Changelog

1.5.0

• Traffic tab. Two layers, because they need different privileges. Unprivileged and always available: every live TCP/UDP connection with the owning process, filterable and grouped by state, with the busiest remote addresses (optionally reverse-resolved); plus per-interface in/out rates and the error and drop counters that usually only surface in ip -s link. Privileged: packet capture through tcpdump, bounded by a packet count and a wall-clock limit so a forgotten capture cannot fill the disk, saved as a normal .pcap you can view in place or download and open in Wireshark. A capture records whatever crosses the wire, which on unencrypted protocols includes credentials — it is never started automatically and the UI says so.

• History that outlives the samples. Monitor kept 24 hours of 1-minute samples, which could tell you memory was at 92% but not whether that was normal for a Tuesday. Each finished hour is now rolled into one row (average and peak per metric) and kept for ~120 days, so the chart offers 24 hours / 7 days / 30 days / 90 days — minute resolution for a day, hourly beyond it. The rollup backfills from the samples you already have, so long ranges work the moment you upgrade, and catches up after the machine has been off. Export CSV gets the data out for a spreadsheet or a bug report.

• Security overview — a tab that assembles what Perch already knew but had scattered: which ports are reachable from the network, whether the firewall is actually on, pending security updates, failed SSH and sudo attempts from the journal grouped by source, sshd_config red flags (root login, password auth, empty passwords), who is in the admin groups, and whether automatic security updates are enabled. Scored, sorted worst-first, and each finding links to the tab that can fix it. It only reads.

• Periodic digest. The notification channels only ever spoke when something was wrong, which makes a healthy machine indistinguishable from a broken notifier. Perch can now send a summary on a schedule through the same channels — CPU and memory averages, which way disk is trending, what fired, what's pending, how old the backup is — with a preview and a send one now button.

• Fleet view. Perch already exposes a token-authenticated read API, so a second Perch is all the agent a fleet needs — no daemon, no new protocol. Add other machines and see CPU, memory, temperature and uptime for each in one grid. Strictly read-only: it polls them, it never asks them to do anything. Their tokens live in ~/.config/perch/fleet.json (chmod 600) and are never sent back to the browser.

• Test a custom rule before saving it, instead of saving and waiting out the once-a-minute cycle to find out whether it was right.

• A backup-staleness rule kind — backup state was recorded but nothing watched it, so a backup that quietly stopped working stayed quiet.

• ? opens a keyboard shortcut sheet, for the shortcuts the app had quietly accumulated (Ctrl+K, Ctrl+I, the terminal's Ctrl+Shift+ family).

• Home widgets resize by dragging their corner, in both directions — width in grid columns, height in rows — instead of a button cycling four presets. Drag-and-drop is grid-aware now too: it drops next to the widget whose centre is nearest the pointer and shows where, rather than guessing from the first element below and to the right.

• The codebase is a package, not one file. The backend split into paths, util, jobs, packages, containers, history and fleet, with dependencies pointing one way and server.py re-exporting every name so nothing external breaks. Cross-module calls go through the module object, so there is one canonical place to patch each helper. The frontend is five ordered scripts instead of one 3900-line file, still with no build step: they concatenate byte-for-byte back to the original and share one global scope, so execution is identical rather than merely equivalent.

• Frontend smoke tests grew from 15 to 28 checks, now covering the file browser, terminal, API client, database browser and traffic views — the riskiest surfaces that had no coverage at all.

1.4.0

• Everything you have installed, in one list. The Packages tab now shows installed software from every manager present — your native one (apt, dnf, pacman or zypper), snap and flatpak — with version, size and description, filterable by name or description, sortable by name or size, and with an only updatable toggle. Each row has Update and Remove, which act on that one package through a password prompt with live output. Filtering and the row cap happen on the server, because a normal desktop has a couple of thousand packages.
• Perch tells you what version it is. The running version sits next to the name in the sidebar, and a new About Perch panel in Settings shows the version, how this copy was installed (git checkout / Debian package / pip), where it lives, the Python version, service state, and its config and cache directories. The version now comes from config.py, which the server had never actually imported — which is how it drifted to 1.0.0 unnoticed.
• Update Perch to the latest stable release from About. Check for updates asks GitHub for the newest published release and shows the release notes — the only thing in Perch that reaches the network, and only when you press the button. Update now then does the right thing for how this copy was installed: a fast-forward git pull for a checkout, or download-and-install the release .deb. It refuses rather than risks anything: a checkout with uncommitted changes, a detached HEAD, or a branch with no upstream all stop with an explanation instead of a merge. A Restart Perch button applies the new version, detached so it survives the restart it triggers.
• JSON ↔ escaped string in the Tools tab. JSON → string minifies and escapes a document so it can be pasted as a string value inside another one (a ConfigMap entry, a Terraform variable, an env var); String → JSON reverses it, accepting the string with or without its surrounding quotes — which is the shape you get when you copy a payload out of a log line. If the unescaped contents aren't JSON it still unescapes them and says so.
• Custom alert rules — the five built-in thresholds only covered machine-wide metrics. You can now add your own rules for the specific things a machine is supposed to be doing: a systemd user unit that stopped running, a port nothing is listening on, a process that vanished, or a folder that grew past a size limit. They're checked once a minute and ride the same path as everything else — channels, per-rule cooldown, the master switch and the alert history. Stored in ~/.config/perch/customrules.json.
• Firewall status on the Network tab, next to the ports it applies to. Reading the live rule set needs root on every firewall tool, so the status (service state, and ufw's own enabled flag) is read without privileges and Show rules dumps the real rule set through pkexec. If ufw is installed but not enabled, Perch says so — that combination is easy to miss.
• Drive health on the Storage tab: physical devices with model, size and SSD/spinning type read from /sys/block, plus a SMART check per device via pkexec smartctl (with a pointer to install smartmontools when it's missing).
• Docker disk usage — docker system df broken out by images, containers, volumes and build cache, with what's reclaimable, so you can see what a prune would actually free before running one. Volumes are listed too.
• Two new cleanup lenses in Clean up: a duplicate finder (compares size, then a 64 KB fingerprint, then the whole file, so only real candidates are read in full) and big files you haven't opened in a long time. Both scan a folder you choose under a time budget and say when they stopped early; neither deletes anything for you.
• Start services at login — the services table gained enable/disable alongside start/stop/restart, and shows which units are set to start at login.
• Your home-screen layout now follows you. It's stored server-side in ~/.config/perch/home.json, so a different browser or machine gets the same home screen; the browser copy stays as an offline cache. Export and Import buttons in Customize home move a layout between installs.
• Frontend smoke tests. CI previously checked app.js only for syntax. A new suite drives the real app in headless Chrome — boot, live data, the widget gallery, layout persistence across a reload, the alerting switch, custom rules, port filtering, and every tab opening without a console error. Run locally with make test-frontend.
• The assistant moved out of the sidebar into a floating button in the bottom-right corner that opens it as a docked chat panel over the current page. Asking about the tab you're looking at no longer means navigating away from it. Ctrl+I toggles it, Esc closes it, and the panel shows which provider and model are answering. #ai still works as a deep link.
• Static file serving now proves containment with realpath instead of stripping .. from the request path — a blocklist that has to be re-proved correct every time input encoding changes.

1.3.0

• A fully customizable home screen — every item on Overview, the stat tiles and the panels, is now a widget in one grid. In Customize home you can drag any of them to reorder, cycle its size (S / M / L / full width) and remove it; previously only the nine stat tiles could be moved or hidden and the panels were fixed. ＋ Add widget opens a searchable gallery of everything available, including 13 widgets beyond the default layout: top processes, disk usage, listening ports, containers & pods, recent alerts, pending updates, failed services, git repositories, reclaimable space, quick actions, a scratchpad, a clock and network interfaces. Anything you remove — built-in tiles and panels included — returns to the gallery, so the home screen can be emptied and rebuilt however you like. Widgets refresh at a cadence matched to their cost (expensive scans load once behind a ↻ button) and nothing is polled while the tab is hidden. Existing layouts migrate automatically, so a home screen you had already arranged looks exactly as it did; reset layout restores the default. Also reachable from Ctrl+K.
• Alert management with a stop/start switch — the Monitor tab gained an Alerting panel: stop alerts outright, snooze them for 15 min / 1 h / 4 h / 24 h (a snooze expires and resumes on its own), enable or disable every rule in one click, and clear the recorded alert history. While alerting is off no rule fires and nothing is written to the history, but sampling and the 24-hour chart keep running — and test notifications are still sent. A rule that breaches while alerting is stopped does not burn its cooldown, so it can fire the moment you start alerts again. The state lives in ~/.config/perch/alertctl.json, survives restarts, and shows as 🔕 on the sidebar from any tab. Also in the Ctrl+K palette.
• Sidebar scrolls independently of the page — the tab list has its own scroll container, so a long sidebar no longer forces the page to move (and vice versa). Brand, CPU/MEM/DISK mini-bars and the theme button stay pinned; on phones the same container scrolls sideways as before.
• File search on the home screen — an overview panel searches the whole system by filename (with regex), shows the top 8 hits inline with Open and Browse, and hands off to the full Search tab on Enter. Same index as the Search tab, so no extra cost.
• Stop the process holding a port, from Network — the listening-ports table now shows the owning user and the process's command line, filters by port/process/command, can show only network-visible ports, and offers Stop (SIGTERM) and Force (SIGKILL) per row. Both act on the exact PID shown, so a port re-bound by something else in the meantime is never killed by mistake. Perch's own port is labelled Perch itself instead of getting buttons, and listeners owned by another user offer a sudo kill command to copy.
• Other container environments in Dev — Perch now detects Podman, nerdctl, LXD/Incus and Kubernetes alongside Docker and shows what they're running: containers with start/stop/restart/remove/shell/logs, and pods with namespace, ready count, restarts, node and logs (read-only). Podman's JSON-array output and Docker's JSON-lines output are both handled. The panel hides itself when nothing beyond Docker is installed, and an unreachable cluster is reported rather than left to hang.
• New endpoints: GET /api/containers, GET /api/ctrlogs, POST /api/ctraction, GET/POST /api/alertctl, and GET /api/monitor?brief=1 (rules, alerting state and recent alerts without the 1440-sample 24-hour history, so home widgets stay cheap).
• Version metadata is now consistent across setup.cfg, config.py, __init__.py and the Debian control file, which had drifted apart.
• Refreshed the README screenshots for the new home screen, and added ones for home customization, the alerting switch and the port controls.

1.2.3

• "Open terminal / shell" now uses Perch's own terminal — the Terminal here buttons (Files, file rows, open-with menu), the Git repo Terminal button, and the Docker container Shell button no longer launch an external emulator (gnome-terminal / x-terminal-emulator). They open a new tab in the built-in web terminal, starting in the right folder or running docker exec into the container. Works headless and over the network, and the external-terminal dependency is gone.

1.2.2

• Fix: terminal Fullscreen crash — the button no longer calls the native Fullscreen API, which could crash the WebKitGTK desktop window (and added nothing over filling the window). Fullscreen is now a pure in-app maximize that reliably fills the window; click Exit to leave.

1.2.1

• Fix: terminal Fullscreen button — now reliably fills the window (an in-app maximize) instead of depending only on the native Fullscreen API, which could silently fail or leave the terminal small inside a black screen. Panes stretch to fill via a flex stage; OS fullscreen is still used when the browser supports it, and Esc restores the normal view.

1.2.0

• Terminal: tabs, splits & fullscreen — the Terminal tab is now a kitty-style multiplexer. Open multiple session tabs, split any pane side-by-side (Ctrl+Shift+E) or stacked (Ctrl+Shift+O) with drag-resizable gutters, jump to real fullscreen, and zoom the font (Ctrl+Shift+±). Each pane is its own shell/pty; click a pane to focus it. Keyboard: Ctrl+Shift+T new tab, Ctrl+Shift+W close pane.

1.1.0

A robustness + capability release: hardened internals, distro-agnostic package management, several new tools for both developers and non-technical users, and a refreshed glass UI.

New tabs & features

• Web terminal — a real login shell in the browser (a proper pty over a websocket, not a command box), under Developer.
• Database browser — inspect SQLite files and PostgreSQL (host psql or a running container); read-only by default with opt-in writes.
• Health scorecard — the Overview now shows a score out of 100 built from disk, updates, failed services, memory, temperature and battery, each finding in plain language with a one-click fix.
• Backup helper — rsync chosen folders to another drive on demand or on a daily/weekly schedule (Storage tab), plus an optional weekly auto tidy-up (Clean up tab).
• Scheduled-tasks manager — edit your crontab and enable/disable systemd timers (Tools tab).
• SSH key manager — list keys with fingerprints, copy public keys, generate ed25519 keys (Runtimes tab).
• Project launcher — run a repo's own npm/yarn/pnpm scripts or Make targets as live jobs, from the Git tab.
• GNOME Tweaks panel — GTK/icon/cursor themes, fonts with antialiasing & hinting, titlebar buttons, clock format, animations, workspaces, and pointer speed (Settings).
• Simple mode — one toggle hides every developer tab for a monitoring-and-settings dashboard aimed at non-technical users.

Cross-distro & desktop

• Package management now works across apt / dnf / pacman / zypper (auto-detected) plus snap and flatpak when present.
• /api/caps reports the platform (native PM, snap, flatpak, GNOME, battery, Wayland) and the UI hides settings/panels that don't apply.
• The .deb ships a polkit policy so package actions show one branded, session-cached password prompt.

Robustness & security

• The URL token is exchanged for an HttpOnly, SameSite=Strict cookie on first visit and the URL is cleaned; repeated bad tokens are locked out.
• Every subprocess call has a default timeout so no request can hang.
• Config files are written atomically; a new unauthenticated /api/health endpoint and systemd Type=notify + watchdog keep the service alive.
• A test suite (unit + HTTP smoke) runs in CI on Python 3.8 and 3.12, and pip install . now builds a real package (declarative setup.cfg).

UI

• Glass / vibrant refresh — translucent blurred surfaces over an accent-tinted gradient backdrop, glowing accent active states, hover lifts, focus rings; light + dark. A Reduce effects toggle (Settings) turns off blur, the gradient, glows and animations for low-powered machines.

Earlier in this line

• Outbound alert channels — when a Monitor rule (or a log watcher) fires, Perch can notify ntfy / Slack / Discord / a generic webhook in addition to the desktop, so alerts reach you when you're away from the machine. Config in ~/.config/perch/notify.json (chmod 600); "Test all" button.
• Log-pattern watchers — define regex rules against the system / user / kernel journal or any file; a matching line fires an alert (polled every 20 s, 5-minute de-dupe). Managed from the Monitor tab.

1.0.0 — final

Adds a full API client (collections, environments with {{vars}}, request history, flows you can run and export to JSON/YAML, and import from Postman collections/environments, curl, or raw HTTP), a pluggable LLM provider (local Claude CLI / Anthropic API / OpenAI-compatible / Ollama) for the AI tab and health report, universal runtime/version switching via rustup and update-alternatives, and a critical-log panel on the Overview that surfaces recent system errors needing attention. The standalone HTTP tester was folded into the API client.

Details

First release. Restructured from a single-file prototype into an installable package with Docker and .deb distribution.

Features

• System — live CPU / memory / GPU / disk-I/O / temperature / network charts, per-core load, battery health, a hardware panel, process manager with a detail inspector, log viewer, kernel tunables, package updates.
• Storage & files — disk usage + folder-size analyzer, whole-system file search (with regex), in-dashboard preview (images, PDF, video, audio, Word, Excel), an in-page text editor with vim mode + sketch canvas, bulk trash, one-click cache cleanup.
• Developer — listening-ports view with kill-by-port + speed test, Docker container control, systemd services, runtime versions, and a toolbox: HTTP request tester, JSON/YAML tools, regex tester, text diff, cron explainer, color/case converters, secret generator, website preview.
• Assistant — chat backed by the local Claude CLI, with an optional live system snapshot.
• Settings — brightness, volume, Bluetooth, Wi-Fi, theme, wallpaper.
• Packages — search and install/remove via apt + snap.
• Command palette (Ctrl+K), grouped sidebar, light/dark theme.