0.54.0 - 2026-09-09

Highlights

• More reliable managed WSL2 runners. Run Linux workloads as the non-root crabbox user with Node/npm ready on PATH, keep detached daemons alive between commands, and avoid headless WSLg and cloud-init startup stalls.
• Less coordinator overhead and faster failure detection. Avoid repeated work over ended lease history, reject confirmed-deleted execution targets before SSH, and recover one transient lease-read failure without replaying the workload.
• Offline-ready Linux toolchains. The developer-image builder now carries verified Node 24.19.0, Go 1.27.0, Bun 1.4.0, and reusable pnpm archives, with offline execution checks and protection for operator-owned tool paths.
• Choose Ubuntu 24.04 for image publication. Select it explicitly while Ubuntu 26.04 remains the default, with promotion and receipt-based rollback scoped to the selected OS.

Upgrade notes

• Reprovision existing managed WSL2 leases to receive the bootstrap fixes. New managed workloads run as crabbox with passwordless sudo and writable work/cache directories; use sudo for operations that require root. PR 1996, PR 2005, PR 2016.
• Headless managed WSL2 bootstrap sets guiApplications=false in the Windows SSH user's .wslconfig, preserving other settings. Explicit desktop/browser requests retain the existing GUI configuration. WSL2 status probes allow up to 30 seconds; other SSH targets retain four seconds. PR 1996, PR 2005.
• The pinned Node/Go/Bun archives apply to newly built or rebaked Linux x86_64 developer images. Managed WSL2 installs the Node/npm subset, without the full image's Go, Docker, browser tools, pnpm activation, or offline pnpm archives. Updating the CLI does not rebake or replace existing images. PR 1944, PR 2006, PR 2008, PR 2009.
• Image publication accepts linux_os=ubuntu:24.04 or ubuntu:26.04, defaulting to 26.04. Standalone Linux minting accepts CRABBOX_OS; explicit image overrides still take precedence, so the selector alone does not verify the guest OS or qualify an image. PR 2028.

Changes

• Managed WSL2: disable redundant cloud-init discovery, verify cold-start Linux readiness before accepting bootstrap, and disable the unused WSLg compositor on headless leases while preserving other WSL settings and existing execution deadlines. PR 1996, PR 2005. Thanks @steipete.
• Managed WSL2: install the shared Node/npm baseline and require both tools for readiness; run workloads as the non-root crabbox user with passwordless sudo, writable work/cache directories, and the managed Node path available. Keep the distribution alive between commands so detached Linux daemons survive until lease cleanup. PR 2008, PR 2016. Thanks @steipete.
• Keep WSL2 workspace-owner renewal small and allow bounded workload contention while preserving token, expiry, and child-state checks. PR 2011. Thanks @steipete.
• Reduce coordinator maintenance work for large lease histories: prepare relevant candidates once per pass, select bridge cleanup from live owners and existing records, and limit pool and provisioning lookups while preserving current-state ownership checks and wakeups. PR 1997, PR 2001. Thanks @steipete.
• Reject run preparation on confirmed-deleted coordinator leases before SSH setup, keeping inspection and release available for recovery. PR 2001. Thanks @steipete.
• Retry an exact coordinator lease read once on HTTP 5xx during run preparation, sharing the original deadline and preserving cancellation and reply-identity checks; SSH, scripts, permanent failures, and ordinary status reads are not replayed. PR 1999.
• Linux developer-image builder: retain verified Node 24.19.0 and pnpm 11.22.0/12.3.4 archives, enforce the selected Node major, and verify an exact NodeSource package before retiring owned aliases on explicit Node 24-to-22 rebakes. Preserve operator-owned tool paths and public Yarn aliases. PR 1944. Thanks @vincentkoc.
• Linux developer-image builder: bake checksum-pinned Go 1.27.0 with offline standard-library and CGO checks. Seed verified Node/Go copies and private Corepack shims into eligible quiescent native GitHub runners' default tool caches, correctly reading systemd's manager environment while preserving custom roots, existing slots, and operator-owned Go aliases. PR 2006. Thanks @vincentkoc.
• Linux developer-image builder: add verified Bun 1.4.0 baseline and optimized archives, keep the portable baseline on the normal PATH, and require guest-compatible nonroot offline TypeScript, test, bundle, and local bunx checks. Preserve operator-owned tool paths across rebakes. PR 2009. Thanks @vincentkoc.
• Add explicit Ubuntu 24.04 developer-image publication selection, retaining Ubuntu 26.04 by default and carrying the selected Linux OS through promotion and receipt rollback. PR 2028. Thanks @vincentkoc.

Maintenance

• Consolidate configuration bindings and shared defaults for Anthropic Sandbox Runtime, Cloud Run Sandbox, FastAPI Cloud, Railway, and Upstash Box while preserving source precedence, explicit clearing, native defaults, and credential boundaries. PR 1993, PR 2000, PR 2004, PR 2007, PR 2010. Thanks @steipete.
• Consolidate Azure Dynamic Sessions, Blaxel, Cloudflare container-runner, Cloudflare Sandbox, and E2B configuration bindings while preserving provider-specific parsing, timeout rules, trusted URL precedence, credential sources, and claim behavior. PR 2012, PR 2013, PR 2014, PR 2015, PR 2017. Thanks @steipete.
• Unify Modal, OpenComputer, Orgo, Semaphore, SmolVM, and Tensorlake configuration/default ownership while retaining sizing and timeout overlays, key resolution, native defaults, cleanup intent, and repeatable-list semantics. PR 2018, PR 2019, PR 2020, PR 2022. Thanks @steipete.
• Unify exe.dev, Lume, and Morph configuration bindings and defaults while preserving trusted hosts, work-root inheritance, input precedence, native image selection, deletion policy, and SSH wake behavior. PR 2024, PR 2025, PR 2029. Thanks @steipete.
• Unify OVHcloud, Runpod, Vast, and W&B configuration bindings and fallback ownership while preserving credential precedence, numeric overlays, explicit image and instance-type selection, machine-class mapping, and release behavior. PR 2027, PR 2032, PR 2033, PR 2034. Thanks @steipete.
• Share unsupported machine-sizing checks and work-root inheritance decisions across providers, preserving explicit-input behavior, provider guidance, raw roots, and validation order. PR 2023, PR 2026. Thanks @steipete.
• Share declared provider names and aliases across selection guards while keeping normalized selection and raw-exact matching distinct, with unchanged validation order and claim matching. PR 2030, PR 2031. Thanks @steipete.

0.53.0 - 2026-09-08

Highlights

• Less waiting for runners and coordinator requests. Use HTTP/2 where supported, close idle control connections promptly, and overlap AWS network discovery and SSH authorization while avoiding redundant access lookups.
• Recover lost run-start responses. Keep the same run identity when a coordinator admission response is lost, recovering the original record without creating another run or replaying the command.
• Safer downloads and failure evidence. Stream downloads into private temporary files, preserve existing destinations when a transfer fails, and keep failure-capture scratch files outside the tested checkout.
• Clearer cloud failures and recovery. Preserve useful GCP API error messages, including billing failures, and automatically recover Azure leases blocked by settled legacy infrastructure operations.
• Image-publication outcomes even on failure. Retain sanitized results for successful, failed, and incomplete measured AWS image publications, including partial measurements and rollback and cleanup state.

Upgrade notes

• Upgrade self-hosted coordinators before clients. Run admission now requires PUT /v1/runs/<run-id>; older coordinators cannot support the new recovery path. Updated coordinators retain the legacy POST route for older clients, and existing run IDs remain readable. PR 1970.
• Ordinary SSH downloads now enforce a 1 GiB per-file limit and retain at least 1 GiB of local free space. Failed, canceled, oversized, or size-mismatched transfers leave existing destinations unchanged. PR 1983.
• Automatic failure captures enforce a 64 MiB limit on intermediate archives and downloaded payloads. Before archive creation, both scratch and output filesystems must each have the 1 GiB reserve plus twice the capture limit available. PR 1983.
• Measured AWS image-publication manifests now use crabbox-devtools-image-proof/v2 and cover failed and incomplete outcomes. Baseline measurements are descriptive; only candidate and promoted cohorts apply the benchmark policy. PR 1986.

Changes

• Negotiate HTTP/2 for coordinator API requests while retaining HTTP/1 compatibility, apply the existing redirect guard to WebSocket upgrades, and finish control shutdown without waiting for an idle peer's close handshake. PR 1985. Thanks @steipete.
• AWS: overlap default-VPC and managed security-group discovery, authorize SSH ingress in batches of at most four, and reuse access-refresh lookups for matching permissions; preserve scope validation, distinct default runner/workspace groups, and revocation and cleanup ordering. PR 1974, PR 1976, PR 1980. Thanks @steipete.
• Recover lost run-admission responses using a client-chosen identity and an atomic initial history record. Recovery stays within the original invocation and request budget, verifies the authenticated request binding, and never replays remote execution. PR 1970, Issue 1962. Thanks @steipete.
• Keep failure-capture scratch files outside tested checkouts, bound archive creation and streamed SSH downloads, and publish downloads atomically after size and disk-space checks. Unknown failures point to recorded-run or retained-lease diagnosis instead of an unchanged full rerun. PR 1983. Thanks @vincentkoc.
• GCP: surface bounded API error summaries and preserve quoted and multiline JSON diagnostics after credential redaction, so lease failures retain their useful cause. PR 1984. Thanks @steipete.
• Azure: recover retained legacy shared-infrastructure fences on the next lease only after verifying that the relevant resources are absent or terminal and the fence owner is unchanged; active operations remain protected. PR 1982. Thanks @steipete.
• Islo: report failed stdout/stderr delivery instead of silently succeeding after losing command output; preserve remote exit codes when stream decoding and delivery finish successfully. PR 1969.
• Enforce controller and coordinator token-command output limits consistently during pipe copying, preserving the existing overflow errors and command deadlines. PR 1971.
• Add scoped AWS provisioning diagnostics for credential preparation, signing, SDK request time, and retry-loop signing counts, keeping concurrent operations separate without changing retry behavior or recording request material. PR 1968. Thanks @steipete.
• Retain sanitized measured-image publication outcomes after success, failure, or interruption, with validated partial cohort measurements, opaque promotion binding, and final rollback and cleanup state. Runner loss leaves the initialized conservative outcome for investigation. PR 1986. Thanks @vincentkoc.

Companion integration

• OpenClaw warm-image cleanup: OpenClaw builds containing PR 142166 restore maintenance when worker profiles use different Crabbox executables. Cleanup tries each configured catalog, retains deletion obligations on errors or deadline exhaustion, and preserves cancellation and allocation pins. Update OpenClaw separately to receive this plugin fix. Thanks @steipete.

Maintenance

• Consolidate bounded byte buffers across command capture, controller/token helpers, SSH diagnostics, Agent Sandbox, and Blacksmith while preserving limits, cancellation, snapshot isolation, truncation visibility, exit handling, and Actions URL discovery. PR 1972, PR 1973, PR 1977. Thanks @steipete.
• Share service-control run-option validation across FastAPI Cloud, Railway, and Unikraft Cloud while preserving rejection messages, precedence, and refusal before provider access. PR 1979. Thanks @steipete.
• Consolidate generated CodeSandbox, CUA, and OpenSandbox configuration bindings while preserving defaults, precedence, validation timing, trusted-only bridge settings, API URL restrictions, and CLI-only stale-claim cleanup. PR 1988, PR 1989, PR 1990. Thanks @steipete.
• Keep CUA runtime and Python bridge defaults aligned with declared configuration, preserving custom SDK imports, whitespace fallback behavior, and read-only diagnostics. PR 1992. Thanks @steipete.

0.52.0 - 2026-09-07

Highlights

• Faster runner startup. Reuse verified SSH endpoints within an operation, publish diagnostics while the workload continues, and overlap AWS quota checks with network preparation.
• A more responsive coordinator. Slow AWS deletion no longer holds up other leases' ingress work. Control WebSocket connections can open independently of lifecycle work, and heartbeats avoid unrelated alarm scans while holding the ingress lock.
• Enforce benchmark limits. New crabbox bench check applies sample, failure, and p95 runner-time limits to every matched local benchmark group, with deterministic JSON and a failing exit status when the policy is not met.
• Run pnpm setup during local hydration. Support pnpm/action-setup with an exact version, including workflows that set up pnpm before Node, and keep the managed pnpm available to later steps.
• Safer workspace reuse and clearer failures. Islo preserves files during --no-sync runs. SSH access rebinding rejects conflicting provider identities, artifact validation is distinguished from workload exits, and readiness timeouts retain their real cause.
• More reliable checkpoints and image preparation. Wait for cloud-init completion before native capture, preserve the running source's boot-completion records during cleanup, and report confirmed checkpoint non-submission as structured JSON.
• Benchmark-gated Linux image publication. Maintainers can opt into comparable baseline, candidate, and promoted-image measurements, with an explicit timing policy and receipt-based rollback through final validation.

Upgrade notes

• bench check requires --max-p95-runner-total. Defaults are three successful samples and zero failures per matched group; p95 always needs at least three runner-total samples. No matches or missing telemetry fail the check. PR 1899.
• Local pnpm/action-setup requires an exact major.minor.patch version. Version inference, ranges, and other pnpm inputs require --github-runner; setup-node's cache: pnpm runs without caching during local hydration. PR 1953.
• SSH artifact-validation failures retain exit 7 but report blockedStage=artifacts and errorKind=provider-error; a workload that exits 7 remains command-exit. Automation should distinguish these outcomes. PR 1934.
• checkpoint create --json can emit crabbox.checkpoint.create.failure.v1 with outcome=not_submitted on a nonzero exit after verified local reservation removal. This does not certify source rollback or readiness; uncertain and post-submission failures keep their recovery state. PR 1952, PR 1963.
• Measured AWS Linux image publication is opt-in and plans 12 leases, with additional launch attempts possible during acquisition retries. It requires an explicit p95 cap, promotes only after candidate checks pass, and keeps rollback armed through final validation. Passing the cap does not establish a speedup over the baseline. PR 1960.

Changes

• Publish run diagnostics without delaying workload admission, preserving ordered lease attribution and joining pending publication before terminal recording; warn on queue overflow or drain expiry while retaining logs and verified terminal receipts. PR 1937.
• Reuse verified SSH endpoints within an operation across direct, proxy, and WSL execution, avoiding redundant login probes while re-evaluating advertised fallbacks when the host or port changes. PR 1941.
• AWS: overlap the initial quota lookup with security-group preparation, retain per-candidate quota checks, and join both operations before launch or failure cleanup. PR 1958. Thanks @steipete.
• Keep AWS deletion and unrelated heartbeat alarm scans out of the ingress queue, and admit control WebSockets independently of lifecycle work, preserving cleanup claims, alarm deadlines, authentication, and message serialization. PR 1951.
• Deduplicate validated AWS coordinator SSH ranges after combining lease and global access, avoiding repeated authorization calls for identical port/range pairs while retaining ingress reconciliation. PR 1945.
• Add crabbox bench check to enforce successful-sample, failure-count, and p95 runner-time limits across every matched local group; expose runner-total sample counts in benchmark reports. PR 1899. Thanks @vincentkoc.
• Local Actions hydration: support pnpm/action-setup with an exact version, including pnpm-before-Node workflows, preserve managed pnpm for later commands, and accept setup-node's cache: pnpm as an explicitly uncached run. PR 1953.
• Distinguish required-artifact, artifact-change, and artifact-schema validation failures from workload exits in timing and failure digests, preserving exit 7 and artifact enforcement. PR 1934, Issue 1894. Thanks @coygeek.
• Reject conflicting known provider identities before rebinding resolved SSH access, and remove alias keys only after validating and removing the unchanged alias claim. PR 1936, Issue 1900. Thanks @coygeek.
• Stop SSH readiness probes and backoff at the shared deadline, report the active probe, and leave authentication unknown when the check expires. PR 1949. Thanks @vincentkoc.
• Agent Sandbox, OpenSandbox, and Hyper-V: classify readiness deadlines and cancellation consistently while retaining the last probe's diagnostic and existing public exit codes. PR 1964.
• Islo: preserve existing workspace files during --no-sync runs even when sync deletion is enabled, retaining normal replacement behavior for archive sync. PR 1959.
• Islo: give sandbox creation its own five-minute budget without shortening command streams or relaxing ordinary API deadlines; report failed create names as unconfirmed locators for explicit identity-checked recovery. PR 1955.
• Islo: finalize run outcomes after guarded cleanup, honor --keep-on-failure for bound setup failures, retain reused sessions after admitted Tailscale preparation fails, and preserve primary codes and causes through cleanup or timing errors while distinguishing provider/artifact failures from command exits. PR 1947.
• Agent Sandbox: finalize bound runs once, preserve primary outcomes through TTL cleanup and timing failures, and report early bound failures with accurate recovery handles. PR 1961.
• Tailscale: withhold raw provider diagnostics and OAuth credentials from preflight and tag-ownership errors while retaining the operation, HTTP status, and actionable tag guidance. PR 1940.
• Proxmox: retain bounded, redacted bootstrap diagnostics and native error causes after acquisition cleanup, preserving quiet success and the existing CLI failure status. PR 1948, Issue 1873. Thanks @coygeek.
• Add bounded AWS provisioning logs that separate ingress-queue and lifecycle waits from create-operation costs and count redundant security-group permission calls without logging request payloads. PR 1938.
• Report producer-confirmed checkpoint non-submission as structured JSON after verified reservation cleanup, without implying that source rollback succeeded. PR 1952. Thanks @steipete.
• Wait for cloud-init completion within the existing 30-second status deadline before native-image cleanup, retain strict post-clean checks with phase/status diagnostics, and release fresh direct AWS/Hetzner reservations only for confirmed pre-submission failures. PR 1963. Thanks @steipete.
• Preserve the running source's cloud-init completion records during Linux developer-image cleanup while clearing cached initialization and seed data; stop preparation if preservation or cleanup fails. PR 1954. Thanks @vincentkoc.
• Add opt-in measured AWS Linux image publication with recipe-bound inputs, comparable baseline/candidate/promoted cohorts, an operator-supplied benchmark policy, an allowlisted public manifest, and receipt rollback through final validation. PR 1960. Thanks @vincentkoc.
• Report image qualification reaping as idle after clean teardown, preserve failed recovery evidence, and verify transient controller ownership before cleanup. PR 1942. Thanks @vincentkoc.

0.51.0 - 2026-09-06

Highlights

• Faster command startup. Commands begin without waiting for best-effort telemetry uploads, while run completion retains baseline samples and verified terminal receipts.
• More reliable failure recovery. More sandbox providers preserve the original command result, honor --keep-on-failure during preparation, and report retained recovery sessions when cleanup fails. Coordinator leases keep local credentials until provider cleanup is confirmed.
• Safer retries and clearer SSH failures. Suggested retries preserve explicit --no-sync and required-artifact globs. SSH readiness stops promptly on host-key rejection, including Windows/WSL connections.
• More useful benchmark reports. Compare runner totals, runner phases, sync phases, and sync skips, grouped by record source so different kinds of observations stay separate.
• Broader local-container compatibility. Opt out of an explicit hostname for runtimes that share the host UTS namespace, and finish cleanup after Podman confirms a container is already gone.
• Recover blocked Azure cleanup. Owners and admins can explicitly acknowledge missing public-IP evidence for eligible expired leases, allowing normal cleanup to resume for the remaining disk with an audit trail.
• Safer AWS image publication. Failed publication smokes can restore the exact prior default aliases and retire the failed image revision without overwriting a newer promotion.

Upgrade notes

• Brokered lease cleanup now requires an updated coordinator that records cleanupCompletedAt and clears remote access after confirmed deletion. Older coordinators and historical leases without that evidence leave local claims and SSH credentials intact; after upgrading, retry stop for the exact lease when its provider identity is recorded. Missing identity without explicit no-resource evidence requires operator reconciliation. PR 1901.
• A successful sandbox command can now return a failed run when automatic cleanup fails. Existing command failures keep their original exit code, with secondary cleanup and timing errors reported separately; use the printed recovery session to finish cleanup. This extends the previous release's behavior to more providers.
• bench report now separates groups by source; records without one use unknown. Consumers should include the source in group keys and tolerate absent phase summaries on legacy records. Only successful observations contribute timing distributions. PR 1896.
• Transactional AWS image promotion and receipt-based rollback require an updated coordinator. Azure's audited recovery also requires an updated coordinator and an owner or admin credential; manage-share and device credentials cannot authorize it, and older workers reject recovered version-3 claims. PR 1756, PR 1893.

Changes

• Start commands without waiting for telemetry uploads; cancel and join the publisher before run completion or lease replacement while preserving baseline samples and verified terminal receipts. PR 1931.
• Preserve explicit --no-sync and every --require-artifact glob in suggested failure retries, avoiding an unintended workspace reset or weakened evidence checks. PR 1933, Issue 1875, Issue 1895. Thanks @coygeek.
• Stop SSH readiness promptly on host-key rejection, including WSL SFTP and split or oversized diagnostics, without changing host trust. PR 1877. Thanks @shunkakinoki.
• Keep coordinator lease credentials until cleanup completion is recorded under the original ownership claim; confirm AWS instance termination and clear stale remote access while preserving provider identity for recovery and audit. PR 1901.
• Group benchmark reports by record source and summarize successful runner totals, runner phases, sync phases, and sync skips, omitting telemetry absent from legacy records. PR 1896. Thanks @vincentkoc.
• Local containers: support localContainer.noHostname and CRABBOX_LOCAL_CONTAINER_NO_HOSTNAME to omit the explicit hostname for runtimes sharing a host UTS namespace; reject incompatible fixed-ID reuse while preserving default fingerprints. PR 1813, PR 1924. Thanks @atrawog.
• Local containers: recognize Podman's exact quoted-ID absence diagnostic so a retried stop can finish cleanup after the container disappears, retaining recovery state for ambiguous or inaccessible runtimes. PR 1922.
• Preserve the requested capacity market for supported providers during coordinator provisioning, and expose retained provisioning failure, resource-existence, and retryability diagnostics in crabbox inspect --json. PR 1892. Thanks @vincentkoc.
• Azure: recognize completed Location polling responses and add explicit, audited recovery for eligible expired leases whose disk cleanup is blocked by missing public-IP completion evidence; retain original identities, ownership checks, and actual deletion receipts. PR 1893. Thanks @steipete.
• AWS images: capture prior default aliases atomically during promotion and restore them from a receipt after a failed publication smoke, retiring the exact failed catalog revision while preserving concurrent newer promotions. PR 1756. Thanks @vincentkoc.
• Shared sandbox runs: keep secondary cleanup and timing errors visible without replacing the primary exit code. PR 1907.
• Docker Sandbox: preserve primary failures through cleanup and timing errors, report retained sessions after failed removal, honor --keep-on-failure during preparation, and preserve successful clone commits across backend reporting failures. PR 1913.
• Apple Machine: report failed or unconfirmed automatic deletion, retain recovery sessions for early --keep-on-failure errors, and preserve command outcomes while distinguishing native transport failures. PR 1914.
• Apple Machine: honor cancellation through ownership waits and native controls, include claim-lock waiting in cleanup budgets, and preserve the original acquisition failure if rollback also fails. PR 1917.
• SmolVM: report deletion failures, honor --keep-on-failure during preparation, and preserve primary outcomes through cleanup and timing errors, retaining provider keep policy and separate profile/resource cleanup budgets. PR 1908.
• SmolVM: honor cancellation during ownership publication, reuse, and cleanup waits; include lock waiting in rollback budgets and preserve the acquisition exit if rollback also fails. PR 1912.
• Tensorlake: honor --keep-on-failure for early failures, report retained recovery sessions after failed cleanup, and preserve command outcomes and native error causes through timing output; keep profile cleanup warning-only. PR 1905. Thanks @steipete.
• Tensorlake: honor cancellation during run admission and ownership publication, include claim-lock waiting in cleanup and failed-create rollback deadlines, and preserve the original failure and ownership without operating on a replacement claim. PR 1888, PR 1906. Thanks @steipete.
• Modal and Docker Sandbox: preserve native cancellation, deadline, and I/O causes, and share command-outcome classification with Tensorlake so bridge failures are not reported as remote command exits. PR 1903. Thanks @steipete.
• Blaxel: report automatic deletion failures, retain recovery sessions after early setup failures, and preserve primary command failures through cleanup and timing errors; recheck the original claim and remote ownership before deletion. PR 1919.
• Freestyle: report automatic deletion failures, preserve command failures through cleanup and timing errors, and retain transport cancellation causes for callers. PR 1907.
• Cloud Run Sandbox: preserve command exits and typed failures through activity cleanup, teardown, and reporting, with final timing and recovery sessions reflecting the complete run outcome. PR 1928.
• AWS Lambda MicroVM: preserve primary outcomes through termination and timing errors, retain recovery metadata after setup failures, and distinguish transport failures from command exits while retaining claim-refresh and operation-lock behavior. PR 1923.
• Orgo: preserve primary command/API exit codes through cleanup and timing errors, and report failed cleanup without changing workspace ownership or no-copy behavior. PR 1926.
• Crownest: accept and omit framework-owned run bookkeeping while retaining command environment-forwarding restrictions; preserve primary outcomes and typed cleanup errors in final timing, and keep recovery claims if Workspace Run cancellation fails. PR 1927.
• W&B: finalize outcomes after automatic Stop, retain recovery sessions and failure retention when cleanup fails, preserve primary failures through timing output, and classify gRPC/API failures as provider errors. PR 1929.
• W&B: allow existing-sandbox runs to omit framework-owned run metadata while retaining explicit environment-forwarding restrictions. PR 1930.
• Fix documentation table-of-contents links for repeated headings so each reaches its own section, preserving existing first-heading URLs. PR 1787. Thanks @steipete.
• Define a provider-neutral Linux developer-image recipe whose digest binds the executable contract and exact installer/readiness source hashes. PR 1897. Thanks @vincentkoc.
• Fix protected image qualification to extract candidates at the canonical artifact path and skip finalization when deployment never started. PR 1915. Thanks @vincentkoc.
• Allow protected image qualification to seal the current CLI by stripping debug metadata and accepting a single artifact up to the existing 128 MiB total bundle cap. PR 1910.
• Fix protected AWS image qualification's Node setup with the supported no-cache input, keeping Go caching disabled. PR 1909.

0.50.0 - 2026-09-05

Highlights

• See where runner time goes. Final timing JSON and benchmark records now report total runner wall time and a bounded phase breakdown, including time spent on cleanup.
• Investigate blocked Azure cleanup. A read-only coordinator API exposes lease-scoped resource identities and deletion progress so operators can diagnose blocked cleanup while retaining ownership checks.
• Safer workspace sync. Blaxel, Freestyle, and SmolVM validate archives before allocating a sandbox and preserve the prepared snapshot. sync-plan --json now previews each provider's actual archive guardrails without contacting it.
• Reliable failure recovery. More providers honor --keep-on-failure during preparation, report recovery sessions when cleanup fails, and preserve the original command result through cleanup and timing output.
• Predictable commands and cancellation. E2B and CubeSandbox preserve literal profile arguments; Tensorlake, Blaxel, Vercel Sandbox, and local bridges retain cancellation and timeout causes instead of reporting misleading workload exits.
• Faster artifact discovery. Literal artifact paths search only their parent directory, avoiding recursive scans while preserving matching and symlink checks.

Upgrade notes

• Runner phase fields are unsigned local telemetry; signed receipt v2 is unchanged. Timing output lists already-committed artifacts, with terminal receipts confirmed separately after persistence. Timing-output failures now appear in the final receipt and exit status. PR 1618.
• Full-archive sync limits can reject a large checkout even when its dirty delta is small; preview them with sync-plan --json. --force-sync-large keeps its normal override but cannot bypass Freestyle's 64 MiB compressed upload cap. SmolVM preparation failures preserve the existing workspace, while a later injection failure can still occur after clearing it. PR 1880, PR 1869, PR 1882.
• Azure cleanup diagnostics require an updated coordinator and an existing owner, manage-share, or admin credential. The endpoint is read-only and is not an inspect CLI flag. PR 1889.

Changes

• Add bounded runner wall-time phase telemetry to final timing JSON and benchmark records without changing signed receipt v2. PR 1618. Thanks @vincentkoc.
• Azure: expose read-only, lease-scoped cleanup identity diagnostics so blocked deletion can be investigated without changing claims, bypassing ownership guards, or accessing provider credentials locally. PR 1889. Thanks @steipete.
• Make sync-plan --json preview the configured provider's full-archive or dirty-delta guardrails accurately, without credentials or provider API calls. PR 1882. Thanks @steipete.
• Blaxel: prepare and validate sync archives before fresh allocation, freeze the pre-create snapshot, and share staged workspace replacement and cleanup while retaining native upload retries. PR 1867. Thanks @steipete.
• Freestyle: check the full archive and compressed upload limit before allocation, freeze pre-create snapshots, and share safe workspace replacement while isolating file-API and exec fallback uploads. PR 1880. Thanks @steipete.
• SmolVM: validate full archive limits and prepare snapshots before fresh allocation or clearing a reused workspace; preserve pre-create bytes and apply the configured sync budget. PR 1869. Thanks @steipete.
• Upstash Box: share run finalization so early failures honor --keep-on-failure, failed deletion reports a kept recovery session, and cleanup/timing errors preserve the primary exit; keep delegated command receipts when secondary cleanup fails. PR 1885. Thanks @steipete.
• Vercel Sandbox: share run finalization so early cleanup failures return accurate recovery sessions, preparation failures honor --keep-on-failure, and timing errors preserve command exits; retain POSIX bridge cancellation and timeout causes. PR 1886. Thanks @steipete.
• CubeSandbox: share sandbox run finalization so failed cleanup retains an accurate recovery session, setup failures honor --keep-on-failure, and timing errors no longer mask command exits; preserve observed abnormal exit codes. PR 1850. Thanks @steipete.
• OpenComputer: share run finalization so cleanup failures are reported, timing errors preserve the original exit, and command preparation honors --keep-on-failure; preserve cancellation and timeout causes and distinguish transport errors from command exits. PR 1845. Thanks @steipete.
• CodeSandbox: share run finalization so failed cleanup returns an accurate recovery session, cancellation honors --keep-on-failure, and timing errors preserve the command outcome. PR 1843. Thanks @steipete.
• Report Azure Dynamic Sessions cleanup failures as failed runs, preserve primary Superserve/Azure errors through cleanup and timing output, and keep Superserve rollback bound to the originally created sandbox. PR 1836. Thanks @steipete.
• Reject mismatched E2B and CubeSandbox read/connection identities before adopting a sandbox or using its execution session, sharing exact resource-ID validation while keeping cleanup bound to the original allocation. PR 1841. Thanks @steipete.
• Preserve literal E2B and CubeSandbox profile arguments through their shared envd command transport, and accept inferred single-string shell programs and explicit empty shell source. PR 1837. Thanks @steipete.
• Tensorlake: preserve cancellation, deadline, and I/O errors from the native command runner instead of misreporting them as workload exits; keep failure timing and displayed diagnostics consistent. PR 1887. Thanks @steipete.
• Blaxel: stop the original process after interrupted polling requests and preserve cancellation and timeout causes without exposing redacted credentials. PR 1846. Thanks @steipete.
• Local provider bridges: preserve cancellation and deadline causes when a POSIX child is interrupted, without masking completed command exits or output-limit errors. PR 1862. Thanks @steipete.
• Limit literal run-artifact discovery to the parent directory, preserving existing matching, required-file, and symlink guards. PR 1878. Thanks @steipete.
• Fix AWS image qualification rollback checks to restore the exact seeded default aliases and revision through --restore-receipt, retire the failed candidate, and reject stale failed-revision updates. PR 1879. Thanks @vincentkoc.

0.49.1 - 2026-09-04

Users upgrading from v0.48.1 also receive the v0.49.0 changes, previously available through the Go module release.

Highlights

• Image-pinned GCP ready pools. Reuse hydrated Linux runners tied to exact boot images or disk snapshots, with capacity fallback across zones and ownership checks throughout creation and cleanup.
• Faster runner startup. Skip redundant Git lookups and unnecessary APT downloads, and share Azure/GCP token refreshes across concurrent requests.
• Safe sync and correct artifacts. Cloudflare and Upstash Box preserve existing workspaces when transfers fail. Blacksmith collects artifacts from the prepared execution workspace that produced them.
• Daytona script support. Run --script and --script-stdin through private SSH with literal arguments, environment profiles, activity refreshes, and cancellation support.
• Correct sandbox targeting and trustworthy cleanup. Canonical IDs no longer resolve to unrelated slug aliases. Failed bootstrap rollback stops further allocation, Hetzner waits for confirmed deletion, and interrupted AWS warmups remain stoppable. Providers retain recovery claims when cleanup fails and preserve the original command result.
• Predictable commands and environment profiles. Preserve literal arguments across delegated providers, isolate each run's uploaded profile, and clean failed uploads without touching replacement claims.
• Clearer failures and more reliable Windows bootstrap. Preserve failed-stage, fallback, terminal-recording, and Machine0 output diagnostics; fresh AWS Windows/WSL2 leases bootstrap through their advertised SSH route.
• Isolated AWS image qualification for maintainers. An opt-in workflow and dedicated authority verify candidate image publication and rollback with bounded cloud access, provider credentials kept out of candidate code, and independent cleanup.

Upgrade notes

• GCP typed ready pools require an updated coordinator and authoritative boot-image or disk-snapshot evidence; machine-image checkpoints and older leases without that evidence cannot join. Coordinator credentials need compute.instances.get and compute.disks.get for typed identity operations. PR 1620, PR 1621.
• Tenki workspace/project settings are now accepted only for recovering older scoped leases. Stop those leases before removing the settings, then use tenki login to select the workspace for new leases. PR 1741.

Changes

• Collect Blacksmith artifacts from execution workspaces selected by a trusted .git/crabbox-artifact-root symlink, pinning the artifact directory before the workload and rejecting invalid bindings before execution while retaining existing exit and publication guards. PR 1840. Thanks @steipete.
• Preserve Upstash Box and SmolVM stream cancellation and timeout causes in run outcomes, and skip command submission when cancellation is already known after an acknowledged environment upload without skipping cleanup. PR 1838. Thanks @steipete.
• Keep canonical lease IDs separate from slug aliases in shared claim lookup and provider routing, preventing missing IDs from selecting, running on, or stopping a different sandbox while preserving provider recovery behavior. PR 1839. Thanks @steipete.
• Clean partial Upstash Box environment uploads after failure or cancellation, isolate each profile, and refuse stale file cleanup while preserving discovery-only reuse and original command outcomes. PR 1834. Thanks @steipete.
• Preserve literal Tensorlake and OpenSandbox profile arguments through final execution, including environment-wrapped commands, and fix Tensorlake's inferred single-string shell execution. PR 1835. Thanks @steipete.
• Preserve literal Agent Sandbox profile arguments through pod stdin execution and share checked workspace/environment command wrapping with Nomad. PR 1831. Thanks @steipete.
• Preserve literal SmolVM and Upstash Box profile arguments, accept inferred single-string shell commands, and share source rendering without adding another shell. PR 1833. Thanks @steipete.
• Read all AWS recovery inventory pages and retain cleanup debt when pagination is incomplete; describe interrupted provisioning without assuming a deployment caused it. PR 1832. Thanks @steipete.
• Preserve literal profile arguments through CodeSandbox, OpenComputer, and Docker Sandbox execution, sharing command-intent parsing without changing provider shells or environment transports. PR 1830. Thanks @steipete.
• Clean failed SmolVM environment-profile uploads with bounded original-claim checks, isolate each run's profile, and reuse shared shell-profile handling without requiring Bash. PR 1829. Thanks @steipete.
• Made interrupted direct AWS warmups stoppable by recording exact instance ownership before readiness, retained recovery claims through EC2 visibility delays, and selected the Ubuntu HTTPS primary archive for automatically chosen stock Ubuntu 26.04 amd64 images. PR 1816. Thanks @steipete.
• Added typed GCP ready-pool cohorts bound to exact boot-image or disk-snapshot provenance while allowing capacity fallback across zones. PR 1621. Thanks @vincentkoc.
• Typed GCP identity generation and registration now observe the owned VM boot disk to bind exact numeric image or snapshot provenance without adding image or snapshot reads to ordinary GCP launches; create cleanup custody requires a numeric VM ID, interrupted token-bound creates capture or retry that ID only through exact ownership lookups and strict rereads, and fully bound pre-upgrade leases may use their lossy historical numeric ID only to corroborate a raw ID during fenced deletion or expiry cleanup before an exact reread. PR 1620. Thanks @vincentkoc.
• Preserve existing Cloudflare container workspaces when sync upload or extraction fails, clean partial archives, and enforce full-checkout size limits before fresh allocation. PR 1814. Thanks @steipete.
• Preserve Upstash Box workspaces when archive upload or extraction fails, clean partial Upstash Box/Tensorlake uploads, and check complete archive limits before creating either sandbox. PR 1820. Thanks @steipete.
• Report SmolVM decoder, file-write and extraction failures instead of false upload success, isolate temporary upload files, and preserve existing files when decoding fails. PR 1826. Thanks @steipete.
• Run direct Daytona --script and --script-stdin commands through the private SSH runner with literal trailing arguments, environment profiles, and provider activity refreshes; keep managed SSH credentials out of process arguments. PR 1781. Thanks @steipete.
• Preserve literal profile arguments and assignment-shaped executable names across Cloudflare Sandbox, Superserve, Crownest, Vercel Sandbox, and Nomad command transports without reinterpreting them as shell syntax. PR 1818. Thanks @steipete.
• Stop direct AWS, Azure, GCP, and Hetzner bootstrap retries from allocating another machine when rollback reports a cleanup failure, preserving both the original failure and cleanup diagnostics. PR 1819. Thanks @steipete.
• Reject inconsistent Hetzner creation/readiness identities before SSH, and keep failed-acquisition cleanup bound to the original server and key; share exact ID/name validation with RunPod. PR 1821. Thanks @steipete.
• Wait for brokered Hetzner delete-action success and exact server absence before reporting cleanup complete or removing managed SSH keys; retain durable recovery evidence through pending or uncertain deletion and expose it in inspect --json. PR 1799. Thanks @steipete.
• Remove local SSH connections, keys, and trust files after fixed-ID AWS lease release, preserving the terminal receipt so failed local cleanup can be retried without repeating provider deletion. PR 1797. Thanks @steipete.
• Closed and joined lease-owned SSH connection masters after confirmed brokered deletion, preserving native connection reuse and lease/host-key isolation while retaining failed local cleanup for a local-only retry. PR 1774. Thanks @steipete.
• Cloudflare: retain recovery claims when teardown fails, preserve command/cancellation outcomes, and fence reuse and cleanup against replaced local claims. PR 1817. Thanks @steipete.
• Report OpenSandbox cleanup failures instead of silently succeeding, preserve the original command exit when cleanup also fails, and finalize timing/session results after cleanup without weakening reuse admission or absolute TTL checks. PR 1804. Thanks @steipete.
• Protect Nomad runs from overwriting replacement claims or recreating retired leases, and expose standard run-session handles with cleanup-aware final outcomes that preserve the original command exit. PR 1810. Thanks @steipete.
• Avoid unnecessary Git metadata lookups during configuration loading, lease claim refreshes, and sync planning while preserving repository and credential trust boundaries. PR 1783. Thanks @steipete.
• Skip unnecessary APT translation, AppStream, and command-not-found downloads during minimal Linux bootstrap while preserving required package indexes, signature checks, and later operator defaults. PR 1794. Thanks @steipete.
• Reuse one Azure or GCP token refresh across concurrent requests, reducing duplicate authentication traffic while preserving credential isolation, refresh margins, and retry behavior. PR 1802. Thanks @steipete.
• Restore current Tenki CLI inventory and legacy-claim recovery, and retain ownership claims until the exact session acknowledges termination; obsolete workspace/project settings now give migration guidance before creating a lease. PR 1741. Thanks @eddiewang.
• Allow fresh brokered AWS Windows and WSL2 leases to bootstrap through advertised SSH port 22 while preserving an explicitly selected final workload port. PR 1801. Thanks @steipete.
• Fix GCP metadata authentication in workerd by using supported redirect handling while continuing to reject redirected token responses without following them. PR 1815. Thanks @steipete.
• Report the correct install, build, or test failure stage from supported phase markers, preserving original exit codes and keeping later artifact-collection failures separate. PR 1795. Thanks @steipete.
• Preserve individual AWS, Azure, and GCP candidate failures in successful leases' provisioning history across market and regional fallback, including previously omitted GCP on-demand failures. PR 1811. Thanks @steipete.
• Preserve finish-submission and receipt-verification errors, attempt counts, and recovery guidance when terminal run recording times out, without changing retry limits or receipt verification. PR 1782. Thanks @steipete.
• Capture complete Machine0 native CLI JSON responses through private regular files on POSIX hosts, reject incomplete captures explicitly, and retain bounded output instead of accepting truncated responses. PR 1780. Thanks @steipete.
• Added a credential-isolated AWS image-qualification transport and non-public per-run authority with fixed sandbox policy, bounded intent reconciliation, verified resource ownership, and eventual-consistency-aware teardown, without changing normal AWS credential behavior. PR 1778. Thanks @vincentkoc.
• Added an opt-in pre-merge AWS image-qualification workflow with isolated candidate builds, deployment-bound proof, publication/rollback checks, and an independent cleanup reaper; enabling it requires the dedicated authority and protected environment. PR 1775. Thanks @vincentkoc.
• Clarify SSH cancellation, safe retained-workload recovery, and Bash login-shell exit behavior, and correct the default local-container image note. PR 1685, PR 1686. Thanks @steipete.
• Fix native macOS readiness test fixtures when temporary directories inherit a different group from the process, without changing production ownership checks. PR 1686. Thanks @steipete.
• Reject changed Azure VM identities during acquisition readiness and use identity-checked VM/companion cleanup for failed acquisitions instead of blind name-based rollback. PR 1827. Thanks @steipete.
• Clean partial Tensorlake environment-profile uploads after failure or cancellation, fence cleanup to original ownership, and share isolated profile lifetimes and source-failure handling with Modal. PR 1825. Thanks @steipete.
• Preserve Cloudflare and Azure Dynamic Sessions cancellation when an incomplete command stream ends with clean EOF, without replacing accepted completion events or scanner errors. PR 1825. Thanks @steipete.

Highlights

• Sync that keeps working. Unreachable Git origins fall back to full-file sync, symlink retargets reach the runner, and Git overlays transfer a consistent snapshot while later edits wait for the next sync.
• Keep the evidence when runs fail. Brokered artifact publishing is restored, and Blacksmith can return requested artifacts after confirmed normal failures with exit codes 1–127 while preserving the original result.
• More predictable creation and checkpoints. Reuse stable lease IDs for managed checkpoint forks, inspect your admission count and limit without allocating, and cancel or recover creation without losing its original readiness deadline.
• Easier Daytona setup. Reuse browser OAuth login and select native container tiers with --class, while preserving custom and checkpoint snapshots.
• More reliable Windows runs and private Mac setup. Managed native Windows setup now checks and repairs the Visual C++ runtime, SSH command input no longer depends on EOF, and macOS bootstrap passwords stay out of shell traces and process arguments.
• Clearer failures and trustworthy results. Get better out-of-memory guidance for local containers and original Tart startup errors, avoid double-counting aliased JUnit reports, and keep late events from rewriting finalized run summaries.

Upgrade notes

• Managed fixed-ID checkpoint forks and crabbox capacity require an updated coordinator; older coordinators reject these requests without falling back to ordinary creation or direct providers. PR 1692, PR 1752.
• On Linux images using cloud-init, native checkpoint preparation now requires completed initialization, the distro Python/cloud-init module, and a runtime directory on tmpfs; preparation failures stop before image creation. PR 1692.
• Fixed-ID creation cancellation requires the updated coordinator. After a coordinator rollback, version-2 admission records stay fenced; upgrade the coordinator again before confirming pre-allocation stop. PR 1749.
• Managed native Windows runtime repair requires access to the pinned Microsoft downloads. Reboot-required or interrupted installations block readiness until an external reboot and retry; static/BYO hosts remain operator-managed. PR 1753.
• Blacksmith artifact collection requires remote timeout support for --kill-after; incompatible timeout implementations now fail preflight before the user command starts. PR 1736.
• Legacy Islo claims remain name-bound. Recreate leases to obtain ID-bound claims; provider deletion still uses the name-based API rather than an atomic delete-by-ID operation. PR 1708.
• Ordinary sync fingerprints advance to v6, causing one safe resync; Git-overlay fingerprints remain v1 and no configuration migration is required. PR 1736.

Changes

• Kept sync working when runners cannot authenticate to or reach Git origins by falling back to a full manifest, preserving internal Git-control exit codes, and recognizing disconnected sockets without mistaking URL digits for authentication failures. PR 1622, PR 1744. Thanks @vincentkoc.
• Restored brokered artifact publishing with complete production storage configuration and atomic deployment of bucket-scoped signing credentials, preserving the existing storage and signed-read design. PR 1732, PR 1737.
• Added replay-safe checkpoint fork --lease-id for coordinator-managed native checkpoints, reusing the same child for matching requests while refusing changed, canceled, or terminal attempts. PR 1692. Thanks @Copilot.
• Made fixed-ID creation cancellable at coordinator admission before allocation, preserving exact owner binding and cancellation across restart, duplicate replay, and reservation races without inventing lease records or treating unknown IDs as released. PR 1749.
• Added crabbox capacity and GET /v1/capacity for read-only snapshots of the authenticated owner's admission-equivalent count and effective limit across all months and orgs, without changing monthly usage or allocating resources. PR 1752. Thanks @steipete.
• Preserved the original provisioning deadline after recovering an uncertain coordinator create response, so readiness is neither cut short by the recovery window nor restarted with a fresh budget; caller cancellation and cleanup ownership remain intact. PR 1740.
• Kept canceled AWS creates from continuing into another region, preserved the 409 create_canceled result and reason, and kept cleanup confirmation separate from cancellation. PR 1743.
• Preserved native AWS, Machine0, and Daytona lease claims through reused-run preparation so concurrent heartbeats cannot invalidate command admission; AWS renewals also preserve fixed-create ownership tags. PR 1692.
• Retained accepted AWS and Hetzner checkpoint identities through interrupted readiness waits, and recorded AWS backing snapshots before AMI deletion so partial cleanup remains retryable. PR 1692.
• Kept running Linux checkpoint sources cloud-init-ready while requiring restored VMs to complete their own initialization. PR 1692.
• Applied configured SSH ports on socket-activated Linux and prepared images by refreshing systemd's SSH socket configuration. PR 1692.
• Prevented failed coordinator maintenance from postponing earlier queued work, while rearming consumed overdue wakeups and reporting retry-scheduling failures. PR 1767.
• Bound typed ready-pool capacity to canonical provider identities, migrated desired state to fixed-size v2 keys without legacy-reader exposure, and routed returns to fail-closed drain cleanup when provider or lease identity evidence changes. PR 1619. Thanks @vincentkoc.
• Kept managed macOS bootstrap passwords out of shell traces and process arguments, made new password files private from creation, and corrected Screen Sharing guidance to keep port 5900 closed in custom ingress rules. PR 1723.
• Preserved native Windows SSH input framing with asynchronous reads that do not wait for EOF or close borrowed stdin, and staged input through the workspace witness for fresh one-shot runs as well as reused leases. PR 1724.
• Added verified Visual C++ v14 runtime checks and repair to shared managed native Windows bootstrap before readiness, preventing missing-runtime failures while leaving WSL2 unchanged. PR 1753.
• Included symlink target identity in ordinary sync fingerprints without following links, so same-content retargets no longer leave stale remote links. PR 1736.
• Made Git-overlay transfers use accepted immutable snapshots for payloads, manifests, fingerprints, and index validation, leaving later edits for the next sync and preserving primary errors through cleanup and fallback. PR 1624. Thanks @vincentkoc.
• Hardened reused Git-overlay workspaces against hidden index changes and incomplete fingerprints while preserving verified ignored caches. PR 1623. Thanks @vincentkoc.
• Made Git-coherence branch selection honor explicit sync.baseRef before inferred defaults, avoiding deleted topic or stale default branches when a valid containing branch exists while preserving the selected commit and tree. PR 1759.
• Kept late run events in the audit log without rewriting finalized run summaries or receipts. PR 1736.
• Deduplicated explicit relative and absolute aliases of JUnit reports while preserving distinct reports and target-platform path semantics. PR 1736.
• Made local-container OOM retry guidance use observed retained-container limits and reported runtime total RAM, with read-only diagnostics in inspect and non-wait status --json and conservative unknown-capacity fallback that preserves the workload exit. PR 1734.
• Collected requested Blacksmith artifacts after confirmed normal workload failures with exit codes 1–127 in the original invocation, preserving the workload result and requiring complete receipts, clean transport completion, and unchanged ownership before publishing evidence. PR 1733.
• Validated artifact-glob and required-artifact patterns by path component, accepting ordinary names such as result..json and rejecting explicit .git or .crabbox paths before lease acquisition while preserving traversal checks. Issue 1751. Thanks @coygeek.
• Preserved literal Blacksmith stdout/stderr control bytes outside the reserved receipt namespace and checked timeout support before user code could have side effects. PR 1736.
• Used ASCII Box's advertised SSH host and port for readiness, sync, execution, and status while retaining the older IP-and-port-22 fallback. PR 1728. Thanks @shunkakinoki.
• Preserved ASCII Box deletion-operation references across interrupted cleanup and required confirmed operation completion and inventory absence before removing ownership claims. PR 1731. Thanks @shunkakinoki.
• Recognized Daytona CLI browser OAuth profiles, honoring DAYTONA_CONFIG_DIR and preserving explicit credentials and API-key precedence; expired tokens direct users to daytona login. PR 1772.
• Added direct Daytona class selection through native container snapshots, validating custom and checkpoint snapshots without replacing or resizing them and cleaning up mismatched allocations. PR 1773.
• Bounded direct Daytona control requests to 60 seconds, including stalled response bodies, without cutting off long-running commands or archive uploads; earlier caller deadlines and exact allocation-recovery ownership remain intact. PR 1750. Thanks @SebTardif.
• Recorded Islo sandbox IDs in ownership claims, validated identity before status and cleanup, and clarified delegated-run behavior and the distinction between sandbox identity and lease addressing. PR 1705, PR 1708. Thanks @zozo123.
• Allowed exactly owned completed Blacksmith Testboxes to finish local claim and SSH-key cleanup when no Actions run URL was assigned, without relaxing native-table framing or ownership checks. PR 1746.
• Preserved delayed Tart startup failures and bounded stderr through readiness and cleanup so later IP, guest-agent, or SSH errors no longer hide the original cause. PR 1738.
• Preserved bounded Hetzner error codes and messages from multiline provider responses without changing allocation recovery or secret redaction. PR 1771. Thanks @steipete.
• Preserved recognized workspace-owner renewal failure states alongside transport errors without changing exit 7 or fail-closed collection and cleanup. Issue 1712. Thanks @coygeek.
• Exposed effective generic lease ttl and idleTimeout in config show text and JSON without changing defaults or lease behavior. PR 1757.
• Made doctor --help and -h show diagnostic modes and primary options before the complete provider flag reference, so the installed CLI explains how to inspect providers, leases, recorded runs, and ponds. Issue 1754. Thanks @coygeek.
• Simplified post-publication Homebrew updates into the ordinary tag-based tap handoff, with independently retryable channel smokes and no need to rebuild or republish a release when the tap update fails. PR 1735.
• Removed extra PR-approval ruleset and administrative-freeze prerequisites from release publication while retaining signed-source, immutable-asset, native-verification, and immediate publication readback checks.
• Aligned copyable full race-test commands with CI's 15-minute package timeout and added a regression check to prevent documentation drift. PR 1736. Thanks @coygeek for the timeout report.

0.48.1 - 2026-09-01

Changes

• Corrected nested JUnit totals and preserved failed-case details so --fail-on-test-failures catches failures even when suite counters are missing or zero, without double-counting parent aggregates.
• Fixed signed receipt/log mismatches by keeping retained output valid UTF-8 before signing and storage, preserving raw captures and full-stream hashes, and marking incomplete retained logs as truncated.
• Kept automatic POSIX SSH failure bundles focused on the current uploaded script instead of earlier uploads and neighboring files. Explicit artifact and download selections remain independent.
• Reduced SSH startup round trips by avoiding redundant successful-login checks and skipping telemetry when no coordinator run handle exists.
• Made run summaries, timing JSON, and recovery guidance distinguish confirmed release from retained or pending cleanup, report local cleanup errors separately, and preserve an existing workload failure's exit code.
• Made coordinator-backed stop use one five-minute cancellation budget across inspection, claim waits, cleanup, release, and observation; local daemon lock waits now honor cancellation without reversing confirmed cleanup.
• Fixed coordinator-managed AWS cleanup during creation by tracking the exact allocation before readiness, continuing to observe pending cleanup, and retaining recovery evidence when storage or deletion is uncertain.
• Prevented ready-pool leases from being borrowed concurrently across typed and legacy pools, including existing duplicate records, and blocked expired or quarantined borrows from returning to ready.
• Honored explicit empty YAML lists for environment forwarding, JUnit paths, and preflight probes while preserving omitted-key inheritance, additive profile/sync lists, and independent automatic result discovery.
• Honored explicit advertised SSH-port selection on ordinary reused coordinator leases without changing host trust or provider cleanup; ready-pool connections retain their pool-recorded endpoint.
• Exposed local-container settings in config show text and JSON, including effective work-root defaults when selected, without Docker discovery or daemon access.
• Kept brokered native checkpoint creation waiting through coordinator-owned capture recovery without submitting another capture, while respecting cancellation, timeouts, and terminal failures. Thanks @Copilot.
• Restored machine-readable missing-checkpoint inspection after managed deletion without treating unresolved capture bindings or coordinator failures as confirmed deletion.
• Unblocked ordinary Machine0 source cleanup when a failed checkpoint capture is proven not to have attempted image submission; interrupted or uncertain submissions retain their recovery records.
• Added checkpoint abandon for unresolved ordinary Machine0 captures: dispose of the verified source through its existing ownership claim while retaining the unresolved image record and blocking image reuse, deletion, or pruning.
• Preserved the original coordinator heartbeat transport error when HTTP fallback also fails or has no time left, without changing successful fallback behavior.
• Fixed Parallels clone placement under the configured parent directory, leaving VM bundle naming and creation to Parallels.

Upgrade notes

• Previously ignored SSH-port overrides now take effect on ordinary reused coordinator leases and reject unadvertised ports. Remove obsolete --ssh-port, ssh.port, or CRABBOX_SSH_PORT settings to retain automatic selection; explicit selection disables port fallback.
• Empty YAML env.allow, results.junit, and run.preflightTools lists now clear inherited values. Omit the key to inherit instead; clearing JUnit paths does not disable results.auto, and profile allowlists remain additive.
• Automatic POSIX SSH failure bundles no longer include the retained .crabbox/scripts store. Explicitly select additional files you need; use --download-on-failure for eligible Linux SSH failure downloads.

0.48.0 - 2026-08-30

Highlights

• Keep the evidence when a run fails. Linux SSH runs can download selected artifacts after a confirmed workload failure with --download-on-failure; --require-artifact-change can reject stale, unchanged evidence instead of accepting files left by an earlier run.
• More capable checkpoints. Brokered native checkpoints gain coordinator-owned admission limits, audit events, and optional unused-checkpoint expiry. Incus gains durable fixed lease IDs and private container disk checkpoints that survive source deletion.
• Smoother remote runs. IPv6 sync and uploads work correctly, overloaded SSH multiplexed sessions recover without replacing the lease, and active lease operations no longer block unrelated runs.
• Safer cleanup and trusted defaults. More providers require exact, unchanged ownership before reuse or destruction; shipped Ubuntu container images are digest-pinned, and the built-in Tart image is verified before boot.
• More reliable Windows and WSL2 execution. WSL2 uses a verified SFTP command envelope with bounded cleanup and complete exit results; native Windows state updates preserve open readers and private routing state.

Upgrade notes

• WSL2 now requires SFTP. Enable the Windows OpenSSH SFTP subsystem and verify Doctor's wsl2-sftp probe before upgrading; the v0.47.0 stdin fallback has been removed.
• Native Windows requires Windows 10 version 1709+ or Windows Server 2019+.
• Blacksmith Testbox stop and reuse require exact local claims. For legacy or missing claims, independently verify the organization and Testbox, stop it with the native CLI, confirm terminal status, and create a new lease; --reclaim does not bypass this requirement.
• Blacksmith Testbox rejects --no-sync. Remove it from runs, prewarm probes, and named jobs; Testbox manages workspace synchronization.
• Static SSH architecture settings are assertions. Explicit or inherited architecture settings, including amd64, must match fresh host evidence; remove the explicit setting to use automatic discovery.

Added

• Added Linux SSH --download-on-failure retrieval after an owned nonzero workload exit, preserving the exit code and collecting selected evidence before failure bundles and teardown.
• Added opt-in Linux SSH --require-artifact-change checks with bounded content snapshots, created/changed/unchanged/missing timing states, and collection of only accepted bytes.
• Added coordinator-owned brokered native checkpoints with transactional checkpoint and fork-claim admission limits, bounded recent audit events, opt-in unused-checkpoint expiry, and promotion-safe cleanup.
• Added durable fixed-ID Incus leases and private container disk checkpoints that survive source deletion, with ownership-checked cleanup and fresh SSH identity before fork startup.
• Added replayable native checkpoint capture-and-retire with --checkpoint-id, --retire-source, read-only --prepare-only admission, and explicit --discard-failed recovery on supported providers; Hetzner source retirement remains unavailable.
• Added providers sizes machine0 --with-context --json to show effective native size and region selection alongside the live catalog, preserving configured defaults and exact fixed-lease replay.

Fixed

• Prevented active lease operations from blocking unrelated claim discovery, slug allocation, and Testbox runs while preserving exact ownership checks and cleanup fencing.
• Fixed IPv6 workspace sync and artifact/egress uploads by using private SSH transport aliases, preserving authentication, host trust, Windows/WSL routing, and transfer cleanup.
• Recovered overloaded SSH multiplexed sessions with one exact-diagnostic retry and a direct-connection fallback while preserving the original lease and command. Thanks @excelsier.
• Rendered failure recovery guidance after automatic cleanup, omitting lease commands only after confirmed release while preserving retained and uncertain cleanup recovery.
• Printed failed-run output tails once after the digest, preserving both streams, bounded output, capture notices, redaction, and failure bundles. Thanks @coygeek.
• Rejected lease-output aliases of captures and success/failure downloads before acquisition, preserving retained lease handles and existing output bytes.
• Released run-owned workspace authority after static SSH one-shot cleanup so the surviving host can be reused immediately, while preserving guarded owner checks and destructive-provider cleanup ordering.
• Preserved SIGINT and SIGQUIT behavior for kept and reused POSIX SSH workloads without weakening child ownership checks or changing caller umasks. Thanks @coygeek.
• Preserved the remote caller's umask for workspace-owned POSIX and WSL2 commands while keeping staged scripts, stdin, and owner state private.
• Reported POSIX and WSL2 workspace-owner setup failures separately from SSH readiness, with bounded pre-start cleanup and fail-closed recovery when child observation is denied.
• Fixed static SSH architecture admission across Linux, macOS, Windows, and WSL2: configured values, including inherited amd64, now require fresh matching evidence after read-only ownership checks and before guarded claim publication; remove explicit architecture settings for automatic discovery, with measured or unknown evidence reported separately from offline defaults.
• Simplified WSL2 SSH execution into one verified, privately blinded SFTP envelope with a derived fixed-control startup/work/completion budget, LF helpers on Windows builds, identity-checked cleanup, and no replay after publication uncertainty; SFTP is now required, replacing the v0.47.0 stdin fallback (enable it and verify Doctor's wsl2-sftp probe before upgrading). Thanks @vincentkoc.
• Kept WSL2 partial-cleanup hashing within its cancellation budget and published complete workload exit results atomically, preserving staged ownership checks and rejecting malformed statuses. Thanks @vincentkoc.
• Made native Windows state replacement and cleanup preserve open readers; the CLI now requires Windows 10 version 1709+ or Windows Server 2019+.
• Kept Windows external routing state readable after publication by creating it with current-user ownership and private ACLs.
• Pinned the built-in Tart macOS image and verified cloned disk, NVRAM, and configuration contents before boot, retaining custom-image overrides, recording verified provenance, and waiting for the guest agent before SSH setup. Thanks @coygeek.
• Pinned shipped Local Container and Apple Container Ubuntu defaults to reviewed multi-platform OCI digests, verified Apple images before bootstrap, and preserved explicit custom-image overrides. Thanks @coygeek.
• Disabled automatic host clipboard and audio passthrough for Tart VMs.
• Kept automatic egress client tickets off SSH, remote shell, and helper process arguments with a foreground bounded-input handoff to the detached client, preventing SSH teardown from truncating ticket delivery.
• Kept secret SSH usernames out of VNC/WebVNC and pond tunnel arguments and daemon state, retained private configs through attached teardown or authenticated detached listener readiness, and preserved pond child environment filtering and overrides.
• Preserved replacement and backend-retained claims after delegated stops in pond release by leaving claim finalization to the provider.
• Fixed cleanup of Docker checkpoint forks from fixed-ID source leases by clearing inherited allocation ownership, including when forking older checkpoint images.
• Required exact Modal sandbox and native scope bindings for stop, reuse, and one-shot cleanup, fencing claim changes and retaining uncertain or legacy resources until termination is confirmed. Thanks @coygeek.
• Required exact Tensorlake resource and API-key scope bindings for reuse and cleanup, fencing claim changes and retaining legacy or uncertain sandboxes until termination is confirmed. Thanks @coygeek.
• Required exact Apple Machine ownership claims bound to daemon storage and an acquisition-only marker, fencing cleanup and retaining legacy, replaced, or uncertain machines without implicit adoption. Thanks @coygeek.
• Required exact ASCII Box ownership claims for reuse and deletion, pinning creation identity and endpoint/organization routing, fencing teardown and rollback, and retaining uncertain resources until deletion is confirmed. Thanks @coygeek.
• Required exact SmolVM ownership claims for deletion and reuse, binding machine identity and endpoint before startup, fencing cleanup against claim changes, and retaining legacy or uncertain resources without implicit adoption. Thanks @coygeek.
• Fenced Nomad stop, cleanup, run teardown, and setup rollback against concurrent claim changes, preserving successor jobs and retaining claims until remote absence is confirmed. Thanks @coygeek.
• Required durable Incus ownership claims for stop and cleanup, preserving legacy instances and keys without implicit adoption, keeping status read-only, and rechecking identity after stop. Thanks @coygeek.
• Required exact, unchanged Proxmox cleanup claims bound to the cluster scope, VMID, and native generation ID, retaining unclaimed or ambiguous VMs and keys and preventing endpoint refreshes from rebinding ownership. Thanks @coygeek.
• Required exact, unchanged Tart cleanup claims bound to the VM's storage and ownership marker, preserving unclaimed, legacy, replaced, or ambiguous VMs and local keys.
• Kept public AWS lease release independent of other instances’ image and network readiness, while fencing ingress writes with fresh lease authority and access state.
• Prevented guest cleanup of confirmed deleted coordinator leases, bounded ordered guest cleanup before authoritative release, and kept prewarm cleanup behind the release owner.
• Preserved managed Daytona cleanup responsibility after lost create responses, with native TTL for kept sandboxes, early exact-resource tracking, and original-context deletion confirmed by provider observation.
• Cleaned exact-owned interrupted Azure public-IP and NIC provisioning prefixes while restoring ordered SKU fallback and preserving immutable-identity cleanup fences. Thanks @excelsier and @vincentkoc.
• Retained scoped direct-AWS fixed-lease cleanup receipts for canonical stop replay after inventory disappears, with fresh account, region, identity, and inventory checks; older compact tombstones remain unchanged and fail closed.
• Required exact scoped Blacksmith Testbox claims for stop/reuse, fenced acquisition rollback and key ownership, and confirmed terminal cleanup before dropping state while preserving active-command cancellation and truthful cleanup results. Thanks @coygeek.
• Reconciled failed Blacksmith stops only after fresh exact-Testbox terminal confirmation, retaining exact claims when local artifact cleanup fails and reporting independent verification failures without losing native exit codes or original command failures.
• Made native checkpoint source retirement replayable, preserving pending operation and image identity across interruption, fencing ordinary release after capture reservation, binding Machine0 retirement to its captured account, and refusing forks from discarded images without restarting a retiring Machine0 source or discarding unresolved ownership records; Hetzner retirement remains unavailable until its project identity can be attested.
• Preserved explicit repository reclaim for existing Machine0 leases and unified fixed replay, inspection, and cleanup around attested native details and early durable UUID binding; retained ambiguous attempts and empty legacy records without duplicate creation or inferred cancellation.
• Attested fixed Machine0 checkpoint-fork replay from identity-checked VM details when inventory omits the pinned image version, preserving key semantics and refusing mismatches without duplicate creation.
• Repaired Machine0 UUID lookups through validated inventory and identity-verified full details by name, preserving UUID ownership and rejecting incomplete or changed identities.
• Resolved full Machine0 default SSH-key metadata before preflight so public keys are not rejected when list summaries omit their local filenames.
• Rejected proven Machine0 PUBLIC-key identity mismatches before VM creation without changing key selection or treating unverified keys as mismatches, and avoided blocking extraction on special files.
• Made Machine0 doctor check the same SSH-key prerequisites as new creation and reject missing legacy key pairs when no default is selected, without mutating keys or blocking existing fixed-lease replay. Thanks @coygeek.
• Preserved configured Machine0 executable paths and polling settings during checkpoint verification, deletion, and pruning while retaining exact image/version ownership checks and local records on uncertain failures.
• Preserved Machine0 missing-version cleanup refusals while distinguishing confirmed version removal from whole-image absence, including lost remove responses without erasing sibling versions or unresolved metadata.
• Marked Machine0 creation-only selectors in provider discovery and excluded them from prewarm follow-ups, with invalid projected provider configuration rejected before allocation.
• Honored explicit Tencent Cloud Spot and on-demand market selections while preserving hourly billing when no market is configured, with invalid values rejected before provider access. Thanks @exAClior.
• Restored Ubuntu ARM64 local-container browser provisioning with signed native Mozilla Firefox packages instead of Snap transition packages, while preserving working browsers and advancing past broken distro candidates. Thanks @coygeek.
• Bounded coordinator lease reads, doctor probes, and HTTP heartbeats to 30 seconds, and stop's preliminary lookup to ten seconds, preserving provisioning budgets, provider-scoped release, caller cancellation, and cleanup evidence.
• Bounded best-effort foreground lease refreshes to 20 seconds so stalled maintenance does not block SSH-backed copy and connection commands for the coordinator's full HTTP budget, while preserving claim checks and caller cancellation.
• Bounded best-effort Testbox portal bookkeeping to one five-second budget and delayed final warmup completion/timing until it ends, preserving successful allocations and retained leases on sync failure.
• Honored cancellation during Code bridge reconnect and code-server readiness waits, preserving the existing retry delays while returning promptly on Ctrl+C. Thanks @SebTardif.
• Honored cancellation during Hostinger bootstrap SSH retry delays while preserving ownership-checked rollback and recovery state. Thanks @SebTardif.
• Reaped WebVNC daemon SSH tunnels across child restarts and orderly shutdown, retaining exact ownership records and reporting failure when cleanup cannot be confirmed.
• Bounded VNC/WebVNC credential reads to 30 seconds and 64 KiB, discarding partial credentials on any failure while preserving connection defaults, caller cancellation, and transport cleanup. Thanks @SebTardif.
• Bounded WebVNC bridge response-header waits to 30 seconds without limiting established WebSocket sessions or bypassing configured HTTP transports. Thanks @SebTardif.
• Preserved macOS WebVNC authentication timeout diagnostics when a connection deadline closes the browser transport before negotiation returns.
• Honored pond connect flags after the pond name so the documented pond connect <name> --export form starts tracked daemons instead of blocking in foreground mode.
• Validated generated prewarm probes through the provider's run contract before backend configuration, ready-pool checks, or ACL changes, preserving follow-up routing and reuse intent.
• Rejected Blacksmith Testbox --no-sync with exit 2 before acquisition or reuse instead of silently delegating sync, including nonblank prewarm --probe-command and named jobs with noSync: true before warmup or dry-run planning.
• Reported bounded, secret-safe remote Git seed failure phases and categories across ordinary sync, local Actions hydration, and native Windows, while preserving file sync and Git coherence behavior. Thanks @coygeek.
• Made config path diagnostics honor CRABBOX_CONFIG, matching the file selected for reads and writes. Thanks @coygeek.
• Exposed resolved Incus settings in config show --json, with endpoint credential redaction and no daemon access.
• Reported omitted local-container architecture as native in config diagnostics without probing the runtime or changing explicit architecture assertions. Thanks @coygeek.
• Preserved bounded Docker and Podman diagnostics when runtime identity probes return empty successful output, without accepting missing identities. Thanks @coygeek.
• Omitted speculative && failure diagnostics for compound shell commands while retaining simple-chain explanations and workload exit behavior. Thanks @coygeek.
• Put copy-command usage, path syntax, and examples before the provider flag reference in cp --help. Thanks @coygeek.
• Clarified uploaded-script path semantics in the Agent Skill, including when to run a synced repository script in place for adjacent assets. Thanks @coygeek.

0.47.0 - 2026-08-28

Added

• Added direct Daytona filesystem checkpoints with explicit stop consent, source restart, verified snapshot forks, and ownership-bound snapshot cleanup.
• Added an experimental Boxd SSH-lease provider with interactive HTTPS login, immutable ownership claims, and safe rejection of the vendor's currently non-isolated production VMs. Thanks @MichielMAnalytics.
• Added explicitly opt-in, image-pinned typed ready pools with exact repository/cache identities and rollback-isolated coordinator storage. Thanks @vincentkoc.
• Added targeted stop --force recovery through verified provider adoption or exact coordinator lease inspection without weakening ownership checks.
• Added replay-safe fixed lease IDs to checkpoint forks and machine-readable JSON output to checkpoint creation and forking.
• Added strict, provider-neutral Linux image readiness manifests with shared CLI/coordinator capability verification and safe legacy-image migration. Thanks @vincentkoc.
• Added fixed idempotent --lease-id replay to local-container warmups, with exact container-intent matching and single-use released IDs.

Fixed

• Clarified static SSH stop/run documentation and added command-path regression coverage for existing best-effort connection cleanup before local unclaiming, without changing runtime behavior.
• Unified provider-owned routing for stop, retry, rescue, and WebVNC commands, preserving scope, explicit false release settings, and Kubernetes environment selectors without exposing URL credentials.
• Saved automatic failure bundles in private user state when the project capture destination is unwritable, retaining verified directories through creation, publication, and cleanup to prevent path substitution while preserving the command exit status.
• Refreshed coordinator runtime and Worker development dependencies, including Nano ID and Undici advisory fixes.
• Preserved Daytona recovery claims and lookup errors when stop cannot verify the sandbox, instead of reporting release from an unverified not-found response.
• Fixed portable Node coordinator control heartbeats deadlocking subsequent lifecycle operations, releases, and graceful shutdown.
• Made direct Daytona sandboxes private, preserved dependencies across syncs, enforced native TTL and idle heartbeats, reported authoritative readiness, and verified allocation rollback and credential-safe redirects.
• Fixed brokered Windows bootstrap on images with built-in OpenSSH by sharing the CLI's installed/system/PATH command resolution; centralized common bootstrap fragments, pinned downloads, and portable OS metadata across both runtimes.
• Unified E2B, Modal, and Cloudflare Sandbox run retention, bounded cleanup, and final timing; preserved command exit codes on cleanup failure, applied Modal keep-on-failure to setup/sync failures, and checked Modal archives before creation with staged workspace replacement.
• Required exact host/project-scoped Semaphore job ownership claims and fresh provider verification before stopping jobs.
• Required exact API-scoped Morph instance ownership claims and fresh provider verification before pause or deletion.
• Returned machine-readable missing checkpoint verdicts and made checkpoint deletion idempotent when local records or coordinator-owned resources are already absent.
• Required exact pool-scoped VM ownership claims and fresh provider verification before XCP-ng release or cleanup deletion.
• Kept local-container bootstrap mounts under the user cache directory for desktop Docker VMs and retained cleanup recovery state when cache settings change. Thanks @johan-eilertsen.
• Required exact, scope-bound ownership claims and fresh provider verification before Sprites deletion or Tenki session termination.
• Required exact, scope-bound local ownership claims before Namespace Devbox and Compute Instance lifecycle mutations, with ownership-verified forced recovery for exact Compute Instance IDs.
• Made direct Daytona SDK commands honor caller deadlines without the default one-minute HTTP cutoff or a separate one-hour execution cap. Thanks @arisylafeta.
• Removed coordinator URL credentials from Code and WebVNC browser links, opener arguments, and viewer bootstrap form actions. Thanks @coygeek.
• Redacted configured and runtime-only credentials from coordinator-stored run failure diagnostics while preserving raw command output. Thanks @coygeek.
• Retried temporary Machine0 read outages within the existing operation deadline while keeping provider mutations single-attempt.
• Added actionable Machine0 recovery hints for unclaimed lease IDs without treating short name hashes as proof of lease ownership.
• Removed idle gaps throughout media previews while preserving every moving interval, so long recordings produce short GIFs without hiding late changes.
• Exposed coordinator cleanup state in brokered inspect --json, preserving pending, error, and retry signals plus the distinction between omitted and explicit releaseDeletesServer: false.
• Reduced Machine0 provisioning reads about twelvefold by polling every 60 seconds by default while preserving fresh fixed-lease ownership checks.
• Failed local-container acquisition and status waits promptly when the exact claimed container exits, while preserving fenced recovery and cleanup for retained leases.
• Redacted coordinator URL credentials, query parameters, and fragments from run-context portal and logs links.
• Preserved Machine0 command deadline, cancellation, and signal failures with partial output and ran independent doctor probes concurrently.
• Required an exact, locked local ownership claim before releasing ordinary AWS instances, preventing tag-matched resources from being terminated without durable lease authority.
• Streamed artifact-collection scripts through SSH stdin so multiple artifact globs no longer overflow macOS OpenSSH multiplexed session requests.
• Allowed Windows and WSL2 SSH readiness checks enough time for delayed native OpenSSH handshakes without slowing Linux or macOS readiness.
• Kept WSL2 workspace-owner commands below the Windows command-line limit by streaming their POSIX scripts over SSH stdin.
• Fenced Linode heartbeats and Tailscale metadata updates with exact account-, scope-, and instance-bound claims, preserving legacy instance claims, idle-timeout intent, and safe release continuity.
• Made two timing-sensitive tests robust on loaded CI runners.
• Required exact, locked resource ownership claims before Tencent Cloud, Nebius, Vast, Orgo, Upstash Box, Coder, and EC2 Mac host lifecycle mutations, preventing name-matched, stale, cross-namespace, or concurrently renewed resources from being destroyed.
• Added authoritative Machine0 machine-class discovery while preserving explicit native size selections and the five-provider legacy class compatibility boundary.

0.46.0 - 2026-08-20

Added

• Added fixed idempotent --lease-id replay to the Machine0 provider: an identical warmup adopts the existing VM instead of creating a second one, a drifted request fails with lease_id_conflict, and a released ID is single-use.

Fixed

• Rejected oversized delegated-run workspaces before any paid or stateful provider resource is created, so size-limit failures no longer leave billable resources behind.
• Made E2B and Azure Dynamic Sessions workspace sync transactional so a failed upload no longer destroys the previous remote workspace, and honored --keep-on-failure for sync and setup failures.
• Stopped losing track of possibly-created billable resources: ambiguous Vast instance creation and failed AWS Lambda MicroVM rollbacks now persist recovery claims and surface errors naming the exact resource instead of failing silently.
• Enforced coordinator-provided SSH host keys before first transport and removed per-lease local SSH credentials after confirmed brokered release.
• Required exact local ownership before destructive cleanup across Cloudflare Dynamic Workers, DigitalOcean, Linode, and Vultr, fencing deletions with revisioned claims so concurrent sessions or stale state can no longer remove the wrong resource.
• Retained evidence for uncertain Cloudflare Dynamic Workers completions - runs are kept with recovery claims instead of reporting not-kept over unreconciled provider state - and documented that stop removes metadata only and cannot cancel active runs.
• Honored documented waiting and cancellation behavior: W&B status --wait now actually waits, Blaxel stops its remote process when polling is interrupted, and status waits bound each in-flight provider call by the requested timeout.
• Made doctor configuration fail with a clear provider error instead of panicking when a backend lacks doctor capability.
• Bounded delegated-provider subprocess captures and background cleanup with explicit limits, deadlines, and visible truncation instead of unbounded growth.
• Preserved exact lease claim revisions across coordinator registration, endpoint refresh, and Tailscale metadata updates so lifecycle cleanup cannot fail with stale authorization and leak provider resources.
• Made canceled Tenki readiness waits report cancellation instead of timeout.
• Consolidated cross-provider infrastructure into shared engines - lifecycle polling (30 providers), cross-origin redirect security (17), cross-process operation locking (9), doctor configuration (66), the AWS/Machine0 fixed-lease mechanism, JSON subprocess exchanges, strict claim matching, and nine smaller helper clusters - preserving every provider-specific behavior, error message, and on-disk path.
• Documented which acquisition and delegated-run lifecycle responsibilities deliberately remain provider-owned and why centralizing them was rejected.

0.45.0 - 2026-08-19

Added

• Added a built-in Machine0 SSH-lease provider with live size and GPU pricing, persistent VM lifecycle, explicit suspend/resume, native versioned images, and tunneled Linux desktop support.
• Added authoritative, target-aware machine-class catalogs to both JSON provider discovery commands while preserving the initial default-target class summaries.
• Added tiny and small machine classes for lower-cost smoke checks and small repositories.
• Added artifact globs and required-artifact proof gates for SSH-backed macOS targets with non-following, protected-path-safe matching. Thanks @coygeek.
• Added an opt-in cmake --version preflight probe for POSIX, WSL2, and native Windows targets. Thanks @coygeek.

Fixed

• Rejected nil or unsupported process-wide HTTP transports with a clear setup error instead of panicking or bypassing host network policy, while preserving explicitly injected clients. Thanks @SebTardif.
• Kept explicit Hetzner server-type requests exact instead of continuing through class fallback candidates after capacity errors.
• Made private draft verification resolve the exact draft by tag and numeric release ID instead of relying on a release-list endpoint that can omit drafts.

0.44.0 - 2026-08-18

Added

• Added credential-free crabbox providers describe discovery for canonical provider-scoped run flags and compiled defaults. Thanks @coygeek.
• Added supported versioned go install as a CLI-only installation channel, with clean module dependency semantics, source-derived release and revision versions, and hermetic release verification. Thanks @coygeek.
• Added an opt-in Linux/WSL2 raw_socket preflight probe that distinguishes direct, non-interactive-sudo, unavailable, and missing-interpreter states without sending packets or elevating workloads. Thanks @coygeek.
• Added checkpoint last-use tracking and composable checkpoint prune --unused-for cleanup for inactive local records and provider artifacts.
• Added provider-native create, verify, delete, and fork lifecycle for direct Hetzner project-snapshot checkpoints, including exact local-claim image deletion.
• Added crabbox heartbeat so external SSH drivers can refresh owned lease idle deadlines and optionally update the idle timeout.
• Added credential-free crabbox claims list output for deterministic, secret-safe inspection of unverified local lease claims across providers. Thanks @coygeek.
• Added retained local-container --lease-output run-session handles with pre-sync emission and exact cleanup on output failure. Thanks @coygeek.

Fixed

• Kept local source and worktree builds on the dev identity instead of trusting Go 1.26 pseudo-versions synthesized from VCS metadata in another checkout.
• Prevented confirmed run --stop-after always teardown from racing workspace-owner renewal and replacing successful, evidence-backed runs with exit 7. Thanks @coygeek.
• Retried brief GitHub API failures during browser login and kept exhausted post-exchange attempts safely retryable instead of turning the next CLI poll into a terminal failure.
• Bounded crabbox claims list inventory reads to 1 MiB per local claim while preserving valid partial output for oversized files. Thanks @coygeek.
• Made local-container heartbeat authorize recorded dynamic runtime scopes and durably compare-and-swap exact claim lifecycle state without recreating or overwriting changed claims. Thanks @coygeek.
• Made AWS image deletion resume from owner-level durable snapshot claims after AMI deregistration or catalog cleanup failures, preventing stale ordinary and capability-variant records from remaining selectable.
• Made static SSH heartbeats persist touched timestamps and explicit idle-timeout replacements across fresh CLI processes, while omitted overrides preserve the stored timeout. Thanks @coygeek.
• Bounded Lambda MicroVM runner response-header waits without limiting uploads or streamed executions, while preserving injected HTTP clients. Thanks @SebTardif.
• Fixed native local-container checkpoint forks to complete their recorded Docker runtime scope before claim creation, allowing immediate commands and safe normal stop while preserving exact claim validation.
• Split fallback E2B HTTP ownership so finite lifecycle calls cannot hang indefinitely while uploads and process streams remain caller-controlled. Thanks @SebTardif.
• Split fallback HTTP ownership for Azure Dynamic Sessions, Blaxel, Cloudflare Sandbox, Freestyle, Orgo, and SmolVM so finite control calls cannot hang while data-plane lifetimes remain caller-controlled. Thanks @SebTardif.
• Rejected ambiguous or extra crabbox heartbeat identifiers before configuration or provider resolution, preventing malformed commands from reaching lease mutation. Thanks @coygeek.
• Rejected native Jujutsu and other unsupported local sync sources before delegated archive providers can provision or execute a remote sandbox.
• Accepted explicit local-container architecture assertions only when the selected Docker or Podman daemon reports a matching native architecture, without enabling emulation. Thanks @coygeek.
• Omitted coordinator-only history commands from failure digests when run history is unavailable, while preserving direct lease recovery guidance.
• Bypassed reusable-workspace ownership for fresh non-retained local-container runs while preserving ownership for retained and reused leases.
• Framed workspace-owner scripts outside native Windows SSH command arguments so retained runs avoid cmd.exe limits, preserve finite stdin and nonzero exits, and clean up promptly.

0.43.0 - 2026-08-15

Added

• Added opt-in python and python3 preflight probes that check the literal executable on POSIX, WSL2, and native Windows targets.

Fixed

• Bounded fallback HTTP clients for finite provider control calls without truncating uploads, downloads, or streaming executions. Thanks @SebTardif.
• Selected native WSL rsync and OpenSSH correctly on Windows, while x64 no-WSL transfers now keep direct control on System32 OpenSSH and bind native rsync to its sibling OpenSSH.
• Made default run --emit-proof headings context-neutral instead of claiming every run occurred after a patch or fix.
• Preserved authoritative recorded-run and lease-claim provider routes while keeping unselected inspection and archive dry-run output provider-neutral.
• Bound coordinator release, heartbeat, and Tailscale mutations to the CLI-selected provider, preventing cross-provider lease deletion or metadata changes.
• Made Actions hydration waits, coordinator lease-release retries, and managed Windows VNC waits return promptly when cancelled during backoff. Thanks @SebTardif.

0.42.0 - 2026-08-14

Added

• Added a checksummed, validated archive fallback for SSH-backed cp from POSIX operator hosts to native Linux or macOS leases (not WSL2) when local rsync is missing or older than 3.4.3, including stock macOS OpenRsync. Thanks @coygeek.

Fixed

• Coordinator lease metadata can no longer switch an explicit or configured provider selection or authorize a different local adapter.
• Provider-native checkpoint identifiers no longer reroute through coincidentally matching Static or External lease identities.
• Required explicit provider intent before lifecycle commands initialize a backend, while preserving claim and recorded-run routing and keeping bare doctor provider-neutral. Thanks @coygeek.
• Prevented Azure orphan-sweep release failures from writing secret-bearing diagnostics to Worker console logs while retaining redacted details in sweep records.
• Rejected native Jujutsu workspaces before Git-manifest sync can fall through to an outer checkout, while preserving colocated Git workspaces and --no-sync. Thanks @atimmer.
• Redacted compound environment assignments, cookie and security-token headers, and camel-case API-token fields from client-visible coordinator diagnostics while preserving surrounding operational context. Thanks @dwin-gharibi.

0.41.6 - 2026-08-13

Fixed

• Restricted sensitive generated local files, including managed attestation keys and signed-URL artifact outputs, to the current OS user on POSIX and Windows. Thanks @dwin-gharibi.
• Made POSIX workspace ownership independent of the remote account's login shell by transporting owner scripts through a private /bin/sh launcher, fixing static macOS sync under zsh, Bash, and Fish. Thanks @osouthgate and @hosmelq.
• Derived implicit Static SSH macOS work roots from the resolved SSH user while preserving explicit roots and EC2 Mac defaults. Thanks @osouthgate.
• Routed implicit status and inspect lease identifiers through the provider recorded in local claims before initializing the configured provider, while preserving explicit-provider precedence and missing-claim fallback. Thanks @coygeek.
• Reported explicit stdout and stderr capture paths and byte counts in emitted run proofs without reading or embedding captured content. Thanks @coygeek.
• Kept repeated repository sync and finalization idempotent across shallow and complete Git workspaces while preserving command exits and clearing witnessed ownership state. Thanks @osouthgate and @hosmelq.
• Made cache stats --json emit an empty array for empty inventories while live smoke accepts legacy null and object reports but rejects other scalar shapes before workloads. Thanks @excelsier.
• Rejected invalid or overlong coordinator-requested lease slugs before provisioning while preserving exact fixed-ID replays created under the legacy length behavior. Thanks @dwin-gharibi.
• Bound valid caller-declared artifact SHA-256 digests into signed broker upload grants, rejected malformed nonblank digests instead of silently disabling integrity checks, and made object storage reject mismatching payloads. Thanks @dwin-gharibi.
• Made GitHub team authorization fail closed on malformed selectors, enforced same-org team scope, and invalidated membership and device proofs when the normalized policy changes. Thanks @dwin-gharibi.
• Preserved pinned AWS SSH ingress and dynamic CIDRs from the other IP family when broker heartbeats refresh access, while replacing obsolete same-family dynamic sources. Thanks @jalehman.
• Kept the exact updated lease-claim snapshot through one-shot run registration and replacement retries so task-owned local containers can clean up without weakening concurrent replacement fences. Thanks @coygeek.

0.41.5 - 2026-08-12

Fixed

• Kept Git-tracked regular files under ambiguous built-in artifact directories in sync manifests while preserving authoritative project excludes, untracked-output filtering, ordered re-includes, and bounded path-and-pattern warnings. Thanks @salmonumbrella.
• Clarified that POSIX SSH run --script uploads a content-hashed standalone copy whose $0 points under .crabbox/scripts/, and documented synced-path execution for scripts that need adjacent repository assets. Thanks @coygeek.
• Classified per-run local-container cgroup OOM-kill increments as memory resource exhaustion, with bounded evidence collection and actionable memory/concurrency guidance while ignoring historical OOM counts on reused leases. Thanks @coygeek.
• Made bare crabbox doctor report compiled-default provider provenance and skip that unchosen provider's credential readiness without weakening explicitly configured provider checks. Thanks @coygeek.
• Retained keep-enabled local containers after SSH readiness failures behind durable exact-resource pending claims, with fenced recovery and cleanup commands, while preserving full rollback for one-shot leases. Thanks @coygeek.
• Reconciled exact-owned Azure VM, NIC, public IP, and managed OS disk orphan sets with stable-identity quarantine and fail-closed durable deletion progress. Thanks @chsong1.
• Invalidated adopted Actions workspace readiness markers before full resync and rehydrated the canonical workspace before running commands. Thanks @vincentkoc.
• Stopped sparse-checkout and skip-worktree omissions from deleting in-scope remote files, and kept staged gitlink removals out of file-deletion manifests. Thanks @vincentkoc.
• Deferred ordinary coordinator lease provider cleanup to durable alarm-owned retries while preserving synchronous force-admin deletion and visible retry state. Thanks @fuller-stack-dev.
• Made future Linux developer-image preparation use root-owned Corepack state while source, candidate, and promoted smoke checks exercise Corepack and pnpm as the runtime user. Thanks @fuller-stack-dev.
• Made local sync report actionable non-Git workdir diagnostics and fail before lease acquisition, resolution, preparation, or ready-pool borrowing. Thanks @bunlongheng.