1.5.121: fixed critical SSH key cleanup and license auth bugs
Posted by tomspark
We shipped 1.5.121 today with six fixes to the support access system, three of them critical. The most serious: the license validation endpoint was reading from the wrong KV namespace, which would have blocked every customer's dashboard button (caught by Codex audit before any impact). The SSH key cleanup logic also had a loose marker match that could strip a customer's own keys if their comment happened to contain our marker text — now uses an anchored regex with the exact session format we write. The auto-disable timer would silently fail if atd wasn't running, leaving Tom's key live past the consent window; we now fall through to nohup-sleep. We also corrected a reversed ACL rule in SETUP.md, clamped the CLI --hours flag to 1..8 locally, and fixed the dashboard to surface Docker socket errors as 500 instead of poll timeouts. Key fixes: - License auth now reads from correct KV namespace - SSH marker cleanup uses anchored regex, won't strip customer keys - Auto-disable timer has reliable fallback when atd isn't available - ACL rules corrected, CLI hours clamped, Docker errors now visible Head to the Updates tab in your dashboard to pull the latest. If you hit anything broken, post here in d/sparkbox. --- Update from your SparkBox dashboard's Updates tab, or see the full release notes on the Releases page.