--- wasm-1.6.1.orig/debian/changelog
+++ wasm-1.6.1/debian/changelog
@@ -0,0 +1,593 @@
+wasm (1.6.1-1) unstable; urgency=medium
+
+  * Fix EACCES at service start: the deploy pipeline now hands the app directory over to the service user after the build
+  * One shared permissions implementation for the base pipeline and the monorepo deployer
+
+ -- Yago Lopez Prado <yago.lopez.adeje@gmail.com>  Thu, 27 Aug 2026 15:07:14 +0000
+
+wasm (1.6.0-1) unstable; urgency=medium
+
+  * Visual redesign: Geist typography, indigo accent, refined components and a common page skeleton across the panel
+
+ -- Yago Lopez Prado <yago.lopez.adeje@gmail.com>  Fri, 14 Aug 2026 15:31:17 +0000
+
+wasm (1.5.1-1) unstable; urgency=medium
+
+  * Fix: panel failed to start on distro pydantic v1 (Ubuntu 24.04); pydantic v1/v2 bridge with architecture guards and distro-import CI gates
+
+ -- Yago Lopez Prado <yago.lopez.adeje@gmail.com>  Fri, 14 Aug 2026 13:38:42 +0000
+
+wasm (1.5.0-1) unstable; urgency=medium
+
+  * Observability and product polish: per-app charts with deploy markers, user cron jobs, CLI deep links, command palette, log search
+
+ -- Yago Lopez Prado <yago.lopez.adeje@gmail.com>  Fri, 14 Aug 2026 12:47:48 +0000
+
+wasm (1.4.0-1) unstable; urgency=medium
+
+  * The panel manages the whole product: databases, services, sites, env vars, settings, scheduled backups, deployment history with rollback, live charts, git webhooks, notifications
+
+ -- Yago Lopez Prado <yago.lopez.adeje@gmail.com>  Fri, 14 Aug 2026 12:16:55 +0000
+
+wasm (1.3.0-1) unstable; urgency=medium
+
+  * Panel security: TLS by default, TOTP 2FA, scoped API tokens, session management, browser E2E in CI
+
+ -- Yago Lopez Prado <yago.lopez.adeje@gmail.com>  Fri, 14 Aug 2026 10:45:08 +0000
+
+wasm (1.2.1-1) unstable; urgency=medium
+
+  * Fix: wasm reported no applications on a machine whose records existed, after the monitor service created /var/lib/wasm and the store moved to it; a database that already exists now outranks an empty location
+
+ -- Yago Lopez Prado <yago.lopez.adeje@gmail.com>  Thu, 13 Aug 2026 15:30:55 +0000
+
+wasm (1.2.0-1) unstable; urgency=medium
+
+  * Fix: the monitor service never started, failing every 30 seconds since installation, because its unit named a state directory systemd was never asked to create
+  * Fix: the panel's journal streams left a journalctl process running on every disconnection
+  * Fix: the panel's live event feed did not exist; /events now streams state changes and notices as server-sent events
+  * Fix: the log drawer and the mobile navigation never ran at all, blocked by the panel's own script-src policy
+  * Fix: the machine strip and the navigation scrolled off the top of every page
+  * Fix: an action that succeeded reported nothing, and a failure was shown as truncated JSON instead of the tool's own output
+  * Fix: page routes answered a manager failure with a plain-text Internal Server Error
+  * Fix: a session renewing itself silently invalidated the CSRF token every control was using
+  * Fix: text colours and badge backgrounds now meet WCAG AA on every surface they are placed on
+  * Feature: deploy an application from the panel
+  * Feature: start, stop, enable and disable services, enable and disable sites, revoke and delete certificates
+  * Feature: take a backup from an application's row, and verify that an archive is sound
+  * Enhancement: wasm web start explains how to reach a loopback panel over an SSH tunnel, and offers a port it has checked is free
+  * Refactor: remove Alpine, which the panel's content security policy had always refused to execute
+
+ -- Yago Lopez Prado <yago.lopez.adeje@gmail.com>  Thu, 13 Aug 2026 14:59:08 +0000
+
+wasm (1.1.0-1) unstable; urgency=medium
+
+  * Fix: wasm list reports the state systemd and the port actually report, not the value written at deploy time; it and wasm health no longer contradict each other
+  * Fix: a service systemd is restarting every few seconds, or one that accepts no connections, is no longer reported as running
+  * Fix: static sites are no longer counted as stopped; they have no service to run
+  * Fix: the RPM builds on Fedora and openSUSE again; a macro named in a comment inside the build section was expanded and ran
+  * Fix: Leap 15.x builds against the packaged Python 3.11 instead of 3.6, which could not run the result
+  * Fix: the package installs on Debian 12, Ubuntu 22.04 and Fedora 41, where python3-questionary does not exist
+  * Fix: wasm web start refuses a port that is already taken instead of printing a token and then failing to bind
+  * Fix: wasm --no-color applies to wasm health, and the logger follows a redirected stdout
+  * Change: wasm list is a coloured table where colour encodes state, and it names what needs attention
+  * Change: publishing waits for the .deb and the RPM to be built, installed and run in clean containers
+
+ -- Yago Lopez Prado <yago.lopez.adeje@gmail.com>  Wed, 12 Aug 2026 17:45:39 +0000
+
+wasm (1.0.3-1) unstable; urgency=medium
+
+  * Fix: the Debian build dependencies in wasm.dsc and debian.control agree, and are the minimum that builds a wheel
+
+ -- Yago Lopez Prado <yago.lopez.adeje@gmail.com>  Wed, 12 Aug 2026 16:38:49 +0000
+
+wasm (1.0.2-1) unstable; urgency=medium
+
+  * Fix: interactive mode works again; it still imported inquirer after that stopped being a dependency
+  * Fix: distribution packages build; the completion scripts are committed instead of generated, so the build no longer needs to run the package
+  * Fix: the RPM spec no longer uses a macro as a tag, which failed every Fedora and openSUSE target
+  * Change: publishing waits for tests, lint, types, a clean install and a container-built .deb
+
+ -- Yago Lopez Prado <yago.lopez.adeje@gmail.com>  Wed, 12 Aug 2026 16:30:49 +0000
+
+wasm (1.0.1-1) unstable; urgency=medium
+
+  * Fix: package manager availability is asked of the command runner, not of the process PATH
+  * Fix: a project whose lock file names a package manager refuses to install with a different one
+
+ -- Yago Lopez Prado <yago.lopez.adeje@gmail.com>  Wed, 12 Aug 2026 16:06:57 +0000
+
+wasm (1.0.0-1) unstable; urgency=medium
+
+  * Security: closes six critical issues, including arbitrary code execution as root through systemd unit environment injection
+  * Security: the process monitor no longer terminates processes or deletes directories; it reports instead of acting
+  * Security: the panel serves no third-party asset, uses HttpOnly session cookies with CSRF, and writes an audit log
+  * Security: database dumps, archive extraction and SQL privileges are validated instead of interpolated
+  * Feature: control panel rebuilt as server-rendered pages, with no build step and no CDN
+  * Feature: --dry-run is enforced at the execution and filesystem seams, so it holds for every command
+  * Change: command line migrated to Click; every command, alias and option is preserved
+  * Change: backup archives are self-contained and verified; format version 2.0.0
+  * Packaging: supports Ubuntu 26.04 and Python 3.14; drops python-jose and python3-inquirer
+
+ -- Yago Lopez Prado <yago.lopez.adeje@gmail.com>  Wed, 12 Aug 2026 15:48:31 +0000
+
+wasm (0.15.8-1) unstable; urgency=medium
+
+  * Feature: Auto-verify and expand SSL certificates for www subdomain coverage
+  * Enhancement: cert_manager.obtain() checks domain coverage before skipping existing certs
+  * Enhancement: Site create verifies existing certs cover all required domains including www
+
+ -- Yago Lopez Prado <yago.lopez.adeje@gmail.com>  Fri, 20 Mar 2026 14:00:00 +0000
+
+wasm (0.15.7-1) unstable; urgency=medium
+
+  * Fix: Site create fails with "site already exists" when config file remains after deletion
+  * Fix: Site create SSL step fails with "site already exists" on second create_site call
+  * Enhancement: Site create updates existing config instead of failing
+
+ -- Yago Lopez Prado <yago.lopez.adeje@gmail.com>  Fri, 20 Mar 2026 13:30:00 +0000
+
+wasm (0.15.6-1) unstable; urgency=medium
+
+  * Feature: Site create now obtains SSL certificates automatically
+  * Feature: Add --no-ssl flag to site create to skip SSL
+  * Enhancement: Site create reuses existing valid certificates instead of re-obtaining
+  * Enhancement: Interactive site create prompts for SSL configuration
+
+ -- Yago Lopez Prado <yago.lopez.adeje@gmail.com>  Fri, 20 Mar 2026 13:00:00 +0000
+
+wasm (0.15.5-1) unstable; urgency=medium
+
+  * Feature: Add --www flag to site create for www subdomain in web server config
+  * Enhancement: Interactive site create prompts for www inclusion
+
+ -- Yago Lopez Prado <yago.lopez.adeje@gmail.com>  Fri, 20 Mar 2026 12:30:00 +0000
+
+wasm (0.15.4-1) unstable; urgency=medium
+
+  * Fix: Interactive mode crashes due to missing Namespace attributes (6 bugs)
+  * Fix: Service create uses wrong attribute name (command vs exec_command)
+  * Fix: Webapp delete, logs, update missing required attributes
+  * Fix: Service logs and cert revoke missing required attributes
+  * Feature: Add --www flag for including www subdomain in SSL certificates
+  * Feature: Add --expand flag for expanding existing SSL certificates
+  * Enhancement: Interactive mode prompts for log lines, follow mode, and branch
+  * Enhancement: Nginx/Apache templates support server_names with www
+
+ -- Yago Lopez Prado <yago.lopez.adeje@gmail.com>  Fri, 20 Mar 2026 12:00:00 +0000
+
+wasm (0.15.3-1) unstable; urgency=medium
+
+  * Fix: SourceManager.fetch() parameter mismatch in Docker Compose deployer
+  * Fix: ServiceManager.create_service() API mismatch in Docker Compose deployer
+  * Fix: Docker Compose build/update timeouts (600000s to 600s/300s)
+  * Feature: Headless worker support for Docker Compose apps with no exposed ports
+  * Enhancement: Add _PASS pattern to EnvManager secret detection
+  * Enhancement: ServiceManager.create_service() accepts extra template context
+
+ -- Yago Lopez Prado <yago.lopez.adeje@gmail.com>  Wed, 11 Mar 2026 12:00:00 +0000
+
+wasm (0.15.2-1) unstable; urgency=medium
+
+  * Fix: Web interface token display uses print() for reliable visibility
+  * Enhancement: Release workflow validates OBS credentials before proceeding
+
+ -- Yago Lopez Prado <yago.lopez.adeje@gmail.com>  Tue, 10 Mar 2026 12:00:00 +0000
+
+wasm (0.15.1-1) unstable; urgency=medium
+
+  * Fix: Python deployer compatibility with Python 3.10 (os.walk instead of Path.walk)
+  * Fix: Django WSGI/ASGI detection break placement
+  * Fix: Docker Compose false-positive detection when framework config files present
+  * Enhancement: Update command uses stored app type from database
+  * Enhancement: Verbose command output logging via Logger.command_output()
+  * Enhancement: Web jobs use specific WASM exceptions instead of bare Exception
+  * Enhancement: Web server uses logging module instead of print()
+  * Enhancement: setup.py adds web/monitor/all extras and fixes entry point
+  * Enhancement: .gitignore updated for rpm/*.spec, .claude/, .ruff_cache/
+
+ -- Yago Lopez Prado <yago.lopez.adeje@gmail.com>  Mon, 09 Mar 2026 12:00:00 +0000
+
+wasm (0.15.0-1) unstable; urgency=medium
+
+  * Feature: Add Docker Compose deployer with full deployment lifecycle
+  * Feature: Add environment variable manager with .env.example discovery and secret auto-generation
+  * Feature: Add advanced Nginx configuration builder with multi-route proxying via wasm.nginx.yaml
+  * Feature: Add backup scheduler with systemd timer integration
+  * Feature: Add wasm env CLI command for configure, show, and export operations
+  * Feature: Add wasm backup schedule CLI subcommand for create, list, and delete
+  * Enhancement: Add DockerError exception type for Docker-related failures
+  * Enhancement: Add DOCKER_COMPOSE app type to store and registry
+  * Enhancement: Update web dashboard UI with improved styling and page components
+  * Enhancement: Add create_advanced_site method to NginxManager
+  * Enhancement: Improve PostgreSQL and Redis database managers
+
+ -- Yago Lopez Prado <yago.lopez.adeje@gmail.com>  Mon, 09 Mar 2026 12:00:00 +0000
+
+wasm (0.14.4-1) unstable; urgency=medium
+
+  * Fix: service_exists() not finding legacy wasm- prefixed services
+  * Fix: Update command fails to restart legacy services
+  * Fix: get_service_config() not reading legacy service files
+
+ -- Yago Lopez Prado <yago.lopez.adeje@gmail.com>  Thu, 06 Feb 2026 15:00:00 +0000
+
+wasm (0.14.3-1) unstable; urgency=medium
+
+  * Fix: Monorepo detection too aggressive (single Next.js apps misdetected)
+  * Fix: Update command crashes with MonorepoDeployer (missing pre_install)
+  * Fix: Update checker shows false positive when already on latest version
+  * Fix: Update checker recommends pip when installed via apt/dnf
+  * Fix: Release workflow supports manual re-trigger via workflow_dispatch
+  * Fix: Debian build includes source/format and source/options files
+
+ -- Yago Lopez Prado <yago.lopez.adeje@gmail.com>  Thu, 06 Feb 2026 14:00:00 +0000
+
+wasm (0.14.2-1) unstable; urgency=medium
+
+  * Feature: Add MonorepoDeployer for Turborepo/pnpm workspace deployments
+  * Feature: New CLI options --subdomains, --workspaces, --no-database
+  * Fix: Update command now queries database for app_path
+    (supports legacy apps with wasm- prefix)
+  * Add workspace and turbo helpers for monorepo detection
+
+ -- Yago López Prado <yago.lopez.adeje@gmail.com>  Tue, 04 Feb 2026 14:00:00 +0000
+
+wasm (0.14.1-1) unstable; urgency=medium
+
+  * Fix: API verify() returns correct keys (checksum_ok, files_ok)
+  * Fix: BackupMetadata now persists includes_build field
+  * Fix: Backup rotation uses direct app_name lookup
+  * Fix: Remove non-ASCII characters from CLI output
+  * Feature: Database backup integration (MySQL, PostgreSQL, MongoDB, Redis)
+  * Feature: New --include-databases flag for backup create
+  * Enhancement: API and CLI now expose all backup options
+
+ -- Yago López Prado <yago.lopez.adeje@gmail.com>  Tue, 28 Jan 2026 12:00:00 +0000
+
+wasm (0.14.0-1) unstable; urgency=medium
+
+  * Feature: New 'wasm health' command for system diagnostics
+  * Feature: New 'wasm config' command (upgrade, show, path)
+  * Feature: Automatic config migration on package upgrade
+  * Feature: Persistent threat storage with SQLite (threat_store.py)
+  * Feature: New API endpoints /api/monitor/threats/history and resolve
+  * Fix: Monitor module duplicate return statement (dead code)
+  * Fix: Inconsistent scan_interval defaults (30s local, 3600s AI)
+  * Fix: API /scan now respects global config (auto_terminate, use_ai)
+  * Fix: CPU/Memory thresholds now used for logging and alerts
+  * Enhancement: Monitor frontend uses WebSocket instead of HTTP polling
+  * Enhancement: Auto-update wasm-monitor service on package upgrade
+  * Enhancement: Improved process fallback with better ps parsing
+  * Enhancement: Notification report includes all threats for audit
+
+ -- Yago López Prado <yago.lopez.adeje@gmail.com>  Wed, 15 Jan 2026 18:00:00 +0000
+
+wasm (0.13.16-1) unstable; urgency=medium
+
+  * Fix: Move python3-inquirer from Depends to Recommends
+  * Fix: Package installs on systems without python3-inquirer in repos
+  * Enhancement: Interactive mode now optional (install inquirer via pip)
+
+ -- Yago López Prado <yago.lopez.adeje@gmail.com>  Wed, 15 Jan 2026 12:00:00 +0000
+
+wasm (0.13.15-1) unstable; urgency=medium
+
+  * Enhancement: Set update checker interval to instant (CHECK_INTERVAL = 0)
+  * Enhancement: Change update notification color to softer yellow (\\033[33m)
+  * Enhancement: Update notifications more visible but less aggressive
+  * Feature: Add --changelog flag to view current version changelog
+  * Feature: New version.py module for version information display
+  * Enhancement: Users can see changelog without visiting GitHub
+  * Enhancement: Fallback to GitHub release notes if changelog unavailable
+  * docs: Document OBS build failure prevention in CLAUDE.md
+  * docs: Add comprehensive OBS Package Management section
+
+ -- Yago López Prado <yago.lopez.adeje@gmail.com>  Wed, 15 Jan 2026 04:00:00 +0000
+
+wasm (0.13.14-1) unstable; urgency=medium
+
+  * Fix: OBS build failures - add missing python3-inquirer dependency
+  * Fix: Update debian.changelog and RPM spec changelog for 0.13.13
+  * Enhancement: Ensure all OBS package dependencies are declared
+
+ -- Yago López Prado <yago.lopez.adeje@gmail.com>  Wed, 15 Jan 2026 01:00:00 +0000
+
+wasm (0.13.13-1) unstable; urgency=medium
+
+  * Fix: Critical bare except clause in monitor API
+  * Fix: Static apps (Vite) trying to restart non-existent services
+  * Fix: Update checker now detects installation method (pip/apt/dnf/etc)
+  * Fix: APT package name in update checker (wasm vs wasm-cli)
+  * Enhancement: Comprehensive logging for silent exception catches
+  * Enhancement: Contextual HTTP error messages in API endpoints
+  * Enhancement: Error handling for file operations (env files, journalctl)
+  * Feature: Update banner in web dashboard
+  * Feature: /api/system/version endpoint for update checking
+
+ -- Yago López Prado <yago.lopez.adeje@gmail.com>  Wed, 15 Jan 2026 00:00:00 +0000
+
+wasm (0.13.12-1) unstable; urgency=medium
+
+  * chore: Clean distribution packages (remove Docker files, dev tools)
+  * docs: Rewrite README professionally without emojis
+  * feat: Add .gitattributes to exclude dev files from git archive
+  * feat: Add MANIFEST.in to control PyPI source distribution
+  * Package cleanup: removed Dockerfile*, docker/, docker-compose.obs.yml
+
+ -- Yago López Prado <yago.lopez.adeje@gmail.com>  Tue, 14 Jan 2026 17:30:00 +0000
+
+wasm (0.13.11-1) unstable; urgency=medium
+
+  * Fix: Environment variables with quotes now properly stripped from .env files
+  * Fix: Systemd service files no longer have double-quoted env vars
+  * Feature: Automatic update checker via GitHub Releases API
+  * Feature: Update notifications shown every hour (cached, non-blocking)
+  * Enhancement: Update checker runs post-command to avoid delays
+
+ -- Yago López Prado <yago.lopez.adeje@gmail.com>  Tue, 14 Jan 2026 16:30:00 +0000
+
+wasm (0.13.9-1) unstable; urgency=medium
+
+  * Fix: 'wasm store import' now updates app type for existing apps
+  * Enhancement: Apps with type 'unknown' get re-detected on import
+
+ -- Yago López Prado <yago.lopez.adeje@gmail.com>  Wed, 08 Jan 2026 20:00:00 +0000
+
+wasm (0.13.8-1) unstable; urgency=medium
+
+  * Feature: 'wasm store import' now auto-detects app type
+    - Detects nextjs (next.config.*, package.json next dep)
+    - Detects vite (vite.config.*, package.json vite dep)
+    - Detects nodejs (package.json)
+    - Detects python (requirements.txt, setup.py, pyproject.toml)
+    - Detects static (index.html)
+
+ -- Yago López Prado <yago.lopez.adeje@gmail.com>  Wed, 08 Jan 2026 19:00:00 +0000
+
+wasm (0.13.7-1) unstable; urgency=medium
+
+  * Fix: 'wasm store sync' now also updates app status (running/stopped)
+  * Enhancement: sync shows both services and apps updated
+
+ -- Yago López Prado <yago.lopez.adeje@gmail.com>  Wed, 08 Jan 2026 18:00:00 +0000
+
+wasm (0.13.6-1) unstable; urgency=medium
+
+  * Fix: 'wasm store sync' using service.active instead of service.status
+  * Fix: Consistent attribute naming in store sync function
+  * All store-related fixes from 0.13.2-0.13.5 consolidated
+
+ -- Yago López Prado <yago.lopez.adeje@gmail.com>  Wed, 08 Jan 2026 17:00:00 +0000
+
+wasm (0.13.5-1) unstable; urgency=medium
+
+  * Fix: 'wasm store import' now finds app directories with different naming
+    - Searches: app-name, domain.com, wasm-app-name
+  * Fix: Import correctly links existing apps to sites
+
+ -- Yago López Prado <yago.lopez.adeje@gmail.com>  Wed, 08 Jan 2026 16:00:00 +0000
+
+wasm (0.13.4-1) unstable; urgency=medium
+
+  * Fix: 'wasm store import' using wrong attribute name (unit_file vs service_file)
+
+ -- Yago López Prado <yago.lopez.adeje@gmail.com>  Wed, 08 Jan 2026 15:00:00 +0000
+
+wasm (0.13.3-1) unstable; urgency=high
+
+  * Fix: Corrupted debian.postrm script causing upgrade failure
+  * Bug caused 'syntax error near unexpected token instructions'
+
+ -- Yago López Prado <yago.lopez.adeje@gmail.com>  Wed, 08 Jan 2026 14:00:00 +0000
+
+wasm (0.13.2-1) unstable; urgency=medium
+
+  * Feature: SQLite persistence store for tracking deployed apps
+  * New: Store tracks apps, sites, services, and databases
+  * New: wasm store commands (init, stats, import, export, sync, path)
+  * Enhancement: webapp list/status commands now use SQLite store
+  * Enhancement: Database create/drop commands track in store
+  * Enhancement: Managers (nginx, apache, service, cert) register in store
+  * Fix: GitHub Actions .deb build missing pybuild-plugin-pyproject
+
+ -- Yago López Prado <yago.lopez.adeje@gmail.com>  Wed, 08 Jan 2026 12:00:00 +0000
+
+wasm (0.13.1-1) unstable; urgency=medium
+
+  * Fix: Systemd services failing with 'Permission denied' when using nvm
+  * Fix: Detect and avoid private paths (nvm, ~/.local) in service ExecStart
+  * Fix: Prefer global Node.js installation over user-specific nvm paths
+  * Enhancement: Add helpful error messages for nvm path issues
+
+ -- Yago López Prado <yago.lopez.adeje@gmail.com>  Mon, 30 Dec 2025 18:00:00 +0000
+
+wasm (0.13.0-1) unstable; urgency=medium
+
+  * Feature: Database UI overhaul with logs, tabs, and SQL import
+  * Feature: Database credential management via config.yaml
+  * Fix: MySQL connection with password protection
+  * Fix: Local environment installation issues
+
+ -- Yago López Prado <yago.lopez.adeje@gmail.com>  Mon, 24 Feb 2025 12:00:00 +0000
+
+wasm (0.11.4-1) unstable; urgency=medium
+
+  * Fix: Backup API using wrong attribute names (backup_id vs id)
+  * Fix: Add -y flag as alias for --force/-f in delete commands
+  * Fix: WebSocket logs handler error handling and stderr capture
+  * Fix: Frontend logs page now handles error and warning messages
+  * Fix: Create backup endpoint using correct BackupManager.create() signature
+
+ -- Yago López Prado <yago.lopez.adeje@gmail.com>  Sat, 21 Dec 2025 16:00:00 +0000
+
+wasm (0.11.3-1) unstable; urgency=medium
+
+  * Fix: GitHub Actions workflow version extraction for OBS tarball naming
+  * The sed regex was including parentheses in version string
+
+ -- Yago López Prado <yago.lopez.adeje@gmail.com>  Sat, 21 Dec 2025 13:00:00 +0000
+
+wasm (0.11.2-1) unstable; urgency=medium
+
+  * Fix: Make web dependencies optional (Recommends) for OBS packages
+  * Web dependencies like python3-fastapi are not available as native packages
+    in Fedora/openSUSE, so they must be installed via pip when needed
+
+ -- Yago López Prado <yago.lopez.adeje@gmail.com>  Sat, 21 Dec 2025 12:00:00 +0000
+
+wasm (0.11.1-1) unstable; urgency=medium
+
+  * Fix: Include web dependencies in OBS packages (deb/rpm)
+  * Add python3-fastapi, python3-uvicorn, python3-jose, python3-passlib,
+    python3-bcrypt, python3-psutil, python3-aiofiles as package dependencies
+  * Improve error messages for missing web dependencies
+  * Show OS-specific installation instructions (apt/dnf/zypper/pip)
+
+ -- Yago López Prado <yago.lopez.adeje@gmail.com>  Sat, 20 Dec 2025 12:00:00 +0000
+
+wasm (0.11.0-1) unstable; urgency=medium
+
+  * New feature: Web Interface Dashboard (wasm web start/stop/status)
+  * REST API for remote application management
+  * Real-time WebSocket updates for logs and events
+  * Token-based authentication with JWT
+  * Rate limiting and brute force protection
+  * API endpoints: /api/apps, /api/services, /api/sites, /api/certs
+  * API endpoints: /api/backups, /api/monitor, /api/system, /api/config
+  * Background job processing with progress tracking
+  * Optional dependencies: pip install wasm-cli[web]
+
+ -- Yago López Prado <yago.lopez.adeje@gmail.com>  Thu, 19 Dec 2024 23:00:00 +0000
+
+wasm (0.10.5-1) unstable; urgency=medium
+
+  * Detect OOM (Out of Memory) build failures with exit code 137
+  * Provide actionable suggestions for resolving memory issues
+  * Add OutOfMemoryError exception with swap/memory configuration tips
+
+ -- Yago López Prado <yago.lopez.adeje@gmail.com>  Thu, 19 Dec 2024 22:00:00 +0000
+
+wasm (0.10.4-1) unstable; urgency=medium
+
+  * CI: Automatic deployment to OBS on release
+  * Fix: OBS deployment configuration in GitHub Actions
+
+ -- Yago López Prado <yago.lopez.adeje@gmail.com>  Thu, 19 Dec 2024 20:00:00 +0000
+
+wasm (0.10.3-1) unstable; urgency=medium
+
+  * Fix: Git pull with unstaged/uncommitted changes during wasm update
+  * Auto-stash local changes before pull, restore after
+  * Handle divergent branches with automatic reset to remote
+  * Handle rebase conflicts gracefully
+  * Preserve .env and untracked files during force updates
+
+ -- Yago López Prado <yago.lopez.adeje@gmail.com>  Thu, 19 Dec 2024 18:00:00 +0000
+
+wasm (0.10.2-1) unstable; urgency=medium
+
+  * Fix: Git "dubious ownership" error during wasm update
+  * Auto-configure git safe.directory for app directories
+
+ -- Yago López Prado <yago.lopez.adeje@gmail.com>  Thu, 19 Dec 2024 12:00:00 +0000
+
+wasm (0.10.0-1) unstable; urgency=medium
+
+  * New feature: Backup and Rollback system
+  * Add 'wasm backup create <domain>' - Create application backups
+  * Add 'wasm backup list [domain]' - List all or app-specific backups
+  * Add 'wasm backup restore <backup_id>' - Restore from backup
+  * Add 'wasm backup delete <backup_id>' - Delete a backup
+  * Add 'wasm backup verify <backup_id>' - Verify backup integrity
+  * Add 'wasm backup info <backup_id>' - Show backup details
+  * Add 'wasm backup storage' - Display storage usage statistics
+  * Add 'wasm rollback <domain> [backup_id]' - Quick rollback to previous state
+  * Auto-backup before 'wasm update' for safe rollback
+  * Backup rotation (configurable max backups per app)
+  * SHA256 checksum verification for backup integrity
+  * Git commit/branch tracking in backup metadata
+  * Exclude node_modules, .git, cache by default (configurable)
+  * JSON output support for automation (--json flag)
+  * Fix: Service create --command argument conflict
+  * Fix: Nginx template duplicate location for health_check=/
+  * Improvement: Use absolute paths in systemd services
+  * 132 tests passing
+
+ -- Yago López Prado <yago.lopez.adeje@gmail.com>  Wed, 18 Dec 2024 18:00:00 +0000
+
+wasm (0.9.2-1) unstable; urgency=medium
+
+  * Fix: Show complete error output (stdout+stderr) when dependency install fails
+  * Fix: Auto-retry without --frozen-lockfile when strict lockfile install fails
+  * Fix: Config file now properly updated during 'wasm setup init' when exists
+  * Fix: Better error display with line limit (20 default, 50 with --verbose)
+  * Improve pnpm/yarn compatibility with version mismatch fallback
+
+ -- Yago López Prado <yago.lopez.adeje@gmail.com>  Wed, 18 Dec 2024 02:00:00 +0000
+
+wasm (0.9.1-1) unstable; urgency=medium
+
+  * Fix setup.py for Ubuntu Jammy compatibility
+  * Provide explicit package metadata in setup.py for older build systems
+  * Fix pybuild "UNKNOWN wheel" error on Jammy
+
+ -- Yago López Prado <yago.lopez.adeje@gmail.com>  Wed, 18 Dec 2024 01:00:00 +0000
+
+wasm (0.9.0-1) unstable; urgency=medium
+
+  * Major enhancement: Comprehensive system dependency checker
+  * Add guided 'wasm setup init' wizard with 6 installation phases
+  * Add 'wasm setup doctor' command for system diagnostics
+  * Support for Node.js package managers: npm, pnpm, yarn, bun
+  * Pre-deployment verification warns about missing dependencies
+  * Package manager fallback: auto-use available PM if requested not found
+  * Add setup.py fallback for Ubuntu Jammy (22.04) compatibility
+  * Improved error messages with actionable hints
+  * 93 tests passing
+
+ -- Yago López Prado <yago.lopez.adeje@gmail.com>  Wed, 18 Dec 2024 00:00:00 +0000
+
+wasm (0.8.3-1) unstable; urgency=medium
+
+  * Add SSH key validation and setup wizard for Git authentication
+  * Auto-generate SSH keys when cloning private repos without SSH configured
+  * Add 'wasm setup ssh' command to manage SSH keys
+  * Improve error messages with step-by-step guidance
+  * Fix test suite compatibility issues
+
+ -- Yago López Prado <yago.lopez.adeje@gmail.com>  Tue, 17 Dec 2024 16:00:00 +0000
+
+wasm (0.8.2-1) unstable; urgency=medium
+
+  * Auto-install python3-inquirer via pip during package installation
+  * Remove python3-inquirer from package dependencies (not in Ubuntu repos)
+  * Add python3-pip as dependency for post-install script
+  * All dependencies now install automatically with the package
+
+ -- Yago López Prado <yago.lopez.adeje@gmail.com>  Tue, 17 Dec 2024 10:00:00 +0000
+
+wasm (0.8.1-1) unstable; urgency=medium
+
+  * Fix: python3-inquirer now a required dependency (was Recommends)
+  * Interactive mode (-i) now works out of the box
+
+ -- Yago López Prado <yago.lopez.adeje@gmail.com>  Mon, 16 Dec 2024 19:00:00 +0000
+
+wasm (0.8.0-1) unstable; urgency=medium
+
+  * Major version bump to 0.8.0
+  * Add AI-powered process monitoring with OpenAI integration
+  * Add email notifications for security threats (SMTP support)
+  * Add automatic malicious process termination
+  * Add pattern-based threat detection
+  * Fix config file permissions for non-root users
+  * Improve CLI structure and help messages
+
+ -- Yago López Prado <yago.lopez.adeje@gmail.com>  Mon, 16 Dec 2024 18:00:00 +0000
+
+wasm (0.1.0-1) unstable; urgency=medium
+
+  * Initial release.
+
+ -- Yago López Prado <yago.lopez.adeje@gmail.com>  Mon, 16 Dec 2024 10:00:00 +0000
--- wasm-1.6.1.orig/debian/control
+++ wasm-1.6.1/debian/control
@@ -0,0 +1,68 @@
+Source: wasm
+Section: admin
+Priority: optional
+Maintainer: Yago López Prado <yago.lopez.adeje@gmail.com>
+# Generating the shell completions runs the package, so everything it imports
+# at import time is needed at build time too, not only at run time. Leaving
+# these out is what made every OBS target fail with ModuleNotFoundError while
+# the GitHub runner, which happens to ship python3-yaml, built fine.
+# Only what builds a wheel. Nothing here runs the package: the shell
+# completions are committed rather than generated, which is what removed
+# the whole class of failure where every runtime import became a build
+# dependency on every distribution and every architecture.
+Build-Depends: debhelper-compat (= 13),
+               dh-python,
+               pybuild-plugin-pyproject,
+               python3-all,
+               python3-setuptools,
+               python3-wheel
+Standards-Version: 4.6.0
+Homepage: https://github.com/Perkybeet/wasm
+Rules-Requires-Root: no
+
+Package: wasm
+Architecture: all
+Depends: ${python3:Depends},
+         ${misc:Depends},
+         python3 (>= 3.10),
+         python3-pip,
+         python3-yaml,
+         python3-jinja2,
+         python3-click,
+         python3-rich,
+         nginx | apache2,
+         certbot
+# python3-inquirer does not exist in Debian or Ubuntu, so the interactive mode
+# it gated never worked on those distributions. Prompts use questionary, which
+# is packaged from Debian 13 and Ubuntu 24.04 onwards.
+#
+# questionary is a Recommends rather than a Depends because it is absent from
+# Debian 12 and Ubuntu 22.04, where a Depends built a package apt then refused
+# to install. apt installs Recommends by default, so nothing changes on the
+# releases that have it, and on the two that do not the package installs and
+# interactive mode explains what is missing.
+Recommends: python3-questionary,
+            python3-fastapi,
+            python3-starlette,
+            python3-pydantic,
+            python3-uvicorn,
+            python3-psutil
+Suggests: git,
+          nodejs,
+          npm
+Description: Web App System Management CLI Tool
+ WASM is a robust CLI tool for deploying and managing web applications
+ on Linux servers. It handles site configuration (Nginx/Apache), SSL
+ certificates (Certbot), systemd services, and automated deployment
+ workflows for various application types.
+ .
+ Features:
+  - Deploy Next.js, Node.js, Vite, Python, and static applications
+  - Nginx and Apache site management
+  - SSL certificate management via Certbot/Let's Encrypt
+  - Systemd service management
+  - Interactive mode with guided prompts
+  - Web dashboard for remote management (optional)
+  - REST API with token-based authentication
+  - Backup and rollback system
+  - AI-powered security monitoring
--- wasm-1.6.1.orig/debian/copyright
+++ wasm-1.6.1/debian/copyright
@@ -0,0 +1,29 @@
+Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: wasm
+Upstream-Contact: Yago López Prado <yago.lopez.adeje@gmail.com>
+Source: https://github.com/Perkybeet/wasm
+
+Files: *
+Copyright: 2024-2025 Yago López Prado
+License: WASM-NCSAL
+
+License: WASM-NCSAL
+ WASM Non-Commercial Source-Available License (WASM-NCSAL) Version 1.0
+ .
+ This software is provided under a non-commercial source-available license.
+ You may use, study, modify, and distribute this software for personal
+ and educational purposes ONLY.
+ .
+ COMMERCIAL USE IS STRICTLY PROHIBITED without prior written authorization
+ from the Author. This includes selling the software, incorporating it into
+ paid products or services, or any form of monetization.
+ .
+ To obtain a commercial license, contact:
+ Email: yago.lopez.adeje@gmail.com / hello@bitbeet.dev
+ Phone: +34 637 881 066
+ .
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+ OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ .
+ See the LICENSE file in the source distribution for the complete terms.
--- wasm-1.6.1.orig/debian/postinst
+++ wasm-1.6.1/debian/postinst
@@ -0,0 +1,70 @@
+#!/bin/bash
+set -e
+
+case "$1" in
+    configure)
+        # Install Python dependencies that aren't available as .deb packages
+        echo "Installing Python dependencies..."
+        pip3 install inquirer --break-system-packages --quiet 2>/dev/null || {
+            echo "Warning: Failed to install inquirer. Interactive mode may not work."
+        }
+        
+        # Create wasm group if it doesn't exist
+        if ! getent group wasm > /dev/null 2>&1; then
+            groupadd --system wasm
+        fi
+        
+        # Set proper permissions for directories
+        if [ -d /var/www/apps ]; then
+            chown -R www-data:www-data /var/www/apps
+            chmod 755 /var/www/apps
+        fi
+        
+        if [ -d /var/log/wasm ]; then
+            chown -R www-data:wasm /var/log/wasm
+            chmod 775 /var/log/wasm
+        fi
+        
+        if [ -d /etc/wasm ]; then
+            chmod 755 /etc/wasm
+            # Config file readable by wasm group (contains sensitive data)
+            chown root:wasm /etc/wasm/config.yaml 2>/dev/null || true
+            chmod 640 /etc/wasm/config.yaml 2>/dev/null || true
+        fi
+
+        # Upgrade config file with new defaults (preserves user values)
+        if [ -f /etc/wasm/config.yaml ]; then
+            echo "Upgrading configuration with new defaults..."
+            wasm config upgrade --quiet 2>/dev/null || true
+        fi
+
+        # Update wasm-monitor service if it exists and is enabled
+        if systemctl is-enabled wasm-monitor.service >/dev/null 2>&1; then
+            echo "Updating wasm-monitor service..."
+            # Reinstall service file with new version
+            wasm monitor install >/dev/null 2>&1 || true
+            # Reload systemd and restart service
+            systemctl daemon-reload
+            systemctl restart wasm-monitor.service || true
+            echo "wasm-monitor service updated and restarted"
+            echo ""
+            echo "NOTE: the monitor no longer terminates processes or deletes files."
+            echo "It decided what was malicious by matching substrings against a"
+            echo "process command line, and acted on that as root. It now reports"
+            echo "resource use, service health and notable processes, and acts on"
+            echo "nothing. The auto_terminate and use_ai settings are ignored."
+        fi
+        ;;
+    
+    abort-upgrade|abort-remove|abort-deconfigure)
+        ;;
+    
+    *)
+        echo "postinst called with unknown argument \`$1'" >&2
+        exit 1
+        ;;
+esac
+
+#DEBHELPER#
+
+exit 0
--- wasm-1.6.1.orig/debian/postrm
+++ wasm-1.6.1/debian/postrm
@@ -0,0 +1,32 @@
+#!/bin/bash
+set -e
+
+case "$1" in
+    remove)
+        echo "Removing WASM..."
+        # Don't remove apps or configuration on remove
+        ;;
+    
+    purge)
+        echo "Purging WASM configuration..."
+        # Remove configuration
+        rm -rf /etc/wasm
+        # Remove logs
+        rm -rf /var/log/wasm
+        # Note: We intentionally don't remove /var/www/apps
+        # to prevent accidental data loss
+        echo "Note: /var/www/apps was not removed to prevent data loss"
+        ;;
+    
+    upgrade|failed-upgrade|abort-install|abort-upgrade|disappear)
+        ;;
+    
+    *)
+        echo "postrm called with unknown argument \`$1'" >&2
+        exit 1
+        ;;
+esac
+
+#DEBHELPER#
+
+exit 0
--- wasm-1.6.1.orig/debian/rules
+++ wasm-1.6.1/debian/rules
@@ -0,0 +1,34 @@
+#!/usr/bin/make -f
+
+export PYBUILD_NAME=wasm
+export DH_VERBOSE=1
+
+%:
+	dh $@ --with python3 --buildsystem=pybuild
+
+override_dh_auto_install:
+	dh_auto_install
+	# Create config directory
+	install -d debian/wasm/etc/wasm
+	# Install default config
+	install -m 644 debian/wasm.default.yaml debian/wasm/etc/wasm/config.yaml
+	# Create apps directory
+	install -d debian/wasm/var/www/apps
+	# Create log directory
+	install -d debian/wasm/var/log/wasm
+	# Shell completion. Committed, not generated here: Click's scripts contain
+	# no command names, so they cannot drift, and running Python during the
+	# build would make every runtime import a build dependency. That is what
+	# failed all twenty-two OBS targets.
+	install -Dm644 src/wasm/completions/wasm.bash \
+		debian/wasm/usr/share/bash-completion/completions/wasm
+	install -Dm644 src/wasm/completions/_wasm \
+		debian/wasm/usr/share/zsh/vendor-completions/_wasm
+	install -Dm644 src/wasm/completions/wasm.fish \
+		debian/wasm/usr/share/fish/vendor_completions.d/wasm.fish
+
+override_dh_installsystemd:
+	dh_installsystemd --no-enable --no-start
+
+override_dh_auto_test:
+	@echo "Skipping tests during package build"
--- wasm-1.6.1.orig/debian/wasm.default.yaml
+++ wasm-1.6.1/debian/wasm.default.yaml
@@ -0,0 +1,109 @@
+# WASM Default Configuration
+# Location: /etc/wasm/config.yaml
+
+# Directory where applications are deployed
+apps_directory: /var/www/apps
+
+# Default web server (nginx or apache)
+webserver: nginx
+
+# User for running services
+service_user: www-data
+
+# SSL configuration
+ssl:
+  enabled: true
+  provider: certbot
+  email: ""
+
+# Logging configuration
+logging:
+  level: info
+  directory: /var/log/wasm
+
+# =============================================================================
+# Node.js Configuration
+# =============================================================================
+# Configure Node.js and package managers for JavaScript applications
+
+nodejs:
+  # Default Node.js version to use
+  default_version: "20"
+  
+  # Whether to use nvm (Node Version Manager)
+  use_nvm: false
+  
+  # Package managers to use/install during setup
+  # Available: npm, pnpm, yarn, bun
+  # npm comes with Node.js by default
+  package_managers:
+    - npm
+    # - pnpm  # Uncomment to enable pnpm
+    # - yarn  # Uncomment to enable yarn
+    # - bun   # Uncomment to enable bun
+
+# =============================================================================
+# Python Configuration
+# =============================================================================
+python:
+  default_version: "3.11"
+  use_venv: true
+
+# =============================================================================
+# AI-Powered Process Monitor Configuration
+# =============================================================================
+# The process monitor scans running processes to detect and neutralize
+# suspicious or malicious activity (e.g., cryptocurrency miners, reverse shells)
+#
+# IMPORTANT: This feature requires additional dependencies:
+#   - psutil (pip install psutil)
+#   - httpx or requests (pip install httpx)
+
+monitor:
+  # Enable/disable the monitor (default: false)
+  enabled: false
+  
+  # How often to scan processes (in seconds)
+  # Default: 3600 (1 hour)
+  scan_interval: 3600
+  
+  # Resource thresholds that trigger additional scrutiny
+  cpu_threshold: 80.0      # Processes using more than this % CPU
+  memory_threshold: 80.0   # Processes using more than this % memory
+  
+  # Automatic termination settings
+  auto_terminate: true           # Automatically terminate detected threats
+  terminate_malicious_only: true # Only terminate "malicious" (not "suspicious")
+  
+  # AI Analysis using OpenAI
+  use_ai: true
+  
+  # Dry run mode - log actions without actually terminating processes
+  dry_run: false
+  
+  # Monitor log file
+  log_file: /var/log/wasm/monitor.log
+  
+  # OpenAI API Configuration
+  # Get your API key from: https://platform.openai.com/api-keys
+  openai:
+    api_key: ""              # Your OpenAI API key
+    model: "gpt-4o-mini"     # Model to use for analysis
+  
+  # SMTP Configuration for Email Notifications
+  # Sends alerts when threats are detected and after mitigation
+  smtp:
+    host: ""                 # SMTP server hostname (e.g., smtp.ionos.es)
+    port: 465                # SMTP port (465 for SSL, 587 for TLS)
+    username: ""             # SMTP username (usually your email)
+    password: ""             # SMTP password
+    use_ssl: true            # Use SSL/TLS connection
+    use_tls: false           # Use STARTTLS (if use_ssl is false)
+    from_address: ""         # From address (defaults to username)
+  
+  # List of email addresses to receive alerts
+  email_recipients: []
+  # Example:
+  # email_recipients:
+  #   - admin@example.com
+  #   - security@example.com
