QManager BETA v0.1.15

🚀 QManager BETA v0.1.15

Full rewrite of the install/update/uninstall pipeline — now filesystem-driven, crash-resilient, and curl-only. New password complexity rules with a live requirements checklist. Critical install-stability fixes: binary corruption, SSH drops on LAN installs, and spontaneous device reboots. Plus a security fix for the password reset tool and a correction to the About page's LAN info.

---

✨ Improvements

Typography — Switched to Manrope

• Euclid Circular B replaced with Manrope across the entire frontend. The app now ships a single Google Fonts–sourced typeface (self-hosted at build time by next/font/google, so the device still needs zero internet at runtime) instead of six local .woff2 weights for Euclid.
• ~200 KB smaller frontend tarball — the qmanager-build output dropped from ~6.5 MB → ~6.3 MB. Manrope's variable-font pipeline is more aggressively subsetted and compressed than the fixed Euclid weights we were shipping, and we're no longer bundling the italic cut we barely used.
• Visual parity — Manrope is still a clean geometric sans in the same family as the previous design language (Vercel/Linear-adjacent), so no UI component needed tuning. Line heights, weights, and tracking all carry over.
• Reversible — the Euclid local-font block is left commented out in app/layout.tsx so we can flip back without re-adding the imports if we decide to revisit the decision.

About Device — Correct LAN Info

• "LAN Gateway" replaced with "LAN Subnet" — The About page previously read LAN info from the modem via AT+QMAP="LANIP", which reports the modem's internal USB/RNDIS pass-through subnet (default 192.168.224.x), not your actual OpenWRT LAN. Changing your LuCI LAN IP never updated the About page because those are two completely different networks.
• Now sourced from OpenWRT UCI — Device IP comes from uci get network.lan.ipaddr, and LAN Subnet is computed as <network_address>/<prefix> from the LAN netmask. Change your LAN to 192.168.228.1/24 and the About page immediately reflects 192.168.228.1 and 192.168.228.0/24.
• One fewer AT call per About page load — Dropping AT+QMAP="LANIP" from the compound AT query reduces modem round-trips and removes a failure mode on pages that were previously gated on modem responsiveness.

Path: About Device (/about-device)

Password Validation — Complexity Rules and Live Requirements Checklist

• Minimum length reduced to 5 (from 6), but passwords must now include at least one uppercase letter, one lowercase letter, and one number. A 5-character Abc12 is demonstrably stronger than a 6-character abcdef — the rule change trades raw length for character-class coverage.
• Live requirements checklist under the password field — both the onboarding password step and the change-password dialog now render a 4-item checklist that greys out (unmet) or turns success-green (met) in real time as the user types. No more guessing what "strong enough" means; the user sees every rule transition green before they can submit.
• Single source of truth — new components/auth/password-requirements.tsx exports both the PasswordRequirements component and an isPasswordValid() helper. Both frontend call sites use isPasswordValid() for their submit validators instead of duplicating regex checks inline. Future rule tweaks (e.g., adding a symbol requirement) change one file.
• Backend parity — auth/login.sh and auth/password.sh enforce the same rules server-side using POSIX grep character classes as defense-in-depth. Error code renamed from password_too_short to password_weak with the consolidated message "Password must be at least 5 characters and include uppercase, lowercase, and a number".
• Existing passwords still work — the new rules only gate password creation (setup + change). Users with longer but weaker existing passwords (e.g., all lowercase) can still log in; they just can't pick one like that going forward.
• Onboarding Continue button is now gated on validity — during first-time setup, the "Continue" button on the password step stays disabled until every requirement in the live checklist is green and the confirmation field matches. No more clicking Continue only to hit a toast error; the button itself tells you you're not ready yet. The step reports its validity up to the wizard via an onValidityChange callback, which flows into the shell's existing continueDisabled prop.

Paths: Onboarding (first-time setup), System Settings → Change Password dialog

🔧 Backend / Infrastructure

Install / Update / Uninstall Pipeline — Full Rewrite (v2)

All three scripts have been redesigned from the ground up to be filesystem-driven and crash-resilient.

• Filesystem-driven service management — stop_services(), enable_services(), and the daemon kill loop now iterate $INITD_DIR/qmanager* and $BIN_DIR/qmanager_* instead of hardcoded service lists. Adding a new init.d service no longer requires updating install.sh in multiple places. The only remaining hardcoded list is UCI_GATED_SERVICES (4 user-controlled services: qmanager_watchcat, qmanager_tower_failover, qmanager_bandwidth, qmanager_dpi).
• Two-phase VERSION write — /etc/qmanager/VERSION.pending is written at the start of install; /etc/qmanager/VERSION is only updated after every step succeeds. If an install crashes mid-way, the old VERSION stays intact and VERSION.pending is a clear debugging breadcrumb.
• build.sh auto-stamps VERSION from package.json — The build now reads the version once and sed-patches it into both install.sh and uninstall.sh in the staged tarball. This fixes the v0.1.13 → v0.1.14 bug where the Updates page kept showing the old version after a successful OTA upgrade because install.sh had a stale hardcoded VERSION="v0.1.13" constant.
• Atomic file installs — New install_file() helper copies to a temp path, strips CRLF, chmods, and atomically renames into place. Eliminates "text file busy" half-writes when replacing running daemons and folds the old separate fix_line_endings / fix_permissions passes into a single operation.
• Interactive modem-detection prompt — If detect_modem_firmware() cannot reach the modem on a fresh install, the script now prompts Continue installation anyway? [y/N] in interactive mode instead of dying outright. Non-interactive mode still fails fast unless --force is passed.
• Mandatory conflict removal — remove_conflicts() (which opkg-removes sms-tool, socat-at-bridge, and socat — packages that clobber /dev/smd11 and collide with our bundled sms_tool) now runs on every install regardless of --skip-packages. Previously --skip-packages also skipped conflict removal, which could leave a broken AT stack even on a "successful" install.
• ethtool is now required (was optional) — install hard-fails if ethtool can't be installed. qmanager_eth_link (ethernet link speed control) and several ethernet-touching paths depend on it; keeping it optional created a class of "works until you touch the ethernet card" bugs.
• Post-install health check — After start_services(), the installer now waits up to 10 seconds for /tmp/qmanager_status.json to be produced by the poller. A stronger signal than just checking pidof qmanager_poller — verifies the poller is actually producing data, not just running.
• AT stack verification — New at_stack_check() step runs qcmd ATI up to 3 times at the very end of install (after services are up) to confirm the full AT pipeline (qcmd → atcli_smd11 → /dev/smd11) is working. On success, logs the modem model line (Quectel, RM551E-GL). On failure, prints a numbered troubleshooting list pointing at /dev/smd11 permissions, direct atcli_smd11 'AT' testing, package conflict checks, and the install log. Warn-only with retries so fresh hardware has a few seconds to settle before the check fires.
• Structured install logging — Everything visible on screen is also mirrored to /tmp/qmanager_install.log and /tmp/qmanager_uninstall.log with timestamps and severity levels (INFO/WARN/ERROR). Log files are truncated at the start of each run, so they always reflect the most recent attempt.
• New install.sh lint in build.sh — Build-time validation that the filesystem-iteration pattern is present, the main qmanager init.d service exists, and every UCI_GATED_SERVICES entry has a real file in scripts/etc/init.d/. Catches design regressions before the tarball is built.
• Cleaner update.sh CGI contract — No frontend changes required. The Software Update page still talks to update.sh the same way; the status JSON schema ({status, message, version, size}) is identical. OTA upgrades from v0.1.14 will work transparently.

curl-only HTTP Everywhere

• Dropped wget and uclient-fetch fallbacks across the entire backend. Previously, every script that fetched anything had a 3-way cascade (uclient-fetch → wget → curl) to support minimal OpenWRT installs. Since curl is now a required package (installed by install.sh alongside jq and coreutils-timeout), the fallbacks were dead weight.
• Affected scripts:
  • qmanager-installer.sh (bootstrap)
  • scripts/usr/bin/qmanager_update (OTA daemon)
  • scripts/usr/bin/qmanager_auto_update (cron-triggered updater)
  • scripts/www/cgi-bin/quecmanager/system/update.sh (Updates page CGI)
  • scripts/www/cgi-bin/quecmanager/device/about.sh (public IP fetch)
• Early failure with clear hint — Scripts that need curl now check for it up-front and print Install it first: opkg update && opkg install curl ca-bundle if it's missing, instead of silently falling through to a dead fallback path.

Bootstrap Installer — Stable + Pre-release Channels

• New --channel flag — `qma...

QManager BETA v0.1.14

🚀 QManager BETA v0.1.14

SMS Alerts are here, so you can receive downtime notifications even when the data path is offline. Plus, Custom SIM Profiles now auto-apply when a matching SIM is inserted.

---

✨ New Features

SMS Alerts

• Downtime SMS notifications — Receive an SMS when internet downtime exceeds your configured threshold.
• Outage-proof delivery path — Alerts are sent via sms_tool over the modem control channel, so delivery still works while data connectivity is down.
• Configurable behavior — Set recipient phone and threshold (1-60 minutes), then trigger a test SMS directly from the dashboard.
• SMS alert history — Sent and failed alert attempts are logged and displayed in the SMS Alerts log card.

Path: Monitoring -> SMS Alerts (/monitoring/sms-alerts)

IMEI Toolkit

For educational purposes only. Use at your own risk.

• Built-in IMEI generator — Generate valid 15-digit IMEI values from device TAC presets or a custom 8-12 digit prefix.
• Automatic Luhn validation — Validate typed or pasted IMEI values in real time once 15 digits are entered.
• Structure breakdown — Inspect TAC, SNR, and check digit fields directly in the toolkit for quick verification.
• Utility actions — Copy generated IMEI values and open external IMEI info lookup in one click.

Path: Cellular -> Settings -> IMEI Settings (/cellular/settings/imei-settings)

🔧 Backend / Infrastructure

AT Command Backend — Migrated to atcli_smd11

• New AT backend — All AT command execution now goes through atcli_smd11 instead of sms_tool. The new binary talks directly to /dev/smd11, is self-aware of long-command timeouts (e.g. AT+QSCAN=3,1, AT+QFOTADL), and produces clean output without the tcgetattr(...)/tcsetattr(...) diagnostics that sms_tool emits on char devices.
• Simpler qcmd — The gatekeeper script no longer needs dual timeout wrappers, the -t 240 native-timeout flag, or per-command warm-up gymnastics. A single outer safety cap (timeout 300) guards against a wedged process; atcli_smd11 handles the real timing.
• sms_tool is now SMS-only — The sms_tool binary still ships, but is reserved for SMS Center (recv/send/delete/status) and SMS Alerts. Every invocation now passes -d /dev/smd11 explicitly and strips the tcgetattr/tcsetattr noise from its output before parsing, so the SMS inbox JSON, storage status, and test-SMS error messages are always clean.
• Retired sms_tool_device setting — The System Settings toggle to switch between /dev/smd11 and /dev/smd7 has been removed (both binaries are now device-locked).
• Installer improvements — install.sh now removes conflicting opkg packages (sms-tool, socat-at-bridge, socat) before installing, then copies both atcli_smd11 and sms_tool from the bundled dependencies/ folder with 755 permissions. The sms-tool opkg package is no longer a required dependency.
• Shared /dev/smd11 lock — SMS Alerts and SMS Center now take the same /var/lock/qmanager.lock that qcmd/atcli_smd11 use, so sms_tool send/recv/delete/status no longer race concurrent AT commands from the poller or watchdog on the char device.

Phone Number Normalization — Simplified

• One rule everywhere: omit the + — SMS Alerts and SMS Center now share a single normalization rule: strip a leading + before handing the number to sms_tool. Nothing else. Inputs with or without + are accepted in the UI; storage in sms_alerts.json is always raw digits.
• Removed MCC-based local-number rewriting — cellular/sms.sh previously read the SIM's IMSI via AT+CIMI and rewrote numbers starting with 0 to an international form using a 270-line MCC-to-country-code lookup table. That lookup, the IMSI read, and the auto-prefixing are all gone — users are responsible for providing the full international number. This cuts cellular/sms.sh from 478 lines to 266 and removes a per-send AT round-trip.
• Migration-safe for existing installs — Legacy sms_alerts.json files containing "recipient_phone": "+14155551234" still work. sms_alerts_init does an in-memory + strip at boot; the file is rewritten the next time you save settings.

Installation / Update Pipeline (So Far)

• Build staging auto-cleanup — bun run package now removes qmanager-build/qmanager_install after both qmanager.tar.gz and sha256sum.txt are successfully generated, leaving only release artifacts.
• Safer conflict removal order — Conflict package removal now prioritizes sms-tool before socat-at-bridge and socat, reducing opkg dependency-chain removal failures.
• SSH-drop mitigation during upgrades — The install stop phase no longer stops qmanager_eth_link, preventing an early ethtool renegotiation that could briefly drop the management link/SSH session.
• Direct release workflow adopted — Fresh install/uninstall docs now use direct latest pre-release tarball download + checksum verification + install.sh/uninstall.sh execution.
• One-liner wrapper restored — qmanager-installer.sh is now a thin bootstrap helper that runs the same direct tarball + checksum flow, but in a single command.

🐛 Bug Fixes

Custom SIM Profiles — Auto-Apply on Matching SIM

• Profiles did not auto-apply on matching ICCID in key flows — A matching profile could be detected, but auto-apply was not consistently triggered across boot and SIM transition paths.
• Fix — Auto-apply now runs on boot, manual SIM slot switch, watchdog Tier 3 SIM failover, and watchdog SIM revert.
• Idempotent behavior — Existing per-step skip logic (APN/TTL/IMEI) ensures repeated triggers only apply differences and complete quickly when nothing changed.
• Concurrency-safe — Auto-apply respects the existing apply lock to avoid races with manual activation.

Sidebar Active-State in Cellular Navigation

• Cellular Information was highlighted on unrelated pages — The parent item stayed active across other Cellular routes, which also kept its sub-items expanded even when viewing a different section.
• Fix — Sidebar route matching now activates Cellular Information only for its own route and declared sub-routes, preventing false highlighting and incorrect submenu expansion.

APN Management Override with Active Custom Profile

• APN fields could override active profile settings — Users could still edit APN values while a Custom SIM Profile was active, creating conflicts with profile-managed APN behavior.
• Fix — APN form controls are now disabled whenever an active Custom SIM Profile is present, with an in-card notice showing profile ownership.
• Carrier Profile remains configurable — The Carrier Profile card stays editable so MBN selection and related carrier firmware controls are unchanged.

Device Metrics + Onboarding Band Source Hardening

• TA=0 showed misleading distance estimates — LTE/NR Cell Distance in Device Metrics could display very small estimated values (e.g. < 10 m) when Timing Advance was 0, even when that radio wasn't actively serving.
• Fix — Device Metrics now treats LTE/NR TA value 0 as unavailable and displays - instead of an estimated distance.
• Temperature averaging included zero sensors — In edge cases, AT+QTEMP sensor readings of 0 were included in the average, lowering the displayed modem temperature.
• Fix — Temperature parsing now excludes all non-positive sensor values (<= 0) before averaging.
• Onboarding used hardcoded band catalogs — Band preference options in onboarding were based on static LTE/NR lists rather than modem capabilities.
• Fix — Onboarding now reads supported LTE/NSA/SA bands from the poller status JSON (device.supported_*_bands) and uses those as the available selection set.

---

📥 Installation

Fresh Install

curl -fsSL -o /tmp/qmanager-installer.sh https://raw.githubusercontent.com/dr-dolomite/QManager/development-home/qmanager-installer.sh && sh /tmp/qmanager-installer.sh

Upgrading from v0.1.13

Head to System Settings → Software Update and hit "Check for Updates" — download, verify, then install with the two-step flow.

---

Thank You

Thanks for using QManager! If you find it useful, consider supporting the project. Bug reports and feature requests are always welcome on GitHub Issues.

License: MIT + Commons Clause

Happy connecting!

QManager BETA v0.1.13

🚀 QManager BETA v0.1.13

Custom SIM Profile reliability improvements — SIM mismatch detection, profile lifecycle events, and DPI boot persistence.

---

🐛 Bug Fixes

📡 Custom SIM Profiles — IMEI Apply Persistence

• 🔧 Profile showed "Inactive" after IMEI change + reboot — When a profile applied a new IMEI, the modem reboot (AT+CFUN=1,1) could trigger a full system reboot on some USB configurations, killing the apply script before it could mark the profile as active.
• ✅ Fix — The active profile marker is now written to flash immediately after a successful IMEI write (AT+EGMR), before the modem reboot command is issued. If the system reboots during the modem reset, the profile is already marked active. Finalization still re-sets on success or clears on total failure.

🌐 DPI Services Not Surviving Reboot

• 🔧 Video Optimizer and Traffic Masquerade settings didn't persist across reboots — The CGI save handlers set UCI config and restarted the service, but never called /etc/init.d/qmanager_dpi enable to register for boot startup.
• ✅ Fix — Enabling either DPI feature now also enables the init.d service for boot. Disabling only removes boot persistence when both features are off. Uninstall always cleans up the boot symlink.

---

✨ New Features

📡 Custom Profile SIM Mismatch Detection

• 🔗 Auto-deactivation on SIM swap — When the device boots with a different SIM card, the poller now checks if the active profile's ICCID matches the current SIM. If there's a mismatch, the profile is automatically deactivated and a warning event is emitted. Profiles without a stored ICCID are left alone.
• 📱 SIM Mismatch badge — The profile table now shows a warning badge ("SIM Mismatch") instead of the blue "Active" badge when the active profile was created for a different SIM than the one currently inserted.

📊 Custom Profile Network Events

• 🧩 Profile lifecycle events — Profile apply, failure, and deactivation are now tracked in the Network Events system:
  • Profile Applied (✅ info / ⚠️ warning for partial) — when a profile is successfully applied
  • Profile Failed (❌ error) — when all apply steps fail
  • Profile Deactivated (ℹ️ info / ⚠️ warning for SIM mismatch) — when a profile is manually or automatically deactivated
• 📱 Events appear in the Data Connection tab of the Network Events card

---

📥 Installation

Fresh Install

wget -O /tmp/qmanager-installer.sh \
  https://github.com/dr-dolomite/QManager/raw/refs/heads/development-home/qmanager-installer.sh && \
  sh /tmp/qmanager-installer.sh

Upgrading from v0.1.12

Head to System Settings → Software Update and hit "Check for Updates" — download, verify, then install with the two-step flow.

---

💙 Thank You

Thanks for using QManager! If you find it useful, consider supporting the project. Bug reports and feature requests are always welcome on GitHub Issues.

License: MIT + Commons Clause

Happy connecting! 📡

QManager BETA v0.1.12

🚀 QManager BETA v0.1.12

Antenna Alignment tool design refinement — improved color contrast for "Best" indicator.

---

🎨 Design Improvements

📡 Antenna Alignment — Best Slot Indicator

• 🔧 "Best" badge and recommendation now use primary color instead of green — prevents visual confusion when all signal values are in the "Good/Excellent" range (also green). The primary color provides clear contrast against signal quality indicators.
• 🔧 "Best" badge z-index fix — The trophy badge on the recommended slot now renders above the card border instead of clipping behind it.

---

📥 Installation

Fresh Install

wget -O /tmp/qmanager-installer.sh \
  https://github.com/dr-dolomite/QManager/raw/refs/heads/development-home/qmanager-installer.sh && \
  sh /tmp/qmanager-installer.sh

Upgrading from v0.1.11

Head to System Settings → Software Update and hit "Check for Updates" — download, verify, then install with the two-step flow.

---

💙 Thank You

Thanks for using QManager! If you find it useful, consider supporting the project. Bug reports and feature requests are always welcome on GitHub Issues.

License: MIT + Commons Clause

Happy connecting! 📡

QManager BETA v0.1.11

🚀 QManager BETA v0.1.11

Antenna Alignment tool, Tailscale --accept-routes fix, and fresh install reliability improvements.

---

🐛 Bug Fixes

🔒 Tailscale Connect Used --accept-routes

• 🔧 Connecting to Tailscale disconnected the device from the network — The tailscale up command still included --accept-routes, which overrides the device's routing table and kills all non-Tailscale connectivity. The connect action would always time out with "Timed out waiting for auth URL".
• ✅ Fix: Replaced with tailscale up --accept-dns=false --json. Also added vpn_fw_ensure_zone to the "already authenticated" reconnect path so the firewall zone is always applied.

📦 Fresh Install Missing coreutils-timeout

• 🔧 All AT commands failed with command_timeout (exit 127) — qcmd wraps every sms_tool call in timeout, but some firmware builds don't include the BusyBox timeout applet.
• ✅ Fix: Added coreutils-timeout to REQUIRED_PACKAGES in the installer script.

---

✨ New Features & Enhancements

📡 Antenna Alignment Tool

• 🆕 New Antenna Alignment page at Cellular → Antenna Alignment — Per-antenna signal strength (RSRP, RSRQ, SINR) for all 4 receiver chains (Main, Diversity, MIMO 3, MIMO 4), with automatic LTE/NR/EN-DC detection.
• 📊 Alignment Meter — Record signal at 3 different angles (directional) or positions (omni), each averaged over 3 samples. A composite score (60% RSRP + 40% SINR) recommends the best position.
• 🔄 Live signal preview — Real-time RSRP and SINR bars for the primary antenna update with each modem poll cycle during recording.
• 🎯 Directional / Omni toggle — Switch between angle-based (0°, 45°, 90°) and position-based (Position A, B, C) recording with custom labels.

---

📥 Installation

Fresh Install

wget -O /tmp/qmanager-installer.sh \
  https://github.com/dr-dolomite/QManager/raw/refs/heads/development-home/qmanager-installer.sh && \
  sh /tmp/qmanager-installer.sh

Upgrading from v0.1.10

Head to System Settings → Software Update and hit "Check for Updates" — download, verify, then install with the two-step flow.

---

💙 Thank You

Thanks for using QManager! If you find it useful, consider supporting the project. Bug reports and feature requests are always welcome on GitHub Issues.

License: MIT + Commons Clause

Happy connecting! 📡

QManager BETA v0.1.10

🚀 QManager BETA v0.1.10

NetBird VPN management, VPN inbound connectivity fix, Tailscale boot control fix, and improved uninstall process for both VPN clients.

---

🐛 Bug Fixes

🔒 VPN Inbound Connectivity (Tailscale & NetBird)

• 🔧 Peers could not reach the device via VPN — Both Tailscale and NetBird suffered from the same issue: the VPN interface (tailscale0 / wt0) was not assigned to any fw4 firewall zone, and mwan3 was hijacking VPN reply packets for WAN routing.
• ✅ Fix: Two-part fix applied automatically on VPN install/connect/service start:
  1. Firewall zone — A UCI zone (input=ACCEPT, output=ACCEPT, forward=ACCEPT) is created for the VPN interface with bidirectional forwarding to LAN. Persists across reboots.
  2. mwan3 ipset exception — The CGNAT range 100.64.0.0/10 is added to the mwan3_connected_ipv4 ipset so mwan3 skips marking VPN-bound traffic. Ephemeral (re-applied on every service start).
• 🔗 Shared helper library (vpn_firewall.sh) ensures both fixes are applied/removed consistently across both VPN clients.

🔄 Tailscale Boot Toggle Not Working

• 🔧 Disabling "Start on Boot" did not prevent Tailscale from reconnecting after reboot — The luci-app-tailscale init script uses a UCI enabled flag as the authoritative control, not the init.d symlink. Additionally, a procd interface trigger fires reload on every WAN up event, bypassing the symlink entirely.
• ✅ Fix: The boot toggle now sets tailscale.@tailscale[0].enabled in UCI config (the flag the init script actually checks), in addition to the init.d enable/disable.

---

✨ New Features & Enhancements

🛡️ NetBird VPN Management

• 🆕 Full NetBird VPN management page at Monitoring → NetBird — Install, connect, disconnect, start/stop service, enable/disable on boot, and uninstall — all from the web UI.
• 📊 Multi-state connection card — Adapts to show the appropriate UI for each state: not installed, service stopped, disconnected, and connected. Connected state shows FQDN, NetBird IP, Management status, and Signal status.
• 🔑 Optional setup key — Enter a setup key from the NetBird dashboard when connecting, or leave empty if already registered.
• 👥 Peers card — Shows connected peer details (hostname, IP, connection type, status, last seen) when available, or a summary peer count for older NetBird versions.

🔐 VPN Mutual Exclusion

• 🆕 Only one VPN can be installed at a time — Installing Tailscale while NetBird is present (or vice versa) is blocked at the backend with a clear error message.
• 🆕 Cross-VPN awareness — Each VPN page detects if the other is installed and shows a prompt directing the user to uninstall it first.

🗑️ Improved VPN Uninstall Process

• 🆕 Uninstall section for both Tailscale and NetBird — Separated bottom section with confirmation dialog, following the established design pattern (Email Alerts, Video Optimizer).
• 🔧 Auto-stops service before removal — No need to manually stop the daemon first; the backend handles it automatically.
• 🔧 Firewall cleanup — VPN firewall zone and mwan3 ipset exception are removed on uninstall (only when the other VPN is also not installed).
• 🔄 Reboot after uninstall — A "Reboot Required" dialog appears after successful removal, offering "Reboot Now" or "Reboot Later" to clean up any remaining artifacts.

---

📥 Installation

Fresh Install

wget -O /tmp/qmanager-installer.sh \
  https://github.com/dr-dolomite/QManager/raw/refs/heads/development-home/qmanager-installer.sh && \
  sh /tmp/qmanager-installer.sh

Upgrading from v0.1.9

Head to System Settings → Software Update and hit "Check for Updates" — download, verify, then install with the two-step flow.

---

💙 Thank You

Thanks for using QManager! If you find it useful, consider supporting the project. Bug reports and feature requests are always welcome on GitHub Issues.

License: MIT + Commons Clause

Happy connecting! 📡

QManager BETA v0.1.9

🚀 QManager BETA v0.1.9

New per-antenna signal statistics page, Video Optimizer improvements, stability fixes for tower locking, poller crash prevention, and IPv6 display improvements.

---

🐛 Bug Fixes

🔒 MTU Reset During Tower Lock/Unlock

• 🔧 Custom MTU lost after locking or unlocking a tower — The modem briefly disconnects during tower lock/unlock operations, causing the RMNET driver to silently reset the interface MTU back to 1500. The persistent config file was intact, but nothing re-applied it after the interface bounced.
• ✅ Fix: Added mtu_reapply_after_bounce() to the tower lock library. After any lock/unlock operation, a short-lived background process polls for the interface to recover (up to 30s), then re-applies the custom MTU from /etc/firewall.user.mtu. Self-terminates after re-apply or timeout.
• 🔗 Integrated into all three code paths: CGI lock/unlock, failover daemon, and scheduled lock apply/clear.
• ℹ️ Note: TTL/HL settings are unaffected (iptables mangle rules are global kernel state and survive interface resets).

📡 Poller MIMO Read Crash Prevention

• 🔧 MIMO layer queries crash modem in wrong network mode — AT+QNWCFG="lte_mimo_layers" causes errors in 5G SA mode, and AT+QNWCFG="nr5g_mimo_layers" causes errors in LTE/NSA mode. Previously, these were sent unconditionally and relied on "fails gracefully" — but errors in compound AT chains can abort subsequent commands.
• ✅ Fix: MIMO read queries are now gated by network_type in both boot-time Group B and Tier 2 polling. Enable commands (,1) remain unconditional since they are idempotent and safe in any mode.

🌐 Ping Target Update

• 🔧 Default ping targets changed from IPs to hostnames — 8.8.8.8/1.1.1.1 replaced with google.com/cloudflare.com for DNS-aware connectivity checks.

---

✨ New Features & Enhancements

📺 Video Optimizer — CDN Hostlist Import/Export

• 🆕 Import and export domain lists — The CDN Hostlist card now supports importing domains from .txt files and exporting the current list. Imported domains are merged (duplicates skipped automatically).
• 🆕 Default domain tracking — Backend now returns the factory default domain list alongside user domains. Custom (user-added) domains are visually distinguished from defaults in the UI.
• 🆕 Sorting — Toggle alphabetical sorting (A→Z / Z→A) or revert to original order via a kebab menu.

📺 Video Optimizer — Faster Verification Test

• 🔧 Verification rewritten from speed test to packet counter — The old verify script ran a full 50 MB download with and without bypass to compare throughput (slow, ~20s+). The new approach reads the nftables packet counter before and after a single HTTPS request to a hostlisted domain — completes in seconds and directly confirms nfqws is intercepting traffic.
• ✅ Results now show pass/fail with the tested domain and packet count instead of speed comparisons.

📦 WebSocket (websocat) Now a Required Dependency

• 🆕 websocat added to required packages in the install script — previously it was an optional external binary that users had to install manually for the Bandwidth Monitor's live WebSocket streaming. Now installed automatically via opkg during install/update.

---

📡 Antenna Statistics Page

• 🆕 New per-antenna signal metrics page at Cellular Information → Antenna Statistics — Displays RSRP, RSRQ, and SINR for each of the 4 receive chains (Main/PRX, Diversity/DRX, MIMO 3/RX2, MIMO 4/RX3), split into separate LTE and NR5G cards.
• 📊 Animated progress bars with quality-tinted colors (green/yellow/red) for quick visual comparison across antenna ports.
• 🔄 Dynamic card ordering — The active technology card always renders first. If only NR5G is active (SA mode), the NR5G card takes the lead position. Empty technology cards show a clean empty state.
• 🔗 Quick access via the "Per-Antenna" link next to the Active MIMO row on the Cellular Information page.
• ♿ Accessible — Progress bars include full ARIA attributes (role="progressbar", aria-valuenow, aria-label) for screen reader support.

---

🎨 UI Improvements

🗂️ Navigation Reorganization

• 🔧 Logs moved to System Settings — Previously a standalone page under Monitoring, now accessible at System Settings → Logs for a more logical grouping with other system-level tools.
• 🔧 Software Update moved to System Settings — Relocated from Monitoring to System Settings → Software Update, keeping all device management in one place.
• 🔧 Email Alerts moved under Network Events — Now accessible at Network Events → Email Alerts as a sub-item, since alerts are directly tied to network event monitoring.

📱 IPv6 Address Display

• 🔧 IPv6 DNS and WAN addresses now display in proper compressed notation — The Cellular Information card previously showed raw Quectel dotted-decimal format (e.g., 253.0.151.106.0.0.0.0.0.0.0.0.0.0.0.9) which overflowed on mobile. Now converts to RFC 5952 compressed form (e.g., fd00:9b6a::9). A tooltip shows the raw value when the address was compressed.

---

📥 Installation

Fresh Install

wget -O /tmp/qmanager-installer.sh \
  https://github.com/dr-dolomite/QManager/raw/refs/heads/development-home/qmanager-installer.sh && \
  sh /tmp/qmanager-installer.sh

Upgrading from v0.1.8

Head to System Settings → Software Update and hit "Check for Updates" — download, verify, then install with the two-step flow.

---

💙 Thank You

Thanks for using QManager! If you find it useful, consider supporting the project. Bug reports and feature requests are always welcome on GitHub Issues.

License: MIT + Commons Clause

Happy connecting! 📡

QManager BETA v0.1.8

🚀 QManager BETA v0.1.8

DPI improvements, package management, and frontend quality polish across Video Optimizer, Traffic Masquerade, Tailscale, and Email Alerts.

---

🐛 Bug Fixes

🛡️ Video Optimizer / Traffic Masquerade

• 🔧 nfqws install failing with "No compatible release found" — The installer used jq's test() regex function, which silently fails on OpenWRT because jq is built without the oniguruma regex library. Replaced with endswith() which is always available. Also added User-Agent header and HTTP status code reporting for better GitHub API error diagnostics.
• 🔧 Install prompt text breaking to multiple lines — The AlertDescription component uses CSS grid, causing inline elements (<code>, <a>) to each render on their own row. Fixed by wrapping content in <p> tags.
• 🔧 Traffic Masquerade card description had truncated sentence — "This sends fake Some carriers may detect..." was a leftover fragment. Cleaned up.
• 🔧 SNI domain input had dangling aria-describedby — Referenced a non-existent element ID. Added proper FieldDescription explaining what the masquerade domain does.

---

✨ New Features

📦 Package Install & Uninstall Support

All optional dependencies now have in-app install and uninstall controls:

• 🛡️ Video Optimizer / Traffic Masquerade — Install nfqws binary directly from zapret GitHub releases. Uninstall removes the binary and disables both features.
• 🌐 Tailscale — One-click opkg install with background progress polling. Uninstall removes packages and cleans up connection state.
• 📧 Email Alerts — One-click opkg install msmtp with progress feedback. Uninstall removes the package and generated config.

All three follow the same UX pattern:

• "Not installed" state shows both an Install button (automated) and a click-to-copy manual opkg command with an "or install manually" divider
• Install runs in the background with live status updates
• Uninstall requires the service to be disabled first, with an AlertDialog confirmation
• CDN Hostlist card is hidden when nfqws is not installed

📊 Live Stats Polling

• ⚡ Video Optimizer and Traffic Masquerade service stats (uptime, packets processed, domains protected) now poll every 1 second while the service is running — no page refresh needed. Polling stops automatically on navigation.

📧 Email Alerts — msmtp Dependency Check

• 🔍 The Email Alerts settings card now checks if msmtp is installed on the device and shows the "not installed" state with install options when missing, instead of silently allowing configuration of a non-functional feature.

---

🎨 UI & Quality Improvements

♿ Accessibility

• 🔧 Added aria-live="polite" regions to Video Optimizer and Traffic Masquerade cards for screen reader announcements on state changes
• 🔧 Added aria-label to all click-to-copy command buttons
• 🔧 Standardized error retry controls from raw <button> elements to proper shadcn Button components with focus indicators and RefreshCcw icons
• 🔧 Added FieldDescription to Traffic Masquerade SNI domain input

🎯 Design Consistency

• 🔧 Fixed ServiceStatusBadge to use correct bg-success/15 token (was bg-success/10) per design system spec
• 🔧 Standardized all icon sizing to Tailwind size-* shorthand across audited components
• 🔧 Added destructive styling to all uninstall confirmation dialog action buttons
• 🔧 Replaced react-icons/tb dependency with lucide AlertTriangle in Video Optimizer and Traffic Masquerade cards

---

🔧 Under the Hood

• 🧩 Extracted CopyableCommand component — Shared click-to-copy opkg command block with clipboard API + fallback (components/ui/copyable-command.tsx)
• 🧩 Extracted ServiceStats component — Reusable stat tile grid used by both Video Optimizer and Traffic Masquerade (components/local-network/service-stats.tsx)
• 🔍 Improved qmanager_dpi_install diagnostics — Logs HTTP status, GitHub API errors (rate limiting), and available release assets to /tmp/qmanager.log

---

📥 Installation

Fresh Install

wget -O /tmp/qmanager-installer.sh \
  https://github.com/dr-dolomite/QManager/raw/refs/heads/development-home/qmanager-installer.sh && \
  sh /tmp/qmanager-installer.sh

Upgrading from v0.1.7

Head to System Settings → Software Update and hit "Check for Updates" — download, verify, then install with the two-step flow.

---

💙 Thank You

Thanks for using QManager! If you find it useful, consider supporting the project. Bug reports and feature requests are always welcome on GitHub Issues.

License: MIT

Happy connecting! 📡

QManager BETA v0.1.7

🚀 QManager BETA v0.1.7

5G SA mode fixes — carrier aggregation, signal data, and neighbor cell scanning now work correctly on Standalone 5G.

---

🐛 Bug Fixes

📡 5G SA Mode — Poller Data Loss

Fixed multiple issues where the status poller produced empty or incorrect data when the modem was connected in 5G SA mode. NSA and LTE-only modes were unaffected.

• 🔧 Empty APN, WAN IPs, and DNS in SA mode — The tier 2 compound AT command put LTE-specific queries (lte_mimo_layers) before general network queries (CGCONTRDP, QMAP). In SA mode (no LTE), the LTE command errored and aborted the entire chain, preventing APN, IP addresses, DNS servers, NR timing advance, and NR MIMO from being collected. Split into 3 independent command groups so each can fail without affecting the others.
• 🔧 SINR showing -327.7 on SCC carriers — The QCAINFO parser divided the raw SNR value by 100 without checking for the Quectel sentinel value -32768 (meaning "not measured"). Now correctly maps -32768 to null instead of producing the bogus -327.7 dB.
• 🔧 Carrier aggregation data intermittently empty — The compound AT+QCAINFO=1;+QCAINFO;+QCAINFO=0 was unreliable because the modem needs time between enabling and querying CA reporting. QCAINFO reporting is now enabled once at boot and queried directly each cycle — faster and fully reliable.
• 🔧 QCAINFO promoted to Tier 1 — Carrier aggregation info (PCC/SCC bands, per-carrier signal strength, bandwidth) now updates every ~2 seconds alongside serving cell data, instead of every ~30 seconds.

🔍 Neighbor Cell Scan — NR5G Field Misalignment

• 🔧 NR5G neighbor scan fields were shifted — The nr5g_meas_info response includes an enabled flag as the first field, but the parser read from field 1 instead of field 2. This caused PCI to show the ARFCN value, signal strength to show the PCI, and so on. All fields now correctly aligned.

---

🔧 Under the Hood

• 🧩 Split tier 2 network queries — APN/IPs, NR timing+MIMO, and LTE timing+MIMO are now independent command groups. LTE errors in SA mode and NR errors in LTE-only mode no longer affect unrelated queries.
• ⚡ Boot-time CA reporting enable — AT+QCAINFO=1 is sent once during boot data collection alongside MIMO/TA enables, eliminating the per-cycle enable/disable overhead.
• 🔍 Updated debug script — debug_poller_at.sh now mirrors the actual poller command structure for accurate diagnostics.

---

📥 Installation

Fresh Install

wget -O /tmp/qmanager-installer.sh \
  https://github.com/dr-dolomite/QManager/raw/refs/heads/development-home/qmanager-installer.sh && \
  sh /tmp/qmanager-installer.sh

Upgrading from v0.1.6

Head to System Settings → Software Update and hit "Check for Updates" — download, verify, then install with the two-step flow.

---

💙 Thank You

Thanks for using QManager! If you find it useful, consider supporting the project. Bug reports and feature requests are always welcome on GitHub Issues.

License: MIT

Happy connecting! 📡

QManager BETA v0.1.6

🚀 QManager BETA v0.1.6

Deep Packet Inspection tools, smarter updates, and UI polish — QManager gets serious about traffic shaping.

---

✨ What's New

📡 Video Optimizer (DPI) — ⚠️ Experimental

A new Video Optimizer page under Local Network that uses nfqws to apply DPI desync techniques, helping bypass video throttling on cellular connections.

⚠️ Disclaimer: This feature is experimental and manipulates network packet behavior at a low level. Results vary by carrier and region. Use at your own risk and proceed with caution — disable immediately if you experience connectivity issues.

• 🔧 On-demand install — nfqws binary is downloaded from GitHub releases on first use (auto-detects device architecture)
• 🎯 Hostlist-based filtering — only targets known video CDN domains (YouTube, Netflix, etc.) via a curated and editable hostname list
• 📋 CDN Hostlist management — add/remove domains or restore the factory default list from a dedicated card
• 📊 Live status — real-time uptime, packet count, and process status when active
• ✅ Before/after verification — built-in speed test against Cloudflare to measure the impact

🎭 Traffic Masquerade (DPI) — ⚠️ Experimental

A companion feature on its own page that uses the same nfqws engine in a different mode — spoofing TLS ClientHello SNI headers to disguise all traffic as a trusted domain.

⚠️ Disclaimer: This feature is experimental and modifies outbound TLS handshakes. It may violate your carrier's terms of service. Use at your own risk and proceed with caution.

• 🌐 Configurable spoof domain — defaults to speedtest.net, user-changeable
• 🔒 Mutual exclusion — Video Optimizer and Traffic Masquerade share a single nfqws instance; enabling one automatically disables the other
• 🧪 Test Injection card — verify masquerade is working with a built-in injection test

📦 Software Update — Two-Step Flow

Updates are now a download-then-install process instead of a single blocking operation.

• ⬇️ Download first — tarball is downloaded and SHA-256 verified before anything is installed
• ✅ Staged install — green "SHA-256 Verified" badge confirms integrity; hit "Install" when ready
• 🔄 Survives navigation — staged downloads persist across page changes (detected on reload)
• 📊 Progress bar — real-time download progress with accessible ARIA attributes

📦 Software Update — Version Management

Replaces the old rollback system with a full version picker.

• 📋 All releases listed — dropdown shows every GitHub release; current version is tagged, versions without assets are grayed out
• ⏪ Rollback or reinstall — select an older version to rollback, or the current version to repair, each with a confirmation dialog
• 📝 Current release notes — view the changelog for your installed version directly from the status card

---

🎨 UI & Design

• 🏷️ Consistent status badges — all status badges across the app now use variant="outline" with semantic color classes and lucide icons (success, warning, destructive, info, muted)
• 🧹 Form layout cleanup — improved spacing and alignment in Traffic Masquerade, MTU, TTL, and Video Optimizer settings cards
• 🎨 Design token normalization — replaced hard-coded colors (emerald, blue) with semantic tokens (text-success, bg-success/5, etc.)

---

🔧 Under the Hood

🧹 Installer & Update Improvements

• 🔄 Automatic legacy cleanup — during install or OTA update, the installer now scans the device for qmanager scripts that are no longer in the current package and removes them automatically. No more orphaned files from previous versions.
• 🔐 Permissions enforcement — every install/update now runs a comprehensive chmod pass over ALL qmanager scripts on the device, ensuring correct permissions (755 for executables, 644 for libraries and data files) even for scripts from prior installs.
• 🗑️ Comprehensive uninstall — uninstall.sh now dynamically scans for all qmanager* init.d services and binaries instead of relying on a hardcoded list. Also cleans up nfqws binary, nftables DPI rules, staged update files, and DPI-related runtime state.

🧩 DPI Backend

• 🧩 DPI helper library — shared shell functions (dpi_helper.sh) for nfqws management, nftables rules, and status reporting
• ⚙️ Init.d service — qmanager_dpi procd service manages a single nfqws instance in either Video Optimizer or Traffic Masquerade mode
• 🔍 Kernel check — verifies CONFIG_NETFILTER_NETLINK_QUEUE support in /proc/config.gz before attempting nfqws setup
• 📡 Debug poller — added debug_poller.sh script for dumping raw AT command responses during diagnostics

---

📥 Installation

Fresh Install

wget -O /tmp/qmanager-installer.sh \
  https://github.com/dr-dolomite/QManager/raw/refs/heads/development-home/qmanager-installer.sh && \
  sh /tmp/qmanager-installer.sh

Upgrading from v0.1.5

Head to System Settings → Software Update and hit "Check for Updates" — download, verify, then install with the new two-step flow.

---

💙 Thank You

Thanks for using QManager! If you find it useful, consider supporting the project. Bug reports and feature requests are always welcome on GitHub Issues.

License: MIT

Happy connecting! 📡