19/mo, unlimited hosted), Download ($99 one-time, self-hosted, ed25519-signed offline license).
• Stripe Checkout + hosted billing portal for customer self-service.
• JWT cookie sessions (RS256, 4096-bit) + refresh-token rotation + scrypt-hashed passwords.
• Email verification + password reset (single-use, 30-min TTL).
• 2FA TOTP enrollment with QR code + 10 recovery codes, AES-256-GCM at-rest secret encryption.
• Personal API tokens for programmatic access (Authorization: Bearer rpt_…).
• Entitlement middleware with three auth modes: JWT cookie, Bearer token, ed25519 license.
• Generic scanner proxy at /v1/scan/:otter/:method with tier-aware rate limiting.
• Daily auto-scan of our own surface, published at /security.
• Public /docs with full API reference + install guide.
• Legal pages: /privacy and /terms.
• Light/dark theme toggle (respects system preference, persists in localStorage).
• Webhook signature verification with event-ID idempotency.
• License delivery email after Download purchases.
• JWKS endpoint for offline JWT verification by downstream installs.

Infrastructure

• All 9 Otter scanner daemons under systemd with restart-on-failure + boot persistence + ProtectSystem=strict hardening.
• nginx 6-header CSP/HSTS/XCT/RP/XFO + per-tier rate limits + per-IP connection cap.
• fail2ban romp-auth jail: 8 hits/5min on auth+checkout 4xx → 1hr ban.
• 300s nginx proxy_read_timeout on /v1/scan/ to accommodate long vuln-scans.

Improvements

• Bumped romp-core license handling — license tokens now ed25519-signed (was HMAC), so the matching public key can ship with every release without exposing a forgable secret.
• 9-Otter parity: red_otter, cyber_guard_dog, black_otter, yellow_otter, white_otter, grey_otter, blue_otter, green_otter, orange_otter.

• Romp PWA — mobile-first browser-based scanner front-end.
• Core red_otter recon: DNS, SSL, headers, port scan, ping, IP lookup, traceroute, WHOIS.
• Self-hosted install via ./romp.sh install && ./romp.sh start.