v0.10.0 and v0.10.1: login throttling, a Setup tab and installer fixes after a first Windows run

ragleap-core v0.10.0 and v0.10.1 were both published on 2026-10-13. v0.10.0 is a hardening and setup release. v0.10.1 fixes installer problems found in the first real run on Windows. This post summarises both from their release notes, and says what the notes admit is still unfinished.

v0.10.0: hardening and setup

• Login throttling. Ten wrong API keys within five minutes lock that client out for fifteen minutes (HTTP 429 with a Retry-After header). It counts the real visitor when RagLeap runs behind a proxy you list in TRUSTED_PROXIES, and can be turned off with AUTH_THROTTLE=off.
• Setup tab and GET /setup/status. A checklist in the dashboard shows what is configured and what is missing. It never shows secrets and makes no AI calls.
• Read-only skill for coding agents. A plugin manifest plus a small client script (health, employees, ask). It cannot change anything.
• Bundled Ollama context window. The bundled Ollama service now defaults to an 8192-token context, so longer document prompts are no longer cut off silently. Override it with OLLAMA_CONTEXT_LENGTH.
• Installer checks. install.sh checks free disk space before downloading (4 GB, or 14 GB for the bundled local AI), refuses to start when another RagLeap setup already uses the same Compose project name, and can use an Ollama app already running on Windows or Mac. A PowerShell installer, install.ps1, and a .gitattributes file that keeps Unix line endings for shell scripts are included.

On safety, every third-party GitHub Action is now pinned to an exact commit, and test fixtures and one installer variable no longer look like real secrets to scanners.

v0.10.1: installer fixes after a first real Windows run

If you installed v0.10.0, nothing here is required. But a Windows machine with a local PostgreSQL, or anything else on port 8000 or 5433, could not start RagLeap before this release.

• Free host ports. The ports RagLeap publishes on your computer are now settings with the same defaults as before: APP_PORT (8000), DB_PORT (5433), VOICE_PORT (8766), NEO4J_HTTP_PORT (7475), NEO4J_BOLT_PORT (7688) and REDIS_PORT (6380). On a fresh install the installer picks the next free port for any default that is already busy, writes it to .env, and uses it for the dashboard link and the ragleap command. An existing .env is never changed.
• ragleap key --rotate. Writes a new random API key to .env, restarts only the app so the old key stops working, checks that the old key is refused and the new one accepted, and prints the new dashboard link once. Your database and data are not touched.
• Browser instead of a printed key. On a desktop (Windows, macOS, or Linux with a display and no SSH session) the installer opens the dashboard in your browser and no longer prints the login key in the terminal. Servers, SSH sessions and CI still get the link printed. Set RAGLEAP_NO_BROWSER=1 to always print it.

Two fixes: the installer's "earlier database exists" check matched any Docker volume with that name, including one from an unrelated install, and now matches only this setup's own volume. The "API docs" line now says the page needs your key in the x-api-key header, because it answers 401 without it, by design.

What the release notes say is not done

• The installer has had one real run, on Windows. The PowerShell installer downloaded the code and built the image, then stopped because a local PostgreSQL already used port 5433. v0.10.1 addresses that.
• The one-line form irm ... | iex fails on that Windows machine and the cause is not known. Download the script first ($s = irm <install.ps1 URL>; iex $s) until it is fixed.
• v0.10.1 was tested on one Windows machine with Docker Desktop and the menu set to skip. The Ollama option on Windows has not been tested.
• At the end of the install the PATH hint is written for bash, not PowerShell, and ports that Windows reserves for itself are not detected by the busy-port check.
• While the browser launches, the key is briefly visible in your computer's process list.
• The installer menu offers only Gemini, Ollama or skip. The engine supports more providers, which you set in the dashboard Settings tab. Local models on a CPU are slower and less accurate than Gemini.
• Public access, an interactive browser and more channels are not built yet. The dashboard is reachable locally or through an SSH tunnel, by design.

Upgrading

Run ragleap update, or git pull and docker compose up --build -d. The v0.10.0 database changes are additive. v0.10.1 does not change your .env; to use the new port settings on an existing install, add them to it.

Read more

The documentation is built from v0.10.1. The full release notes are on the release pages for v0.10.0 and v0.10.1. The previous release is covered in v0.9.0: the AI Office dashboard, a new installer and pluggable embeddings.