diff --git a/CHANGELOG.md b/CHANGELOG.md
index 894acb7..a191ee7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,18 @@
+## v1.0.1 (2026-05-05)
+
+## What's Changed
+
+- ci: drop develop-FF gate from release dispatches; require main by @rado0x54 in https://github.com/rado0x54/ShellWatch/pull/200
+- Preprod Release by @rado0x54 in https://github.com/rado0x54/ShellWatch/pull/201
+- chore: update agent CHANGELOG.md for agent/v1.0.0 by @github-actions[bot] in https://github.com/rado0x54/ShellWatch/pull/202
+- docs: align README and docs/ with current code by @rado0x54 in https://github.com/rado0x54/ShellWatch/pull/203
+- docs: refactor README — logo, tagline, requirements, dev/prod flow by @rado0x54 in https://github.com/rado0x54/ShellWatch/pull/204
+- chore: self-host Geist fonts; drop Google Fonts dependency by @rado0x54 in https://github.com/rado0x54/ShellWatch/pull/206
+- ci: bump homebrew-tap formula on agent release by @rado0x54 in https://github.com/rado0x54/ShellWatch/pull/205
+- Preprod Release by @rado0x54 in https://github.com/rado0x54/ShellWatch/pull/207
+
+**Full Changelog**: https://github.com/rado0x54/ShellWatch/compare/v1.0.0...v1.0.1
+
## v1.0.0 (2026-05-03)
## What's Changed
diff --git a/README.md b/README.md
index 5e94bcc..6fe9693 100644
--- a/README.md
+++ b/README.md
@@ -21,7 +21,7 @@ ShellWatch is a Human-in-the-Loop platform for agent-driven SSH. Passkey-first a
- **Passkey-only auth** — WebAuthn for UI login, agent enrollment, and SSH authentication via OpenSSH's [`webauthn-sk-ecdsa-sha2-nistp256@openssh.com`](https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.u2f) signature algorithm
- **End-to-end SSH-agent proxy** — local `ssh`/`scp`/`git` reach a passkey via ShellWatch with explicit browser approval per signature
-- **Agent forwarding into sessions** — your passkey-backed SSH agent is forwarded into every ShellWatch session, so you can hop to additional hosts and enable SSH-agent-based PAM integration
+- **Agent forwarding into sessions** — your passkey-backed SSH agent is forwarded into ShellWatch sessions (per-endpoint toggle), so you can hop to additional hosts and enable SSH-agent-based PAM integration
- **PAM integration** — pair with [`pam-ssh-agent-webauthn`](https://github.com/rado0x54/pam-ssh-agent-webauthn) to gate `sudo` (or any PAM-aware step) behind a passkey approval surfaced through ShellWatch
- **Human-in-the-loop for agents** — MCP agents request, humans approve; sensitive actions can require per-action consent
- **Realtime notifications** — sign requests arrive as Web Push and in-UI toasts
@@ -38,6 +38,14 @@ ShellWatch is a Human-in-the-Loop platform for agent-driven SSH. Passkey-first a
PubkeyAcceptedAlgorithms=+webauthn-sk-ecdsa-sha2-nistp256@openssh.com
```
+ One-liner to append it and reload `sshd`:
+
+ ```bash
+ echo 'PubkeyAcceptedAlgorithms=+webauthn-sk-ecdsa-sha2-nistp256@openssh.com' \
+ | sudo tee -a /etc/ssh/sshd_config
+ sudo systemctl reload ssh # or: sudo systemctl reload sshd
+ ```
+
- **Client (`ssh`):** OpenSSH **10.3+** — only when using the [SSH agent proxy](#ssh-agent-proxy). The PAM-from-inside-a-session path uses our [PAM module](https://github.com/rado0x54/pam-ssh-agent-webauthn) talking to `$SSH_AUTH_SOCK` directly, and plain ShellWatch sessions opened from the UI or MCP have no client-side OpenSSH requirement.
## Quick start
diff --git a/client/src/app.css b/client/src/app.css
index 142caf9..7e683a8 100644
--- a/client/src/app.css
+++ b/client/src/app.css
@@ -326,6 +326,13 @@ pre,
background: var(--warning, var(--secondary));
}
+.badge-demo {
+ color: var(--accent);
+}
+.badge-demo::before {
+ background: var(--accent);
+}
+
/* ------------------------------------------------------------------
* Status dots — small 6px squares, colored, glow when live
* ------------------------------------------------------------------ */
diff --git a/client/src/lib/components/ServerSetupGuide.svelte b/client/src/lib/components/ServerSetupGuide.svelte
new file mode 100644
index 0000000..84b6154
--- /dev/null
+++ b/client/src/lib/components/ServerSetupGuide.svelte
@@ -0,0 +1,187 @@
+
+
+
+
+
+ Two one-time steps on each server you want to reach. Requires
+ OpenSSH 8.4+.
+
+ 2. Add this passkey to ~/.ssh/authorized_keys
+ {sshOneLiner}
+
+
+{:else if passkey}
+
+ This authenticator does not expose an SSH-compatible public key. You can still use it for login. To enable SSH, register a different passkey from Settings.
+
+{:else}
+
+ 2. Add a passkey to ~/.ssh/authorized_keys (example)
+
+ echo 'webauthn-sk-ecdsa-sha2-nistp256@openssh.com
+ AAAAK3dlYmF1dGhuLXNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBExample…=
+ example_com-alice-yubikey5' >> ~/.ssh/authorized_keys
+
+
+
+ Replace the key body and comment with your own — copy the exact one-liner for a specific passkey
+ from Settings → Passkeys.
+