ragleap-core v0.10.0 release notes

Hardening and setup release. New since v0.9.0: login throttling, a Setup tab in the dashboard, a read-only plugin for coding agents, and safer installer checks.

New

Login throttling. Ten wrong API keys within five minutes lock that client out for fifteen minutes (HTTP 429 with a Retry-After header). It counts the real visitor when RagLeap runs behind a proxy you list in TRUSTED_PROXIES, and can be turned off with AUTH_THROTTLE=off.
Setup tab and GET /setup/status. A checklist in the dashboard shows what is configured and what is missing. It never shows secrets and makes no AI calls.
Read-only RagLeap skill for coding agents. A plugin manifest plus a small client script (health, employees, ask). It cannot change anything.
Bundled Ollama context window. The bundled Ollama service now defaults to an 8192-token context, so longer document prompts are no longer cut off silently. Override it with OLLAMA_CONTEXT_LENGTH.
Installer checks. install.sh now checks free disk space before downloading (4 GB, or 14 GB for the bundled local AI), refuses to start when another RagLeap setup already uses the same Compose project name, and can use an Ollama app already running on Windows or Mac. A PowerShell installer, install.ps1, and a .gitattributes file that keeps Unix line endings for shell scripts are included.

Safety

Every third-party GitHub Action is pinned to an exact commit.
Test fixtures and one installer variable no longer look like real secrets to scanners.

Honest limits

The installer has now had one real run on Windows. The PowerShell installer downloaded the code and built the image, then stopped because a local PostgreSQL already used port 5433. Fixed host ports (database, voice, neo4j, redis) can clash on other machines too. Picking free ports automatically is the next fix.
The one-line form irm ... | iex failed on that Windows machine. Download the script first ($s = irm <install.ps1 URL>; iex $s) until it is fixed. The cause is not known yet.
The installer menu offers only Gemini, Ollama or skip. The engine supports more providers, which you set in the dashboard Settings tab.
Local models on a CPU are slower and less accurate than Gemini.
Public access, an interactive browser and more channels are not built yet. The dashboard is reachable through an SSH tunnel or locally, by design.

Upgrading

Run ragleap update, or git pull and docker compose up --build -d. The database changes are additive.