chore(release): 1.0.0

.github/workflows/ci.yml

@@ -88,6 +88,9 @@ jobs:
             mingw-w64-x86_64-libuv
             mingw-w64-x86_64-sqlite3
             mingw-w64-x86_64-zlib
+            curl
+            openssl
+            mingw-w64-ucrt-x86_64-nodejs
             python
       - name: Build libuvcpp and uvscope
         shell: msys2 {0}
@@ -244,6 +247,16 @@ jobs:
           print("Windows ConPTY terminal smoke OK")
           PY
 
+      - name: HTTP/2 runtime smoke
+        shell: msys2 {0}
+        run: |
+          set -e
+          # Prefer the MSYS tools here: curl/openssl understand POSIX paths.
+          # Node comes from the UCRT64 repo (the MINGW64 repo has no nodejs
+          # package); the script converts the paths it passes to Windows form.
+          export PATH="/usr/bin:/ucrt64/bin:$PWD/.deps/libuvcpp/bin:$MINGW_PREFIX/bin:$PATH"
+          bash ./scripts/h2-smoke.sh ./build-mingw/uvscope.exe 18820 18821
+
   macos:
     name: macOS arm64
     runs-on: macos-14
@@ -272,3 +285,7 @@ jobs:
           cmake --build build -j"$(sysctl -n hw.ncpu)"
           ./build/uvscope --version
           ./build/uvscope --self-check
+      - name: HTTP/2 runtime smoke
+        run: |
+          OPENSSL_BIN="$(brew --prefix openssl@3)/bin/openssl" \
+            bash ./scripts/h2-smoke.sh ./build/uvscope 18820 18821

.github/workflows/docs.yml

@@ -0,0 +1,53 @@
+name: Docs
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "docs/**"
+      - "mkdocs.yml"
+      - ".github/workflows/docs.yml"
+  pull_request:
+    paths:
+      - "docs/**"
+      - "mkdocs.yml"
+      - ".github/workflows/docs.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  build:
+    name: Build site
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install MkDocs Material
+        run: pip install mkdocs-material
+      - name: Build
+        run: mkdocs build
+      - uses: actions/upload-pages-artifact@v3
+        with:
+          path: site
+
+  deploy:
+    name: Deploy
+    if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - id: deployment
+        uses: actions/deploy-pages@v4

.github/workflows/release.yml

@@ -63,11 +63,18 @@ jobs:
           cmake --build build -j"$(nproc)"
           ./build/uvscope --self-check
           bash ./scripts/smoke-test.sh ./build/uvscope 18787 18788
+      - name: Resolve version
+        id: version
+        # Tag: v1.0.0 -> 1.0.0. Branch dispatch: chore/release-1.0.0 ->
+        # chore-release-1.0.0, so a dry run cannot create slashed paths.
+        run: |
+          label="${GITHUB_REF_NAME#v}"
+          echo "label=${label//\//-}" >> "$GITHUB_OUTPUT"
       - name: Package
         run: |
           mkdir -p packages stage
           cmake --install build --prefix "$PWD/stage"
-          VERSION="${GITHUB_REF_NAME#v}"
+          VERSION="${{ steps.version.outputs.label }}"
           tar -C stage -czf "packages/uvscope-${VERSION}-linux-${{ matrix.arch }}.tar.gz" .
           cpack --config build/CPackConfig.cmake -G DEB -B packages || true
           cpack --config build/CPackConfig.cmake -G RPM -B packages || true
@@ -105,6 +112,9 @@ jobs:
             mingw-w64-x86_64-sqlite3
             mingw-w64-x86_64-zlib
             mingw-w64-x86_64-curl
+            curl
+            openssl
+            mingw-w64-ucrt-x86_64-nodejs
       - name: Build and stage
         shell: msys2 {0}
         run: |
@@ -122,6 +132,10 @@ jobs:
           cp -f "$MINGW_PREFIX/bin/"*.dll build-mingw/ 2>/dev/null || true
           find .deps/libuvcpp-src/build-uvscope -name 'libllhttp.dll' -type f -exec cp -f {} build-mingw/ \; 2>/dev/null || true
           timeout 90 ./build-mingw/uvscope.exe --self-check
+          # Same HTTP/2 runtime check as CI. Node comes from the UCRT64 repo;
+          # curl/openssl come from MSYS and understand POSIX paths.
+          PATH="/usr/bin:/ucrt64/bin:$PWD/.deps/libuvcpp/bin:$MINGW_PREFIX/bin:$PATH" \
+            bash ./scripts/h2-smoke.sh ./build-mingw/uvscope.exe 18820 18821
           cmake --install build-mingw --prefix "$(cygpath -m "$PWD/stage")"
           mkdir -p stage/bin
           cp -f build-mingw/libllhttp.dll stage/bin/ 2>/dev/null || true
@@ -132,11 +146,17 @@ jobs:
           done
           curl -fsSL https://curl.se/ca/cacert.pem -o stage/bin/cacert.pem || \
             cp "$MINGW_PREFIX/ssl/certs/ca-bundle.crt" stage/bin/cacert.pem || true
+      - name: Resolve version
+        id: version
+        shell: pwsh
+        run: |
+          $name = "${{ github.ref_name }}".TrimStart('v').Replace('/', '-')
+          "label=$name" >> $env:GITHUB_OUTPUT
       - name: Create zip
         shell: pwsh
         run: |
           New-Item -ItemType Directory -Force packages | Out-Null
-          $name = "${{ github.ref_name }}".TrimStart('v')
+          $name = "${{ steps.version.outputs.label }}"
           Compress-Archive -Path stage\* -DestinationPath "packages\uvscope-$name-mingw-x64.zip" -Force
       - name: Install Inno Setup
         shell: pwsh
@@ -180,16 +200,23 @@ jobs:
             -DCMAKE_PREFIX_PATH="$CMAKE_PREFIX_PATH"
           cmake --build build -j"$(sysctl -n hw.ncpu)"
           ./build/uvscope --self-check
+          OPENSSL_BIN="$(brew --prefix openssl@3)/bin/openssl" \
+            bash ./scripts/h2-smoke.sh ./build/uvscope 18820 18821
+      - name: Resolve version
+        id: version
+        run: |
+          label="${GITHUB_REF_NAME#v}"
+          echo "label=${label//\//-}" >> "$GITHUB_OUTPUT"
       - name: Bundle and package
         run: |
           mkdir -p packages stage
           cmake --install build --prefix "$PWD/stage"
-          # macOS 0.11.0 is a source-oriented build: libuvcpp and llhttp are
+          # macOS 1.0.0 is a source-oriented build: libuvcpp and llhttp are
           # bundled; Homebrew supplies libuv and OpenSSL. Record the linkage for
           # diagnostics and ad-hoc sign the executable.
           otool -L stage/bin/uvscope || true
           codesign --force --deep -s - stage/bin/uvscope || true
-          VERSION="${GITHUB_REF_NAME#v}"
+          VERSION="${{ steps.version.outputs.label }}"
           tar -C stage -czf "packages/uvscope-${VERSION}-macos-arm64.tar.gz" .
           ls -lh packages
       - uses: actions/upload-artifact@v4
@@ -203,10 +230,16 @@ jobs:
     name: Publish release
     runs-on: ubuntu-latest
     needs: [linux, windows, macos]
+    permissions:
+      contents: write
+      id-token: write
     # Publish only when every platform job succeeded. `always()` used to publish
-    # a partial release even when one platform failed.
-    if: startsWith(github.ref, 'refs/tags/')
+    # a partial release even when one platform failed. A manual dispatch runs
+    # the SBOM/signature steps without creating a release, which lets us test
+    # the supply-chain pipeline before tagging.
+    if: startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch'
     steps:
+      - uses: actions/checkout@v4
       # Download only the platform packages. `web-dist` is a build input for the
       # platform jobs, not a release asset; downloading every artifact used to
       # leak its JS/CSS into the release.
@@ -226,9 +259,39 @@ jobs:
         with:
           name: macos-arm64
           path: artifacts/macos-arm64
+      - name: Version label
+        id: version
+        # A branch dispatch has slashes in ref_name; a tag does not. Keep the
+        # SBOM path valid for both.
+        run: echo "name=${GITHUB_REF_NAME//\//-}" >> "$GITHUB_OUTPUT"
+      - name: Generate SBOM
+        uses: anchore/sbom-action@v0
+        with:
+          path: .
+          format: spdx-json
+          output-file: artifacts/uvscope-${{ steps.version.outputs.name }}-sbom.spdx.json
+          upload-artifact: false
+          upload-release-assets: false
+      - uses: sigstore/cosign-installer@v3
+      - name: Checksums and signature
+        run: |
+          cd artifacts
+          # Flat basenames: GitHub releases download all assets into one
+          # directory, so `sha256sum -c SHA256SUMS` must work without the
+          # per-platform staging folders used while building.
+          find . -type f \( ! -name SHA256SUMS ! -name '*.sigstore.json' \) -print0 \
+            | sort -z | while IFS= read -r -d '' file; do
+                (cd "$(dirname "$file")" && sha256sum "$(basename "$file")")
+              done > SHA256SUMS
+          cosign sign-blob --yes --bundle SHA256SUMS.sigstore.json SHA256SUMS
+          echo "--- SHA256SUMS ---"
+          cat SHA256SUMS
+          echo "--- signature bundle ---"
+          ls -l SHA256SUMS.sigstore.json
       - name: Show assets
         run: find artifacts -type f -maxdepth 3 -printf '%p %k KB\n'
       - uses: softprops/action-gh-release@v2
+        if: startsWith(github.ref, 'refs/tags/')
         with:
           files: artifacts/**/*
           generate_release_notes: true

.gitignore

@@ -19,6 +19,10 @@ dist/
 web/node_modules/
 web/dist/
 web/.vite/
+
+# Documentation site
+site/
+.cache/
 npm-debug.log*
 yarn-error.log*
 

AGENTS.md

@@ -10,9 +10,13 @@ This repository is designed for incremental, verifiable agent work. Read
   - `./scripts/build.sh`
   - `./build/uvscope --self-check`
   - `bash ./scripts/smoke-test.sh ./build/uvscope 18787 18788`
+  - `bash ./scripts/h2-smoke.sh ./build/uvscope 18820 18821`
   - `npm --prefix web run build`
+  - `mkdocs build`
 - No second networking stack. All target I/O goes through libuvcpp.
 - Never fabricate protocol fields. Missing data is omitted or explicitly marked unknown.
+- Keep `README.md`, `docs/API.md`, `docs/EVENTS.md` and the help page in sync with behavior.
+  Event fields may be added in 1.x but not renamed or retyped.
 - Do not include credentials, certificates, API keys or traffic captures in commits.
 
 ## Module template
@@ -39,10 +43,18 @@ patches retired with libuvcpp 1.8.2 in `docs/LIBUVCPP_UPSTREAM.zh-CN.md` are the
 
 ## Release checklist
 
-1. `npm --prefix web run build`
+1. `npm --prefix web ci && npm --prefix web run check:i18n && npm --prefix web run build`
 2. `./scripts/build.sh`
 3. `./build/uvscope --self-check`
-4. `bash ./scripts/smoke-test.sh ./build/uvscope`
-5. CI green on Linux, Windows MinGW and macOS
-6. Update `CHANGELOG.md` and tag `v<version>`
-7. Verify release assets: Linux tar/deb/rpm, Windows zip/setup.exe, macOS tar
+4. `bash ./scripts/smoke-test.sh ./build/uvscope 18787 18788`
+5. `bash ./scripts/h2-smoke.sh ./build/uvscope 18820 18821`
+6. `mkdocs build` and `./scripts/bench.sh ./build/uvscope` (record the reference run)
+7. CI green on Linux x64, Windows x64 MinGW and macOS arm64
+8. Update the version in `CMakeLists.txt`, `web/package.json`, `web/package-lock.json`,
+   `web/src/stores/auth.ts`, `packaging/windows/uvscope.iss` and the docs
+9. Update `CHANGELOG.md` and tag `v<version>`
+10. Verify release assets: Linux x64/arm64 tar/deb/rpm, Windows zip/setup.exe, macOS tar.gz,
+    `SHA256SUMS`, `SHA256SUMS.sigstore.json` and the SPDX SBOM
+11. Verify the published Linux artifact with `--version` and `--self-check`
+
+Windows arm64, HTTP/3 and native plugin loading are not part of the 1.x release matrix.

CHANGELOG.md

@@ -4,6 +4,39 @@ All notable changes to uvscope are documented here. The format is based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this project adheres to
 [Semantic Versioning](https://semver.org/).
 
+## [1.0.0] - 2026-10-25
+
+First stable release. No protocol behavior changed since 0.11.0; 1.0 adds the release
+engineering, documentation and verification work required to treat uvscope as a product.
+
+### Added
+
+- Documentation site (MkDocs Material on GitHub Pages, built in CI) with guides for building,
+  operations and performance, plus reference pages for the API, event schema, extension boundary
+  and architecture.
+- Release supply chain: `SHA256SUMS`, a Sigstore keyless signature over the checksums
+  (`SHA256SUMS.sigstore.json`) and a generated SPDX SBOM.
+- HTTP/2 runtime verification on Windows MinGW and macOS arm64 CI (`scripts/h2-smoke.sh`).
+- `scripts/bench.sh` / `scripts/bench.py` and a documented reverse-proxy baseline in
+  `docs/PERFORMANCE.md`.
+- `docs/EVENTS.md` fixes the 1.x event compatibility contract; `docs/EXTENDING.md` documents
+  variables, request scripts, the command library and the internal child-process IPC boundary.
+- `docs/OPERATIONS.md` covers the data layout, backup/restore, upgrades, isolation and hardening.
+
+### Changed
+
+- README and all project documentation reorganized for the 1.0 product surface, supported
+  platform matrix and known limitations.
+- Help-page texts updated for backend WebSocket sessions, SOCKS5 byte counters, proxy supervision
+  and the isolation note.
+
+### Compatibility
+
+- The 1.x API and event schema are additive-only: existing field names, types and meanings stay
+  stable, and consumers ignore unknown fields and event types.
+- Windows arm64, HTTP/3 stabilization and a native plugin ABI are explicitly outside the 1.x
+  matrix and tracked in the roadmap.
+
 ## [0.11.0] - 2026-10-25
 
 ### Added
@@ -461,9 +494,9 @@ The libuvcpp fixes are submitted upstream as
 
 ### Fixed
 
-- Added TLS SNI support to libuvcpp HTTP/1.1 clients via
-  [`patches/upstream/0001-tls-sni.patch`](patches/upstream/0001-tls-sni.patch). Without it, HTTPS
-  requests to modern virtual hosts fail or receive an unrelated certificate.
+- Added TLS SNI support to libuvcpp HTTP/1.1 clients via the (now retired) patch
+  `patches/upstream/0001-tls-sni.patch`. Without it, HTTPS requests to modern virtual hosts fail
+  or receive an unrelated certificate.
 
 ### Known limitations
 

CMakeLists.txt

@@ -1,7 +1,7 @@
 cmake_minimum_required(VERSION 3.20)
 
 project(uvscope
-  VERSION 0.11.0
+  VERSION 1.0.0
   DESCRIPTION "A libuvcpp-powered multi-protocol web debugging workbench and gateway"
   HOMEPAGE_URL "https://github.com/Antruly/uvscope"
   LANGUAGES CXX)

CONTRIBUTING.md

@@ -18,9 +18,15 @@ rewrites.
 ./build/uvscope --self-check
 npm --prefix web run typecheck
 npm --prefix web run build
+npm --prefix web run check:i18n
+bash ./scripts/smoke-test.sh ./build/uvscope 18787 18788
+bash ./scripts/h2-smoke.sh ./build/uvscope 18820 18821
+python3 -m pip install mkdocs-material && mkdocs build
 ```
 
-For UI changes, include a screenshot at 1600×1000 (and a narrow viewport if relevant).
+`smoke-test.sh` needs `curl`, `node`, `openssl` and `python3` for the full matrix. For UI changes,
+include a screenshot at 1600×1000 (and a narrow viewport if relevant). Follow the
+[Code of Conduct](CODE_OF_CONDUCT.md).
 
 ## Code guidelines
 
@@ -40,20 +46,29 @@ For UI changes, include a screenshot at 1600×1000 (and a narrow viewport if rel
 
 ## libuvcpp changes
 
-Changes to libuvcpp live in a patch under `patches/` and must include:
+uvscope builds against the libuvcpp **v1.8.2** release SDK. One patch is currently carried on top
+of that tag: `patches/upstream/0005-ws-client-handshake-headers.patch`, which adds
+`uvcpp_ws_client::set_handshake_header()` so the backend WebSocket debugger can send
+`Authorization`, `Origin`, `Cookie` and `Sec-WebSocket-Protocol` during the Upgrade request. The
+earlier SNI, POSIX timeout, install-completeness and SOCKS5 stage patches were retired in
+1.8.1/1.8.2; see [docs/LIBUVCPP_UPSTREAM.zh-CN.md](docs/LIBUVCPP_UPSTREAM.zh-CN.md).
+
+If a new patch is needed, it must include:
 
 - a focused explanation of the failure;
 - the smallest possible code change;
 - a reproducible test or a precise manual verification;
 - a note for the upstream project.
 
-The current SNI patch exists because the HTTP client did not set `SSL_set_tlsext_host_name()`, so
-modern virtual hosts either abort or serve a default certificate.
+Patch files are applied in filename order by `scripts/build-libuvcpp.sh`; a patch that no longer
+applies must be updated or dropped when the SDK tag moves.
 
 ## Security
 
 Do not include real credentials, private keys or customer data in issues, tests or screenshots.
-See [SECURITY.md](SECURITY.md) for private reporting.
+See [SECURITY.md](SECURITY.md) for private reporting. Event schemas and the public API are
+documented in [docs/EVENTS.md](docs/EVENTS.md) and [docs/API.md](docs/API.md); additive changes
+are expected within 1.x.
 
 ## License