Sync the self-hosting stack

CHANGELOG.md

@@ -9,6 +9,61 @@ one of them changed. An entry says which artefact and which version, so `web 0.1
 Every version published to a channel appears here. Nothing is written from memory afterwards: a build
 cannot be published without its entry.
 
+## 2026-10-26 — The script library `api 2.2.0` `web 2.2.0`
+
+**Scripts arrive in the RMM.** A new Scripts area, between Agents and Vault, holds the
+organization's library of PowerShell 5.1, PowerShell 7, cmd, bash and sh scripts, and the history
+of its runs. The Admin Center gains a platform library, under Scripts: what it publishes appears
+read-only in every organization's library, where it runs like the organization's own scripts or is
+copied into it to be adapted. Only a super-admin publishes a platform script.
+
+**A script has versions.** Each change is saved as a draft, and only a published version runs as a
+library script; a draft runs only as a test, by someone allowed to run ad-hoc commands. Earlier
+versions stay readable, can be compared and restored. Parameters reach the script as environment
+variables under their own names — `$env:Target` in PowerShell, `"$Target"` in a shell, `!Target!`
+in cmd — and never inside its code. A parameter can take a secret from the vault: it is handed to
+the script for that run only, and masked in the output.
+
+**Run a script, or a one-off command, on many machines at once.** From Scripts, or from Assets — tick
+machines and use the bar, or a machine's menu. A one-off command needs a stronger right than a
+library script. The dialog shows which machines are ready, which are offline and will be waited for
+(a day by default), and which are excluded and why, and asks you to type the number of machines
+above a threshold. The run's page then follows every machine live: its status, its exit code and its
+output as it is written. From there you can cancel some machines or all of them, re-run the failures,
+the selection or everything, and export the results as CSV. The Runs tab lists past runs, yours or
+everyone's, and a machine's drawer shows its own. A notice arrives in the bell when your run fails,
+when a run of yours longer than a minute succeeds, or when someone else cancels it.
+
+**Runs survive a restart.** A run keeps going through an api restart or update, or a machine that
+loses its connection: the job runs on the machine, and its result is collected when the machine is
+reachable again. Scripts run as SYSTEM on Windows and root on Linux and macOS; running as the
+signed-in user comes in a later version.
+
+**New rights decide who does what.** Roles gain a Scripts domain: *Run library scripts*, *Run ad-hoc
+commands* (which requires the first) and *Manage the script library*. The two run rights can be
+narrowed to folders of machines like the other machine rights. A fresh install gives all three to the
+Owner and Administrator roles, and *Run library scripts* to the Operator role. An existing platform
+gives them to the Owner only, and leaves its other roles as they are: add the rights in the role
+editor. Platform roles gain the Scripts page of the Admin Center.
+
+**A platform switch stops every script.** Under Admin Center → Settings → Machines, *Scripts on this
+platform* turned off refuses every new run and stops the ones running, after a confirmation.
+
+**Each organization sets its script policy.** In its Policies, the Scripts section sets how long
+outputs are kept — 90 days by default, or for ever — and from how many machines a run asks for the
+typed confirmation, 10 by default. Outputs are encrypted with the vault's key, and each organization
+keeps at most 1 GB of them: past it, the oldest go first. Every run, cancel, output read and export is
+recorded in the audit log.
+
+**Machines need agent 0.53.0**, published on the stable channel. A machine with an older agent is
+excluded from a run, and the run dialog offers to update its agent. The limits on script jobs
+running at once, `SCRIPT_MAX_RUNNING_JOBS` (200) and `SCRIPT_MAX_RUNNING_JOBS_PER_ORG` (50), now
+apply. A second person's approval, schedules and the assistant's use of the library come in later
+versions.
+
+Update the web image first, or both images at once. The database does not change.
+`SCRIPTS_PREVIEW` can stay at `false`: it now hides only the library's next, unfinished parts.
+
 ## 2026-10-26 — The agent can run the script library's jobs `agent 0.53.0`
 
 **The agent learns to run the script library's jobs.** A job survives an agent restart or a lost