chore(changelog): update version to v2026.10.15.1 in CHANGELOG.md

feat(proxy): add wildcard domains with on-demand TLS (#27)

* feat(proxy): add wildcard domains with on-demand TLS

- Route hosts one label below a wildcard domain (*.example.com) to the app; exact domains win
- Issue a Let's Encrypt certificate per host on its first TLS handshake (HTTP-01) and renew it with the others
- Guard on-demand issuance: optional ON_DEMAND_TLS_ASK approval endpoint, ON_DEMAND_TLS_PER_HOUR limit, one-hour backoff after a failure
- Reject malformed wildcards and wildcards as an app's primary domain

* docs: document wildcard domains and on-demand TLS

* fix(certs): skip preview certificates when renewing wildcard hosts

Preview domains (preview-<label>.<primary>) fall under a wildcard on the primary domain. Their certificates stay on disk after the preview is removed and were picked up as on-demand hosts, so they would have been renewed indefinitely.

* docs: explain how preview domains work next to wildcard domains

* fix(certs): keep exact domains and ask outages out of on-demand gating

- Renew exact domains (of any app, or DOMAIN) below a wildcard as regular domains, never through ON_DEMAND_TLS_ASK
- Distinguish a denial (4xx, one-hour backoff) from an ask failure (timeout, network error, 5xx): retry the host after a minute and a due renewal on the next run
- Check the hourly cap before calling the ask endpoint and prune expired backoff entries
- Release the ask response body for keep-alive

* fix(domains): keep wildcards out of the primary domain and preview hosts

- Refuse removing the primary domain when a wildcard would take its place
- Validate the domain passed to zero deploy like zero domain add does
- Never match preview-* hosts with a wildcard, so a destroyed preview is not routed to the production app and its leftover certificate is not renewed

* docs(cli): mention wildcard domains in domain help and the add_domain tool

* docs: describe ask verdicts, preview hosts and primary domain rules for wildcards

chore(changelog): update version to v2026.7.9 in CHANGELOG.md

Feature/config and cleanup (#26)

* feat: add image pruning and update app configuration workflows

- Introduced periodic dangling image pruning to prevent disk issues.
- Added `updateAppConfig` function for modifying app configurations, with field tracking.
- Ensured unreferenced images are removed after deployments or previews are deregistered.
- Updated `composeDown` to support image and volume removal options.
- Improved `destroyPreview` and app removal workflows to clean up associated resources.

* chore: release v2026.7.8 with config updates, image garbage collection, and bug fixes

Fix/renew host certificate (#25)

* fix(certs): properly renew host certificate

* bump changelog

* tests

MCP integration (#24)

* feat(mcp): added MCP functionality

* ci(release): add step to install CLI dependencies in release workflow

* feat(cli): add `--cwd` flag to `mcp` command for directory context handling (#24)

- Validate `--cwd` path existence and handle path switching.
- Update `mcpServers` configuration to include `--cwd` argument.
- Log current working directory with server connection details.

* feat(mcp): added additional tools

* feat(mcp): introduce MCP integration with CLI tools and schema-level safety features

ci(release): add step to install CLI dependencies in release workflow

feat(cli): add `--cwd` flag to `mcp` command for directory context ha…

…ndling (#24)

- Validate `--cwd` path existence and handle path switching.
- Update `mcpServers` configuration to include `--cwd` argument.
- Log current working directory with server connection details.

feat(mcp): added MCP functionality

feat(mcp): added additional tools