CHANGELOG.md

# Changelog

## Unreleased

### Changes

- Docs: consolidate provider selection, class catalogs, and lifecycle references; correct stale provider support, sizing, and transport guidance.

## 0.74.0 - 2026-10-10

### Highlights

- **Recover GitHub Codespaces leases safely after interrupted requests.** Caller-supplied lease IDs now bind recovery to the exact account and creation intent, with receipts that prevent accidental recreation. [PR 2752](https://github.com/openclaw/crabbox/pull/2752), [Issue 2660](https://github.com/openclaw/crabbox/issues/2660). Thanks @jcxmt125.
- **Start exe.dev leases from a prepared VM.** Use `--exe-dev-from` to copy a ready workspace into a separately owned lease with fresh ownership tags and a persistent work root. [PR 2757](https://github.com/openclaw/crabbox/pull/2757), [PR 2754](https://github.com/openclaw/crabbox/pull/2754). Thanks @salmonumbrella.
- **See what AWS capacity checks actually know.** Doctor distinguishes sufficient quota from unchecked regional usage instead of reporting available capacity from the quota ceiling alone. [PR 2753](https://github.com/openclaw/crabbox/pull/2753). Thanks @vincentkoc.
- **Run more concurrent coordinator leases.** Fleet, org, and capacity-admin active-lease caps rise from 20 to 50; the ordinary owner cap and monthly budgets remain unchanged. [PR 2756](https://github.com/openclaw/crabbox/pull/2756).

### Upgrade notes

- Automation parsing AWS doctor capacity output should handle `capacity=unknown quota_limit=sufficient usage=unchecked region=...`: a sufficient quota no longer implies available regional capacity. [PR 2753](https://github.com/openclaw/crabbox/pull/2753). Thanks @vincentkoc.

### Added

- exe.dev: start separately claimed leases from prepared VMs with `--exe-dev-from`, fresh ownership tags, and persistent work roots while preserving existing claim paths. [PR 2757](https://github.com/openclaw/crabbox/pull/2757), [PR 2754](https://github.com/openclaw/crabbox/pull/2754). Thanks @salmonumbrella.
- GitHub Codespaces: support replay-safe caller-supplied lease IDs with account- and intent-bound recovery, exact-resource cleanup, and terminal receipts. [PR 2752](https://github.com/openclaw/crabbox/pull/2752), [Issue 2660](https://github.com/openclaw/crabbox/issues/2660). Thanks @jcxmt125.

### Changes

- Coordinator: raise fleet, org, and capacity-admin active-lease caps from 20 to 50, preserving the ordinary owner cap and monthly budgets. [PR 2756](https://github.com/openclaw/crabbox/pull/2756).

### Fixes

- AWS: stop reporting available capacity from quota ceilings alone; mark regional usage unchecked and clarify that class fallback still requires quota headroom. [PR 2753](https://github.com/openclaw/crabbox/pull/2753). Thanks @vincentkoc.
- DigitalOcean: prefer the first available region near San Francisco when no region is configured, preserve explicit regions, and reuse the recorded region on fixed-lease replay. [PR 2758](https://github.com/openclaw/crabbox/pull/2758).
- Azure: refuse retained network-companion cleanup when provider-key or fixed-attempt tags conflict with the original claim, even when immutable resource IDs still match. [PR 2751](https://github.com/openclaw/crabbox/pull/2751).

## 0.73.0 - 2026-10-08

### Highlights

- **Start AWS Windows leases on Server 2025.** The promoted eu-west-1 developer image and stock fallback now use Windows Server 2025; an explicit OS selector keeps Server 2022 available. [PR 2748](https://github.com/openclaw/crabbox/pull/2748), [PR 2734](https://github.com/openclaw/crabbox/pull/2734), [Issue 2717](https://github.com/openclaw/crabbox/issues/2717). Thanks @saftall.
- **Run shell workloads in Azure sandboxes and recover failed Azure VMs safely.** The new Azure Container Apps Sandboxes provider supports kept Linux workloads, uploads, idle resume, and verified cleanup. Azure VM leases retain cleanup ownership after VM loss, with `crabbox hold` for salvage. [PR 2738](https://github.com/openclaw/crabbox/pull/2738), [PR 2733](https://github.com/openclaw/crabbox/pull/2733). Thanks @galiniliev.
- **Keep Windows command arguments intact.** Native programs and uploaded PowerShell scripts receive embedded quotes, empty arguments, backslashes, and Unicode without the legacy argument binder losing or merging them. [PR 2736](https://github.com/openclaw/crabbox/pull/2736).
- **Recover interrupted creates after a coordinator reset.** Bounded history reads, streamed log downloads, and capped caches reduce memory pressure; interrupted creates fail promptly while preserving provider cleanup ownership. [PR 2745](https://github.com/openclaw/crabbox/pull/2745).
- **Know how to stop every retained lease.** Runs print the exact stop command and retention reason, Cloudflare retries failed container cleanup, and stop respects cleanup already owned by expiry. [PR 2741](https://github.com/openclaw/crabbox/pull/2741), [PR 2735](https://github.com/openclaw/crabbox/pull/2735), [PR 2747](https://github.com/openclaw/crabbox/pull/2747), [Issue 2740](https://github.com/openclaw/crabbox/issues/2740), [Issue 2746](https://github.com/openclaw/crabbox/issues/2746). Thanks @coygeek and @shakkernerd.

### Upgrade notes

- AWS Windows leases now boot Server 2025 by default. Pin `--os windows-server:2022` to keep Server 2022. [PR 2748](https://github.com/openclaw/crabbox/pull/2748), [PR 2734](https://github.com/openclaw/crabbox/pull/2734), [Issue 2717](https://github.com/openclaw/crabbox/issues/2717). Thanks @saftall.
- After an Azure VM disappears, automatic cleanup resumes only previously admitted deletion. Otherwise choose `crabbox stop` or `crabbox hold` explicitly, even for an expired lease; retain local claims for recovery. Holds do not expire automatically and need explicit finalization after salvage and disposal. [PR 2733](https://github.com/openclaw/crabbox/pull/2733). Thanks @galiniliev.

### Added

- Azure Sandbox: run kept Linux shell workloads in existing Azure Container Apps Sandbox groups with fixed lease recovery, explicit uploads, idle resume, and verified cleanup that can interrupt active requests. [PR 2738](https://github.com/openclaw/crabbox/pull/2738). Thanks @galiniliev.

### Changes

- AWS Windows leases: default the stock AMI fallback to Server 2025 in direct and brokered mode while preserving explicit Server 2022 selection and promoted-image precedence. [Issue 2717](https://github.com/openclaw/crabbox/issues/2717). [PR 2748](https://github.com/openclaw/crabbox/pull/2748). Thanks @saftall.
- AWS Windows images: enable guarded Server 2025 bakes from stock with source-only OS selection, guest-version proof, and matching Server Core containers; explicit Server 2022 leases retain stock selection. [Issue 2717](https://github.com/openclaw/crabbox/issues/2717). [PR 2734](https://github.com/openclaw/crabbox/pull/2734). Thanks @saftall.

### Fixes

- Stop: observe expiry-owned cleanup and reconcile its confirmed completion without duplicate provider deletion, preserving local recovery material while pending. [PR 2747](https://github.com/openclaw/crabbox/pull/2747). [Issue 2746](https://github.com/openclaw/crabbox/issues/2746). Thanks @shakkernerd.
- Coordinator: bound historical lease reads, log downloads, cleanup scans, and bridge history caches; fail interrupted creates promptly before dispatch or after resource-ID publication while retaining provider cleanup custody. [PR 2745](https://github.com/openclaw/crabbox/pull/2745).
- Windows developer images: reboot through validated SSH without racing workspace ownership release, require bounded SSH down/up transitions before resuming prep, and fail on rejected shutdown commands. [PR 2744](https://github.com/openclaw/crabbox/pull/2744).
- Windows developer images: retry and verify container pulls and native package downloads, report the failing prep step, exception and longer log tail, and distinguish accepted release from unconfirmed cleanup after prep failure. [PR 2743](https://github.com/openclaw/crabbox/pull/2743).
- AWS developer images: wait up to `CRABBOX_IMAGE_CAPACITY_WAIT` (default 45 minutes per acquisition) for fleet, owner, or org active-lease capacity, preserving cleanup and excluding rejected attempts from measured timings. [PR 2742](https://github.com/openclaw/crabbox/pull/2742).
- Windows developer images: keep staged TruffleHog binaries executable on stock Server 2025 and report validation exit codes, stdout, stderr, and launch errors before atomic installation. [PR 2739](https://github.com/openclaw/crabbox/pull/2739).
- Run: print the exact provider-scoped stop command and retention reason when ownership checks fail closed or automatic cleanup cannot confirm the lease stopped, including timing JSON. [Issue 2740](https://github.com/openclaw/crabbox/issues/2740). [PR 2741](https://github.com/openclaw/crabbox/pull/2741). Thanks @coygeek.
- Validate OS selector compatibility after lease flags resolve the provider and target, so a configured or environment Windows Server selector accepts `--target windows` while incompatible final selections still fail. [PR 2737](https://github.com/openclaw/crabbox/pull/2737).
- Windows: preserve embedded quotes, empty arguments, backslashes, and Unicode when running native executables or passing arguments to uploaded PowerShell scripts. [PR 2736](https://github.com/openclaw/crabbox/pull/2736).
- Azure: preserve original fixed-lease companion identities before readiness and across endpoint refresh, resume automatic cleanup only after durable deletion admission, and validate current attachments across the full companion set before deletion; reject reassigned or replacement resources and verify every resource slot before completion. [PR 2733](https://github.com/openclaw/crabbox/pull/2733). Thanks @galiniliev.
- Azure: retain failed leases for salvage with durable holds that block reuse and deletion, including observation-only holds when the original local claim is lost; finalize holds explicitly after read-only verification of operator cleanup. [PR 2733](https://github.com/openclaw/crabbox/pull/2733). Thanks @galiniliev.
- Azure: report fixed-lease capacity rejections as settled only after exact companion cleanup and local claim removal. [PR 2733](https://github.com/openclaw/crabbox/pull/2733). Thanks @galiniliev.
- Cloudflare: retain cleanup alarms after container destruction fails and retry terminal leases before reporting stopped or expired status. [PR 2735](https://github.com/openclaw/crabbox/pull/2735).
- Warmup: report definitive coordinator quota rejection in timing output while preserving recovery for interrupted or ambiguous creation. [PR 2732](https://github.com/openclaw/crabbox/pull/2732). [Issue 2731](https://github.com/openclaw/crabbox/issues/2731). Thanks @shakkernerd.
- Scaleway: create fixed leases from public images without snapshot access, recover the exact server after lost responses, and revalidate root-disk attempt ownership before cleanup. [PR 2728](https://github.com/openclaw/crabbox/pull/2728).

## 0.72.0 - 2026-10-06

### Highlights

- **Start cached Cloudflare containers in about 1–2 seconds, then checkpoint and fork them.** Native container execution speeds up startup, while checkpoints capture reusable workspaces and forks start new leases from them. [PR 2625](https://github.com/openclaw/crabbox/pull/2625), [PR 2713](https://github.com/openclaw/crabbox/pull/2713). Thanks @altaywtf.
- **Use class-sized AWS disks without a 400 GB image minimum.** The promoted eu-west-1 Linux developer image now has a 32 GB root snapshot, so `tiny` leases request 40 GB; a live lease reported a 38 GB root filesystem. [PR 2668](https://github.com/openclaw/crabbox/pull/2668), [PR 2704](https://github.com/openclaw/crabbox/pull/2704), [PR 2714](https://github.com/openclaw/crabbox/pull/2714).
- **Get clearer AWS acquisition and Windows readiness results.** Reclaimed instances fail promptly, recorded Windows leases use Windows readiness, and `--os windows-server:2022|2025` selects the server version explicitly. [PR 2721](https://github.com/openclaw/crabbox/pull/2721), [PR 2722](https://github.com/openclaw/crabbox/pull/2722), [PR 2720](https://github.com/openclaw/crabbox/pull/2720), [Issue 2716](https://github.com/openclaw/crabbox/issues/2716), [Issue 2715](https://github.com/openclaw/crabbox/issues/2715), [Issue 2717](https://github.com/openclaw/crabbox/issues/2717). Thanks @saftall.
- **Keep run output through transient coordinator append failures.** Atomic, idempotent event appends and bounded retries preserve event order and recover lost acknowledgements without duplicating output. [PR 2723](https://github.com/openclaw/crabbox/pull/2723), [Issue 1561](https://github.com/openclaw/crabbox/issues/1561).
- **Find the right on-demand computer and access workflow more easily.** The README, crabbox.sh home page, provider catalog, and desktop/VNC/browser guides now explain the current agent workflow and supported providers together. [PR 2697](https://github.com/openclaw/crabbox/pull/2697), [PR 2699](https://github.com/openclaw/crabbox/pull/2699), [PR 2698](https://github.com/openclaw/crabbox/pull/2698). Thanks @shakkernerd.

### Upgrade notes

- Stop kept Cloudflare leases before redeploying the runner: the one-time cutover deletes the old classes' Durable Object state. Then run `crabbox cleanup` to retire old claims and delete the six legacy container applications as described in [the Cloudflare upgrade guide](docs/providers/cloudflare.md). `--type basic` now maps to the higher-cost `standard-1` with a warning; `--type lite` is rejected because the bundled image cannot start on it. [PR 2625](https://github.com/openclaw/crabbox/pull/2625). Thanks @altaywtf.
- Explicit target or Windows-mode flags that contradict a recorded lease now fail before guest access. Remove the conflicting flags or select the lease's recorded platform; release-only resolution remains available for cleanup. [PR 2722](https://github.com/openclaw/crabbox/pull/2722), [Issue 2715](https://github.com/openclaw/crabbox/issues/2715). Thanks @saftall.
- Repository contributors must install the shared autoreview skill from `openclaw/agent-skills`; the repository no longer carries its own executable helper. Existing copy-mode consumers should reinstall to receive updates. [PR 2663](https://github.com/openclaw/crabbox/pull/2663). Thanks @vincentkoc.

### Added

- AWS Windows leases accept `--os windows-server:2022` or `windows-server:2025` (also `os` / `CRABBOX_OS`) in direct and brokered mode; the default remains Server 2022 and promoted Windows AMIs still win without a Windows selector. [PR 2720](https://github.com/openclaw/crabbox/pull/2720). [Issue 2717](https://github.com/openclaw/crabbox/issues/2717). Thanks @saftall.
- **Checkpoint and fork Cloudflare containers.** `crabbox checkpoint create` captures a running Cloudflare lease as a `cloudflare-container-snapshot` in about 8 seconds, and `checkpoint fork` starts new leases from it in seconds, retrying while a fresh snapshot propagates. Delegated-run providers can now implement native checkpoints through `DelegatedCheckpointBackend`. Cloudflare has no snapshot delete API; snapshots expire after 30 days and `checkpoint delete --local-only` removes the record. Cloudflare lease commands keep using the runner URL and workdir the lease was created with, and a create or fork whose runner response is lost keeps its claim so `status` and `stop` can still reach the container. Stopping a lease while it starts keeps it stopped; unresolved creates retain cleanup custody regardless of elapsed time or a temporary stopped status during snapshot retries, and retries reuse containers already started by concurrent requests. [PR 2713](https://github.com/openclaw/crabbox/pull/2713), [PR 2626](https://github.com/openclaw/crabbox/pull/2626). Thanks @altaywtf.
- Add optional vCPU and memory minimums for new AWS Linux leases while preserving existing class fallback behavior. [PR 2710](https://github.com/openclaw/crabbox/pull/2710). [Issue 2709](https://github.com/openclaw/crabbox/issues/2709). Thanks @shakkernerd.

### Changes

- Use one shared autoreview installation from `openclaw/agent-skills`; repository entrypoints receive upstream fixes without copied helpers or tests. [PR 2663](https://github.com/openclaw/crabbox/pull/2663). Thanks @vincentkoc.
- AWS Linux leases now get their class root-disk size (40 GB for `tiny` instead of 400 GB): the promoted eu-west-1 developer image was rebaked from stock Ubuntu with a 32 GB root. [PR 2668](https://github.com/openclaw/crabbox/pull/2668), [PR 2704](https://github.com/openclaw/crabbox/pull/2704), [PR 2714](https://github.com/openclaw/crabbox/pull/2714).
- **Cached Cloudflare containers start in about 1–2 seconds.** The `cloudflare` runner moves to the Containers `durable_object` scheduling policy: one Durable Object class starts each lease's image and instance type through `ctx.container`, commands and uploads use native `exec()`, and the in-container Go runner, six per-type classes, and `max_instances: 4` cap are gone. `--type basic` now uses `standard-1` with a warning, `--type lite` is rejected because the bundled image cannot start on it, `--cloudflare-image` selects a named runner image, canceled commands stop their process group, and a lease whose container stops ends instead of continuing in an empty workspace. Upgrading is a one-time cutover: stop kept leases first, because redeploying deletes the old classes' Durable Object state. [PR 2625](https://github.com/openclaw/crabbox/pull/2625). Thanks @altaywtf.
- Rewrite the README around on-demand computers for agents, with every supported provider listed. [PR 2697](https://github.com/openclaw/crabbox/pull/2697).
- Redesign the crabbox.sh home page around on-demand computers for agents, with a provider wall generated from the catalog, a new crab-in-a-box icon, and a tokenized visual system shared by the docs and Features pages. [PR 2699](https://github.com/openclaw/crabbox/pull/2699). Thanks @shakkernerd.
- Refresh the docs against the current CLI and provider catalog, including a single guide to desktop, VNC, browser and portal access. [PR 2698](https://github.com/openclaw/crabbox/pull/2698).

### Fixes

- Accept native Tenki SSH certificates on the first connection and during refresh by comparing the decoded session extension directly, while retaining key, signature, and expiry checks. [PR 2727](https://github.com/openclaw/crabbox/pull/2727).
- DigitalOcean: check size availability before creating resources and retain definite fixed-lease rejections as retryable, locally releasable attempts. [PR 2725](https://github.com/openclaw/crabbox/pull/2725).
- Scaleway: accept the same SSH public key after API comment normalization, allowing first fixed-lease acquisition and safe cleanup of stranded key-only attempts. [PR 2724](https://github.com/openclaw/crabbox/pull/2724).
- Boat (ASCII Box): release absent sandboxes without waiting for blocked background data purges, while preserving the purge operation ID in fixed-lease terminal receipts. [PR 2726](https://github.com/openclaw/crabbox/pull/2726).
- Probe resolved SSH leases with their recorded platform, preserve Linux bootstrap gates, and reject contradictory explicit target flags. [Issue 2715](https://github.com/openclaw/crabbox/issues/2715), [PR 2722](https://github.com/openclaw/crabbox/pull/2722), [PR 2718](https://github.com/openclaw/crabbox/pull/2718). Thanks @saftall.
- Fail AWS acquire promptly when EC2 terminates an instance or closes its Spot request during network, SSH, Windows, or coordinator SSM readiness, preserving the reclaim reason and existing cleanup ownership. [PR 2721](https://github.com/openclaw/crabbox/pull/2721), [Issue 2716](https://github.com/openclaw/crabbox/issues/2716). Thanks @saftall.
- Retry transient run-event append failures with stable IDs, atomic sequence updates, and bounded publication deadlines while preserving ordered output and capped queues. [PR 2723](https://github.com/openclaw/crabbox/pull/2723), [Issue 1561](https://github.com/openclaw/crabbox/issues/1561).
- Blacksmith Testbox: `run --id tbx_...` and stop read only the exact claim file instead of scanning every local claim. [PR 2719](https://github.com/openclaw/crabbox/pull/2719).
- Apply explicit lifecycle target flags before provider validation so Linux defaults cannot block macOS stop/release, pause/resume, list, or cleanup. [PR 2712](https://github.com/openclaw/crabbox/pull/2712), [Issue 2706](https://github.com/openclaw/crabbox/issues/2706). Thanks @coygeek.
- Stop coordinator alarm rearm loops from stale prewarm retries, clamped overdue work, and controller-owned wakes, with diagnostics and bounded backoff that survives concurrent heartbeats without postponing future deadlines. [PR 2711](https://github.com/openclaw/crabbox/pull/2711).
- Transfer only verified seeded-worktree deltas on POSIX SSH targets, prune exclusions from fresh verified seeds, include reverted and remote edits on reused leases, and witness rsync receivers directly so failed transfers do not strand a detached workspace guard. [PR 2707](https://github.com/openclaw/crabbox/pull/2707).
- Reject AWS developer-image mints outside the requested region and clean up failed unpromoted candidate checkpoints and snapshots while preserving promotion rollback. [PR 2704](https://github.com/openclaw/crabbox/pull/2704).
- Keep lease reads, heartbeats, and releases responsive during maintenance history discovery by releasing the lifecycle mutex and Cloudflare storage input gate while scanning candidates; retain fenced rereads before mutations. [PR 2705](https://github.com/openclaw/crabbox/pull/2705).
- Keep the homepage workload router's Copy button fully visible for short command snippets. [PR 2703](https://github.com/openclaw/crabbox/pull/2703). [Issue 2701](https://github.com/openclaw/crabbox/issues/2701). Thanks @shakkernerd.
- Advertise Scaleway's existing `fixed-lease-id` support in the provider catalog and enforce capability parity across registered backends. [PR 2702](https://github.com/openclaw/crabbox/pull/2702).

## 0.71.0 - 2026-10-04

### Highlights

- **Retry cloud allocations with the same lease ID.** RunPod, Scaleway, and Linode now support fixed idempotent lease IDs, and the provider catalog advertises support so orchestrators can check before creating a lease. [PR 2680](https://github.com/openclaw/crabbox/pull/2680), [PR 2684](https://github.com/openclaw/crabbox/pull/2684), [PR 2678](https://github.com/openclaw/crabbox/pull/2678), [PR 2674](https://github.com/openclaw/crabbox/pull/2674).
- **Get timely coordinator responses under load.** Lease creates that cannot start committing admission within 30 seconds return a retryable 503; provider deadlines, compact polling, and bounded history reads reduce stalls and memory pressure. [PR 2687](https://github.com/openclaw/crabbox/pull/2687), [PR 2689](https://github.com/openclaw/crabbox/pull/2689), [PR 2672](https://github.com/openclaw/crabbox/pull/2672), [PR 2671](https://github.com/openclaw/crabbox/pull/2671), [PR 2693](https://github.com/openclaw/crabbox/pull/2693), [PR 2695](https://github.com/openclaw/crabbox/pull/2695), [Issue 1561](https://github.com/openclaw/crabbox/issues/1561), [Issue 2694](https://github.com/openclaw/crabbox/issues/2694). Thanks @shakkernerd.
- **Spend less time scanning local claims.** Generated slugs avoid a full claim-directory scan, exact lease IDs use one-file lookups, ambiguous stop targets fail clearly, and resumable pruning removes eligible expired claims. [PR 2685](https://github.com/openclaw/crabbox/pull/2685).
- **Choose the CPU and memory your workload needs.** DigitalOcean, Scaleway, and Linode now map portable machine classes to distinct real sizes, with explicit native type overrides preserved. Review the higher-cost `standard` defaults below before upgrading. [PR 2676](https://github.com/openclaw/crabbox/pull/2676).

### Upgrade notes

- The `standard` class now selects larger, higher-cost machines: DigitalOcean `s-1vcpu-1gb` → `s-4vcpu-8gb`, Scaleway `DEV1-S` → `DEV1-L`, and Linode `g6-standard-1` → `g6-standard-4`. Keep the old size with `--type <old type>` or `class: tiny`; explicitly configured native types still take precedence. [PR 2676](https://github.com/openclaw/crabbox/pull/2676).
- Successful stop/release now triggers bounded daily pruning of expired E2B and sufficiently old Blacksmith Testbox local claims. Set `claims.autoPrune: false` or `CRABBOX_CLAIMS_AUTO_PRUNE=false` to retain them; recovery claims and provider resources remain protected. [PR 2685](https://github.com/openclaw/crabbox/pull/2685).
- Generated slugs now end in an eight-hex lease-ID suffix. Update scripts that assume the previous generated format; explicit `--slug` values retain their existing behavior. Ambiguous stop/release slugs now require an exact lease ID. [PR 2685](https://github.com/openclaw/crabbox/pull/2685).

### Added

- Support fixed idempotent RunPod lease IDs with account-bound replay, lost-create recovery, and durable stop receipts for fixed-lease orchestrators. [PR 2680](https://github.com/openclaw/crabbox/pull/2680).
- Support fixed idempotent Scaleway lease IDs with replay, journaled SSH-key and root-volume recovery, and terminal release receipts for fixed-lease orchestrators. [PR 2684](https://github.com/openclaw/crabbox/pull/2684).
- Support fixed idempotent Linode lease IDs with account-bound replay, lost-create recovery, and terminal stop receipts. [PR 2678](https://github.com/openclaw/crabbox/pull/2678).
- Advertise backend-derived `fixed-lease-id` support in the provider catalog so fixed-lease orchestrators can preflight caller-supplied lease IDs. [PR 2674](https://github.com/openclaw/crabbox/pull/2674).
- Add `claims prune` and resumable daily maintenance after successful stop/release for providers with proven remote expiry bounds (E2B, and Blacksmith Testbox past GitHub's 35-day run cap); preserve recovery claims, concurrent updates, and provider resources, with `claims.autoPrune` / `CRABBOX_CLAIMS_AUTO_PRUNE` opt-out. [PR 2685](https://github.com/openclaw/crabbox/pull/2685).
- Let the guarded AWS Linux image publisher bake a smaller root snapshot from stock Ubuntu with `linux_root_gb`, keeping candidate, baseline, and promoted proofs on normal sizing. [PR 2668](https://github.com/openclaw/crabbox/pull/2668).

### Changed

- Make `--class` select real machine sizes on DigitalOcean, Scaleway, and Linode, with CPU/RAM profiles and explicit type overrides preserved. The `standard` class mapping increases size and cost (DigitalOcean `s-1vcpu-1gb` → `s-4vcpu-8gb`, Scaleway `DEV1-S` → `DEV1-L`, Linode `g6-standard-1` → `g6-standard-4`); keep the old size with `--type <old type>` or `class: tiny`. [PR 2676](https://github.com/openclaw/crabbox/pull/2676).
- Avoid the local claim-directory scan before coordinator create by giving generated slugs an eight-hex ID suffix, use O(1) exact canonical lease-ID claim lookups, and make AWS/coordinator acquisition, core claim routing, and Testbox ownership scans cancellable. [PR 2685](https://github.com/openclaw/crabbox/pull/2685).
- Page coordinator CLI lists with compact summaries, bound slug lookup and durable admission memory, keep identity/list reads out of the lifecycle queue, and arm cleanup recovery before provider I/O; preserve legacy list and full inspect responses. [PR 2672](https://github.com/openclaw/crabbox/pull/2672).

### Fixes

- Bound runner synchronization history reads and pending writes while preserving complete stale responses, legacy identities, and retry behavior. [PR 2695](https://github.com/openclaw/crabbox/pull/2695), [Issue 2694](https://github.com/openclaw/crabbox/issues/2694). Thanks @shakkernerd.
- Prevent queued coordinator uploads from retaining every run log in memory, page run-event reads at storage, and return structured failures for interrupted event appends instead of uncaught Worker errors. [PR 2693](https://github.com/openclaw/crabbox/pull/2693).
- Buffer POSIX sync manifest writes, time out rsync only after I/O inactivity, and retain workspace-witness stop requests when interrupted transfers are still settling. [PR 2692](https://github.com/openclaw/crabbox/pull/2692).
- Return a retryable 503 when coordinator lease creates cannot begin committing admission within 30 seconds instead of hanging. [PR 2687](https://github.com/openclaw/crabbox/pull/2687); related [Issue 1561](https://github.com/openclaw/crabbox/issues/1561).
- Bound coordinator AWS, Azure, and Tailscale requests with retryable 503 deadlines, and verify Mac host ownership outside the coordinator lock, so stalled image or Mac host operations cannot indefinitely block queued lease creates. [PR 2689](https://github.com/openclaw/crabbox/pull/2689).
- Tolerate up to ±5 seconds of ASCII Box (Boat) create/read timestamp skew while preserving the original fixed-lease witness, and keep failed own creates inspectable and stoppable. [PR 2681](https://github.com/openclaw/crabbox/pull/2681).
- Report fleet, org, and owner lease headroom with the blocking cap in `capacity`, and identify fleet limits in allocation errors. [PR 2679](https://github.com/openclaw/crabbox/pull/2679).
- End interrupted coordinator provisioning waits on the first recovery tick, retain safe cleanup of uncertain cloud resources, and show the current attempt phase in lease diagnostics. [PR 2677](https://github.com/openclaw/crabbox/pull/2677).
- Refresh Tenki SSH gateway certificates before new connections so long-running commands retain workspace-owner renewal, collection, and cleanup access; report credential expiry when refresh fails. [PR 2675](https://github.com/openclaw/crabbox/pull/2675).
- Allow heartbeat and `status --wait` to renew owned direct fixed leases on DigitalOcean and Azure by validating the acquired account scope and exact resource identity. [PR 2673](https://github.com/openclaw/crabbox/pull/2673).
- Reject ambiguous local slugs before stop/release instead of selecting the first claim, and extend coordinator cancel-create recovery and final-attempt windows from 10 to 30 seconds each. [PR 2685](https://github.com/openclaw/crabbox/pull/2685).
- Bound coordinator lease-list memory as retained history grows, preserving visibility, filters, and result ordering. [PR 2671](https://github.com/openclaw/crabbox/pull/2671), [Issue 1561](https://github.com/openclaw/crabbox/issues/1561). Thanks @shakkernerd.
- Retain Blacksmith Testbox claims and keys until the exact associated GitHub work settles, and report exact native queue and terminal status. [PR 2670](https://github.com/openclaw/crabbox/pull/2670), [Issue 2669](https://github.com/openclaw/crabbox/issues/2669). Thanks @shakkernerd.
- Authenticate hosted Homebrew verifier metadata reads with the workflow's read-only token to avoid anonymous GitHub API rate limits while keeping installation credential-free. [PR 2665](https://github.com/openclaw/crabbox/pull/2665).
- Retry dropped connections in release asset downloads during public release and Homebrew verification instead of failing on one transient network error. [PR 2667](https://github.com/openclaw/crabbox/pull/2667).
- Expose the exact Blacksmith workflow association and verified remote settlement through read-only status, including after local claim finalization. [PR 2683](https://github.com/openclaw/crabbox/pull/2683), [Issue 2682](https://github.com/openclaw/crabbox/issues/2682). Thanks @shakkernerd.

### Credits

- Thanks @shakkernerd for [PR 2650](https://github.com/openclaw/crabbox/pull/2650) (cold Actions hydration from GitHub SSH checkouts) and [PR 2651](https://github.com/openclaw/crabbox/pull/2651) (AWS SSH access refresh over IPv4), which shipped in 0.70.0 without the thanks in its notes.

## 0.70.0 - 2026-10-01

### Highlights

- **Use less storage for small cloud leases.** Automatic AWS/GCP root disks now scale from 40 GB for `tiny` to 400 GB for `beast`, raised to the image or snapshot minimum. Explicit sizes still win; the current promoted AWS AMI still requires 400 GB. [PR 2632](https://github.com/openclaw/crabbox/pull/2632).
- **Skip repeated GCP image lookups.** The coordinator caches image and snapshot minimums for up to 30 minutes, removing that metadata round trip from warm creates and invalidating cached ingress verification when metadata requests fail. [PR 2633](https://github.com/openclaw/crabbox/pull/2633), [PR 2634](https://github.com/openclaw/crabbox/pull/2634).
- **Start Hetzner desktops and browsers again.** Oversized bootstrap configurations fit the provider's 32 KiB limit, and package hooks no longer restart cloud-init midway through Ubuntu 26.04 setup. [PR 2637](https://github.com/openclaw/crabbox/pull/2637), [PR 2647](https://github.com/openclaw/crabbox/pull/2647).
- **Keep long runs alive through a lost renewal response.** Bounded workspace-owner retries prevent a single transport failure from ending a healthy run with exit 7, while explicit ownership denials still stop it. File copies and tunnels also try every candidate SSH port. [PR 2653](https://github.com/openclaw/crabbox/pull/2653), [PR 2641](https://github.com/openclaw/crabbox/pull/2641), [PR 2642](https://github.com/openclaw/crabbox/pull/2642), [Issue 1712](https://github.com/openclaw/crabbox/issues/1712). Thanks @youssef-tharwat.
- **Retry Apple Container allocations with the same lease ID.** Caller-supplied IDs support verified replay, interrupted-start recovery, and terminal release receipts. [PR 2654](https://github.com/openclaw/crabbox/pull/2654), [PR 2644](https://github.com/openclaw/crabbox/pull/2644), [Issue 2643](https://github.com/openclaw/crabbox/issues/2643). Thanks @genaro23.

### Upgrade notes

- Automatic AWS/GCP root disks are now 40/80/150/150/250/400 GB for `tiny`/`small`/`standard`/`fast`/`large`/`beast`, raised to the source minimum. Set `aws.rootGB: 400` or `CRABBOX_AWS_ROOT_GB=400`, and `gcp.rootGB: 400` or `CRABBOX_GCP_ROOT_GB=400`, to retain 400 GB. Automatic sizing requires image or snapshot metadata access and fails if that lookup fails; positive explicit sizes bypass it. Older clients still request 400 GB, ready-pool leases retain their disks, and GCP machine-image restores inherit their original disks. [PR 2632](https://github.com/openclaw/crabbox/pull/2632).
- GCP image-family aliases can retain the inspected image for the coordinator cache's 30-minute window. Relevant provider errors invalidate the cached source hints. [PR 2633](https://github.com/openclaw/crabbox/pull/2633).
- Workspace-owner transport retries extend the ownership TTL by two transport-call budgets, so recovery of an abandoned workspace can take longer. Explicit denial responses and exhausted ownership windows remain terminal. [PR 2653](https://github.com/openclaw/crabbox/pull/2653), [PR 2641](https://github.com/openclaw/crabbox/pull/2641). Thanks @youssef-tharwat.

### Added

- Support caller-supplied Apple Container lease IDs with verified replay, recovery of interrupted startup, and terminal release receipts. [PR 2654](https://github.com/openclaw/crabbox/pull/2654), [PR 2644](https://github.com/openclaw/crabbox/pull/2644), [Issue 2643](https://github.com/openclaw/crabbox/issues/2643). Thanks @genaro23.

### Changed

- Scale automatic AWS/GCP root disks by lease class (40/80/150/150/250/400 GB), raised to the source image or snapshot minimum; explicit sizes retain their existing behavior. [PR 2632](https://github.com/openclaw/crabbox/pull/2632).
- Cache GCP root-disk source minimums in coordinator memory for up to 30 minutes and expose lookup time as `gcp.image_minimum`, removing repeated image reads before warm creates while preserving explicit-size bypass. [PR 2633](https://github.com/openclaw/crabbox/pull/2633).

### Fixes

- Let `cp` and `tunnel` try every candidate SSH port when the post-claim endpoint probe cannot create a session for the first one, and warn with each candidate's failure when none answers. [PR 2642](https://github.com/openclaw/crabbox/pull/2642). Thanks @youssef-tharwat.
- Seed public GitHub SSH origins through anonymous HTTPS before local Actions hydration, preventing cold workspace Git-root adoption failures. [PR 2650](https://github.com/openclaw/crabbox/pull/2650), [Issue 2649](https://github.com/openclaw/crabbox/issues/2649).
- Classify missing Unix daemon sockets as network failures in `doctor`, preserving endpoint guidance instead of incorrectly recommending CLI installation. [PR 2652](https://github.com/openclaw/crabbox/pull/2652).
- Prevent bootstrap package hooks from restarting cloud-init between stages, which leaves Hetzner Ubuntu 26.04 desktop and browser leases waiting indefinitely for readiness. [PR 2647](https://github.com/openclaw/crabbox/pull/2647).
- Preserve non-UTF-8 POSIX filenames and symlink targets during cold tar sync instead of failing extraction on bsdtar targets. [PR 2636](https://github.com/openclaw/crabbox/pull/2636).
- Stage remote failure archives on the workspace disk so small `/tmp` filesystems on tiny Linux boxes do not prevent collecting failure evidence. [PR 2638](https://github.com/openclaw/crabbox/pull/2638).
- Compress oversized Hetzner cloud-init into a gzip MIME envelope so desktop and browser leases fit the provider's 32 KiB user-data limit without changing bootstrap ordering. [PR 2637](https://github.com/openclaw/crabbox/pull/2637).
- Use `connect` in interactive-shell quickstart and troubleshooting examples so copied commands open the box instead of only printing an SSH command. [PR 2635](https://github.com/openclaw/crabbox/pull/2635).
- Let Actions hydration start directly after warmup even when the guest's Bash logout hook fails; missing-workspace fingerprint cleanup no longer invokes that hook. [PR 2639](https://github.com/openclaw/crabbox/pull/2639).
- Point generated `actions.workflow` at the custom `init --workflow` path. [PR 2624](https://github.com/openclaw/crabbox/pull/2624). Thanks @KrasimirKralev.
- Print empty JSON inventories as `[]` (or `{}` for object-shaped provider lists) instead of `null` across lease lists, events, history, ready pools, cache volumes, provider sizes, ports, and admin inventories. [PR 2631](https://github.com/openclaw/crabbox/pull/2631).
- Release a pressed macOS VNC key when `desktop type` or `desktop paste` is cancelled between its key-down and key-up; Screen Sharing otherwise kept it held after disconnect. [PR 2630](https://github.com/openclaw/crabbox/pull/2630), [PR 2628](https://github.com/openclaw/crabbox/pull/2628), [Issue 2627](https://github.com/openclaw/crabbox/issues/2627). Thanks @altaywtf for the fix and @saariuslystoned for the report.
- Invalidate cached GCP firewall verification when root-image or snapshot metadata requests fail, so the next create rechecks the managed ingress policy. [PR 2634](https://github.com/openclaw/crabbox/pull/2634).
- Prefer IPv4 for AWS coordinator connections so heartbeats refresh the source used by public SSH, while preserving IPv6 fallback and configured proxies. [PR 2651](https://github.com/openclaw/crabbox/pull/2651), [Issue 2648](https://github.com/openclaw/crabbox/issues/2648).
- Keep long runs alive across bounded workspace-owner renewal transport failures while preserving fail-closed token and expiry checks. [PR 2653](https://github.com/openclaw/crabbox/pull/2653), [PR 2641](https://github.com/openclaw/crabbox/pull/2641), [Issue 1712](https://github.com/openclaw/crabbox/issues/1712). Thanks @youssef-tharwat.
- Correct the Hetzner provider documentation to describe the existing Ubuntu 26.04 image mapping. [PR 2640](https://github.com/openclaw/crabbox/pull/2640).
- Extract release-verifier source archives from files so bsdtar closing its input early cannot interrupt verification with a broken pipe. [PR 2622](https://github.com/openclaw/crabbox/pull/2622).

## 0.69.0 - 2026-09-29

### Highlights

- **Keep commands and files in the intended repository.** Retained Actions workspaces must prove their Git root and origin before reuse, closing cross-repository command execution and file transfer even with `--no-sync --no-hydrate`. Explicit cross-repository hydration keeps claim-bound consent. [PR 2605](https://github.com/openclaw/crabbox/pull/2605), [PR 2564](https://github.com/openclaw/crabbox/pull/2564). Thanks @vincentkoc.
- **Spend less time preparing brokered cloud leases.** GCP skips unchanged firewall updates, shares OAuth tokens, and reuses exact firewall checks for five minutes; AWS skips redundant SSH ingress mutations and caches VPC discovery. Fresh Hetzner lease keys avoid full key inventories, and successful AWS Spot/Hetzner price quotes are cached for five minutes. [PR 2610](https://github.com/openclaw/crabbox/pull/2610), [PR 2614](https://github.com/openclaw/crabbox/pull/2614), [PR 2609](https://github.com/openclaw/crabbox/pull/2609), [PR 2611](https://github.com/openclaw/crabbox/pull/2611).
- **Get clear failures without losing cleanup or logs.** Definite capacity rejections stop recovery and cancellation, ambiguous AWS allocations retain cleanup custody, completed runs keep logs after lost commit acknowledgements, and coordinator stop cleanup uses the lease's SSH identity. [PR 2616](https://github.com/openclaw/crabbox/pull/2616), [PR 2604](https://github.com/openclaw/crabbox/pull/2604), [Issue 1561](https://github.com/openclaw/crabbox/issues/1561), [PR 2617](https://github.com/openclaw/crabbox/pull/2617).
- **Start Parallels macOS guests more reliably.** Apple silicon defaults to full clones unless a snapshot selects linked mode, and guest preparation waits for a working Tools execution session within the startup deadline. Linked-clone warnings and Local Network diagnostics explain common failure paths. [PR 2606](https://github.com/openclaw/crabbox/pull/2606), [PR 2615](https://github.com/openclaw/crabbox/pull/2615), [Issue 2398](https://github.com/openclaw/crabbox/issues/2398), [Issue 2612](https://github.com/openclaw/crabbox/issues/2612). Thanks @saariuslystoned.
- **See where lease creation time goes.** Lease events and timing JSON now expose bounded coordinator admission and provider-preparation step durations, repeated calls, and failures without provider payloads. [PR 2607](https://github.com/openclaw/crabbox/pull/2607).
- **Use compatible GCP boot disks and build the Node coordinator again.** GCP chooses the boot disk type for each machine family and falls back on disk incompatibility; the Node image pins the updated AWS RDS CA bundle, including me-west-1 roots. [PR 2608](https://github.com/openclaw/crabbox/pull/2608), [PR 2618](https://github.com/openclaw/crabbox/pull/2618).

### Upgrade notes

- Parallels macOS guests on Apple silicon now default to `full` clones when no snapshot is selected. To keep linked cloning, use `--parallels-clone-mode linked` or `parallels.cloneMode: linked`; an existing snapshot name or ID also preserves the linked default. Full clones use the source VM's current state and require snapshot selectors to be cleared. [PR 2606](https://github.com/openclaw/crabbox/pull/2606), [PR 2615](https://github.com/openclaw/crabbox/pull/2615), [Issue 2398](https://github.com/openclaw/crabbox/issues/2398), [Issue 2612](https://github.com/openclaw/crabbox/issues/2612). Thanks @saariuslystoned.
- The coordinator caches exact GCP managed-firewall verification for up to five minutes. External firewall drift can go unnoticed during that window; the next uncached create reconciles it. Policy changes, credential rotation, and relevant provider errors invalidate reuse. [PR 2614](https://github.com/openclaw/crabbox/pull/2614).
- Definite coordinator create failures with no possible provider resource return `422 provisioning_failed`, including matching bound replays. Clients should treat that exact status/code as terminal; ambiguous allocation outcomes retain recovery and cleanup custody. [PR 2608](https://github.com/openclaw/crabbox/pull/2608), [PR 2616](https://github.com/openclaw/crabbox/pull/2616).

### Added

- Expose bounded coordinator admission and provider preparation step durations in lease creation events and timing JSON, including repeated-call and failure counts without provider payloads. [PR 2607](https://github.com/openclaw/crabbox/pull/2607).

### Changed

- Reuse exact coordinator GCP firewall verifications for five minutes with policy/credential isolation and error invalidation, and separate Compute request timings from token acquisition. [PR 2614](https://github.com/openclaw/crabbox/pull/2614).
- Avoid full Hetzner SSH-key inventory reads for fresh lease keys and cache successful coordinator AWS Spot/Hetzner price estimates for five minutes without blocking admission on quote failures. [PR 2611](https://github.com/openclaw/crabbox/pull/2611).
- Skip redundant brokered AWS SSH ingress mutations and cache account/region-scoped VPC discovery while preserving fresh policy checks and legacy world-rule cleanup. [PR 2609](https://github.com/openclaw/crabbox/pull/2609).
- Skip unchanged brokered GCP firewall updates and reuse coordinator OAuth tokens until their existing refresh margin, preserving drift reconciliation and credential isolation. [PR 2610](https://github.com/openclaw/crabbox/pull/2610).

### Fixes

- Verify retained Actions workspace identity before run, sync, cache warm, or editor handoff; preserve custom paths and explicit cross-repository hydration with claim-bound consent. [PR 2605](https://github.com/openclaw/crabbox/pull/2605), [PR 2564](https://github.com/openclaw/crabbox/pull/2564). Thanks @vincentkoc.
- Prepare the lease's SSH key and authoritative host-key pin before best-effort coordinator stop cleanup, so the Actions hydration stop marker and egress client cleanup no longer fail host verification; preparation failures warn without blocking provider release. [PR 2617](https://github.com/openclaw/crabbox/pull/2617).
- Preserve definite provider rejection diagnostics on coordinator create replays and stop client recovery without cancellation; ambiguous public AWS allocations retain cleanup custody and cannot fall back to another candidate or region. [PR 2616](https://github.com/openclaw/crabbox/pull/2616).
- Preserve run-history logs after an ambiguous terminal commit, confirming the exact stored finish before acknowledging recovery and retaining evidence when rereads fail. [PR 2604](https://github.com/openclaw/crabbox/pull/2604), [Issue 1561](https://github.com/openclaw/crabbox/issues/1561).
- Select GCP boot disks by machine family, using Hyperdisk Balanced for Hyperdisk-only families and `pd-balanced` elsewhere; fall back on disk/machine incompatibilities and reject image-strategy checkpoints of Hyperdisk leases with guidance to use disk snapshots. [PR 2608](https://github.com/openclaw/crabbox/pull/2608).
- Return `422 provisioning_failed` with attempt diagnostics when a coordinator create definitively failed with no possible provider resource, instead of an HTTP 500 that clients replayed as uncertain. [PR 2608](https://github.com/openclaw/crabbox/pull/2608).
- Pin the current AWS RDS global CA bundle in the Node coordinator image, including the me-west-1 root CAs, fixing image builds broken by the stale checksum. [PR 2618](https://github.com/openclaw/crabbox/pull/2618).
- Bound Parallels guest-exec readiness and macOS preparation retries, preserve linked clones for unset mode with snapshot selectors, and diagnose macOS host network access. Clarify the existing retention contract: `--keep-on-failure` starts after acquisition; generated-ID acquisition failures roll back, while fixed IDs retain their replay/cleanup contract. [PR 2615](https://github.com/openclaw/crabbox/pull/2615), [Issue 2612](https://github.com/openclaw/crabbox/issues/2612). Thanks @saariuslystoned.
- Default Parallels macOS guests on Apple silicon to full clones without snapshot selectors, warn before linked macOS clones about observed IP/Tools failures, and clarify snapshot-clearing guidance while retaining linked defaults elsewhere. [PR 2606](https://github.com/openclaw/crabbox/pull/2606), [PR 2615](https://github.com/openclaw/crabbox/pull/2615), [Issue 2398](https://github.com/openclaw/crabbox/issues/2398). Thanks @saariuslystoned.
- Return precise diagnostics and `native_unsupported` JSON receipts when checkpoint capability resolution refuses capture, and reject invalid modes before lease resolution. [PR 2613](https://github.com/openclaw/crabbox/pull/2613).

## 0.68.0 - 2026-09-28

### Highlights

- **Reach a usable Linux workspace sooner.** Minimal bootstrap can finish before unrelated services reach multi-user.target. In two guest-boot replay samples per variant, median readiness fell from 19.0 to 12.7 seconds on AWS, 28.3 to 15.8 seconds on GCP, and 32.2 to 28.7 seconds on Hetzner; these measure guest boot, not end-to-end creation. [PR 2595](https://github.com/openclaw/crabbox/pull/2595).
- **Detect readiness without repeated SSH sessions.** Bounded guest-side polling and AWS's current-boot marker reduced median AWS readiness lag from 10.4 to 2.1 seconds and command wall time from 70.7 to 61.6 seconds across three interleaved pairs. Legacy guests and optional setup retain their completion gates. [PR 2600](https://github.com/openclaw/crabbox/pull/2600).
- **Spend less time synchronizing cloud workspaces.** Reusing the workspace-owner SSH connection improved all 12 cloud repository sync pairs; the unchanged-repository median fell from 10.9 to 7.5 seconds. For an empty workspace with Git seeding and overlays disabled, streaming tar reduced the 20,002-file cold-sync median from 18.7 to 13.2 seconds across three pairs on one AWS lease. [PR 2593](https://github.com/openclaw/crabbox/pull/2593), [PR 2592](https://github.com/openclaw/crabbox/pull/2592).
- **Keep the idle window after a slow create and reach Azure capacity sooner.** Managed idle expiry starts when the lease becomes active, while the hard TTL still starts at admission. Azure checks SKU eligibility before network allocation and reaches other configured regions after one capacity failure per market. [PR 2596](https://github.com/openclaw/crabbox/pull/2596), [PR 2587](https://github.com/openclaw/crabbox/pull/2587).
- **See where creation time goes and control sync compression.** Lease events and Linux timing JSON expose creation milestones with clock provenance; explicit compression overrides support link-specific tuning while keeping the compressed default. [PR 2588](https://github.com/openclaw/crabbox/pull/2588), [PR 2591](https://github.com/openclaw/crabbox/pull/2591).
- **Build Rust and Python-tool projects from prepared Linux images.** The x86_64 developer-image recipe includes checksum-pinned Rust/Cargo and uv/uvx with nonroot offline functional checks; image qualification also preserves smoke results when login-shell logout hooks fail. [PR 2584](https://github.com/openclaw/crabbox/pull/2584), [PR 2585](https://github.com/openclaw/crabbox/pull/2585). Thanks @vincentkoc.

### Upgrade notes

- Hetzner's default `ubuntu:26.04` selector now selects the published Ubuntu 26.04 image instead of Ubuntu 24.04. Choose `ubuntu:24.04` explicitly to retain the older OS; custom image choices remain unchanged. Brokered defaults require the updated coordinator, and direct selection requires the updated CLI. [PR 2599](https://github.com/openclaw/crabbox/pull/2599).
- The broker client create wait is now 31 minutes, including Azure Linux requests that previously used a ten-minute wait. Caller cancellation and earlier deadlines still win; lease TTL remains admission-based even though idle expiry starts at activation. [PR 2596](https://github.com/openclaw/crabbox/pull/2596).

### Added

- Expose brokered creation observations in lease events and Linux timing JSON, with clock provenance for admission, provider requests, SSH, and current-boot readiness. [PR 2588](https://github.com/openclaw/crabbox/pull/2588).
- Allow explicit `sync.compression` and `CRABBOX_SYNC_COMPRESSION` overrides while retaining compression by default on every link. [PR 2591](https://github.com/openclaw/crabbox/pull/2591).
- Include checksum-pinned Rust/Cargo and uv/uvx in Linux x86_64 developer images, with nonroot offline build and Python-tool smoke checks. [PR 2584](https://github.com/openclaw/crabbox/pull/2584). Thanks @vincentkoc.

### Changed

- Detect Linux bootstrap completion within one authenticated SSH session with bounded guest-side readiness polling; require AWS's per-boot workspace-ready marker on new guests while retaining cloud-init waits for legacy guests and optional setup gates. [PR 2600](https://github.com/openclaw/crabbox/pull/2600).
- Start minimal Linux lease bootstrap before multi-user.target, avoid SSH restarts when configured listeners are already active, and retain readiness checks and optional setup gates. [PR 2595](https://github.com/openclaw/crabbox/pull/2595).
- Route ordinary brokered Azure capacity fallback across regions after one capacity failure per market, cache confirmed rejections for five minutes, expose attempt durations, and bound legacy creation to 25 minutes with a 31-minute broker client wait. [PR 2596](https://github.com/openclaw/crabbox/pull/2596).
- Detect newly ready guests sooner with short initial SSH readiness retries and a bounded five-second backoff, preserving host trust, authentication, cancellation, and bootstrap checks. [PR 2586](https://github.com/openclaw/crabbox/pull/2586).
- Preflight brokered Azure VM SKU eligibility before allocating network fragments and reduce create polling delays while honoring per-response Retry-After and preserving exact cleanup. [PR 2587](https://github.com/openclaw/crabbox/pull/2587).
- Reuse a private foreground SSH connection for direct POSIX workspace ownership checks, with complete stdin-frame validation and joined cleanup after acquisition failure, cancellation, and release. [PR 2593](https://github.com/openclaw/crabbox/pull/2593).
- Stream the first transfer into an empty POSIX workspace over one tar SSH channel when Git seeding and overlays are disabled, retaining manifest scope, metadata, ownership checks, pruning, and finalization; nonempty workspaces and Git fallback paths keep rsync. [PR 2592](https://github.com/openclaw/crabbox/pull/2592).
- Detect brokered AWS and GCP network addresses sooner with bounded exponential polling, retaining provider error handling and existing deadlines. [PR 2590](https://github.com/openclaw/crabbox/pull/2590).
- Skip baseline APT work on stock Linux images only when every required tool passes existing capability probes; retain package installation, readiness repair, and per-lease SSH setup when needed. [PR 2589](https://github.com/openclaw/crabbox/pull/2589).

### Fixes

- Map Hetzner's default `ubuntu:26.04` selector to the publicly available `ubuntu-26.04` image, preserving explicit Ubuntu 24.04 and custom image choices. [PR 2599](https://github.com/openclaw/crabbox/pull/2599).
- Start managed lease idle expiry at activation across providers, preserving the admission-based TTL cap so slow provisioning cannot consume the idle window. [PR 2596](https://github.com/openclaw/crabbox/pull/2596).
- Preserve Linux smoke and cleanup exit status when login-shell logout hooks fail during image minting or retained-image qualification. [PR 2585](https://github.com/openclaw/crabbox/pull/2585). Thanks @vincentkoc.

## 0.67.0 - 2026-09-26

### Highlights

- **Power lab hosts only when work needs them.** Static SSH power hooks start a dedicated host before its first lease and shut it down after the last lease, retaining retryable custody if shutdown fails; the explicit dedicated-host contract keeps power control with one controller.
- **Use Proxmox through a runtime adapter with safer lease recovery.** `adapter serve` now supports fixed-ID Linux workspaces; VMID reservations skip locally bound IDs and are serialized through durable publication to prevent concurrent collisions. Definite native pre-allocation 401/403 rejections free the attempt, while proxy-generated 403s and other ambiguous replies retain custody.
- **Keep forwarded environment values out of command lines.** SSH commands, preflight, Windows/WSL2, and cache warming receive values through private temporary files over stdin; unsupported NUL values are rejected by variable name, and checkpoint archives exclude staged environment files left by interrupted cleanup.
- **Recover coordinator failures without duplicate allocations or lost leases.** Atomic lease admission and publication, exact rereads after ambiguous commits, and provider-owned failure facts preserve recovery authority; Azure leases settle after definite VM rejection and verified companion cleanup. Kept warmed leases also honor recorded idle/TTL expiry where automatic reaping is supported.
- **Use Azure GA ephemeral disks and managed identities.** Eligible VMs can use ephemeral OS disks with full caching, while managed disks remain the default; direct VMs can attach an existing user-assigned managed identity and verify it before fixed-lease readiness.
- **Spend less time preparing sync snapshots.** On a shared Apple M3 Ultra, unchanged-fixture median snapshot preparation fell from 5.195 s to 2.698 s for a realistic repository and from 48.547 s to 25.378 s for 20,002 files. The local Git-seed path uses 17 Git calls instead of 50 and reads 25% fewer logical source bytes while retaining independent content verification.
- **Run more reliably across local and hosted targets.** SSH workspace locks work with BusyBox `flock`, Blacksmith joins canceled sync children and closes native SSH masters before returning, and WSL2 static targets support non-administrator Windows accounts. Parallels IP discovery stops admitting probes at its deadline and preserves the latest VM-query error instead of giving stale recovery advice.

### Upgrade notes

- Replace `azure.osDisk: ephemeral-preview`, `--azure-os-disk ephemeral-preview`, and `CRABBOX_AZURE_OS_DISK=ephemeral-preview` with `ephemeral`, including coordinator environment settings. GA full caching requires at least 8 active vCPUs, a supported family (N/L/M/H, D/DC/E/Eb/EC v5-v7, or F v6-v7), and sufficient local storage; existing `ephemeral` settings now use full caching, so smaller VMs and Fsv2 no longer qualify. `managed` remains the default and the option for smaller VMs or native checkpoints; released CLIs sending the removed value to an updated coordinator receive HTTP 400 before allocation. [PR 2565](https://github.com/openclaw/crabbox/pull/2565), [PR 2567](https://github.com/openclaw/crabbox/pull/2567). Thanks @jwmoss.
- Static SSH power hooks require `static.power.dedicated: true` in trusted user configuration, exclusive host ownership by one controller/state directory, a canonical IP, explicit SSH credentials, and absolute hook executable paths. Preserve the claims and `ssh-power` state until shutdown completes; use distinct static IDs for concurrent leases, and do not use prepared `run --id` reuse while power custody remains. [PR 2545](https://github.com/openclaw/crabbox/pull/2545), [PR 2576](https://github.com/openclaw/crabbox/pull/2576). Thanks @altaywtf.
- `warmup.keep` is a new configuration key and still defaults to `true`; retention across runs no longer exempts kept warmups from recorded idle/TTL expiry where automatic reaping is available. Recreate existing direct GCP guests to install the updated expiry guard, and ensure their service account can delete the VM. Manual `cleanup` still skips kept machines; for providers without an automatic idle reaper, use `warmup.keep: false` with scheduled cleanup or stop explicitly. Tenki retains its documented sticky-lease exception. [Issue 2536](https://github.com/openclaw/crabbox/issues/2536), [PR 2553](https://github.com/openclaw/crabbox/pull/2553). Thanks @youssef-tharwat for the report.
- Drain Proxmox adapter workspaces under their original configuration before changing the token ID, endpoint, node, or clone settings; rotating only the token secret is supported. For older prepared claims left by definite clone rejection, restore permissions and use checked `stop --force` recovery only after inspecting the task and VM; keep claims after ambiguous proxy responses. [PR 2577](https://github.com/openclaw/crabbox/pull/2577), [PR 2562](https://github.com/openclaw/crabbox/pull/2562), [PR 2566](https://github.com/openclaw/crabbox/pull/2566), [PR 2570](https://github.com/openclaw/crabbox/pull/2570). Thanks @ahkohd.
- SSH command environment values containing NUL now fail before upload; remove the NUL or pass binary data as a file instead. Empty and multiline values remain supported. [PR 2573](https://github.com/openclaw/crabbox/pull/2573).
- Daytona API-key fixed acquisition now requires `organizationId` from `/api-keys/current`; older deployments must update that endpoint or use an OAuth organization profile. Existing saved claims remain supported. [PR 2574](https://github.com/openclaw/crabbox/pull/2574). Thanks @Patrick-Erichsen.
- Ordinary Blacksmith Testbox runs now require macOS/Linux process-group support and compatible `ps`, matching artifact runs; unsupported controllers fail before acquiring a lease. [PR 2547](https://github.com/openclaw/crabbox/pull/2547).

### Added

- Power dedicated static SSH hosts on for their first lease and off after the last, with durable host references, retryable shutdown, and joined hook cancellation. [Issue 2544](https://github.com/openclaw/crabbox/issues/2544), [PR 2545](https://github.com/openclaw/crabbox/pull/2545), [PR 2576](https://github.com/openclaw/crabbox/pull/2576). Thanks @altaywtf.
- Run Proxmox fixed-ID Linux workspaces behind `adapter serve`, with immutable routing and token-identity scopes, secret rotation, and exact registered cleanup receipts so deleted VMs do not leave workspaces stuck stopping. [Issue 2558](https://github.com/openclaw/crabbox/issues/2558), [PR 2560](https://github.com/openclaw/crabbox/pull/2560), [PR 2577](https://github.com/openclaw/crabbox/pull/2577). Thanks @ahkohd.
- Attach an existing user-assigned managed identity to direct Azure VMs with `azure.userAssignedIdentityResourceId` or `--azure-user-assigned-identity-resource-id`, verifying attachment before fixed-lease readiness or adoption. To add an identity to an existing fixed lease, stop it and allocate a replacement with a new lease ID. [PR 2575](https://github.com/openclaw/crabbox/pull/2575). Thanks @galiniliev.

### Fixes

- Keep allowlisted SSH environment values out of command lines and workspace-owner launchers using private temporary files delivered over stdin, including preflight, Windows/WSL2, and cache warming; reject NUL-containing values by variable name and refuse remote cleanup after workspace ownership renewal fails. [Issue 2535](https://github.com/openclaw/crabbox/issues/2535), [PR 2556](https://github.com/openclaw/crabbox/pull/2556), [PR 2573](https://github.com/openclaw/crabbox/pull/2573). Thanks @youssef-tharwat for the report.
- Exclude staged SSH command environment files left by interrupted cleanup from workspace checkpoint archives. [PR 2569](https://github.com/openclaw/crabbox/pull/2569).
- Reserve Proxmox VMIDs without colliding with live local bindings or concurrent local acquisitions, checking alternatives against cluster inventory and holding the reservation fence through durable claim publication. [Issue 2559](https://github.com/openclaw/crabbox/issues/2559), [PR 2566](https://github.com/openclaw/crabbox/pull/2566), [PR 2571](https://github.com/openclaw/crabbox/pull/2571). Thanks @ahkohd.
- Retire Proxmox prepared claims after definite native pre-allocation authorization rejection and support checked `stop --force` recovery for absent, unbound attempts; retain custody after proxy-generated, task-bearing, or otherwise ambiguous 401/403 responses. [Issue 2559](https://github.com/openclaw/crabbox/issues/2559), [PR 2562](https://github.com/openclaw/crabbox/pull/2562), [PR 2570](https://github.com/openclaw/crabbox/pull/2570). Thanks @ahkohd.
- Commit legacy coordinator lease admission and publication atomically and resolve ambiguous commits through exact bound-record rereads, avoiding duplicate provisioning while preserving cancellation and cleanup authority. [Issue 1561](https://github.com/openclaw/crabbox/issues/1561), [PR 2555](https://github.com/openclaw/crabbox/pull/2555).
- Retain unresolved coordinator allocations after cancellation without a cloud ID, using provider-owned provisioning-failure facts while core owns recovery timing. Settle Azure leases only after definite VM rejection and verified companion cleanup, preserve uncertainty across mixed fallback failures, and explain scheduled cleanup retries in `stop`. [PR 2478](https://github.com/openclaw/crabbox/pull/2478), [PR 2552](https://github.com/openclaw/crabbox/pull/2552), [PR 2578](https://github.com/openclaw/crabbox/pull/2578). Thanks @steipete.
- Allow Azure fixed-lease `stop --force` to finish retained claims after external cleanup, verifying VM and companion absence with read-only checks and preserving interrupted recovery for retry. [PR 2572](https://github.com/openclaw/crabbox/pull/2572). Thanks @galiniliev.
- Honor recorded idle/TTL expiry for kept direct cloud warmups, including the GCP guest expiry guard, and add `warmup.keep` without changing the retention default or manual cleanup protection. [Issue 2536](https://github.com/openclaw/crabbox/issues/2536), [PR 2553](https://github.com/openclaw/crabbox/pull/2553). Thanks @youssef-tharwat for the report.
- Support BusyBox `flock` for SSH workspace locks without mistaking its unsupported timed-wait option for workspace contention. [PR 2579](https://github.com/openclaw/crabbox/pull/2579).
- Finish Blacksmith sync-child cleanup before returning from canceled runs and disable detached native SSH masters for sync and artifact transfers, closing connections after successful, failed, or canceled runs. [PR 2547](https://github.com/openclaw/crabbox/pull/2547), [PR 2580](https://github.com/openclaw/crabbox/pull/2580).
- Support WSL2 static targets under non-administrator Windows accounts by removing WMI shell discovery and accepting read-only app-capability grants on HOME while keeping private staging ACLs strict. [Issue 2543](https://github.com/openclaw/crabbox/issues/2543), [PR 2546](https://github.com/openclaw/crabbox/pull/2546), [PR 2554](https://github.com/openclaw/crabbox/pull/2554). Thanks @altaywtf.
- Stop Parallels IP discovery from admitting probes after its startup deadline, preserve caller cancellation and the final VM-query error, and suppress stale DHCP or clone-mode advice when current inventory is unavailable. [PR 2480](https://github.com/openclaw/crabbox/pull/2480), [PR 2548](https://github.com/openclaw/crabbox/pull/2548). Thanks @steipete.
- Preserve Lambda acquisition causes when rollback fails, report recovery-claim write failures, and block automatic fresh-allocation retries after failed cleanup. [PR 2463](https://github.com/openclaw/crabbox/pull/2463). Thanks @steipete.
- Bound Tencent Cloud IP-readiness reads and retry waits, preserve cancellation and acquisition causes after rollback failure, and prevent cleanup errors from triggering fresh-instance retries. [PR 2464](https://github.com/openclaw/crabbox/pull/2464). Thanks @steipete.
- Keep background telemetry from replacing workspace command witnesses and failing successful hydration reads with exit 74. [PR 2563](https://github.com/openclaw/crabbox/pull/2563).
- Report missing local claims accurately when replaying `stop` after verified absence, retaining exit 1 without a terminal receipt and preserving provider resolver and genuine identity-mismatch errors. [PR 2551](https://github.com/openclaw/crabbox/pull/2551).

### Changed

- Use GA full caching for Azure ephemeral OS disks through the SDK and coordinator, with supported-family and active-vCPU eligibility checks; managed OS disks remain the default. [PR 2565](https://github.com/openclaw/crabbox/pull/2565), [PR 2567](https://github.com/openclaw/crabbox/pull/2567). Thanks @jwmoss.
- Build local Git-seed snapshot manifests once, validate captured Git inputs at acceptance, reuse copied-file digests between mandatory content reads, and avoid rescanning unrelated parent directories. The unchanged 20,002-file fixture used 17 rather than 50 Git calls and 894,566,442 rather than 1,192,755,256 logical source bytes; median snapshot preparation fell from 48.547 s to 25.378 s on a shared Apple M3 Ultra. These measure local preparation, not network-transfer throughput; final uncached content and byte-count verification remain mandatory. [PR 2581](https://github.com/openclaw/crabbox/pull/2581).
- Move direct Daytona integration to the maintained Go clients and typed organization/lifetime metadata, and reconcile fixed cleanup through exact sandbox lookup so retirement of the paginated endpoint cannot strand cleanup. [PR 2574](https://github.com/openclaw/crabbox/pull/2574). Thanks @Patrick-Erichsen.

## 0.66.0 - 2026-09-24

### Highlights

- **Run proxy-aware commands through host egress.** `egress run` manages proxy setup, command execution, and session cleanup; optional HTTP(S) upstream credentials stay on the host.
- **Safer cleanup and recovery.** The shared fixed-lease engine owns cleanup-binding persistence and recovery transactions, preserves uncertain claims, and validates cleanup identities and terminal receipts. Incus accepts repeated stop by exact lease ID after confirmed deletion.
- **More reliable provider connections and diagnostics.** NVIDIA Brev uses native OpenSSH, retains host/container targets, and probes only provenance-matched status routes. Parallels fails early when guest tools stay unavailable; Boxd waits on the authenticated forwarded port and reports definite create rejections with their server diagnostics.
- **Preserve workspaces and verify developer images.** Origin seeding leaves non-empty raw workspaces intact, and shallow checkout reuse restores branch ancestry. Linux developer-image acceptance requires trusted builder verification and functional offline smokes before publication.
- **Provider observations preserve lease policy.** OVH, Sprites, and Boat/ASCII Box retain recorded lifetime and idle settings across status, reuse, and heartbeat operations; unknown observations stay unknown.
- **Bound optional waits and reject overflowing budgets.** AWS and Hetzner price quotes fall back after five seconds, oversized execution and lifetime budgets fail before dispatch, and readiness waits preserve cancellation. Multipart uploads retain archives until their producers finish, and Vultr retries release the previous response first.
- **Consolidate internal implementation paths.** Shared WebSocket upgrade checks, slug allocation, provider flag provenance, and tag and metadata helpers reduce duplication while preserving existing behavior.

### Upgrade notes

- `egress run` requires an existing, exclusively owned Linux SSH lease, and the command must opt into its lease-local proxy. Scoped cleanup requires the current Linux helper and pidfd support. [PR 2506](https://github.com/openclaw/crabbox/pull/2506).
- Keep local claims and journals when upgrading hosts with unfinished fixed-ID cleanup. Inconsistent Parallels identities and invalid terminal receipts now fail instead of being reported as cleaned up. [PR 2515](https://github.com/openclaw/crabbox/pull/2515).
- Linux developer-image preparation and publication must use the updated standalone verifier from the same trusted source as the installer and publisher, and require the `linux-builder` profile. Existing valid builder manifests retain their canonical-byte contract; older installed scripts do not gain `--verify` automatically. [PR 2533](https://github.com/openclaw/crabbox/pull/2533).

### Added

- Add `egress run` to own proxy setup, remote execution, and session cleanup for one job, with optional HTTP(S) upstream chaining that keeps credentials on the host and never falls back to direct egress; `egress stop --session` supports scoped cleanup and prevents late startup. [PR 2506](https://github.com/openclaw/crabbox/pull/2506).

### Fixes

- Keep Boxd lease SSH readiness on the authenticated forwarded port instead of falling back to port 22 while the forward starts. [PR 2519](https://github.com/openclaw/crabbox/pull/2519), [PR 2530](https://github.com/openclaw/crabbox/pull/2530). Thanks @MichielMAnalytics.
- Reject unverified Linux developer images with trusted-source builder verification, functional offline smokes, contained scratch, and fail-closed archive publication. [PR 1995](https://github.com/openclaw/crabbox/pull/1995), [PR 2533](https://github.com/openclaw/crabbox/pull/2533). Thanks @vincentkoc.
- Accept BOM-prefixed GitHub Runner registrations when seeding verified tool caches and create new registration files privately regardless of the caller's umask. [PR 1995](https://github.com/openclaw/crabbox/pull/1995), [PR 2533](https://github.com/openclaw/crabbox/pull/2533). Thanks @vincentkoc.
- Classify definite Boxd create rejections without retaining orphaned claims, preserve gRPC server diagnostics, and allow forced local recovery after authenticated inventory proves an unbound create absent. [PR 2537](https://github.com/openclaw/crabbox/pull/2537).
- Print joined CLI error causes alongside exit diagnostics while preserving command exit codes and standalone error output. [PR 2537](https://github.com/openclaw/crabbox/pull/2537).
- Restore complete branch history before coherence checks when reusing shallow Git workspaces, while preserving wrong-branch rejection and index rollback. [PR 2529](https://github.com/openclaw/crabbox/pull/2529). Thanks @steipete.
- Allow repeated Incus stop with the exact canonical lease ID after confirmed deletion, validating the retained terminal receipt and connection identity while keeping slug lookups live. [PR 2486](https://github.com/openclaw/crabbox/pull/2486), [PR 2523](https://github.com/openclaw/crabbox/pull/2523). Thanks @vincentkoc.
- Bound optional AWS and Hetzner price quotes to five seconds so stalled pricing falls back to existing estimates. [PR 2524](https://github.com/openclaw/crabbox/pull/2524). Analysis: [PR 1630](https://github.com/openclaw/crabbox/pull/1630). Thanks @steipete.
- Probe NVIDIA Brev SSH readiness during ordinary status only when the cached config matches the workspace claim's prepared provenance, preserving host/container targets and rejecting stale organization routes. [PR 2434](https://github.com/openclaw/crabbox/pull/2434), [PR 2527](https://github.com/openclaw/crabbox/pull/2527). Thanks @vincentkoc.
- Preserve non-empty raw workspaces when origin seeding becomes available by using plain manifest sync, and reject malformed Git destinations before transfer. [PR 2526](https://github.com/openclaw/crabbox/pull/2526). Narrows [PR 2284](https://github.com/openclaw/crabbox/pull/2284). Thanks @vincentkoc.
- Fail Parallels IP discovery early after repeated post-boot Tools-unavailable probes, preserve DHCP/SSH fallback, and name clone-mode, snapshot-reset, and startup-timeout flags in diagnostics. [Issue 2398](https://github.com/openclaw/crabbox/issues/2398), [PR 2525](https://github.com/openclaw/crabbox/pull/2525). Thanks @saariuslystoned.
- Preserve OVH heartbeat policy, including pre-upgrade overrides, across reuse and status reads, recording activity and explicit idle-timeout changes atomically in the local lease claim. [PR 2420](https://github.com/openclaw/crabbox/pull/2420). Thanks @steipete.
- Retain OVH SSH targets for plain status readiness checks and keep both status modes out of repository admission, while preserving metadata-only observations without a public address. [PR 2420](https://github.com/openclaw/crabbox/pull/2420). Thanks @steipete.
- Bound OVH IP-readiness lookups and retry waits with an elapsed-time deadline, preserving caller cancellation causes and provider error precedence. [PR 2420](https://github.com/openclaw/crabbox/pull/2420). Thanks @steipete.
- Resolve NVIDIA Brev SSH routes with native OpenSSH, preserve captured routes across commands, sync, copying, forwarding, and interactive sessions, and retain bounded, redacted certificate-hook diagnostics. [PR 2429](https://github.com/openclaw/crabbox/pull/2429), [PR 2516](https://github.com/openclaw/crabbox/pull/2516). Thanks @vincentkoc.
- Preserve NVIDIA Brev leases' host/container target across fresh-process status, reuse, and stop/start, while honoring explicit target changes. [PR 2430](https://github.com/openclaw/crabbox/pull/2430), [PR 2517](https://github.com/openclaw/crabbox/pull/2517). Thanks @vincentkoc.
- Preserve fixed-lease claims after uncertain cleanup, durably bind Azure companion cleanup identities before deletion, honor existing deletion markers on retries, and reject inconsistent Parallels cleanup identities and invalid terminal receipts. [PR 2515](https://github.com/openclaw/crabbox/pull/2515). Thanks @steipete.
- Fail AWS Lambda microVM runs when stdout or stderr delivery fails, preserving the output error through cleanup instead of reporting remote success. [PR 2513](https://github.com/openclaw/crabbox/pull/2513). Thanks @steipete.
- Prevent polling and delegated exit error wrappers from panicking during self-matching with non-comparable causes, preserving diagnostics and classification. [PR 2513](https://github.com/openclaw/crabbox/pull/2513). Thanks @steipete.
- Finish E2B and CubeSandbox upload producers before releasing source archives and surface source-read failures, using the same multipart lifetime owner as Blaxel. [PR 2509](https://github.com/openclaw/crabbox/pull/2509). Thanks @steipete.
- Finish Blaxel multipart producers before retrying or releasing borrowed archives, preserving HTTP error precedence and early-success uploads. [PR 2505](https://github.com/openclaw/crabbox/pull/2505). Thanks @steipete.
- Keep Sprites status and list factual: omit unavailable birth and expiry, show recorded lease policy instead of reader defaults, and preserve acquisition policy through endpoint preparation and reuse. [PR 2289](https://github.com/openclaw/crabbox/pull/2289). Thanks @steipete.
- Reject overflowing Nomad, Agent Sandbox, and Superserve execution timeouts before provider dispatch while preserving disabled deadlines, service defaults, and caller cancellation. [PR 2503](https://github.com/openclaw/crabbox/pull/2503). Thanks @steipete.
- Keep Boat/ASCII Box observations factual and preserve recorded TTL, retention, and idle policy across ordinary and fixed-ID reuse; persist heartbeat activity and explicit idle replacements without extending native expiry. [PR 2287](https://github.com/openclaw/crabbox/pull/2287). Thanks @steipete.
- Report Blacksmith sync guard timeouts consistently in run results, timing data, and failure bundles without reclassifying ordinary exit 124 or an earlier workload failure. [PR 2510](https://github.com/openclaw/crabbox/pull/2510). Thanks @vincentkoc.
- Bound Azure Dynamic Sessions timeouts for existing runner deadlines before authentication, and reject overflowing direct runner deadlines before command side effects, retaining TTL/default precedence. [PR 2512](https://github.com/openclaw/crabbox/pull/2512). Thanks @steipete.
- Reject oversized Superserve-derived sandbox lifetimes before rounding seconds, preventing duration overflow from bypassing the seven-day cap. [PR 2504](https://github.com/openclaw/crabbox/pull/2504). Thanks @steipete.
- Reject overflowing OpenSandbox execution and lifetime budgets before requests, preserve valid coverage rules, and retain recovery claims with malformed lifetime seconds. [PR 2511](https://github.com/openclaw/crabbox/pull/2511). Thanks @steipete.
- Reject overflowing Cloudflare Dynamic Workers execution budgets before dispatch, preserving disabled timeouts and repository security caps. [PR 2507](https://github.com/openclaw/crabbox/pull/2507). Thanks @steipete.
- Release Vultr rate-limit responses before waiting and retrying, preventing a retry from stalling behind its own connection limit. [PR 2306](https://github.com/openclaw/crabbox/pull/2306). Thanks @steipete.

### Maintenance

- Make fixed-lease cleanup-binding persistence the shared engine default and consolidate recovery transactions, journal writes, and completion handling across direct provider adapters. [PR 2528](https://github.com/openclaw/crabbox/pull/2528).
- Consolidate WebSocket upgrade predicates, slug allocation, provider flag provenance, and tag sanitization and metadata validation without changing their public behavior. [PR 2531](https://github.com/openclaw/crabbox/pull/2531), [PR 2532](https://github.com/openclaw/crabbox/pull/2532), [PR 2534](https://github.com/openclaw/crabbox/pull/2534), [PR 2538](https://github.com/openclaw/crabbox/pull/2538).
- Recover notarization upload deadlines with one bounded S3 acceleration retry or an explicit accelerated route, and require successful signer exit plus online verification before capturing a receipt. [PR 2518](https://github.com/openclaw/crabbox/pull/2518). Thanks @steipete.
- Preserve selected release-verification tools and clean up read-only temporary Go caches without following symlinks or masking earlier failures. [PR 2520](https://github.com/openclaw/crabbox/pull/2520). Thanks @steipete.

## 0.65.0 - 2026-09-22

### Highlights

- **Recover interrupted Boat sandbox creation.** Fixed lease IDs retain the original creation intent, allow one bounded recovery submission, and bind later retries and cleanup to the exact returned sandbox.
- **Malformed timeouts no longer trigger premature cleanup.** Checked duration conversions preserve leases with overflowing idle limits, while existing TTL and ownership checks continue to apply.
- **Authentication requests have bounded waits.** GitHub membership checks, OAuth requests, and Cloudflare Access key loading stop stalled requests instead of leaving authentication waiting indefinitely.
- **Provider startup respects cancellation and deadlines.** Hostinger and Upstash Box readiness waits now include stalled responses and polling backoff; GCP and Scaleway retain the original cancellation and timeout causes.
- **More reliable provider cleanup and status.** Azure resumes fixed-ID worker cleanup after local claim loss, Scaleway removes root disks recorded for new leases, and Vast status probes use the native SSH endpoint and stored key.

### Upgrade notes

- Boat fixed lease IDs require persistent local Crabbox state and the original provider account, endpoint, and organization selector. Lost creation replies permit only one recovery submission within the native 24-hour window, further limited by the intent TTL. Preserve unresolved attempts for inspection; successful cleanup permanently retires the lease ID. Use an organization ID for org-billed creation. [PR 2472](https://github.com/openclaw/crabbox/pull/2472).
- Scaleway release now deletes the allocation-recorded root disk for newly created leases. Later-attached disks and legacy untracked disks remain untouched; failed cleanup retains recovery state for retry. [PR 2468](https://github.com/openclaw/crabbox/pull/2468).

- GitHub membership/OAuth and Cloudflare Access timeout fixes require a coordinator redeploy. Updating the CLI alone does not change deployed authentication behavior. [PR 2481](https://github.com/openclaw/crabbox/pull/2481), [PR 2482](https://github.com/openclaw/crabbox/pull/2482), [PR 2483](https://github.com/openclaw/crabbox/pull/2483).

### Features

- Add replay-safe ASCII Box (Boat) fixed lease IDs with durable keyed creation, one recovery submission within the native 24-hour window, exact-ID adoption, and single-use release tombstones through the shared engine. [PR 2472](https://github.com/openclaw/crabbox/pull/2472), [Issue 1747](https://github.com/openclaw/crabbox/issues/1747). Thanks @shunkakinoki.

### Fixes

- Recover direct Azure fixed-ID worker cleanup after local claim loss, preserve cancellation, and resume interrupted cleanup from durable resource identities. [PR 2501](https://github.com/openclaw/crabbox/pull/2501). Thanks @galiniliev.
- Reject overflowing CodeSandbox SDK operation budgets before authentication or SDK startup while preserving separate setup and command deadlines. [PR 2500](https://github.com/openclaw/crabbox/pull/2500). Thanks @steipete.
- Reject overflowing OpenComputer and Blaxel execution budgets before provider dispatch, including response grace, while preserving timeout defaults, payloads, and cancellation. [PR 2497](https://github.com/openclaw/crabbox/pull/2497). Thanks @steipete.
- Reject overflowing Firecracker disk and Hyper-V memory byte conversions before lease state, filesystem copies, or native VM creation, preserving existing sizing defaults and recovery paths. [PR 2495](https://github.com/openclaw/crabbox/pull/2495). Thanks @steipete.
- Prevent out-of-range persisted idle seconds from authorizing Cloud Run Sandbox idle expiry while preserving independent TTL, stale-create, and invalid-timestamp cleanup policies. [PR 2496](https://github.com/openclaw/crabbox/pull/2496). Thanks @steipete.
- Bound Upstash Box readiness response reads by the five-minute creation wait, preserve caller cancellation causes, and retain detached cleanup after failed creation. [PR 2498](https://github.com/openclaw/crabbox/pull/2498). Thanks @steipete.
- Preserve sandbox and Nomad resources with overflowing idle timeouts by sharing checked duration conversion, while retaining provider-specific TTL, deadline, timestamp, and ownership policies. [PR 2494](https://github.com/openclaw/crabbox/pull/2494). Thanks @steipete.
- Preserve running leases with malformed idle timeouts instead of letting duration overflow trigger cleanup; share the bounded expiry check with Machine0 while retaining provider ownership and lifecycle safeguards. [PR 2492](https://github.com/openclaw/crabbox/pull/2492). Thanks @steipete.
- Preserve Hostinger caller cancellation through acquisition and stop waits, interrupt polling backoff promptly, and bound acquisition reads by the existing ten-minute readiness budget. [PR 2499](https://github.com/openclaw/crabbox/pull/2499). Thanks @steipete.
- Bound GitHub membership verification to 15 seconds, including stalled response bodies and team pagination, so authentication fails closed without leaving shared checks stuck indefinitely. [PR 2481](https://github.com/openclaw/crabbox/pull/2481).
- Bound GitHub OAuth code exchange and post-exchange verification while preserving one-use-code handling, the existing verification retry, and encrypted credential reuse on callback retries. [PR 2482](https://github.com/openclaw/crabbox/pull/2482).
- Bound Cloudflare Access signing-key loads to 15 seconds so stalled responses cannot hold bearer authentication indefinitely; preserve identity fallback, key rotation, and failure caching. [PR 2483](https://github.com/openclaw/crabbox/pull/2483).
- Delete each new Scaleway lease's allocation-recorded root disk on release, preserve recovery state after cleanup failures, and leave later-attached and legacy untracked disks untouched. [PR 2468](https://github.com/openclaw/crabbox/pull/2468).
- Preserve caller cancellation causes and timeout classification during Scaleway public-IP readiness without changing its five-minute budget or timeout exit code. [PR 2468](https://github.com/openclaw/crabbox/pull/2468).
- Preserve reclaimed fixed leases during cleanup by distinguishing ownership-fence rejection from an admitted deletion in the shared engine. [PR 2462](https://github.com/openclaw/crabbox/pull/2462).
- Use Vast's native SSH endpoint and stored lease key for plain status readiness checks, avoiding false unready results while keeping observations read-only. [PR 2447](https://github.com/openclaw/crabbox/pull/2447).
- Preserve GCP IP-readiness cancellation causes and deadline classification while retaining the budget-timeout diagnostic and completed-response precedence. [PR 2467](https://github.com/openclaw/crabbox/pull/2467).
- Preserve underlying Scaleway SDK/configuration errors for diagnostics while retaining redacted messages and exit code 3. [PR 2466](https://github.com/openclaw/crabbox/pull/2466).

### Maintenance

- Consolidate Azure configuration under one typed owner while preserving VM and dynamic-session routing, shared input provenance, disk policy, and coordinator request fields. [PR 2491](https://github.com/openclaw/crabbox/pull/2491). Thanks @steipete.
- Keep GCP configuration and explicit-input intent under one provider-specific owner while preserving file/environment precedence, OS-image defaults, and coordinator requests. [PR 2488](https://github.com/openclaw/crabbox/pull/2488). Thanks @steipete.
- Reuse shared claim idle-expiry policy for Coder cleanup while preserving its twelve-hour grace period, timestamp normalization, and ownership safeguards. [PR 2490](https://github.com/openclaw/crabbox/pull/2490). Thanks @steipete.
- Reuse Local Container's shared idle-expiry rule for legacy unscoped orphan claims while preserving strict twelve-hour grace, runtime identity checks, and stored-key retention. [PR 2489](https://github.com/openclaw/crabbox/pull/2489).
- Share generated flag application and accepted-input bookkeeping across E2B, Freestyle, Semaphore, and Tenki while preserving their validation and normalization order. [PR 2487](https://github.com/openclaw/crabbox/pull/2487).
- Derive CubeSandbox defaults, file/environment bindings, and flags from one typed declaration while preserving aliases, proxy-port parsing, and endpoint trust policy. [PR 2485](https://github.com/openclaw/crabbox/pull/2485).
- Consolidate built-in fixed-lease admission, attempt codecs, claim binding, recovery policy, and terminal receipts in a shared engine; preserve native identity proofs and existing local records while retaining the external provider’s delegated protocol. [PR 2462](https://github.com/openclaw/crabbox/pull/2462).
- Share RunPod and Vast lease-reuse admission while preserving read-only observations, stale-claim rejection, and recorded idle-timeout policy. [PR 2469](https://github.com/openclaw/crabbox/pull/2469).
- Share AWS and Azure endpoint-refresh identity policy while preserving recorded cleanup authority and legacy-claim behavior. [PR 2470](https://github.com/openclaw/crabbox/pull/2470).
- Share E2B and CubeSandbox's claim-fenced deletion transaction while preserving endpoint-bound ownership checks, provider errors, and not-found recovery. [PR 2474](https://github.com/openclaw/crabbox/pull/2474).
- Reuse shared claim idle-expiry policy for Local Container cleanup while preserving its twelve-hour grace period and ownership safeguards. [PR 2475](https://github.com/openclaw/crabbox/pull/2475).
- Reuse the shared sandbox status projection for Cloud Run Sandbox without changing ownership probes, expiry rules, or public labels. [PR 2476](https://github.com/openclaw/crabbox/pull/2476).
- Share Linode's status-first HTTP response decoding with DigitalOcean while preserving typed errors, redaction, and partial-response diagnostics. [PR 2479](https://github.com/openclaw/crabbox/pull/2479).

- Make provider deadline tests deterministic, preserve incomplete canceled HTTPS responses in GCP fixtures, allow native PowerShell startup headroom, and cover coordinator create recovery after reconstruction within the same deployment. [PR 2473](https://github.com/openclaw/crabbox/pull/2473), [PR 2484](https://github.com/openclaw/crabbox/pull/2484), [PR 2493](https://github.com/openclaw/crabbox/pull/2493), [PR 2471](https://github.com/openclaw/crabbox/pull/2471).

## 0.64.0 - 2026-09-21

### Highlights

- **Boxd uses TLS gRPC and API-key authentication.** The provider independently verifies isolation before guest access and retains immutable-ID cleanup for legacy console claims.
- **Recover the same sandbox or VM after interrupted creation.** Fixed lease IDs for Tenki, Parallels, Proxmox, and Agent Sandbox durably bind each attempt to its original resource and reject conflicting retries or reuse after release.
- **More reliable Linux desktop startup and resizing.** Optional package installs refresh stale indexes, and managed Wayland viewers automatically hand off resizing only after verifying retirement of the previous remote client.
- **Safer cleanup after interrupted or external deletion.** Core verifies resource absence before forgetting eligible Daytona and ASCII Box claims; DigitalOcean retains managed SSH keys and recovery credentials when Droplet rollback fails.
- **Opt-in portable ready-pool access has bounded grants.** Experimental AWS Linux support binds each borrow to an ephemeral key and immutable expiry, with SSM installation and reboot fencing before reuse; heartbeats do not renew access.
- **Heartbeats retain the intended lease policy.** Explicit idle-timeout changes survive fresh observations across cloud and local VM providers, while ordinary heartbeats preserve recorded limits and existing TTL caps. Transient read-only coordinator lookups now retry within a bounded budget.
- **More dependable Parallels startup and capacity limits.** Concurrent clones share capacity reservations, macOS preparation checks Node and SSH earlier, guest scripts travel over stdin, and timeout diagnostics explain the next recovery step.
- **Reliable workspace paths and SSH control.** Relative and dash-prefixed workspace names remain literal through commands and sync, and workspace-owner control connections stay independent of workload connections.

### Upgrade notes

- Boxd now requires a `bxd_` API key in `CRABBOX_BOXD_API_KEY` or `BOXD_API_KEY`; interactive session tokens and the device-login helper are retired. Set `CRABBOX_BOXD_ORG` for org-fenced keys so `list` and `cleanup` can validate org-billed machines. Legacy console claims remain available for lifecycle cleanup, but guest access requires a new lease. [PR 2432](https://github.com/openclaw/crabbox/pull/2432).
- Automatic managed Wayland resize handoff requires updated CLI bridges and a coordinator deploy advertising retirement protocol version 1. Unsupported control surfaces, unknown clients, or ambiguous retirement retain manual close-and-reconnect guidance. Updating the local CLI alone does not enable the coordinator and portal changes. [PR 2457](https://github.com/openclaw/crabbox/pull/2457).
- `stop --force` can forget eligible ordinary Daytona and ASCII Box claims only after exact resource absence is verified under the claim lock. Legacy Daytona claims without endpoint and organization binding still require manual recovery; fixed-ID, checkpoint, coordinator, and adapter-owned claims retain their existing recovery owners. ASCII Box ordinary-stop reconciliation is preserved. [PR 2454](https://github.com/openclaw/crabbox/pull/2454).
- Portable ready-pool access is experimental and requires both client `--access` opt-in and a coordinator deployed with `CRABBOX_PORTABLE_POOLS_ENABLED=true`. The first adapter supports prepared AWS public Linux SSH leases with SSM access. Borrows default to and cannot exceed 30 minutes, further capped by lease and authorization expiry; there is no in-place renewal, and heartbeats only prove liveness. Preserve private receipts and keys until cleanup completes, and complete the documented live fencing proof before production rollout. [PR 2458](https://github.com/openclaw/crabbox/pull/2458).
- Tenki, Parallels, Proxmox, and Agent Sandbox fixed lease IDs require persistent local Crabbox state and unchanged allocation inputs across retries. Preserve their claims and keys; ambiguous submissions retain recovery state, and successful stop permanently retires the ID. Use a new ID for later work. Pin Agent Sandbox controllers and CRDs together to the qualified `v1.0.0` release. Kept Tenki sessions remain sticky and require an explicit `stop`; heartbeats do not add native expiry. [PR 2442](https://github.com/openclaw/crabbox/pull/2442), [PR 2443](https://github.com/openclaw/crabbox/pull/2443), [PR 2444](https://github.com/openclaw/crabbox/pull/2444), [PR 2342](https://github.com/openclaw/crabbox/pull/2342).
- Cloudflare runner image deployments now default to pnpm 12.5.1. Projects without a `packageManager` pin inherit this breaking change; migrate pnpm configuration or set `"packageManager": "pnpm@10.24.0"` before deployment. Updating the local CLI alone does not replace deployed runner images. [PR 2379](https://github.com/openclaw/crabbox/pull/2379).
- The Node coordinator container image moves to Node 24 LTS on redeployment. Dependency updates include the Azure SDK majors and Vitest 5; the Go toolchain remains compatible with Go 1.26.5. [PR 2453](https://github.com/openclaw/crabbox/pull/2453).
- Existing Lume golden images need the matching firstboot and launchd hooks reinstalled before use with named shared directories. Refresh the image hooks from the `v0.64.0` scripts; upgrading the host CLI alone is insufficient. [PR 2409](https://github.com/openclaw/crabbox/pull/2409).
- AWS quota inspection uses `ec2:DescribeInstanceTypes` alongside `servicequotas:GetServiceQuota`; update custom caller or coordinator policies accordingly. Missing metadata is reported as unknown, and private workspace resource caps require successful inspection. [PR 2435](https://github.com/openclaw/crabbox/pull/2435).

### Features

- Migrate Boxd to TLS gRPC with API-key authentication, independently verified isolation, and immutable-ID cleanup, including recovery of legacy console claims. [PR 1718](https://github.com/openclaw/crabbox/pull/1718), [PR 2432](https://github.com/openclaw/crabbox/pull/2432). Thanks @MichielMAnalytics.
- Support retry-safe Tenki fixed lease IDs with durable attempt recovery, exact-session attestation, read-only inspection, and single-use terminal receipts; honor acquisition cancellation and locate uploaded scripts after login startup changes directory. [PR 2021](https://github.com/openclaw/crabbox/pull/2021), [PR 2442](https://github.com/openclaw/crabbox/pull/2442). Thanks @eddiewang.
- Add replay-safe fixed Parallels lease IDs with durable creation intent, attested host and VM identity, recovery after lost replies without resubmission, and single-use release tombstones. [PR 2383](https://github.com/openclaw/crabbox/pull/2383), [Issue 2382](https://github.com/openclaw/crabbox/issues/2382), [PR 2443](https://github.com/openclaw/crabbox/pull/2443). Thanks @saariuslystoned.
- Add replay-safe fixed Proxmox lease IDs with durable VMID/generation binding, conflict checks, retained uncertain attempts, and terminal release tombstones. [PR 1861](https://github.com/openclaw/crabbox/pull/1861), [Issue 1847](https://github.com/openclaw/crabbox/issues/1847), [PR 2444](https://github.com/openclaw/crabbox/pull/2444). Thanks @devinkuhn.
- Add durable fixed lease IDs for Agent Sandbox with exact Kubernetes identity replay and foreground terminal confirmation with a two-minute cleanup budget, and adapter completion that preserves terminal receipts outside active inventory. [Issue 1742](https://github.com/openclaw/crabbox/issues/1742). [PR 2342](https://github.com/openclaw/crabbox/pull/2342). Thanks @jimmybrancaccio.
- Add experimental opt-in portable typed ready-pool access with immutable bounded grants, private local receipts, AWS SSM installation and reboot fencing, and retained cleanup capacity. [Issue 1074](https://github.com/openclaw/crabbox/issues/1074), [PR 2458](https://github.com/openclaw/crabbox/pull/2458).
- Add opt-in direct-host Parallels capacity limits through `parallels.maxVMs` and `CRABBOX_PARALLELS_MAX_VMS`, preserve fleet-entry precedence, and let explicit YAML zero clear inherited limits. [PR 2392](https://github.com/openclaw/crabbox/pull/2392), [Issue 2386](https://github.com/openclaw/crabbox/issues/2386). Thanks @saariuslystoned.

### Fixes

- Retain DigitalOcean managed SSH keys and recovery credentials when acquisition rollback cannot delete the Droplet, allowing cleanup to be retried safely. [PR 2459](https://github.com/openclaw/crabbox/pull/2459).
- Preserve DigitalOcean acquisition cancellation causes and timeout exit codes, including failed rollback, and suppress automatic fresh-allocation retries after cleanup failure. [PR 2460](https://github.com/openclaw/crabbox/pull/2460).
- Refresh optional desktop and browser package indexes on prepared Linux images, retry mirror rollovers with bounded deadlines, and reject partial refreshes instead of installing from stale package URLs. [PR 2457](https://github.com/openclaw/crabbox/pull/2457).
- Wait for desktop startup readiness and automatically hand off managed Wayland resizing only after verifying retirement of the previous remote client; retain manual guidance for ambiguous or unavailable control. [Issue 2076](https://github.com/openclaw/crabbox/issues/2076), [PR 2457](https://github.com/openclaw/crabbox/pull/2457).
- Bound Vast SSH-endpoint readiness requests and retry waits by the startup deadline, preserving cancellation causes without exposing redacted transport secrets. [PR 2448](https://github.com/openclaw/crabbox/pull/2448).
- Recover absent direct-provider claims through shared, claim-fenced `stop --force` evidence verification; bind new Daytona leases to their authenticated account, retain unbound legacy claims, and preserve ASCII Box ordinary-stop reconciliation. [PR 2115](https://github.com/openclaw/crabbox/pull/2115), [Issue 2108](https://github.com/openclaw/crabbox/issues/2108), [PR 2454](https://github.com/openclaw/crabbox/pull/2454). Thanks @Patrick-Erichsen for the report and PR, and @mislavivanda for the issue.
- Retried transient read-only coordinator lookups with bounded backoff and a 60-second total budget, preserving caller deadlines and mutation and terminal receipt replay contracts. [Issue 1561](https://github.com/openclaw/crabbox/issues/1561), [PR 2452](https://github.com/openclaw/crabbox/pull/2452). Thanks @excelsier.
- Preserve RunPod SSH-readiness cancellation causes, distinguish startup deadlines from caller cancellation, and retain completed provider errors. [PR 2449](https://github.com/openclaw/crabbox/pull/2449).
- Use EC2 instance metadata for AWS vCPU quota admission and readiness, including bare-metal types, and keep unknown instance costs out of capacity recommendations. [PR 2302](https://github.com/openclaw/crabbox/pull/2302), [PR 2435](https://github.com/openclaw/crabbox/pull/2435). Thanks @vincentkoc.
- Refresh the Cloudflare runner to Node 24.21.0, Go 1.26.8, GitHub CLI 2.101.0, and pnpm 12.5.1; unpinned projects inherit the pnpm 10-to-12 breaking default change on deployment and should migrate configuration or pin `packageManager` to `pnpm@10.24.0`. [PR 2379](https://github.com/openclaw/crabbox/pull/2379). Thanks @altaywtf.
- Persist RunPod heartbeat activity and explicit idle-timeout changes, preserve stored lifecycle policy across fresh reads, and reject stale updates instead of reporting success. [PR 2441](https://github.com/openclaw/crabbox/pull/2441).
- Preserve Vast leases' recorded heartbeat policy across fresh reads and upgrades, honor explicit idle-timeout changes without extending the stored TTL, and report stale claim updates as failures. [PR 2433](https://github.com/openclaw/crabbox/pull/2433).
- Preserve literal relative and dash-prefixed workspace paths across shell commands and sync, and prepare immutable local Actions hydration before invalidating reusable state. [PR 1739](https://github.com/openclaw/crabbox/pull/1739). Thanks @steipete.
- Daytona: omit unverified default class labels from snapshot forks and document opt-in workload concurrency and memory limits. [PR 2114](https://github.com/openclaw/crabbox/pull/2114), [PR 2421](https://github.com/openclaw/crabbox/pull/2421). Thanks @Patrick-Erichsen.
- Wait for fresh exe.dev VMs to advertise their SSH route, preserve its user, port, and ambient SSH configuration, and bound inventory refreshes by the bootstrap timeout while retaining verified rollback. [PR 2271](https://github.com/openclaw/crabbox/pull/2271), [PR 2424](https://github.com/openclaw/crabbox/pull/2424). Thanks @salmonumbrella.
- Resolve NVIDIA Brev environment API keys against their effective organization instead of stale saved credentials, preserving organization-scoped lifecycle checks for headless runs. [PR 2427](https://github.com/openclaw/crabbox/pull/2427). Thanks @vincentkoc.
- Preserve NVIDIA Brev deletion recovery claims when the CLI returns blank inventory output; only valid inventory can confirm a workspace is gone. [PR 2426](https://github.com/openclaw/crabbox/pull/2426). Thanks @vincentkoc.
- Deliver Parallels POSIX guest preparation and SSH-key installation scripts over stdin on local and remote hosts, preserving fail-fast shell checks and preventing child commands from consuming the script. [PR 2401](https://github.com/openclaw/crabbox/pull/2401), [Issue 2396](https://github.com/openclaw/crabbox/issues/2396), [PR 2431](https://github.com/openclaw/crabbox/pull/2431). Thanks @saariuslystoned.
- Report ASCII Box/Boat cleanup phase and remaining deadline, preserve the last deletion status on timeout, and reconcile unchanged claims after exact native 404 plus complete inventory absence without repeating teardown; failed or partial inventory retains the claim. [Issue 1730](https://github.com/openclaw/crabbox/issues/1730), [PR 2428](https://github.com/openclaw/crabbox/pull/2428). Thanks @shunkakinoki.
- Isolate ASCII Box SSH host trust per lease so recycled IPs and gateway endpoints do not block new boxes, while retaining same-lease host-key checks and the native authentication key. [PR 1785](https://github.com/openclaw/crabbox/pull/1785), [Issue 1748](https://github.com/openclaw/crabbox/issues/1748). Thanks @shunkakinoki.
- Preserve DigitalOcean leases' stored idle timeout on ordinary heartbeats and honor explicit timeout changes without extending the creation-based TTL. [PR 2418](https://github.com/openclaw/crabbox/pull/2418).
- Redact Lambda and Vast API-error bodies before truncation, and sanitize appended body-read diagnostics for DigitalOcean, Lambda, OVH, and Vast without changing HTTP-error classification. [PR 2451](https://github.com/openclaw/crabbox/pull/2451).
- Preserve canonical cancellation/deadline context and recognized release-denial states in workspace-owner error messages. [PR 2412](https://github.com/openclaw/crabbox/pull/2412). Thanks @steipete.
- Keep workspace-owner SSH control traffic separate from workload connections while preserving renewal deadlines and ownership checks. [PR 2419](https://github.com/openclaw/crabbox/pull/2419). Thanks @steipete.
- Explain Parallels IP discovery timeouts with clone mode, NIC details, and retry-time console guidance while preserving cleanup and clone defaults. [PR 2415](https://github.com/openclaw/crabbox/pull/2415), [Issue 2398](https://github.com/openclaw/crabbox/issues/2398). Thanks @saariuslystoned.
- Distinguish unavailable Parallels IP observations from missing DHCP records and explain how to clear snapshot selectors for full-clone retries. [PR 2422](https://github.com/openclaw/crabbox/pull/2422).
- Multipass: preserve ready status endpoints, persist heartbeat timeout changes across fresh reads, and retain recovery keys when failed provisioning cannot be rolled back. [PR 2414](https://github.com/openclaw/crabbox/pull/2414).
- Keep Phala status and controller observations from preparing SSH access or rewriting claims, while preserving existing gateway routes and strict host-key verification. [PR 2410](https://github.com/openclaw/crabbox/pull/2410).
- Tencent Cloud: preserve the live stored idle timeout during ordinary touches and apply explicit heartbeat overrides without changing the original TTL cap. [PR 2416](https://github.com/openclaw/crabbox/pull/2416).
- Restore Lume guest bootstrap with named shared directories, authenticated status readiness, and cleanup with quiet partial-match `lsof` output; existing golden images need refreshed hooks. [PR 2409](https://github.com/openclaw/crabbox/pull/2409).
- Lume: persist heartbeat policy across fresh reads, honor explicit idle-timeout changes, and admit owned instance-scoped leases through the public heartbeat command. [PR 2407](https://github.com/openclaw/crabbox/pull/2407).
- Persist explicit idle-timeout changes in Proxmox heartbeats while preserving omitted limits, legacy labels, current-node routing, and the lease TTL cap. [PR 2408](https://github.com/openclaw/crabbox/pull/2408).
- Persist Tart heartbeat timestamps and explicit idle-timeout changes in the lease claim, preserving them across fresh status reads and cleanup without losing SSH target details. [PR 2405](https://github.com/openclaw/crabbox/pull/2405).
- Honor explicit idle-timeout changes in Azure and Hetzner heartbeats, preserving stored limits when omitted and keeping metadata writes in the selected provider. [PR 2403](https://github.com/openclaw/crabbox/pull/2403).
- Show the configured direct-host Parallels capacity in text and JSON config output, including zero and negative unlimited settings, without substituting a fleet limit. [PR 2400](https://github.com/openclaw/crabbox/pull/2400), follow-up to [PR 2392](https://github.com/openclaw/crabbox/pull/2392).
- Prepare Node and npm before Parallels macOS readiness checks, preserving usable existing runtimes offline and installing the pinned baseline when needed. [PR 2387](https://github.com/openclaw/crabbox/pull/2387), [Issue 2381](https://github.com/openclaw/crabbox/issues/2381). Thanks @saariuslystoned.
- Check macOS SSH listener availability during Parallels guest preparation, including older readiness helpers and configured fallback ports, so missing listeners fail earlier. [PR 2399](https://github.com/openclaw/crabbox/pull/2399), [Issue 2397](https://github.com/openclaw/crabbox/issues/2397). Thanks @saariuslystoned.
- Avoid spurious SSH-directory creation failures when concurrent leases share fresh local state, while retaining existing directory validation. [PR 2395](https://github.com/openclaw/crabbox/pull/2395). Thanks @saariuslystoned.
- Enforce Parallels fleet capacity across concurrent clones sharing local state, including differently named entries for the same host and account, while keeping doctor and checkpoint dry-run selection lock-free. [PR 2385](https://github.com/openclaw/crabbox/pull/2385), [Issue 2384](https://github.com/openclaw/crabbox/issues/2384). Thanks @saariuslystoned.
- Persist explicit idle-timeout changes in GCP heartbeats while preserving omitted limits, legacy labels, and the lease TTL cap. [PR 2404](https://github.com/openclaw/crabbox/pull/2404).
- Report successful SSH authentication when a readiness check still times out, including real proxy routes, so diagnostics distinguish missing guest readiness from connection or authentication failures. [PR 2391](https://github.com/openclaw/crabbox/pull/2391). Thanks @saariuslystoned.
- Honor explicit idle-timeout changes in direct Parallels heartbeats while preserving the stored window when the flag is omitted. [PR 2406](https://github.com/openclaw/crabbox/pull/2406). Thanks @saariuslystoned.
- Apple VM: persist heartbeat timestamps and explicit idle-timeout changes across fresh status reads, preserving recorded timeout and TTL policy when the flag is omitted. [PR 2413](https://github.com/openclaw/crabbox/pull/2413). Thanks @steipete.
- Hyper-V: retain ready SSH endpoints for exactly owned leases, preserve metadata-only plain status for legacy claims, and persist heartbeat timestamps and idle-timeout overrides across fresh reads. [PR 2411](https://github.com/openclaw/crabbox/pull/2411). Thanks @steipete.

### Maintenance

- Refresh Go and Worker dependencies, including current Azure SDK majors, regexp2 v2, and Vitest 5; update SHA-pinned CI actions and runtime image digests, and move the Node coordinator image to Node 24 LTS while retaining Go 1.26.5 compatibility. [PR 2453](https://github.com/openclaw/crabbox/pull/2453).
- Shorten Go CI feedback with parallel CLI race-test shards and cached Go builds, preserving the required checks and complete test coverage. [PR 2455](https://github.com/openclaw/crabbox/pull/2455).
- Consolidate provider defaults, lease repository scope and selection, finalization, naming, and polling while preserving provider-specific behavior. [PR 2310](https://github.com/openclaw/crabbox/pull/2310), [PR 2394](https://github.com/openclaw/crabbox/pull/2394), [PR 2372](https://github.com/openclaw/crabbox/pull/2372), [PR 2375](https://github.com/openclaw/crabbox/pull/2375), [PR 2380](https://github.com/openclaw/crabbox/pull/2380), [PR 2389](https://github.com/openclaw/crabbox/pull/2389), [PR 2390](https://github.com/openclaw/crabbox/pull/2390), [PR 2393](https://github.com/openclaw/crabbox/pull/2393).
- Share coordinator alias parsing, GCP image observations, and asynchronous operation tracking; stabilize active-controller cancellation fixtures with the controlled test clock. [PR 2378](https://github.com/openclaw/crabbox/pull/2378), [PR 2376](https://github.com/openclaw/crabbox/pull/2376), [PR 2373](https://github.com/openclaw/crabbox/pull/2373), [PR 2402](https://github.com/openclaw/crabbox/pull/2402).
- Deduplicate local VM and delegated sandbox observation, SSH bootstrap, endpoint policy, config and flag application, test support, coordinator sweep and runner HTTP helpers, and provider readiness termination without changing behavior. [PR 2423](https://github.com/openclaw/crabbox/pull/2423), [PR 2436](https://github.com/openclaw/crabbox/pull/2436), [PR 2437](https://github.com/openclaw/crabbox/pull/2437), [PR 2438](https://github.com/openclaw/crabbox/pull/2438), [PR 2439](https://github.com/openclaw/crabbox/pull/2439), [PR 2456](https://github.com/openclaw/crabbox/pull/2456).

## 0.63.0 - 2026-09-20

### Highlights

- **Tenki works with the current CLI and rotating gateway certificates.** Sandbox creation uses supported lifetime flags, and SSH verifies the gateway's certificate authority instead of pinning individual gateway keys.
- **More reliable macOS VM startup.** Prepared Parallels macOS images can bootstrap without guest Tools, and Apple VM builds cloud-init seed disks without mounting them on the host.
- **Boat works after the ASCII Box rename.** Updated CLI discovery, response parsing, SSH keys, and cleanup preserve existing Crabbox lease identities.
- **Safer cancellation and cleanup recovery.** Canceled operations stop waiting for lease locks, while failed deletion or local SSH cleanup retains the state needed for a safe retry.

### Upgrade notes

- Tenki host-authority discovery requires a workspace API key from `tenki onboard` or `TENKI_API_KEY` when the CLI does not report an authoritative trust file. Kept leases use sticky mode with no maximum duration; `warmup` defaults to keeping the lease. Use `--keep=false --ttl 15m` for a bounded test, and explicitly stop the lease afterward: Tenki's maximum duration pauses the sandbox rather than destroying it, and idle-timeout metadata does not enforce native expiry. [PR 2341](https://github.com/openclaw/crabbox/pull/2341).

### Fixes

- Verify Tenki gateway certificates using authoritative CLI trust or authenticated CA and session-scoped gateway discovery. Reject missing or invalid trust without enrolling leaf keys, preserve native Tenki credentials, and restore sandbox creation with supported, mutually exclusive sticky and maximum-duration flags. [PR 2341](https://github.com/openclaw/crabbox/pull/2341). Thanks @francoluxor.
- Support the ASCII Box to Boat rename across CLI discovery, mixed response envelopes, SSH key selection, deletion operations, and secret redaction while preserving existing provider and lease identities. [PR 2303](https://github.com/openclaw/crabbox/pull/2303). Thanks @zozo123.
- Let prepared Parallels macOS clones bootstrap through an explicitly trusted host-side SSH key when Tools cannot report or prepare the guest. Match the exact clone's DHCP identity, preserve its SSH port, reuse configured Screen Sharing only on an exactly owned clone, and wait for authenticated RFB readiness before typing. [PR 1745](https://github.com/openclaw/crabbox/pull/1745), [PR 2362](https://github.com/openclaw/crabbox/pull/2362). Thanks @saariuslystoned.
- Build Apple VM cloud-init seed disks directly with the shared FAT16 writer, removing the host MS-DOS mount requirement while preserving Firecracker and XCP-ng image formats. [PR 2343](https://github.com/openclaw/crabbox/pull/2343). Thanks @steipete.
- Honor cancellation while terminal cleanup waits for exact lease-claim locks across GCP, Lume, Tart, Coder, Modal, Namespace, and related adapters. Release operation or capacity locks promptly, preserve state before deletion, and retain independent acquisition rollback and durable finalization after confirmed deletion. Apply the same cancellation boundary to explicit forget-missing cleanup in OpenSandbox, Vercel Sandbox, Crownest, and SuperServe. [PR 2361](https://github.com/openclaw/crabbox/pull/2361), [PR 2363](https://github.com/openclaw/crabbox/pull/2363), [PR 2364](https://github.com/openclaw/crabbox/pull/2364), [PR 2365](https://github.com/openclaw/crabbox/pull/2365). Thanks @steipete.
- Remove generated GCP and Linode SSH credentials and host-trust files before retiring successfully deleted or absent leases. Keep the exact recovery claim if local cleanup fails. Complete local SSH cleanup after successful failed-acquisition rollback for GCP, Azure, and Linode; retain credentials when remote cleanup fails, report local cleanup errors, and stop fresh allocation retries when recovery is incomplete. Linode terminal cleanup also honors cancellation while waiting for the claim lock. [PR 2357](https://github.com/openclaw/crabbox/pull/2357), [PR 2358](https://github.com/openclaw/crabbox/pull/2358), [PR 2359](https://github.com/openclaw/crabbox/pull/2359). Thanks @steipete.
- Bound GCP public-IP discovery to two minutes, including in-flight observations and caller cancellation. Give failed-acquisition rollback up to three minutes to confirm remote deletion, including after caller cancellation, so slower deletion operations can finish cleanup. [PR 2357](https://github.com/openclaw/crabbox/pull/2357), [PR 2359](https://github.com/openclaw/crabbox/pull/2359). Thanks @steipete.
- Preserve generated Tart SSH credentials when failed-acquisition rollback cannot confirm ownership, delete the VM, or retire its claim, and report local artifact-cleanup errors alongside the original failure. [PR 2360](https://github.com/openclaw/crabbox/pull/2360). Thanks @steipete.
- Preserve Lume's last successfully published claim when acquisition metadata updates fail, retaining the exact recovery state instead of falling back to unguarded rollback. [PR 2366](https://github.com/openclaw/crabbox/pull/2366). Thanks @steipete.

### Maintenance

- Consolidate Pond process and artifact preparation, retained sandbox activity updates, and remote sandbox ownership metadata checks while preserving provider-specific policy and existing behavior. [PR 2356](https://github.com/openclaw/crabbox/pull/2356), [PR 2367](https://github.com/openclaw/crabbox/pull/2367), [PR 2368](https://github.com/openclaw/crabbox/pull/2368). Thanks @steipete.
- Share GCP and Hetzner implicit machine candidate selection in the coordinator while preserving explicit overrides, stored types, profile applicability, and stable ordering. [PR 2369](https://github.com/openclaw/crabbox/pull/2369). Thanks @steipete.
- Keep Windows staged-launcher test helpers alive until final observation and confirm bounded teardown, removing timing-dependent failures without changing production transport behavior. [PR 2354](https://github.com/openclaw/crabbox/pull/2354), [Issue 2226](https://github.com/openclaw/crabbox/issues/2226). Thanks @steipete.

## 0.62.0 - 2026-09-18

### Highlights

- **Recover the same Azure VM or DigitalOcean Droplet.** Fixed lease IDs let direct provisioning recover the original allocation after a lost reply or readiness failure.
- **Readiness probes now respect their deadlines.** Local Container endpoint checks, SSH inspections, and Tart/Scaleway IP discovery include running provider commands and requests in their timeout budgets.
- **Keep signed artifact URLs out of errors.** Upload, download, and manifest request failures retain useful diagnostics without exposing signed request URLs.
- **More reliable lease policy and run history.** SSH access preserves coordinator idle timeouts, explicit heartbeats can finish access refreshes, and abandoned admissions are finalized without replaying workloads.

### Upgrade notes

- Azure and DigitalOcean fixed lease IDs are single-use and require the original local state and per-lease SSH key. Preserve both through retries and cleanup; changed inputs or accounts are rejected, unresolved allocations retain their recovery state, and successful cleanup retires the ID. Azure fixed-ID creation uses one SKU in the configured location without SKU, market, or region fallback; snapshot forks and `ephemeral-preview` disks are unsupported on this path. Ordinary Azure provisioning keeps its existing fallback behavior. [PR 2351](https://github.com/openclaw/crabbox/pull/2351).

### Changes

- Add `warmup --lease-id` support for direct Azure and DigitalOcean leases. Persist the create intent before allocation, recover the same resource after interrupted provisioning, and reject replaced resources using immutable provider identities. [PR 2351](https://github.com/openclaw/crabbox/pull/2351). Thanks @steipete.
- Raise checkpoint limits in the production Cloudflare coordinator configuration to 100 globally, per owner, and per organization, giving retained worker caches more room. Preview, lease, and checkpoint-use claim limits are unchanged. [PR 2338](https://github.com/openclaw/crabbox/pull/2338). Thanks @steipete.

### Fixes

- Bound each Local Container inspection during SSH readiness to 30 seconds, including final diagnostics, while preserving the overall SSH timeout, original SSH error, and exact-container identity checks. [PR 2352](https://github.com/openclaw/crabbox/pull/2352). Thanks @steipete.
- Enforce readiness budgets for Local Container endpoint discovery (30 seconds), Tart IP discovery (five minutes), and Scaleway public-IP discovery (five minutes), including in-flight inspections and requests. Preserve each provider's retry behavior and diagnostics, and honor earlier cancellation. [PR 2350](https://github.com/openclaw/crabbox/pull/2350), [PR 2349](https://github.com/openclaw/crabbox/pull/2349), [PR 2348](https://github.com/openclaw/crabbox/pull/2348). Thanks @steipete.
- Redact signed artifact request URLs from setup and transport errors for uploads, downloads, and manifests, while preserving the operation and underlying failure. [PR 2340](https://github.com/openclaw/crabbox/pull/2340). Thanks @steipete.
- Preserve the coordinator's reported idle timeout when resolving SSH access and updating managed lease claims, so local defaults do not overwrite remote policy. [PR 2339](https://github.com/openclaw/crabbox/pull/2339). Thanks @steipete.
- Give explicit broker heartbeats the existing mutation timeout to finish provider access refreshes, while retaining shorter automatic-heartbeat and foreground-touch deadlines, caller cancellation, and single-request behavior. [PR 2331](https://github.com/openclaw/crabbox/pull/2331). Thanks @steipete.
- Finalize abandoned pre-work admissions against their original request and authentication, preventing late responses from reopening failed history. Bookkeeping may take up to 60 seconds across three attempts after the 10-second admission allowance; the original command error remains the result, and unresolved history is reported with its run ID. Workloads are not replayed, and older stranded records are not repaired automatically. [Issue 2223](https://github.com/openclaw/crabbox/issues/2223), [PR 2227](https://github.com/openclaw/crabbox/pull/2227). Thanks @steipete.
- Recover abandoned external-provider slug reservation locks on Windows so subsequent reservations can acquire and release them normally. [PR 2292](https://github.com/openclaw/crabbox/pull/2292). Thanks @zozo123.
- Let admin commands reuse an already-authorized GitHub broker session when no explicit admin token is configured. Explicit tokens retain precedence, and authorization remains with the coordinator. [PR 1714](https://github.com/openclaw/crabbox/pull/1714). Thanks @steipete.

### Maintenance

- Refresh the default Tart macOS Sequoia image to the publisher's September 5 image, with verified manifest and VM configuration hashes.
- Consolidate configuration and flag ownership for Docker Sandbox, Tart, Codespaces, Islo, Boxd, Static, Hyper-V, Windows Sandbox, Local Container, and Actions while preserving configured values, input precedence, and saved settings. [PR 2327](https://github.com/openclaw/crabbox/pull/2327), [PR 2329](https://github.com/openclaw/crabbox/pull/2329), [PR 2332](https://github.com/openclaw/crabbox/pull/2332), [PR 2333](https://github.com/openclaw/crabbox/pull/2333), [PR 2334](https://github.com/openclaw/crabbox/pull/2334), [PR 2335](https://github.com/openclaw/crabbox/pull/2335).
- Share primary machine-class selection across DigitalOcean, Linode, OVH, Scaleway, Hetzner, GCP, TencentCloud, Phala, Namespace Devbox, and Vultr while retaining provider-owned defaults, native overrides, and fallback mappings. [PR 2344](https://github.com/openclaw/crabbox/pull/2344), [PR 2345](https://github.com/openclaw/crabbox/pull/2345), [PR 2346](https://github.com/openclaw/crabbox/pull/2346).
- Clarify that configured Actions fields and workflow-input inspection belong to hydration; standalone dispatch sends only explicitly supplied fields. [PR 2330](https://github.com/openclaw/crabbox/pull/2330).

## 0.61.0 - 2026-09-17

### Highlights

- **Complete installations now include a native runtime pack.** Matching Linux, macOS, and Windows companions handle supported filesystem operations, and the Linux companions let independent Linux and WSL2 SSH commands run without Bash.
- **Safer file copies and more accurate test results.** Archive copies validate before replacing the destination and record recovery decisions durably. JUnit collection preserves report bytes and counts paths to the same file only once.
- **Inspect macOS toolchains before running tests.** Preflight reports the platform and effective developer-tool selection, with opt-in Swift, Xcode, Homebrew, and Bash version probes.
- **More reliable lease reuse and sync.** Preserve recorded idle policy, refresh workspace ownership when replacing leases, and avoid retaining stale nested caches or losing track of previously synced files.

### Upgrade notes

- Keep the complete `crabbox-runtime/` directory beside the real CLI executable when installing a release archive; Homebrew installs the complete distribution. Every pack contains amd64 and arm64 companions for Linux, macOS, and Windows and is bound to its matching controller. Reinstall the matching archive or Homebrew package if an official installation's pack is missing or incomplete; do not mix packs between builds. `go install` remains CLI-only: a source-built CLI can compile the filesystem helper locally with Go 1.26 or newer, but retains shell-backed command supervision. [PR 1556](https://github.com/openclaw/crabbox/pull/1556), [PR 2300](https://github.com/openclaw/crabbox/pull/2300).
- Running an independent argv command without Bash requires the complete runtime pack and a Linux or WSL2 SSH target. Existing Bash login behavior is retained when Bash is available; explicit `--shell` and Bash scripts still require it. Newly generated Linux readiness scripts use POSIX `sh`, but existing images and readiness scripts are not upgraded in place, and initial provisioning retains its own prerequisites. The new `bash` preflight probe is opt-in through `--preflight --preflight-tools default,bash`; missing Bash is diagnostic, not a request to install it. [PR 2300](https://github.com/openclaw/crabbox/pull/2300), [PR 2296](https://github.com/openclaw/crabbox/pull/2296).
- Interrupted archive copies from older releases now stop when they encounter `.crabbox-cp-transaction` or `.crabbox-cp-backup` sidecars. Inspect the destination and backup, then use `cp --recover keep-destination` or `cp --recover restore-backup` for that exact destination; recovery retains the old marker and unselected data and prints their location. New copies use a private persistent journal outside the transferred tree; keep it until recovery completes. Archive fallback remains limited to POSIX operator hosts and native Linux/macOS SSH targets; native Windows copy still needs a provider-native backend. SSH copy from Windows operators or to WSL2 targets still requires rsync 3.4.3 or newer on both ends. [PR 1556](https://github.com/openclaw/crabbox/pull/1556).
- Managed SSH JUnit collection now deduplicates by opened-file identity across explicit and automatic paths, so aliases no longer inflate totals; separate files with identical contents remain separate reports. Explicit collection accepts up to 4,096 paths, 64 MiB per report, and 256 MiB total. Automatic discovery keeps its 50-report, 16 MiB-per-report, and 64 MiB-total limits. Provider-native result APIs retain their existing contracts. [PR 1556](https://github.com/openclaw/crabbox/pull/1556).

### Changes

- Use one native filesystem engine for POSIX archive-copy fallback and managed SSH JUnit collection on POSIX and native Windows targets. Validate complete archives before publication, preserve report bytes, and deduplicate aliases by opened-file identity. Complete installations include all six matching filesystem companions, without requiring Go on the target. [PR 1556](https://github.com/openclaw/crabbox/pull/1556). Thanks @steipete.
- Record archive-copy publication and cleanup in destination-bound durable journals, and add explicit `cp --recover keep-destination|restore-backup` recovery for legacy sidecars. Preserve unselected destination and backup data instead of inferring an outcome from historical markers. [PR 1556](https://github.com/openclaw/crabbox/pull/1556).
- Bundle Linux command-supervision companions with complete CLI installations, discover and validate the matching runtime pack automatically, and support independent Linux/WSL2 SSH commands when Bash is absent. Add opt-in Bash version and missing-state preflight reporting on Linux, macOS, and WSL2, and generate managed-runner readiness checks with POSIX `sh` while retaining tool, bootstrap-marker, workroot, and desktop checks. [PR 2300](https://github.com/openclaw/crabbox/pull/2300), [PR 2296](https://github.com/openclaw/crabbox/pull/2296). Thanks @coygeek.
- Add `macos_platform` to default macOS preflight, reporting OS version/build, architecture, and effective developer-tool selection. Offer opt-in `swift`, `xcodebuild`, and `brew` probes with bounded execution and confirmed cleanup before the workload continues. [PR 2281](https://github.com/openclaw/crabbox/pull/2281). Thanks @coygeek.
- Keep running Islo sandboxes active through a provider-owned heartbeat capability, using a bounded no-op after observing the live state and reporting the provider's current idle policy. Paused and terminal sandboxes are not resumed by heartbeat, `--idle-timeout` is rejected, and absolute lifetime is not extended. [PR 1707](https://github.com/openclaw/crabbox/pull/1707). Thanks @zozo123.

### Fixes

- Finish the old workspace owner before replacing an unavailable lease, acquire fresh ownership before retrying sync, and avoid repeating completed cleanup when replacement acquisition fails. [PR 2293](https://github.com/openclaw/crabbox/pull/2293).
- Preserve ownership of previously synced files when attaching local Git metadata to a raw workspace, so later syncs can remove obsolete files without importing stale readiness markers. Keep pruning on the guarded manifest path, reject directory symlinks before deletion, and preserve Git-overlay caches only in individually verified directories so root-only ignore rules do not retain stale nested caches. [PR 2285](https://github.com/openclaw/crabbox/pull/2285), [PR 2291](https://github.com/openclaw/crabbox/pull/2291).
- Preserve recorded direct-lease idle timeouts across provider preparation, reuse, and repository reclaim. Honor explicit run and heartbeat replacements while keeping claim labels and coordinator registration consistent and preserving managed-coordinator policy. [PR 2288](https://github.com/openclaw/crabbox/pull/2288).
- Keep Upstash Box status age and runtime metadata tied to native observations, preserve recorded local lease policy across reuse, and omit unknown policy instead of inventing current defaults or expiry. [PR 2283](https://github.com/openclaw/crabbox/pull/2283).
- Keep concurrent AWS heartbeats responsive when SSH sources are unchanged, while retaining durable ingress repair, alarm arming, and normal access setup for changed sources. [PR 2290](https://github.com/openclaw/crabbox/pull/2290).
- Preserve local GCP lease claims during cleanup dry-runs when an instance disappears, and share the cleanup mutation boundary with Azure recovery. [PR 2297](https://github.com/openclaw/crabbox/pull/2297).
- Report discovered Parallels lease addresses consistently and surface IP-discovery failures when connecting, while preserving VM identity for best-effort status and cleanup. [PR 2301](https://github.com/openclaw/crabbox/pull/2301). Thanks @saariuslystoned.
- Preserve terminal heredocs and significant trailing whitespace in Blacksmith Testbox shell commands while retaining command output and exit status. [PR 2295](https://github.com/openclaw/crabbox/pull/2295). Thanks @shakkernerd.
- Report the effective Linode machine type in doctor diagnostics, honoring configured native types and explicit generic overrides. [PR 2298](https://github.com/openclaw/crabbox/pull/2298).
- Bound retained POSIX preflight version output before extracting its first line, while draining excess output so verbose tools finish normally. [PR 2282](https://github.com/openclaw/crabbox/pull/2282).
- Preserve caller cancellation consistently in Crownest status waits while sharing request deadlines and polling with other providers. [PR 2276](https://github.com/openclaw/crabbox/pull/2276).
- Reject overflowing day durations before checkpoint pruning or benchmark filtering, preventing very large retention ages from wrapping into short deletion windows or incorrect report cutoffs. [PR 2280](https://github.com/openclaw/crabbox/pull/2280).

### Maintenance

- Consolidate provider-owned defaults and native machine-type projections behind adapters while preserving configured values, explicit overrides, and existing selection behavior. [PR 2307](https://github.com/openclaw/crabbox/pull/2307), [PR 2308](https://github.com/openclaw/crabbox/pull/2308), [PR 2309](https://github.com/openclaw/crabbox/pull/2309), [PR 2311](https://github.com/openclaw/crabbox/pull/2311), [PR 2313](https://github.com/openclaw/crabbox/pull/2313), [PR 2314](https://github.com/openclaw/crabbox/pull/2314), [PR 2315](https://github.com/openclaw/crabbox/pull/2315), [PR 2316](https://github.com/openclaw/crabbox/pull/2316).
- Move provider-specific diagnostic connections and native display values into their adapters, and share Upstash Box/SmolVM configuration displays and Runpod/SmolVM JSON request construction while retaining ordinary loaded-config output and provider-owned transport policy. [PR 2312](https://github.com/openclaw/crabbox/pull/2312), [PR 2317](https://github.com/openclaw/crabbox/pull/2317), [PR 2318](https://github.com/openclaw/crabbox/pull/2318).
- Consolidate provider configuration bindings and value ownership for Nomad, Hostinger, Tenki, Daytona, Proxmox, Sprites, Unikraft Cloud, XCP-ng, Superserve, and MXC, while preserving input precedence, explicit values, validation, and saved configuration. [PR 2320](https://github.com/openclaw/crabbox/pull/2320), [PR 2321](https://github.com/openclaw/crabbox/pull/2321), [PR 2322](https://github.com/openclaw/crabbox/pull/2322), [PR 2323](https://github.com/openclaw/crabbox/pull/2323), [PR 2324](https://github.com/openclaw/crabbox/pull/2324), [PR 2325](https://github.com/openclaw/crabbox/pull/2325).
- Share bounded acquisition polling and cancellation-aware retry delays across providers while retaining provider-owned readiness rules, request budgets, and diagnostics. [PR 2278](https://github.com/openclaw/crabbox/pull/2278), [PR 2279](https://github.com/openclaw/crabbox/pull/2279).
- Keep CodeSandbox runtime fallback defaults aligned with declared configuration while preserving the fixed SDK workspace boundary and operation-specific budgets. [PR 1991](https://github.com/openclaw/crabbox/pull/1991). Thanks @steipete.
- Make first runs easier with a task-first README, tested Docker and Node examples, warm-reuse guidance, and responsive desktop/mobile banners. [PR 2275](https://github.com/openclaw/crabbox/pull/2275). Thanks @zozo123.
- Cancel superseded pull-request CI runs while preserving independent main-branch and manual runs. [PR 2286](https://github.com/openclaw/crabbox/pull/2286).

## 0.60.0 - 2026-09-14

### Highlights

- **Bring Git history to runners without origin access.** Opt into local-object seeding to carry complete selected histories and reachable tags alongside your working files, enabling offline historical diffs and `git describe`.
- **Run from a folder without creating a repository.** Explicit directory sync transfers an allowlisted working set through the existing POSIX/WSL SSH path, with source-tree ignore rules and normal sync safeguards.
- **More reliable sync and WSL2 startup.** Cancel content hashing and snapshot copying promptly between filesystem operations, handle directory replacements with custom state roots, and give staged WSL2 architecture probes their full execution allowance.

### Upgrade notes

- Local Git seeding is opt-in through `--git-seed-source local`, `sync.gitSeedSource: local`, or `CRABBOX_SYNC_GIT_SEED_SOURCE=local`; `sync.gitSeed` must remain enabled. It supports ordinary SSH-backed Linux, macOS, WSL2, and native Windows targets with Git. Use a raw workspace and `--no-hydrate` when Actions hydration is configured; directory sync, Actions hydration, fresh PR checkouts, ready pools, and Git overlay cannot be combined with it. Replacing an existing origin-seeded checkout requires explicit `--full-resync`. [PR 2264](https://github.com/openclaw/crabbox/pull/2264).
- Local seeding transfers complete selected Git histories: working-file excludes do not redact historical blobs. Selected objects must already be available locally, and preparation or verification failures do not fall back to origin or file-only sync. Full working files and uncompressed objects count toward sync size guardrails; separate hard limits cap the object total and bundle at 512 MiB each. Preview identities, sizes, and digest with `sync-plan --git-seed-source local --json`. [PR 2264](https://github.com/openclaw/crabbox/pull/2264).
- Directory sync requires explicit `sync.source: directory` and a nonempty `sync.include`; Git remains required for isolated `.gitignore` matching. The effective current directory is the source root, including inside an outer checkout. It supports POSIX/WSL managed-manifest SSH sync; `watch`, delegated/native-source providers, native Windows archive sync, Actions workspaces, Git-backed ready pools, Git overlay/base refs, and PR/patch modes are unsupported. In-scope nested repositories must be excluded or selected as the source root. [PR 2253](https://github.com/openclaw/crabbox/pull/2253).

### Changes

- Add offline local-object Git seeding with complete selected HEAD/base histories and reachable tags, preserving exact object identities without forwarding source remotes, hooks, or credentials. Freeze the accepted working-file snapshot with the bundle, import metadata without checking out historical files, and retain ordinary file and deletion sync. Expose seed evidence in `sync-plan` and timing JSON. [PR 2264](https://github.com/openclaw/crabbox/pull/2264). Thanks @coygeek.
- Add explicit include-only directory sync and `sync-plan` previews without creating source Git metadata. Apply source-tree `.gitignore` rules through private temporary metadata, validate the complete manifest before acquisition and again before transfer, and preserve managed-state exclusions, size limits, and guarded deletion of previously synced files. [PR 2253](https://github.com/openclaw/crabbox/pull/2253). Thanks @coygeek.

### Fixes

- Honor cancellation while copying Git snapshots and hashing sync content, bound regular-file reads to their observed size, and preserve cancellation alongside cleanup errors instead of falling back to full sync. Keep stable fingerprint encoding unchanged. [PR 2268](https://github.com/openclaw/crabbox/pull/2268), [PR 2269](https://github.com/openclaw/crabbox/pull/2269).
- Keep directory-to-file replacement sync working with custom state roots, preserving historical deletions and managed-state exclusions. Revalidate the effective protected subtree during snapshot acceptance even when ordinary ignore rules are unchanged. [PR 2266](https://github.com/openclaw/crabbox/pull/2266), [PR 2267](https://github.com/openclaw/crabbox/pull/2267).
- Give WSL2 static SSH architecture probes a 15-second execution allowance plus the existing bounded transport setup and cleanup budgets, preventing staging from consuming the whole probe deadline while respecting earlier caller deadlines. [PR 2265](https://github.com/openclaw/crabbox/pull/2265).
- Seed detached commits by their exact origin SHA before POSIX/WSL2 file sync when no containing origin tracking branch exists. Verify the commit and tree in private staging, retain ordinary file sync when the remote cannot serve the commit, and leave native Windows branch-only seeding unchanged. [PR 2261](https://github.com/openclaw/crabbox/pull/2261).
- Warn when `--expose` cannot change an existing coordinator-managed lease's Pond ports, and point to `crabbox tunnel` for forwarding an existing service. Preserve normal command execution and direct/registered port refresh. [PR 2256](https://github.com/openclaw/crabbox/pull/2256).
- Show the observed non-running Multipass state instead of a stale ready label, and leave Freestyle's absent instance type empty instead of reporting the VM name. [PR 2258](https://github.com/openclaw/crabbox/pull/2258), [PR 2257](https://github.com/openclaw/crabbox/pull/2257).

### Maintenance

- Make Cloudflare and OpenComputer cleanup-deadline tests deterministic while retaining cancellation, failed-result, and retained-session checks. [PR 2259](https://github.com/openclaw/crabbox/pull/2259), [PR 2262](https://github.com/openclaw/crabbox/pull/2262).
- Bound staged Windows launcher test output draining and retain bounded architecture-probe failure diagnostics. [PR 2254](https://github.com/openclaw/crabbox/pull/2254), [PR 2260](https://github.com/openclaw/crabbox/pull/2260).

## 0.59.0 - 2026-09-13

### Highlights

- **Linux desktops follow the browser window.** The portal controller can match the desktop resolution to the viewer, with Fit desktop available for local scaling and resize-capable TigerVNC on new local-container desktops.
- **Pause idle Islo sandboxes and resume them for reuse.** Opt into an idle-pause policy when creating a sandbox; `run --id` and `ssh` resume paused sandboxes before using them.
- **Check that Python environments actually work.** The new opt-in `python3-venv` preflight creates a disposable environment, checks Python and pip, and reports confirmed cleanup before the workload starts.
- **Qualify an existing AWS image without rebuilding it.** Protected retained-image qualification verifies source inputs, normal catalog selection, runtime smoke, and receipt rollback while preserving the borrowed AMI and snapshot.

### Upgrade notes

- Islo idle pausing is off by default. Enable `--islo-idle-pause` or `islo.idlePause: true` and choose an `--idle-timeout` longer than the expected workload: provider activity accounting is not established for long-running commands, shares, or tailnet traffic. Reuse does not rewrite the policy, and no provider deletion deadline is added. [PR 1706](https://github.com/openclaw/crabbox/pull/1706).
- Linux portal viewers now default to Match window when the server supports resizing. Recreate existing Xvfb/x11vnc local-container leases to gain resizing; explicit 8-bit desktops remain fixed-size. Direct SSH viewers retain Local scaling, and Wayland resizing depends on the installed WayVNC version and current sizing client. [PR 2075](https://github.com/openclaw/crabbox/pull/2075), [PR 2222](https://github.com/openclaw/crabbox/pull/2222).
- Select `--preflight-tools default,python3-venv` with `--preflight` on Linux, macOS, or WSL2; native Windows does not run this probe. Missing Python, venv, or pip remains diagnostic when cleanup is confirmed. Transport, ownership, or cleanup failures stop the workload, and the probe never installs host tools or reuses a project environment. [PR 2217](https://github.com/openclaw/crabbox/pull/2217).

### Changes

- Match Linux portal desktops to the viewer window with controller-only resize requests, bounded collaboration requests, and a Fit opt-out. Use TigerVNC for new local-container and public-installer XFCE desktops, and retire the stopped legacy exporter's failure marker during installer upgrades. [PR 2075](https://github.com/openclaw/crabbox/pull/2075). Thanks @vincentkoc.
- Add opt-in Islo idle pausing and explicitly resume paused sandboxes before reused runs or SSH access, preserving default creation behavior and existing retention and Stop semantics. [PR 1706](https://github.com/openclaw/crabbox/pull/1706). Thanks @zozo123.
- Add a functional `python3-venv` preflight with separate capability and cleanup results, checks of the disposable environment's Python and pip, and confirmed process, scratch-directory, and transport-stage retirement. [PR 2217](https://github.com/openclaw/crabbox/pull/2217). Thanks @coygeek.
- Qualify retained AWS images through an isolated protected catalog without reminting: admit the source and archive helpers before deployment, verify one normal-selection lease against the exact promotion revision, run the full runtime smoke, and exercise receipt rollback with borrowed-image-safe cleanup. Accept instance-store mappings beside the single verified EBS root. [PR 2225](https://github.com/openclaw/crabbox/pull/2225), [PR 2238](https://github.com/openclaw/crabbox/pull/2238). Thanks @vincentkoc.
- Add a protected image-publisher authentication check that verifies administrator access without creating leases or publishing images. [PR 2219](https://github.com/openclaw/crabbox/pull/2219). Thanks @vincentkoc.
- Show loaded Hyper-V configuration in offline text and JSON output, preserving nonsecret values without invoking Hyper-V or displaying guest credentials. [PR 2243](https://github.com/openclaw/crabbox/pull/2243).

### Fixes

- Prepare immutable image-qualification identity and deadlines before credential-dependent deployment, reject delayed admission after the work cutoff, and preserve independent cleanup ownership. [PR 2250](https://github.com/openclaw/crabbox/pull/2250). Thanks @vincentkoc.
- Recognize AWS Tailscale endpoints in Pond peers and policy diagnostics while preserving SSH discovery for leases without Tailscale enrollment. Honor help before Pond release or disconnect can act, reject malformed lifecycle arguments, and preserve literal names and the `--` separator. [PR 2246](https://github.com/openclaw/crabbox/pull/2246), [PR 2245](https://github.com/openclaw/crabbox/pull/2245).
- Return confirmed brokered Tailscale preparation failures promptly instead of replaying them, while preserving exact-attempt cancellation and recovery when provider creation is uncertain. [PR 2247](https://github.com/openclaw/crabbox/pull/2247).
- Finish reusable-workspace sync and cleanup when a witnessed child exits between liveness probes, retaining ownership whenever process absence cannot be confirmed. [PR 2248](https://github.com/openclaw/crabbox/pull/2248).
- Reject stale administrator grants before committing legacy AWS cleanup recovery, preserving the lease, audit, and cleanup wake when authorization changes. [PR 2239](https://github.com/openclaw/crabbox/pull/2239).
- Share delegated command parsing so single shell strings execute correctly and literal operator arguments remain quoted across provider transports. [PR 2233](https://github.com/openclaw/crabbox/pull/2233).
- Reject decoded negative creation sizes for Hyper-V, Multipass, Freestyle, and OpenComputer instead of silently omitting them, while preserving defaults and supported positive sizing. Keep existing-lease operations available when creation-only sizing is invalid. [PR 2242](https://github.com/openclaw/crabbox/pull/2242), [PR 2241](https://github.com/openclaw/crabbox/pull/2241), [PR 2235](https://github.com/openclaw/crabbox/pull/2235), [PR 2237](https://github.com/openclaw/crabbox/pull/2237), [PR 2244](https://github.com/openclaw/crabbox/pull/2244).
- Reject non-finite Vercel Sandbox vCPU settings during configuration validation, preserving service defaults and supported fractional values. [PR 2230](https://github.com/openclaw/crabbox/pull/2230).
- Preserve precommand cancellation and operational failure classifications in saved timing and local history, and retain Anthropic Sandbox Runtime cancellation and deadline causes without changing numeric exit codes. [PR 2217](https://github.com/openclaw/crabbox/pull/2217), [PR 2229](https://github.com/openclaw/crabbox/pull/2229).
- Prevent Corepack downloads and automatic project pinning during preflight version probes, and suppress supported pnpm secondary version and lockfile management while preserving project selection and the workload's original environment. [PR 2224](https://github.com/openclaw/crabbox/pull/2224).
- Render XFCE clients in explicitly requested 8-bit desktops by selecting an 8-bit TrueColor visual, preserving the requested depth and fixed-size Xvfb/x11vnc backend. [PR 2222](https://github.com/openclaw/crabbox/pull/2222). Thanks @vincentkoc.
- Restore native Windows architecture checks under Windows PowerShell 5.1 by using supported unsigned 16-bit types. [PR 2240](https://github.com/openclaw/crabbox/pull/2240). Thanks @vincentkoc.
- Limit artifact discovery to the possible match depth for canonical non-recursive wildcard patterns, preserving selection and recursive glob behavior. [PR 2214](https://github.com/openclaw/crabbox/pull/2214). Thanks @vincentkoc.

### Maintenance

- Consolidate provider workspace operations, command-stream handling, and sandbox lease views while retaining provider-specific behavior. [PR 2232](https://github.com/openclaw/crabbox/pull/2232), [PR 2234](https://github.com/openclaw/crabbox/pull/2234), [PR 2236](https://github.com/openclaw/crabbox/pull/2236). Thanks @steipete.
- Use a private stdin pipe for WSL2 Python preflight completion and retirement checks, preserving program bytes without staging another workload. [PR 2217](https://github.com/openclaw/crabbox/pull/2217).
- Validate documentation-site heading links against the renderer's shared heading identities, excluding fenced and commented pseudoheadings while preserving published IDs and repository-only anchor rules. [PR 2231](https://github.com/openclaw/crabbox/pull/2231).

## 0.58.0 - 2026-09-12

### Highlights

- **Keep run history after a lease is gone.** Opt into private local logs and parsed results with `--record-local`, then read them offline without a coordinator.
- **See which container image actually ran.** Docker and Podman evidence now distinguishes the requested image reference from the runtime image ID and reported repository digests, and keeps that snapshot after cleanup.
- **More reliable cleanup and lease recovery.** Finish AWS cleanup when an instance has already disappeared, recover eligible legacy cleanup from original allocation evidence, and recognize repeated fixed-ID coordinator requests without creating another machine.
- **Smoother sync and artifact collection on macOS.** Avoid scanning unrelated files in crowded directories, handle socket and FIFO state paths safely, and keep artifact matching consistent with the stock shell.

### Upgrade notes

- Local recording is off by default. Use `crabbox run --record-local -- <command>` or enable `history.local.enabled` in trusted user configuration; repository configuration cannot opt you in. Retained command output is not automatically secret-redacted. Read it with `history`, `logs`, or `results --source local`; default retention is 100 inactive records, 256 MiB, and 30 days. [PR 2141](https://github.com/openclaw/crabbox/pull/2141).
- Setting `XDG_STATE_HOME` now also selects the root for generated lease SSH keys and host trust. Keep the same root through acquisition, reuse, and cleanup; switching roots does not migrate existing keys or discover leases from the old root. Unset defaults and user-supplied keys keep their existing paths. [PR 2164](https://github.com/openclaw/crabbox/pull/2164).
- AWS legacy cleanup recovery is administrator-only and requires authenticated evidence of the original allocation. Missing account or Region authority leaves cleanup unresolved; an absent instance alone does not prove that owned keys and access resources are cleaned up. [PR 1904](https://github.com/openclaw/crabbox/pull/1904), [PR 1975](https://github.com/openclaw/crabbox/pull/1975).

### Changes

- Add private local run history with bounded logs, parsed results, explicit source provenance, and offline readback after lease cleanup. Support `--source local|coordinator|all`, bounded pruning, and deletion of inactive records while preserving existing coordinator defaults. [PR 2141](https://github.com/openclaw/crabbox/pull/2141). Thanks @coygeek.
- Record Docker and Podman creation references, runtime image IDs, and reported repository digests in run evidence, timing JSON, retained inspection, and opt-in local history. Preserve the initial snapshot through bootstrap and cleanup; unavailable digests remain explicit, and the observation is not a signed filesystem attestation. [PR 2202](https://github.com/openclaw/crabbox/pull/2202). Thanks @coygeek.
- Add a credential-free local-container quickstart skill and make both Crabbox skills discoverable by installers, with validated catalog metadata and an installation guide that works on narrow screens. [PR 1911](https://github.com/openclaw/crabbox/pull/1911). Thanks @zozo123.
- AWS: complete cleanup after a verified empty instance response without skipping owned keys, bind new leases to their original account and Region, and recover eligible legacy cleanup using original CloudTrail allocation evidence with an atomic recovery audit. [PR 1904](https://github.com/openclaw/crabbox/pull/1904), [PR 1975](https://github.com/openclaw/crabbox/pull/1975). Thanks @vincentkoc.
- Keep portable workspace ownership exclusive when a runner reports successful directory creation after losing a creation race. [PR 2201](https://github.com/openclaw/crabbox/pull/2201).
- Recognize identical fixed-ID coordinator replays of terminal leases separately from conflicting create requests, without repeating provider creation. [PR 1925](https://github.com/openclaw/crabbox/pull/1925). Thanks @Melbourneandrew.
- Honor an explicit `XDG_STATE_HOME` for generated lease SSH keys and host trust, including isolated-root reuse and cleanup, while retaining private storage permissions. [PR 2164](https://github.com/openclaw/crabbox/pull/2164). Thanks @coygeek.
- Resolve macOS managed-state path spelling with bounded metadata queries instead of scanning sibling files. Handle Unix sockets and FIFOs without opening them, so crowded temporary directories do not block sync preparation. [PR 2187](https://github.com/openclaw/crabbox/pull/2187), [PR 2207](https://github.com/openclaw/crabbox/pull/2207).
- Collect nested artifact globs from safe literal directory prefixes without traversing unrelated siblings. Keep matching case-sensitive on macOS when `nocaseglob` is enabled, while preserving explicit `nocasematch` behavior, archive membership, and collection limits. [PR 2162](https://github.com/openclaw/crabbox/pull/2162), [PR 2208](https://github.com/openclaw/crabbox/pull/2208). Thanks @vincentkoc.
- Nomad: bound finite control-plane requests, retain durable recovery identity when registration is uncertain, and preserve caller cancellation and established execution streams. [PR 1916](https://github.com/openclaw/crabbox/pull/1916). Thanks @SebTardif.
- GCP: preserve capacity fallback when a bounded error summary omits retry evidence, while keeping displayed diagnostics redacted and bounded. [PR 1987](https://github.com/openclaw/crabbox/pull/1987). Thanks @steipete.
- Linode: record the actual selected instance type when an explicit type contains only whitespace. [PR 2186](https://github.com/openclaw/crabbox/pull/2186).

### Maintenance

- Consolidate shared provider configuration, SSH access, cleanup, storage, and coordinator helpers, preserving provider-owned behavior and existing CLI, configuration, and wire formats. [PR 2171](https://github.com/openclaw/crabbox/pull/2171), [PR 2205](https://github.com/openclaw/crabbox/pull/2205). Thanks @steipete.
- Remove obsolete provider and checkpoint forwarding layers and strengthen cross-platform fixtures, lifecycle checks, and coordinator storage tests. [PR 2204](https://github.com/openclaw/crabbox/pull/2204), [PR 2206](https://github.com/openclaw/crabbox/pull/2206). Thanks @steipete.

## 0.57.0 - 2026-09-11

### Highlights

- **Run commands on existing Daytona fixed-ID leases.** The new `crabbox exec` streams commands without workspace sync or hydration and keeps repository ownership protected until transport cleanup finishes.
- **Smoother XFCE desktops.** Prevent duplicate panels and notification-area warnings, start the visible terminal inside the desktop session, and refresh panel styling without restarting the rest of the desktop.
- **Safer Daytona fixed-lease cleanup and expiry recovery.** Verify API-key organization identity during cleanup, reconcile leases deleted by native TTL or external actions, and use `stop --current-repo` for repository-scoped cleanup.
- **See more provider settings offline.** Inspect Freestyle, Crownest, OpenComputer, OpenSandbox, and CUA configuration in text and JSON, including providers that are not currently selected.

### Upgrade notes

- `exec` initially supports completed direct Daytona fixed-ID Linux leases; `stop --current-repo` provides repository-scoped cleanup for that direct fixed-ID route. Check capabilities with `crabbox exec --check --provider daytona` before allocating; other providers, ordinary leases, coordinator routes, and Windows targets are not supported by these execution and cleanup modes. [PR 2119](https://github.com/openclaw/crabbox/pull/2119).
- `exec` leaves the SSH account's initial working directory unchanged and requires piped or redirected stdin; use `</dev/null` when no input is needed and an explicit shell command to change directories. Non-PTY streams preserve bytes; `--pty` uses terminal semantics. [PR 2119](https://github.com/openclaw/crabbox/pull/2119).
- Daytona fixed-lease cleanup with API keys requires organization metadata from the current-key endpoint. Older servers that omit it require an OAuth organization profile for cleanup; a bare 404 or elapsed TTL does not prove that a sandbox has been removed. [PR 2111](https://github.com/openclaw/crabbox/pull/2111).
- New XFCE bootstrap runs retain `crabbox-desktop-session.service` as an alias of `crabbox-desktop.service` so released clients can still reset the desktop. Panel refresh does not clear existing terminal color or menu caches. [PR 2117](https://github.com/openclaw/crabbox/pull/2117).

### Changes

- Add `crabbox exec` for commands on completed Daytona fixed-ID leases without workspace sync or hydration. Forward non-PTY streams without rewriting their bytes, resolve fresh SSH access, and retain the repository claim through command execution and local transport cleanup. [PR 2119](https://github.com/openclaw/crabbox/pull/2119). Thanks @steipete.
- Add offline `exec --check` capability discovery and `stop --current-repo` cleanup for supported fixed-ID leases. Validate repository ownership under the same lock used for deletion, so cleanup waits for active `exec` commands and a previous owner cannot delete a lease after another repository reclaims it. [PR 2119](https://github.com/openclaw/crabbox/pull/2119). Thanks @steipete.
- Let XFCE own its panel, window manager, desktop renderer, and visible-terminal autostart. Apply theme changes through the matching user session, restart only the existing panel when its CSS changes, and leave unchanged styling alone to prevent duplicate components and notification-area warnings. [PR 2117](https://github.com/openclaw/crabbox/pull/2117). Thanks @steipete.
- Daytona: verify fixed-lease cleanup with API keys against current-key organization metadata and reconcile acquired fixed leases after confirmed native TTL or external deletion. Inspection records a terminal tombstone without issuing deletion or recreating the fixed ID; incomplete or ambiguous cleanup retains the claim. [PR 2111](https://github.com/openclaw/crabbox/pull/2111). Thanks @steipete.
- Show Freestyle, Crownest, OpenComputer, OpenSandbox, and CUA settings in offline `config show` text and JSON, including unselected providers. Preserve explicit zero/false values and URL redaction, report only already-loaded key presence, and avoid credential discovery, external default resolution, or SDK bridge execution. [PR 2104](https://github.com/openclaw/crabbox/pull/2104), [PR 2112](https://github.com/openclaw/crabbox/pull/2112). Thanks @steipete.
- Include recognized workspace-owner protocol states in child and phase-witness inspection errors, making ownership failures easier to diagnose while preserving ownership decisions and retry behavior. [PR 2106](https://github.com/openclaw/crabbox/pull/2106). Thanks @steipete.

### Maintenance

- Go installation verification: retry recognized checksum-service and module-ZIP HTTP/2 interruptions once during dependency download, retaining checksum enforcement and the unchanged offline install checks. [PR 2113](https://github.com/openclaw/crabbox/pull/2113), [PR 2118](https://github.com/openclaw/crabbox/pull/2118). Thanks @steipete.
- Move existing local, cloud, VPS, and runtime configuration displays into provider adapters while preserving published fields, text positions, redaction, and zero/false/null/empty values. [PR 2110](https://github.com/openclaw/crabbox/pull/2110), [PR 2116](https://github.com/openclaw/crabbox/pull/2116), [PR 2120](https://github.com/openclaw/crabbox/pull/2120), [PR 2121](https://github.com/openclaw/crabbox/pull/2121), [PR 2127](https://github.com/openclaw/crabbox/pull/2127). Thanks @steipete.
- Share default and compact JSON request construction across provider adapters while retaining exact wire formats, nil-body handling, request replay, and provider-owned authentication, timeout, and retry policies. [PR 2122](https://github.com/openclaw/crabbox/pull/2122), [PR 2124](https://github.com/openclaw/crabbox/pull/2124), [PR 2125](https://github.com/openclaw/crabbox/pull/2125). Thanks @steipete.
- Share buffered JSON response decoding for E2B, CubeSandbox, and Azure Dynamic Sessions while keeping body closing, successful header copies, and typed API errors in their adapters. [PR 2126](https://github.com/openclaw/crabbox/pull/2126). Thanks @steipete.
- Reuse the shared exact tag codecs in DigitalOcean, Linode, and Scaleway without changing their tag formats. [PR 2091](https://github.com/openclaw/crabbox/pull/2091). Thanks @vincentkoc.
- Select Linode paginated resource types at their call sites, preserving page traversal, ordering, duplicates, and results collected before a later page fails. [PR 2123](https://github.com/openclaw/crabbox/pull/2123). Thanks @steipete.
- Reuse shared loopback-host validation and request-envelope test assertions while preserving URL validation errors and exact wire checks. [PR 2129](https://github.com/openclaw/crabbox/pull/2129), [PR 2130](https://github.com/openclaw/crabbox/pull/2130). Thanks @vincentkoc and @steipete.

## 0.56.0 - 2026-09-11

### Highlights

- **More reliable native Windows runners.** Start with working Node/npm on PATH and launch detached daemons that survive command and SSH-session exit.
- **Understand configuration and preflight tools offline.** See explicit settings separately from defaults, and discover accepted tool names and target support with the new `crabbox preflight-tools` command.
- **Less setup work on restored Linux desktops.** Reuse installed desktop packages and a working Chrome or Chromium instead of repeating package transactions and browser downloads.
- **Replay Daytona warmups and checkpoint forks.** Use fixed IDs to recover the same operation while preserving its organization, repository, and original lease deadline; explicit stop can wait for confirmed deletion beyond 30 seconds.
- **Safer Sprites reuse and earlier sync errors.** Keep Sprites operations on the configured account, verify ownership before reuse, and catch missing sparse-checkout files before SSH lease work.

### Upgrade notes

- Recreate existing managed native Windows leases to receive the Node/npm baseline and `Start-CrabboxDetachedProcess.ps1`. Use that launcher for daemons that must survive SSH-session exit; ordinary `Start-Process` children remain subject to OpenSSH session cleanup. Healthy existing Node/npm installations are retained. [PR 2069](https://github.com/openclaw/crabbox/pull/2069), [PR 2074](https://github.com/openclaw/crabbox/pull/2074).
- Sprites reuse without a local ownership claim requires explicit `--reclaim`, even when Crabbox labels match. Plain `status` stays API-only and reports `ready=false`; use `status --wait` to probe SSH with the existing key, or a normal reuse command to retry bootstrap. [PR 2077](https://github.com/openclaw/crabbox/pull/2077).
- Restored Linux desktop images retain their working package-installed browser at its existing version. Update browsers when maintaining or rebaking the image; per-lease configuration and readiness checks still run. [PR 2073](https://github.com/openclaw/crabbox/pull/2073).

### Changes

- Managed native Windows: install checksum-pinned Node 24.19.0/npm when either is missing or broken, require both for readiness, and update the developer-image default pin while preserving overrides. Refresh PowerShell PATH from machine/user settings and verify fresh SSH connections after bootstrap restarts the service. [PR 2069](https://github.com/openclaw/crabbox/pull/2069), [PR 2074](https://github.com/openclaw/crabbox/pull/2074). Thanks @steipete.
- Add `Start-CrabboxDetachedProcess.ps1` for native Windows daemons that survive command and SSH-session exit with a private hidden console, preserving ordinary command timeouts and workspace ownership. [PR 2069](https://github.com/openclaw/crabbox/pull/2069). Thanks @steipete.
- Distinguish explicit provider settings, generic inputs, and defaults in offline `config show` text and JSON. Provider catalogs describe possible authentication methods while leaving authentication and live readiness unchecked. [PR 2090](https://github.com/openclaw/crabbox/pull/2090), [Issue 1465](https://github.com/openclaw/crabbox/issues/1465). Thanks @coygeek.
- Discover accepted preflight names, defaults, and target support offline with `crabbox preflight-tools [--json]`; unknown names point to the installed-binary catalog before lease acquisition. [PR 2081](https://github.com/openclaw/crabbox/pull/2081), [Issue 1589](https://github.com/openclaw/crabbox/issues/1589). Thanks @coygeek.
- Managed Linux: reuse installed desktop packages and a working package-installed Chrome or Chromium on restored images, avoiding redundant package transactions and browser repository downloads while preserving per-lease configuration and readiness checks. [PR 2073](https://github.com/openclaw/crabbox/pull/2073). Thanks @steipete.
- Daytona: support fixed warmup and checkpoint-fork IDs with durable, organization-bound replay and cleanup, preserving original lease deadlines and explicit repository transfers without recreating released operations. [PR 1700](https://github.com/openclaw/crabbox/pull/1700). Thanks @steipete.
- Daytona: let signal- or deadline-owned `stop` and its `release` alias wait for confirmed deletion beyond the 30-second automatic-cleanup cap; retain the bounded fallback for non-cancelable callers and existing run/watch cleanup and rollback budgets. [PR 2089](https://github.com/openclaw/crabbox/pull/2089). Thanks @steipete.
- Daytona: send the organization header exactly once so direct control-plane calls with a Daytona CLI OAuth profile no longer fail with 403 "Invalid authentication context". [PR 1700](https://github.com/openclaw/crabbox/pull/1700). Thanks @steipete.
- Sprites: keep API, bootstrap, and SSH commands on the configured account and endpoint; validate ownership before reuse, require explicit adoption without a local claim, keep plain status observational, use native tool checks for readiness, and safely recover already-deleted resources. [PR 1776](https://github.com/openclaw/crabbox/pull/1776), [PR 2077](https://github.com/openclaw/crabbox/pull/2077). Thanks @aezell and @Patrick-Erichsen.
- Validate sparse-checkout and skip-worktree sync scope before SSH lease work, explain how to materialize or exclude missing tracked files, and rebuild the final manifest after acquisition. [PR 2097](https://github.com/openclaw/crabbox/pull/2097), [Issue 1567](https://github.com/openclaw/crabbox/issues/1567). Thanks @coygeek.
- Include the resolved `workroot` in SSH-backed inspect/status JSON, including native Windows and WSL2 leases. [PR 2069](https://github.com/openclaw/crabbox/pull/2069). Thanks @steipete.
- Show Phala settings in offline configuration text and JSON, preserving unset versus explicit attestation settings without invoking the provider CLI. [PR 2099](https://github.com/openclaw/crabbox/pull/2099). Thanks @steipete.

### Maintenance

- Consolidate Agent Sandbox, AWS Lambda MicroVM, Namespace Devbox, and Namespace Instance configuration bindings while preserving input precedence, explicit values, validation order, and provider lifecycle behavior. [PR 2078](https://github.com/openclaw/crabbox/pull/2078), [PR 2079](https://github.com/openclaw/crabbox/pull/2079), [PR 2080](https://github.com/openclaw/crabbox/pull/2080), [PR 2082](https://github.com/openclaw/crabbox/pull/2082). Thanks @steipete.
- Consolidate Coder, Multipass, Machine0, Nebius, and NVIDIA Brev configuration bindings and defaults while preserving source accounting, raw values, saved-file semantics, and provider validation. [PR 2083](https://github.com/openclaw/crabbox/pull/2083), [PR 2084](https://github.com/openclaw/crabbox/pull/2084), [PR 2086](https://github.com/openclaw/crabbox/pull/2086), [PR 2092](https://github.com/openclaw/crabbox/pull/2092), [PR 2093](https://github.com/openclaw/crabbox/pull/2093). Thanks @steipete.
- Consolidate Blacksmith, Incus, Firecracker, Phala, and Freestyle configuration bindings while preserving explicit false/zero/unset values, input admission, ordered validation, and runtime ownership. [PR 2094](https://github.com/openclaw/crabbox/pull/2094), [PR 2095](https://github.com/openclaw/crabbox/pull/2095), [PR 2096](https://github.com/openclaw/crabbox/pull/2096), [PR 2098](https://github.com/openclaw/crabbox/pull/2098), [PR 2100](https://github.com/openclaw/crabbox/pull/2100). Thanks @steipete.
- Share provider flag-presence checks and duration/integer parsing while preserving explicit empty/default/false/zero inputs and existing validation behavior. [PR 2035](https://github.com/openclaw/crabbox/pull/2035), [PR 2085](https://github.com/openclaw/crabbox/pull/2085), [PR 2087](https://github.com/openclaw/crabbox/pull/2087), [PR 2088](https://github.com/openclaw/crabbox/pull/2088). Thanks @vincentkoc and @steipete.
- Share Doctor check-severity aggregation across providers and telemetry sample ordering/deduplication across coordinator consumers, retaining CLI check precedence and existing telemetry history limits. [PR 2070](https://github.com/openclaw/crabbox/pull/2070), [PR 2071](https://github.com/openclaw/crabbox/pull/2071). Thanks @steipete.

## 0.55.0 - 2026-09-09

### Highlights

- **More reliable managed macOS runners.** Start with working Node/npm, acquire workspace ownership without extra lock utilities, and let detached daemons run without keeping completed commands waiting.
- **Safer host pinning and lease recovery.** Protect occupied and retained hosts, repair stale coordinator reservations, and give administrators explicit reservation inspection and recovery commands.
- **Less waiting on unavailable AWS capacity.** Move definitive capacity rejections directly to an already configured fallback, while keeping explicitly requested instance types exact.
- **Safer checkpoints and artifact downloads.** Release local checkpoint reservations when preparation fails before submission, and retrieve Blacksmith run artifacts through bounded native file downloads.
- **Linux images keep the selected pnpm default.** Activate pnpm for the actual runtime user and verify that default offline through source, candidate, and promoted-image checks; qualification bundles also preserve publisher rollback.

### Upgrade notes

- Managed macOS warmup now completes SSH session setup and checks both Node and npm, including when an older coordinator omitted the baseline. Missing tools receive checksum-pinned Node 24.19.0 on Intel or Apple Silicon; healthy existing installations are retained. [PR 2051](https://github.com/openclaw/crabbox/pull/2051).
- Update self-hosted coordinators for host reservation repair and the new admin inspection/clear routes. Org-member AWS Mac host pins require an exact coordinator allocation record for the host, current org, and region; historical leases do not grant pin access. Reuse an occupied or retained lease by its exact ID, or stop it before requesting a new lease on that host. [PR 2049](https://github.com/openclaw/crabbox/pull/2049), [PR 2057](https://github.com/openclaw/crabbox/pull/2057).
- Blacksmith artifact collection requires a client with `testbox download` (verified in Blacksmith 0.4.57 and 0.4.58), OpenSSH `scp`, and compatible `ps` on macOS or Linux. Existing limits remain 256 files, 10 MiB compressed, and one 30-second collection deadline covering transfer and validation. [PR 2043](https://github.com/openclaw/crabbox/pull/2043).
- Rebuild or rebake Linux developer images to receive the runtime user's pnpm-default fix. Image checks preserve the resolved default without network access or reactivation; project package-manager pins retain their existing behavior. [PR 2065](https://github.com/openclaw/crabbox/pull/2065).

### Changes

- Managed macOS: initialize SSH sessions through PAM so stock `nohup` can detach in the user's launchd context, retain key-only authentication, and use fresh bootstrap connections. Close internal command-wrapper pipes before user execution so detached daemons do not hold completed commands open. [PR 2051](https://github.com/openclaw/crabbox/pull/2051). Thanks @steipete.
- Managed macOS: install checksum-pinned Node 24.19.0 when Node/npm are missing, complete older coordinators' bootstrap during warmup, and require both tools for readiness. Share an atomic-directory workspace gate across POSIX owner updates and child witnesses so `flock` or `lockf` is not required, while preserving fail-closed recovery. [PR 2051](https://github.com/openclaw/crabbox/pull/2051). Thanks @steipete.
- Reject occupied host pins and coordinator replies with a different lease ID before bootstrap or cleanup, and show retained leases in ordinary text and JSON listings. Permit org-member AWS Mac host pins only through an exact host/org/region allocation record, preserving admin-only access for missing, ambiguous, or other-org records. [PR 2049](https://github.com/openclaw/crabbox/pull/2049). Thanks @steipete.
- Repair stale coordinator host associations against canonical lease state during pinned creation, preserving in-flight and retained instances. Add `admin hosts reservation` inspection and guarded `admin hosts clear` recovery without terminating instances or discarding cleanup obligations. [PR 2057](https://github.com/openclaw/crabbox/pull/2057). Thanks @steipete.
- AWS: hand definitive instance-capacity rejections directly to an already configured type or market fallback, avoiding repeated requests to unavailable capacity while retaining exact-type, macOS, private-workspace, and transient-error retries. [PR 2046](https://github.com/openclaw/crabbox/pull/2046). Thanks @steipete.
- Preserve recorded broker network diagnostics in inspect/status JSON, including SSH source CIDRs and AWS placement fields, without adding provider requests or changing the resolved network mode. [PR 2039](https://github.com/openclaw/crabbox/pull/2039). Thanks @vincentkoc.
- Allow the existing bodyless coordinator GET/HEAD curl fallback after a dial-local timeout while the request budget remains live, without replaying mutations or extending deadlines. Show the recorded provisioning cause when cleanup is pending, preserving a primary failure when present and omitting empty error details. [PR 2044](https://github.com/openclaw/crabbox/pull/2044), [PR 2054](https://github.com/openclaw/crabbox/pull/2054). Thanks @vincentkoc and @steipete.
- Release the exact local checkpoint reservation and return the non-submission receipt when brokered native source preparation fails before any checkpoint or image request. Preserve uncertain coordinator submissions for recovery. [PR 2042](https://github.com/openclaw/crabbox/pull/2042). Thanks @steipete.
- Transfer Blacksmith run artifacts through bounded native file download instead of bulk stdout, preserving the original collection deadline and shared claim while isolating each invocation's evidence. [PR 2043](https://github.com/openclaw/crabbox/pull/2043). Thanks @steipete.
- Linux developer-image builder: seed the selected pnpm default for the runtime user after privileged preparation, then reject offline source, candidate, or promoted-image default drift without changing project pins. [PR 2065](https://github.com/openclaw/crabbox/pull/2065). Thanks @vincentkoc.
- Include the Linux smoke script in image qualification bundles and admit publisher cleanup-owned rollback while keeping promotion rollback armed until the transaction completes. [PR 2062](https://github.com/openclaw/crabbox/pull/2062). Thanks @vincentkoc.
- Restore omission of ignored empty and zero provider settings when updating user configuration, while preserving explicit clears and meaningful false/zero overrides. [PR 2053](https://github.com/openclaw/crabbox/pull/2053). Thanks @steipete.

### Maintenance

- Consolidate Scaleway and Tencent Cloud configuration bindings and runtime defaults while preserving location/endpoint overrides, list-input behavior, 64-bit sizes, raw values, and explicit type precedence. [PR 2036](https://github.com/openclaw/crabbox/pull/2036), [PR 2041](https://github.com/openclaw/crabbox/pull/2041). Thanks @steipete.
- Consolidate DigitalOcean, Vultr, and Linode file/environment bindings without adding provider flags, preserving image and type selection, raw boot settings, list behavior, and saved-file omission. [PR 2045](https://github.com/openclaw/crabbox/pull/2045), [PR 2050](https://github.com/openclaw/crabbox/pull/2050), [PR 2052](https://github.com/openclaw/crabbox/pull/2052). Thanks @steipete.
- Consolidate Lambda, KubeVirt, and Sealos DevBox configuration ownership while preserving structured mounts, YAML diagnostics, key sources, local versus guest paths, explicit release choices, and saved-file semantics. [PR 2055](https://github.com/openclaw/crabbox/pull/2055), [PR 2058](https://github.com/openclaw/crabbox/pull/2058), [PR 2056](https://github.com/openclaw/crabbox/pull/2056). Thanks @steipete.
- Consolidate Apple Container, Apple Machine, Apple VM, and Local Container settings while preserving distinct flags, legacy configuration names, ordered validation, image/checksum updates, explicit values, and runtime-only state. [PR 2059](https://github.com/openclaw/crabbox/pull/2059), [PR 2061](https://github.com/openclaw/crabbox/pull/2061), [PR 2063](https://github.com/openclaw/crabbox/pull/2063). Thanks @steipete.
- Share accepted local-path expansion, XCP-ng selector overlays, and offline SSH display defaults while preserving input precedence, raw values, provider guards, saved markers, and runtime ownership boundaries. [PR 2060](https://github.com/openclaw/crabbox/pull/2060), [PR 2064](https://github.com/openclaw/crabbox/pull/2064), [PR 2066](https://github.com/openclaw/crabbox/pull/2066). Thanks @steipete.

## 0.54.0 - 2026-09-09

### Highlights

- **More reliable managed WSL2 runners.** Run Linux workloads as the non-root `crabbox` user with Node/npm ready on PATH, keep detached daemons alive between commands, and avoid headless WSLg and cloud-init startup stalls.
- **Less coordinator overhead and faster failure detection.** Avoid repeated work over ended lease history, reject confirmed-deleted execution targets before SSH, and recover one transient lease-read failure without replaying the workload.
- **Offline-ready Linux toolchains.** The developer-image builder now carries verified Node 24.19.0, Go 1.27.0, Bun 1.4.0, and reusable pnpm archives, with offline execution checks and protection for operator-owned tool paths.
- **Choose Ubuntu 24.04 for image publication.** Select it explicitly while Ubuntu 26.04 remains the default, with promotion and receipt-based rollback scoped to the selected OS.

### Upgrade notes

- **Reprovision existing managed WSL2 leases** to receive the bootstrap fixes. New managed workloads run as `crabbox` with passwordless sudo and writable work/cache directories; use `sudo` for operations that require root. [PR 1996](https://github.com/openclaw/crabbox/pull/1996), [PR 2005](https://github.com/openclaw/crabbox/pull/2005), [PR 2016](https://github.com/openclaw/crabbox/pull/2016).
- Headless managed WSL2 bootstrap sets `guiApplications=false` in the Windows SSH user's `.wslconfig`, preserving other settings. Explicit desktop/browser requests retain the existing GUI configuration. WSL2 status probes allow up to 30 seconds; other SSH targets retain four seconds. [PR 1996](https://github.com/openclaw/crabbox/pull/1996), [PR 2005](https://github.com/openclaw/crabbox/pull/2005).
- The pinned Node/Go/Bun archives apply to newly built or rebaked Linux x86_64 developer images. Managed WSL2 installs the Node/npm subset, without the full image's Go, Docker, browser tools, pnpm activation, or offline pnpm archives. Updating the CLI does not rebake or replace existing images. [PR 1944](https://github.com/openclaw/crabbox/pull/1944), [PR 2006](https://github.com/openclaw/crabbox/pull/2006), [PR 2008](https://github.com/openclaw/crabbox/pull/2008), [PR 2009](https://github.com/openclaw/crabbox/pull/2009).
- Image publication accepts `linux_os=ubuntu:24.04` or `ubuntu:26.04`, defaulting to 26.04. Standalone Linux minting accepts `CRABBOX_OS`; explicit image overrides still take precedence, so the selector alone does not verify the guest OS or qualify an image. [PR 2028](https://github.com/openclaw/crabbox/pull/2028).

### Changes

- Managed WSL2: disable redundant cloud-init discovery, verify cold-start Linux readiness before accepting bootstrap, and disable the unused WSLg compositor on headless leases while preserving other WSL settings and existing execution deadlines. [PR 1996](https://github.com/openclaw/crabbox/pull/1996), [PR 2005](https://github.com/openclaw/crabbox/pull/2005). Thanks @steipete.
- Managed WSL2: install the shared Node/npm baseline and require both tools for readiness; run workloads as the non-root `crabbox` user with passwordless sudo, writable work/cache directories, and the managed Node path available. Keep the distribution alive between commands so detached Linux daemons survive until lease cleanup. [PR 2008](https://github.com/openclaw/crabbox/pull/2008), [PR 2016](https://github.com/openclaw/crabbox/pull/2016). Thanks @steipete.
- Keep WSL2 workspace-owner renewal small and allow bounded workload contention while preserving token, expiry, and child-state checks. [PR 2011](https://github.com/openclaw/crabbox/pull/2011). Thanks @steipete.
- Reduce coordinator maintenance work for large lease histories: prepare relevant candidates once per pass, select bridge cleanup from live owners and existing records, and limit pool and provisioning lookups while preserving current-state ownership checks and wakeups. [PR 1997](https://github.com/openclaw/crabbox/pull/1997), [PR 2001](https://github.com/openclaw/crabbox/pull/2001). Thanks @steipete.
- Reject run preparation on confirmed-deleted coordinator leases before SSH setup, keeping inspection and release available for recovery. [PR 2001](https://github.com/openclaw/crabbox/pull/2001). Thanks @steipete.
- Retry an exact coordinator lease read once on HTTP 5xx during run preparation, sharing the original deadline and preserving cancellation and reply-identity checks; SSH, scripts, permanent failures, and ordinary status reads are not replayed. [PR 1999](https://github.com/openclaw/crabbox/pull/1999).
- Linux developer-image builder: retain verified Node 24.19.0 and pnpm 11.22.0/12.3.4 archives, enforce the selected Node major, and verify an exact NodeSource package before retiring owned aliases on explicit Node 24-to-22 rebakes. Preserve operator-owned tool paths and public Yarn aliases. [PR 1944](https://github.com/openclaw/crabbox/pull/1944). Thanks @vincentkoc.
- Linux developer-image builder: bake checksum-pinned Go 1.27.0 with offline standard-library and CGO checks. Seed verified Node/Go copies and private Corepack shims into eligible quiescent native GitHub runners' default tool caches, correctly reading systemd's manager environment while preserving custom roots, existing slots, and operator-owned Go aliases. [PR 2006](https://github.com/openclaw/crabbox/pull/2006). Thanks @vincentkoc.
- Linux developer-image builder: add verified Bun 1.4.0 baseline and optimized archives, keep the portable baseline on the normal PATH, and require guest-compatible nonroot offline TypeScript, test, bundle, and local `bunx` checks. Preserve operator-owned tool paths across rebakes. [PR 2009](https://github.com/openclaw/crabbox/pull/2009). Thanks @vincentkoc.
- Add explicit Ubuntu 24.04 developer-image publication selection, retaining Ubuntu 26.04 by default and carrying the selected Linux OS through promotion and receipt rollback. [PR 2028](https://github.com/openclaw/crabbox/pull/2028). Thanks @vincentkoc.

### Maintenance

- Consolidate configuration bindings and shared defaults for Anthropic Sandbox Runtime, Cloud Run Sandbox, FastAPI Cloud, Railway, and Upstash Box while preserving source precedence, explicit clearing, native defaults, and credential boundaries. [PR 1993](https://github.com/openclaw/crabbox/pull/1993), [PR 2000](https://github.com/openclaw/crabbox/pull/2000), [PR 2004](https://github.com/openclaw/crabbox/pull/2004), [PR 2007](https://github.com/openclaw/crabbox/pull/2007), [PR 2010](https://github.com/openclaw/crabbox/pull/2010). Thanks @steipete.
- Consolidate Azure Dynamic Sessions, Blaxel, Cloudflare container-runner, Cloudflare Sandbox, and E2B configuration bindings while preserving provider-specific parsing, timeout rules, trusted URL precedence, credential sources, and claim behavior. [PR 2012](https://github.com/openclaw/crabbox/pull/2012), [PR 2013](https://github.com/openclaw/crabbox/pull/2013), [PR 2014](https://github.com/openclaw/crabbox/pull/2014), [PR 2015](https://github.com/openclaw/crabbox/pull/2015), [PR 2017](https://github.com/openclaw/crabbox/pull/2017). Thanks @steipete.
- Unify Modal, OpenComputer, Orgo, Semaphore, SmolVM, and Tensorlake configuration/default ownership while retaining sizing and timeout overlays, key resolution, native defaults, cleanup intent, and repeatable-list semantics. [PR 2018](https://github.com/openclaw/crabbox/pull/2018), [PR 2019](https://github.com/openclaw/crabbox/pull/2019), [PR 2020](https://github.com/openclaw/crabbox/pull/2020), [PR 2022](https://github.com/openclaw/crabbox/pull/2022). Thanks @steipete.
- Unify exe.dev, Lume, and Morph configuration bindings and defaults while preserving trusted hosts, work-root inheritance, input precedence, native image selection, deletion policy, and SSH wake behavior. [PR 2024](https://github.com/openclaw/crabbox/pull/2024), [PR 2025](https://github.com/openclaw/crabbox/pull/2025), [PR 2029](https://github.com/openclaw/crabbox/pull/2029). Thanks @steipete.
- Unify OVHcloud, Runpod, Vast, and W&B configuration bindings and fallback ownership while preserving credential precedence, numeric overlays, explicit image and instance-type selection, machine-class mapping, and release behavior. [PR 2027](https://github.com/openclaw/crabbox/pull/2027), [PR 2032](https://github.com/openclaw/crabbox/pull/2032), [PR 2033](https://github.com/openclaw/crabbox/pull/2033), [PR 2034](https://github.com/openclaw/crabbox/pull/2034). Thanks @steipete.
- Share unsupported machine-sizing checks and work-root inheritance decisions across providers, preserving explicit-input behavior, provider guidance, raw roots, and validation order. [PR 2023](https://github.com/openclaw/crabbox/pull/2023), [PR 2026](https://github.com/openclaw/crabbox/pull/2026). Thanks @steipete.
- Share declared provider names and aliases across selection guards while keeping normalized selection and raw-exact matching distinct, with unchanged validation order and claim matching. [PR 2030](https://github.com/openclaw/crabbox/pull/2030), [PR 2031](https://github.com/openclaw/crabbox/pull/2031). Thanks @steipete.

## 0.53.0 - 2026-09-08

### Highlights

- **Less waiting for runners and coordinator requests.** Use HTTP/2 where supported, close idle control connections promptly, and overlap AWS network discovery and SSH authorization while avoiding redundant access lookups.
- **Recover lost run-start responses.** Keep the same run identity when a coordinator admission response is lost, recovering the original record without creating another run or replaying the command.
- **Safer downloads and failure evidence.** Stream downloads into private temporary files, preserve existing destinations when a transfer fails, and keep failure-capture scratch files outside the tested checkout.
- **Clearer cloud failures and recovery.** Preserve useful GCP API error messages, including billing failures, and automatically recover Azure leases blocked by settled legacy infrastructure operations.
- **Image-publication outcomes even on failure.** Retain sanitized results for successful, failed, and incomplete measured AWS image publications, including partial measurements and rollback and cleanup state.

### Upgrade notes

- **Upgrade self-hosted coordinators before clients.** Run admission now requires `PUT /v1/runs/<run-id>`; older coordinators cannot support the new recovery path. Updated coordinators retain the legacy `POST` route for older clients, and existing run IDs remain readable. [PR 1970](https://github.com/openclaw/crabbox/pull/1970).
- Ordinary SSH downloads now enforce a **1 GiB per-file limit** and retain at least **1 GiB of local free space**. Failed, canceled, oversized, or size-mismatched transfers leave existing destinations unchanged. [PR 1983](https://github.com/openclaw/crabbox/pull/1983).
- Automatic failure captures enforce a **64 MiB limit** on intermediate archives and downloaded payloads. Before archive creation, both scratch and output filesystems must each have the 1 GiB reserve plus twice the capture limit available. [PR 1983](https://github.com/openclaw/crabbox/pull/1983).
- Measured AWS image-publication manifests now use `crabbox-devtools-image-proof/v2` and cover failed and incomplete outcomes. Baseline measurements are descriptive; only candidate and promoted cohorts apply the benchmark policy. [PR 1986](https://github.com/openclaw/crabbox/pull/1986).

### Changes

- Negotiate HTTP/2 for coordinator API requests while retaining HTTP/1 compatibility, apply the existing redirect guard to WebSocket upgrades, and finish control shutdown without waiting for an idle peer's close handshake. [PR 1985](https://github.com/openclaw/crabbox/pull/1985). Thanks @steipete.
- AWS: overlap default-VPC and managed security-group discovery, authorize SSH ingress in batches of at most four, and reuse access-refresh lookups for matching permissions; preserve scope validation, distinct default runner/workspace groups, and revocation and cleanup ordering. [PR 1974](https://github.com/openclaw/crabbox/pull/1974), [PR 1976](https://github.com/openclaw/crabbox/pull/1976), [PR 1980](https://github.com/openclaw/crabbox/pull/1980). Thanks @steipete.
- Recover lost run-admission responses using a client-chosen identity and an atomic initial history record. Recovery stays within the original invocation and request budget, verifies the authenticated request binding, and never replays remote execution. [PR 1970](https://github.com/openclaw/crabbox/pull/1970), [Issue 1962](https://github.com/openclaw/crabbox/issues/1962). Thanks @steipete.
- Keep failure-capture scratch files outside tested checkouts, bound archive creation and streamed SSH downloads, and publish downloads atomically after size and disk-space checks. Unknown failures point to recorded-run or retained-lease diagnosis instead of an unchanged full rerun. [PR 1983](https://github.com/openclaw/crabbox/pull/1983). Thanks @vincentkoc.
- GCP: surface bounded API error summaries and preserve quoted and multiline JSON diagnostics after credential redaction, so lease failures retain their useful cause. [PR 1984](https://github.com/openclaw/crabbox/pull/1984). Thanks @steipete.
- Azure: recover retained legacy shared-infrastructure fences on the next lease only after verifying that the relevant resources are absent or terminal and the fence owner is unchanged; active operations remain protected. [PR 1982](https://github.com/openclaw/crabbox/pull/1982). Thanks @steipete.
- Islo: report failed stdout/stderr delivery instead of silently succeeding after losing command output; preserve remote exit codes when stream decoding and delivery finish successfully. [PR 1969](https://github.com/openclaw/crabbox/pull/1969).
- Enforce controller and coordinator token-command output limits consistently during pipe copying, preserving the existing overflow errors and command deadlines. [PR 1971](https://github.com/openclaw/crabbox/pull/1971).
- Add scoped AWS provisioning diagnostics for credential preparation, signing, SDK request time, and retry-loop signing counts, keeping concurrent operations separate without changing retry behavior or recording request material. [PR 1968](https://github.com/openclaw/crabbox/pull/1968). Thanks @steipete.
- Retain sanitized measured-image publication outcomes after success, failure, or interruption, with validated partial cohort measurements, opaque promotion binding, and final rollback and cleanup state. Runner loss leaves the initialized conservative outcome for investigation. [PR 1986](https://github.com/openclaw/crabbox/pull/1986). Thanks @vincentkoc.

### Companion integration

- **OpenClaw warm-image cleanup:** OpenClaw builds containing [PR 142166](https://github.com/openclaw/openclaw/pull/142166) restore maintenance when worker profiles use different Crabbox executables. Cleanup tries each configured catalog, retains deletion obligations on errors or deadline exhaustion, and preserves cancellation and allocation pins. Update OpenClaw separately to receive this plugin fix. Thanks @steipete.

### Maintenance

- Consolidate bounded byte buffers across command capture, controller/token helpers, SSH diagnostics, Agent Sandbox, and Blacksmith while preserving limits, cancellation, snapshot isolation, truncation visibility, exit handling, and Actions URL discovery. [PR 1972](https://github.com/openclaw/crabbox/pull/1972), [PR 1973](https://github.com/openclaw/crabbox/pull/1973), [PR 1977](https://github.com/openclaw/crabbox/pull/1977). Thanks @steipete.
- Share service-control run-option validation across FastAPI Cloud, Railway, and Unikraft Cloud while preserving rejection messages, precedence, and refusal before provider access. [PR 1979](https://github.com/openclaw/crabbox/pull/1979). Thanks @steipete.
- Consolidate generated CodeSandbox, CUA, and OpenSandbox configuration bindings while preserving defaults, precedence, validation timing, trusted-only bridge settings, API URL restrictions, and CLI-only stale-claim cleanup. [PR 1988](https://github.com/openclaw/crabbox/pull/1988), [PR 1989](https://github.com/openclaw/crabbox/pull/1989), [PR 1990](https://github.com/openclaw/crabbox/pull/1990). Thanks @steipete.
- Keep CUA runtime and Python bridge defaults aligned with declared configuration, preserving custom SDK imports, whitespace fallback behavior, and read-only diagnostics. [PR 1992](https://github.com/openclaw/crabbox/pull/1992). Thanks @steipete.

## 0.52.0 - 2026-09-07

### Highlights

- **Faster runner startup.** Reuse verified SSH endpoints within an operation, publish diagnostics while the workload continues, and overlap AWS quota checks with network preparation.
- **A more responsive coordinator.** Slow AWS deletion no longer holds up other leases' ingress work. Control WebSocket connections can open independently of lifecycle work, and heartbeats avoid unrelated alarm scans while holding the ingress lock.
- **Enforce benchmark limits.** New `crabbox bench check` applies sample, failure, and p95 runner-time limits to every matched local benchmark group, with deterministic JSON and a failing exit status when the policy is not met.
- **Run pnpm setup during local hydration.** Support `pnpm/action-setup` with an exact version, including workflows that set up pnpm before Node, and keep the managed pnpm available to later steps.
- **Safer workspace reuse and clearer failures.** Islo preserves files during `--no-sync` runs. SSH access rebinding rejects conflicting provider identities, artifact validation is distinguished from workload exits, and readiness timeouts retain their real cause.
- **More reliable checkpoints and image preparation.** Wait for cloud-init completion before native capture, preserve the running source's boot-completion records during cleanup, and report confirmed checkpoint non-submission as structured JSON.
- **Benchmark-gated Linux image publication.** Maintainers can opt into comparable baseline, candidate, and promoted-image measurements, with an explicit timing policy and receipt-based rollback through final validation.

### Upgrade notes

- `bench check` requires `--max-p95-runner-total`. Defaults are three successful samples and zero failures per matched group; p95 always needs at least three runner-total samples. No matches or missing telemetry fail the check. [PR 1899](https://github.com/openclaw/crabbox/pull/1899).
- Local `pnpm/action-setup` requires an exact `major.minor.patch` version. Version inference, ranges, and other pnpm inputs require `--github-runner`; setup-node's `cache: pnpm` runs without caching during local hydration. [PR 1953](https://github.com/openclaw/crabbox/pull/1953).
- SSH artifact-validation failures retain exit `7` but report `blockedStage=artifacts` and `errorKind=provider-error`; a workload that exits `7` remains `command-exit`. Automation should distinguish these outcomes. [PR 1934](https://github.com/openclaw/crabbox/pull/1934).
- `checkpoint create --json` can emit `crabbox.checkpoint.create.failure.v1` with `outcome=not_submitted` on a nonzero exit after verified local reservation removal. This does not certify source rollback or readiness; uncertain and post-submission failures keep their recovery state. [PR 1952](https://github.com/openclaw/crabbox/pull/1952), [PR 1963](https://github.com/openclaw/crabbox/pull/1963).
- Measured AWS Linux image publication is opt-in and plans 12 leases, with additional launch attempts possible during acquisition retries. It requires an explicit p95 cap, promotes only after candidate checks pass, and keeps rollback armed through final validation. Passing the cap does not establish a speedup over the baseline. [PR 1960](https://github.com/openclaw/crabbox/pull/1960).

### Changes

- Publish run diagnostics without delaying workload admission, preserving ordered lease attribution and joining pending publication before terminal recording; warn on queue overflow or drain expiry while retaining logs and verified terminal receipts. [PR 1937](https://github.com/openclaw/crabbox/pull/1937).
- Reuse verified SSH endpoints within an operation across direct, proxy, and WSL execution, avoiding redundant login probes while re-evaluating advertised fallbacks when the host or port changes. [PR 1941](https://github.com/openclaw/crabbox/pull/1941).
- AWS: overlap the initial quota lookup with security-group preparation, retain per-candidate quota checks, and join both operations before launch or failure cleanup. [PR 1958](https://github.com/openclaw/crabbox/pull/1958). Thanks @steipete.
- Keep AWS deletion and unrelated heartbeat alarm scans out of the ingress queue, and admit control WebSockets independently of lifecycle work, preserving cleanup claims, alarm deadlines, authentication, and message serialization. [PR 1951](https://github.com/openclaw/crabbox/pull/1951).
- Deduplicate validated AWS coordinator SSH ranges after combining lease and global access, avoiding repeated authorization calls for identical port/range pairs while retaining ingress reconciliation. [PR 1945](https://github.com/openclaw/crabbox/pull/1945).
- Add `crabbox bench check` to enforce successful-sample, failure-count, and p95 runner-time limits across every matched local group; expose runner-total sample counts in benchmark reports. [PR 1899](https://github.com/openclaw/crabbox/pull/1899). Thanks @vincentkoc.
- Local Actions hydration: support `pnpm/action-setup` with an exact version, including pnpm-before-Node workflows, preserve managed pnpm for later commands, and accept setup-node's `cache: pnpm` as an explicitly uncached run. [PR 1953](https://github.com/openclaw/crabbox/pull/1953).
- Distinguish required-artifact, artifact-change, and artifact-schema validation failures from workload exits in timing and failure digests, preserving exit `7` and artifact enforcement. [PR 1934](https://github.com/openclaw/crabbox/pull/1934), [Issue 1894](https://github.com/openclaw/crabbox/issues/1894). Thanks @coygeek.
- Reject conflicting known provider identities before rebinding resolved SSH access, and remove alias keys only after validating and removing the unchanged alias claim. [PR 1936](https://github.com/openclaw/crabbox/pull/1936), [Issue 1900](https://github.com/openclaw/crabbox/issues/1900). Thanks @coygeek.
- Stop SSH readiness probes and backoff at the shared deadline, report the active probe, and leave authentication unknown when the check expires. [PR 1949](https://github.com/openclaw/crabbox/pull/1949). Thanks @vincentkoc.
- Agent Sandbox, OpenSandbox, and Hyper-V: classify readiness deadlines and cancellation consistently while retaining the last probe's diagnostic and existing public exit codes. [PR 1964](https://github.com/openclaw/crabbox/pull/1964).
- Islo: preserve existing workspace files during `--no-sync` runs even when sync deletion is enabled, retaining normal replacement behavior for archive sync. [PR 1959](https://github.com/openclaw/crabbox/pull/1959).
- Islo: give sandbox creation its own five-minute budget without shortening command streams or relaxing ordinary API deadlines; report failed create names as unconfirmed locators for explicit identity-checked recovery. [PR 1955](https://github.com/openclaw/crabbox/pull/1955).
- Islo: finalize run outcomes after guarded cleanup, honor `--keep-on-failure` for bound setup failures, retain reused sessions after admitted Tailscale preparation fails, and preserve primary codes and causes through cleanup or timing errors while distinguishing provider/artifact failures from command exits. [PR 1947](https://github.com/openclaw/crabbox/pull/1947).
- Agent Sandbox: finalize bound runs once, preserve primary outcomes through TTL cleanup and timing failures, and report early bound failures with accurate recovery handles. [PR 1961](https://github.com/openclaw/crabbox/pull/1961).
- Tailscale: withhold raw provider diagnostics and OAuth credentials from preflight and tag-ownership errors while retaining the operation, HTTP status, and actionable tag guidance. [PR 1940](https://github.com/openclaw/crabbox/pull/1940).
- Proxmox: retain bounded, redacted bootstrap diagnostics and native error causes after acquisition cleanup, preserving quiet success and the existing CLI failure status. [PR 1948](https://github.com/openclaw/crabbox/pull/1948), [Issue 1873](https://github.com/openclaw/crabbox/issues/1873). Thanks @coygeek.
- Add bounded AWS provisioning logs that separate ingress-queue and lifecycle waits from create-operation costs and count redundant security-group permission calls without logging request payloads. [PR 1938](https://github.com/openclaw/crabbox/pull/1938).
- Report producer-confirmed checkpoint non-submission as structured JSON after verified reservation cleanup, without implying that source rollback succeeded. [PR 1952](https://github.com/openclaw/crabbox/pull/1952). Thanks @steipete.
- Wait for cloud-init completion within the existing 30-second status deadline before native-image cleanup, retain strict post-clean checks with phase/status diagnostics, and release fresh direct AWS/Hetzner reservations only for confirmed pre-submission failures. [PR 1963](https://github.com/openclaw/crabbox/pull/1963). Thanks @steipete.
- Preserve the running source's cloud-init completion records during Linux developer-image cleanup while clearing cached initialization and seed data; stop preparation if preservation or cleanup fails. [PR 1954](https://github.com/openclaw/crabbox/pull/1954). Thanks @vincentkoc.
- Add opt-in measured AWS Linux image publication with recipe-bound inputs, comparable baseline/candidate/promoted cohorts, an operator-supplied benchmark policy, an allowlisted public manifest, and receipt rollback through final validation. [PR 1960](https://github.com/openclaw/crabbox/pull/1960). Thanks @vincentkoc.
- Report image qualification reaping as idle after clean teardown, preserve failed recovery evidence, and verify transient controller ownership before cleanup. [PR 1942](https://github.com/openclaw/crabbox/pull/1942). Thanks @vincentkoc.

## 0.51.0 - 2026-09-06

### Highlights

- **Faster command startup.** Commands begin without waiting for best-effort telemetry uploads, while run completion retains baseline samples and verified terminal receipts.
- **More reliable failure recovery.** More sandbox providers preserve the original command result, honor `--keep-on-failure` during preparation, and report retained recovery sessions when cleanup fails. Coordinator leases keep local credentials until provider cleanup is confirmed.
- **Safer retries and clearer SSH failures.** Suggested retries preserve explicit `--no-sync` and required-artifact globs. SSH readiness stops promptly on host-key rejection, including Windows/WSL connections.
- **More useful benchmark reports.** Compare runner totals, runner phases, sync phases, and sync skips, grouped by record source so different kinds of observations stay separate.
- **Broader local-container compatibility.** Opt out of an explicit hostname for runtimes that share the host UTS namespace, and finish cleanup after Podman confirms a container is already gone.
- **Recover blocked Azure cleanup.** Owners and admins can explicitly acknowledge missing public-IP evidence for eligible expired leases, allowing normal cleanup to resume for the remaining disk with an audit trail.
- **Safer AWS image publication.** Failed publication smokes can restore the exact prior default aliases and retire the failed image revision without overwriting a newer promotion.

### Upgrade notes

- Brokered lease cleanup now requires an updated coordinator that records `cleanupCompletedAt` and clears remote access after confirmed deletion. Older coordinators and historical leases without that evidence leave local claims and SSH credentials intact; after upgrading, retry `stop` for the exact lease when its provider identity is recorded. Missing identity without explicit no-resource evidence requires operator reconciliation. [PR 1901](https://github.com/openclaw/crabbox/pull/1901).
- A successful sandbox command can now return a failed run when automatic cleanup fails. Existing command failures keep their original exit code, with secondary cleanup and timing errors reported separately; use the printed recovery session to finish cleanup. This extends the previous release's behavior to more providers.
- `bench report` now separates groups by `source`; records without one use `unknown`. Consumers should include the source in group keys and tolerate absent phase summaries on legacy records. Only successful observations contribute timing distributions. [PR 1896](https://github.com/openclaw/crabbox/pull/1896).
- Transactional AWS image promotion and receipt-based rollback require an updated coordinator. Azure's audited recovery also requires an updated coordinator and an owner or admin credential; manage-share and device credentials cannot authorize it, and older workers reject recovered version-3 claims. [PR 1756](https://github.com/openclaw/crabbox/pull/1756), [PR 1893](https://github.com/openclaw/crabbox/pull/1893).

### Changes

- Start commands without waiting for telemetry uploads; cancel and join the publisher before run completion or lease replacement while preserving baseline samples and verified terminal receipts. [PR 1931](https://github.com/openclaw/crabbox/pull/1931).
- Preserve explicit `--no-sync` and every `--require-artifact` glob in suggested failure retries, avoiding an unintended workspace reset or weakened evidence checks. [PR 1933](https://github.com/openclaw/crabbox/pull/1933), [Issue 1875](https://github.com/openclaw/crabbox/issues/1875), [Issue 1895](https://github.com/openclaw/crabbox/issues/1895). Thanks @coygeek.
- Stop SSH readiness promptly on host-key rejection, including WSL SFTP and split or oversized diagnostics, without changing host trust. [PR 1877](https://github.com/openclaw/crabbox/pull/1877). Thanks @shunkakinoki.
- Keep coordinator lease credentials until cleanup completion is recorded under the original ownership claim; confirm AWS instance termination and clear stale remote access while preserving provider identity for recovery and audit. [PR 1901](https://github.com/openclaw/crabbox/pull/1901).
- Group benchmark reports by record source and summarize successful runner totals, runner phases, sync phases, and sync skips, omitting telemetry absent from legacy records. [PR 1896](https://github.com/openclaw/crabbox/pull/1896). Thanks @vincentkoc.
- Local containers: support `localContainer.noHostname` and `CRABBOX_LOCAL_CONTAINER_NO_HOSTNAME` to omit the explicit hostname for runtimes sharing a host UTS namespace; reject incompatible fixed-ID reuse while preserving default fingerprints. [PR 1813](https://github.com/openclaw/crabbox/pull/1813), [PR 1924](https://github.com/openclaw/crabbox/pull/1924). Thanks @atrawog.
- Local containers: recognize Podman's exact quoted-ID absence diagnostic so a retried `stop` can finish cleanup after the container disappears, retaining recovery state for ambiguous or inaccessible runtimes. [PR 1922](https://github.com/openclaw/crabbox/pull/1922).
- Preserve the requested capacity market for supported providers during coordinator provisioning, and expose retained provisioning failure, resource-existence, and retryability diagnostics in `crabbox inspect --json`. [PR 1892](https://github.com/openclaw/crabbox/pull/1892). Thanks @vincentkoc.
- Azure: recognize completed Location polling responses and add explicit, audited recovery for eligible expired leases whose disk cleanup is blocked by missing public-IP completion evidence; retain original identities, ownership checks, and actual deletion receipts. [PR 1893](https://github.com/openclaw/crabbox/pull/1893). Thanks @steipete.
- AWS images: capture prior default aliases atomically during promotion and restore them from a receipt after a failed publication smoke, retiring the exact failed catalog revision while preserving concurrent newer promotions. [PR 1756](https://github.com/openclaw/crabbox/pull/1756). Thanks @vincentkoc.
- Shared sandbox runs: keep secondary cleanup and timing errors visible without replacing the primary exit code. [PR 1907](https://github.com/openclaw/crabbox/pull/1907).
- Docker Sandbox: preserve primary failures through cleanup and timing errors, report retained sessions after failed removal, honor `--keep-on-failure` during preparation, and preserve successful clone commits across backend reporting failures. [PR 1913](https://github.com/openclaw/crabbox/pull/1913).
- Apple Machine: report failed or unconfirmed automatic deletion, retain recovery sessions for early `--keep-on-failure` errors, and preserve command outcomes while distinguishing native transport failures. [PR 1914](https://github.com/openclaw/crabbox/pull/1914).
- Apple Machine: honor cancellation through ownership waits and native controls, include claim-lock waiting in cleanup budgets, and preserve the original acquisition failure if rollback also fails. [PR 1917](https://github.com/openclaw/crabbox/pull/1917).
- SmolVM: report deletion failures, honor `--keep-on-failure` during preparation, and preserve primary outcomes through cleanup and timing errors, retaining provider keep policy and separate profile/resource cleanup budgets. [PR 1908](https://github.com/openclaw/crabbox/pull/1908).
- SmolVM: honor cancellation during ownership publication, reuse, and cleanup waits; include lock waiting in rollback budgets and preserve the acquisition exit if rollback also fails. [PR 1912](https://github.com/openclaw/crabbox/pull/1912).
- Tensorlake: honor `--keep-on-failure` for early failures, report retained recovery sessions after failed cleanup, and preserve command outcomes and native error causes through timing output; keep profile cleanup warning-only. [PR 1905](https://github.com/openclaw/crabbox/pull/1905). Thanks @steipete.
- Tensorlake: honor cancellation during run admission and ownership publication, include claim-lock waiting in cleanup and failed-create rollback deadlines, and preserve the original failure and ownership without operating on a replacement claim. [PR 1888](https://github.com/openclaw/crabbox/pull/1888), [PR 1906](https://github.com/openclaw/crabbox/pull/1906). Thanks @steipete.
- Modal and Docker Sandbox: preserve native cancellation, deadline, and I/O causes, and share command-outcome classification with Tensorlake so bridge failures are not reported as remote command exits. [PR 1903](https://github.com/openclaw/crabbox/pull/1903). Thanks @steipete.
- Blaxel: report automatic deletion failures, retain recovery sessions after early setup failures, and preserve primary command failures through cleanup and timing errors; recheck the original claim and remote ownership before deletion. [PR 1919](https://github.com/openclaw/crabbox/pull/1919).
- Freestyle: report automatic deletion failures, preserve command failures through cleanup and timing errors, and retain transport cancellation causes for callers. [PR 1907](https://github.com/openclaw/crabbox/pull/1907).
- Cloud Run Sandbox: preserve command exits and typed failures through activity cleanup, teardown, and reporting, with final timing and recovery sessions reflecting the complete run outcome. [PR 1928](https://github.com/openclaw/crabbox/pull/1928).
- AWS Lambda MicroVM: preserve primary outcomes through termination and timing errors, retain recovery metadata after setup failures, and distinguish transport failures from command exits while retaining claim-refresh and operation-lock behavior. [PR 1923](https://github.com/openclaw/crabbox/pull/1923).
- Orgo: preserve primary command/API exit codes through cleanup and timing errors, and report failed cleanup without changing workspace ownership or no-copy behavior. [PR 1926](https://github.com/openclaw/crabbox/pull/1926).
- Crownest: accept and omit framework-owned run bookkeeping while retaining command environment-forwarding restrictions; preserve primary outcomes and typed cleanup errors in final timing, and keep recovery claims if Workspace Run cancellation fails. [PR 1927](https://github.com/openclaw/crabbox/pull/1927).
- W&B: finalize outcomes after automatic Stop, retain recovery sessions and failure retention when cleanup fails, preserve primary failures through timing output, and classify gRPC/API failures as provider errors. [PR 1929](https://github.com/openclaw/crabbox/pull/1929).
- W&B: allow existing-sandbox runs to omit framework-owned run metadata while retaining explicit environment-forwarding restrictions. [PR 1930](https://github.com/openclaw/crabbox/pull/1930).
- Fix documentation table-of-contents links for repeated headings so each reaches its own section, preserving existing first-heading URLs. [PR 1787](https://github.com/openclaw/crabbox/pull/1787). Thanks @steipete.
- Define a provider-neutral Linux developer-image recipe whose digest binds the executable contract and exact installer/readiness source hashes. [PR 1897](https://github.com/openclaw/crabbox/pull/1897). Thanks @vincentkoc.
- Fix protected image qualification to extract candidates at the canonical artifact path and skip finalization when deployment never started. [PR 1915](https://github.com/openclaw/crabbox/pull/1915). Thanks @vincentkoc.
- Allow protected image qualification to seal the current CLI by stripping debug metadata and accepting a single artifact up to the existing 128 MiB total bundle cap. [PR 1910](https://github.com/openclaw/crabbox/pull/1910).
- Fix protected AWS image qualification's Node setup with the supported no-cache input, keeping Go caching disabled. [PR 1909](https://github.com/openclaw/crabbox/pull/1909).

## 0.50.0 - 2026-09-05

### Highlights

- **See where runner time goes.** Final timing JSON and benchmark records now report total runner wall time and a bounded phase breakdown, including time spent on cleanup.
- **Investigate blocked Azure cleanup.** A read-only coordinator API exposes lease-scoped resource identities and deletion progress so operators can diagnose blocked cleanup while retaining ownership checks.
- **Safer workspace sync.** Blaxel, Freestyle, and SmolVM validate archives before allocating a sandbox and preserve the prepared snapshot. `sync-plan --json` now previews each provider's actual archive guardrails without contacting it.
- **Reliable failure recovery.** More providers honor `--keep-on-failure` during preparation, report recovery sessions when cleanup fails, and preserve the original command result through cleanup and timing output.
- **Predictable commands and cancellation.** E2B and CubeSandbox preserve literal profile arguments; Tensorlake, Blaxel, Vercel Sandbox, and local bridges retain cancellation and timeout causes instead of reporting misleading workload exits.
- **Faster artifact discovery.** Literal artifact paths search only their parent directory, avoiding recursive scans while preserving matching and symlink checks.

### Upgrade notes

- Runner phase fields are unsigned local telemetry; signed receipt v2 is unchanged. Timing output lists already-committed artifacts, with terminal receipts confirmed separately after persistence. Timing-output failures now appear in the final receipt and exit status. [PR 1618](https://github.com/openclaw/crabbox/pull/1618).
- Full-archive sync limits can reject a large checkout even when its dirty delta is small; preview them with `sync-plan --json`. `--force-sync-large` keeps its normal override but cannot bypass Freestyle's 64 MiB compressed upload cap. SmolVM preparation failures preserve the existing workspace, while a later injection failure can still occur after clearing it. [PR 1880](https://github.com/openclaw/crabbox/pull/1880), [PR 1869](https://github.com/openclaw/crabbox/pull/1869), [PR 1882](https://github.com/openclaw/crabbox/pull/1882).
- Azure cleanup diagnostics require an updated coordinator and an existing owner, manage-share, or admin credential. The endpoint is read-only and is not an `inspect` CLI flag. [PR 1889](https://github.com/openclaw/crabbox/pull/1889).

### Changes

- Add bounded runner wall-time phase telemetry to final timing JSON and benchmark records without changing signed receipt v2. [PR 1618](https://github.com/openclaw/crabbox/pull/1618). Thanks @vincentkoc.
- Azure: expose read-only, lease-scoped cleanup identity diagnostics so blocked deletion can be investigated without changing claims, bypassing ownership guards, or accessing provider credentials locally. [PR 1889](https://github.com/openclaw/crabbox/pull/1889). Thanks @steipete.
- Make `sync-plan --json` preview the configured provider's full-archive or dirty-delta guardrails accurately, without credentials or provider API calls. [PR 1882](https://github.com/openclaw/crabbox/pull/1882). Thanks @steipete.
- Blaxel: prepare and validate sync archives before fresh allocation, freeze the pre-create snapshot, and share staged workspace replacement and cleanup while retaining native upload retries. [PR 1867](https://github.com/openclaw/crabbox/pull/1867). Thanks @steipete.
- Freestyle: check the full archive and compressed upload limit before allocation, freeze pre-create snapshots, and share safe workspace replacement while isolating file-API and exec fallback uploads. [PR 1880](https://github.com/openclaw/crabbox/pull/1880). Thanks @steipete.
- SmolVM: validate full archive limits and prepare snapshots before fresh allocation or clearing a reused workspace; preserve pre-create bytes and apply the configured sync budget. [PR 1869](https://github.com/openclaw/crabbox/pull/1869). Thanks @steipete.
- Upstash Box: share run finalization so early failures honor `--keep-on-failure`, failed deletion reports a kept recovery session, and cleanup/timing errors preserve the primary exit; keep delegated command receipts when secondary cleanup fails. [PR 1885](https://github.com/openclaw/crabbox/pull/1885). Thanks @steipete.
- Vercel Sandbox: share run finalization so early cleanup failures return accurate recovery sessions, preparation failures honor `--keep-on-failure`, and timing errors preserve command exits; retain POSIX bridge cancellation and timeout causes. [PR 1886](https://github.com/openclaw/crabbox/pull/1886). Thanks @steipete.
- CubeSandbox: share sandbox run finalization so failed cleanup retains an accurate recovery session, setup failures honor `--keep-on-failure`, and timing errors no longer mask command exits; preserve observed abnormal exit codes. [PR 1850](https://github.com/openclaw/crabbox/pull/1850). Thanks @steipete.
- OpenComputer: share run finalization so cleanup failures are reported, timing errors preserve the original exit, and command preparation honors `--keep-on-failure`; preserve cancellation and timeout causes and distinguish transport errors from command exits. [PR 1845](https://github.com/openclaw/crabbox/pull/1845). Thanks @steipete.
- CodeSandbox: share run finalization so failed cleanup returns an accurate recovery session, cancellation honors `--keep-on-failure`, and timing errors preserve the command outcome. [PR 1843](https://github.com/openclaw/crabbox/pull/1843). Thanks @steipete.
- Report Azure Dynamic Sessions cleanup failures as failed runs, preserve primary Superserve/Azure errors through cleanup and timing output, and keep Superserve rollback bound to the originally created sandbox. [PR 1836](https://github.com/openclaw/crabbox/pull/1836). Thanks @steipete.
- Reject mismatched E2B and CubeSandbox read/connection identities before adopting a sandbox or using its execution session, sharing exact resource-ID validation while keeping cleanup bound to the original allocation. [PR 1841](https://github.com/openclaw/crabbox/pull/1841). Thanks @steipete.
- Preserve literal E2B and CubeSandbox profile arguments through their shared envd command transport, and accept inferred single-string shell programs and explicit empty shell source. [PR 1837](https://github.com/openclaw/crabbox/pull/1837). Thanks @steipete.
- Tensorlake: preserve cancellation, deadline, and I/O errors from the native command runner instead of misreporting them as workload exits; keep failure timing and displayed diagnostics consistent. [PR 1887](https://github.com/openclaw/crabbox/pull/1887). Thanks @steipete.
- Blaxel: stop the original process after interrupted polling requests and preserve cancellation and timeout causes without exposing redacted credentials. [PR 1846](https://github.com/openclaw/crabbox/pull/1846). Thanks @steipete.
- Local provider bridges: preserve cancellation and deadline causes when a POSIX child is interrupted, without masking completed command exits or output-limit errors. [PR 1862](https://github.com/openclaw/crabbox/pull/1862). Thanks @steipete.
- Limit literal run-artifact discovery to the parent directory, preserving existing matching, required-file, and symlink guards. [PR 1878](https://github.com/openclaw/crabbox/pull/1878). Thanks @steipete.
- Fix AWS image qualification rollback checks to restore the exact seeded default aliases and revision through `--restore-receipt`, retire the failed candidate, and reject stale failed-revision updates. [PR 1879](https://github.com/openclaw/crabbox/pull/1879). Thanks @vincentkoc.

## 0.49.1 - 2026-09-04

Users upgrading from v0.48.1 also receive the [v0.49.0 changes](https://github.com/openclaw/crabbox/blob/v0.49.0/CHANGELOG.md#0490---2026-09-03), previously available through the Go module release.

### Highlights

- **Image-pinned GCP ready pools.** Reuse hydrated Linux runners tied to exact boot images or disk snapshots, with capacity fallback across zones and ownership checks throughout creation and cleanup.
- **Faster runner startup.** Skip redundant Git lookups and unnecessary APT downloads, and share Azure/GCP token refreshes across concurrent requests.
- **Safe sync and correct artifacts.** Cloudflare and Upstash Box preserve existing workspaces when transfers fail. Blacksmith collects artifacts from the prepared execution workspace that produced them.
- **Daytona script support.** Run `--script` and `--script-stdin` through private SSH with literal arguments, environment profiles, activity refreshes, and cancellation support.
- **Correct sandbox targeting and trustworthy cleanup.** Canonical IDs no longer resolve to unrelated slug aliases. Failed bootstrap rollback stops further allocation, Hetzner waits for confirmed deletion, and interrupted AWS warmups remain stoppable. Providers retain recovery claims when cleanup fails and preserve the original command result.
- **Predictable commands and environment profiles.** Preserve literal arguments across delegated providers, isolate each run's uploaded profile, and clean failed uploads without touching replacement claims.
- **Clearer failures and more reliable Windows bootstrap.** Preserve failed-stage, fallback, terminal-recording, and Machine0 output diagnostics; fresh AWS Windows/WSL2 leases bootstrap through their advertised SSH route.
- **Isolated AWS image qualification for maintainers.** An opt-in workflow and dedicated authority verify candidate image publication and rollback with bounded cloud access, provider credentials kept out of candidate code, and independent cleanup.

### Upgrade notes

- GCP typed ready pools require an updated coordinator and authoritative boot-image or disk-snapshot evidence; machine-image checkpoints and older leases without that evidence cannot join. Coordinator credentials need `compute.instances.get` and `compute.disks.get` for typed identity operations. [PR 1620](https://github.com/openclaw/crabbox/pull/1620), [PR 1621](https://github.com/openclaw/crabbox/pull/1621).
- Tenki workspace/project settings are now accepted only for recovering older scoped leases. Stop those leases before removing the settings, then use `tenki login` to select the workspace for new leases. [PR 1741](https://github.com/openclaw/crabbox/pull/1741).

### Changes

- Collect Blacksmith artifacts from execution workspaces selected by a trusted `.git/crabbox-artifact-root` symlink, pinning the artifact directory before the workload and rejecting invalid bindings before execution while retaining existing exit and publication guards. [PR 1840](https://github.com/openclaw/crabbox/pull/1840). Thanks @steipete.
- Preserve Upstash Box and SmolVM stream cancellation and timeout causes in run outcomes, and skip command submission when cancellation is already known after an acknowledged environment upload without skipping cleanup. [PR 1838](https://github.com/openclaw/crabbox/pull/1838). Thanks @steipete.
- Keep canonical lease IDs separate from slug aliases in shared claim lookup and provider routing, preventing missing IDs from selecting, running on, or stopping a different sandbox while preserving provider recovery behavior. [PR 1839](https://github.com/openclaw/crabbox/pull/1839). Thanks @steipete.
- Clean partial Upstash Box environment uploads after failure or cancellation, isolate each profile, and refuse stale file cleanup while preserving discovery-only reuse and original command outcomes. [PR 1834](https://github.com/openclaw/crabbox/pull/1834). Thanks @steipete.
- Preserve literal Tensorlake and OpenSandbox profile arguments through final execution, including environment-wrapped commands, and fix Tensorlake's inferred single-string shell execution. [PR 1835](https://github.com/openclaw/crabbox/pull/1835). Thanks @steipete.
- Preserve literal Agent Sandbox profile arguments through pod stdin execution and share checked workspace/environment command wrapping with Nomad. [PR 1831](https://github.com/openclaw/crabbox/pull/1831). Thanks @steipete.
- Preserve literal SmolVM and Upstash Box profile arguments, accept inferred single-string shell commands, and share source rendering without adding another shell. [PR 1833](https://github.com/openclaw/crabbox/pull/1833). Thanks @steipete.
- Read all AWS recovery inventory pages and retain cleanup debt when pagination is incomplete; describe interrupted provisioning without assuming a deployment caused it. [PR 1832](https://github.com/openclaw/crabbox/pull/1832). Thanks @steipete.
- Preserve literal profile arguments through CodeSandbox, OpenComputer, and Docker Sandbox execution, sharing command-intent parsing without changing provider shells or environment transports. [PR 1830](https://github.com/openclaw/crabbox/pull/1830). Thanks @steipete.
- Clean failed SmolVM environment-profile uploads with bounded original-claim checks, isolate each run's profile, and reuse shared shell-profile handling without requiring Bash. [PR 1829](https://github.com/openclaw/crabbox/pull/1829). Thanks @steipete.
- Made interrupted direct AWS warmups stoppable by recording exact instance ownership before readiness, retained recovery claims through EC2 visibility delays, and selected the Ubuntu HTTPS primary archive for automatically chosen stock Ubuntu 26.04 amd64 images. [PR 1816](https://github.com/openclaw/crabbox/pull/1816). Thanks @steipete.
- Added typed GCP ready-pool cohorts bound to exact boot-image or disk-snapshot provenance while allowing capacity fallback across zones. [PR 1621](https://github.com/openclaw/crabbox/pull/1621). Thanks @vincentkoc.
- Typed GCP identity generation and registration now observe the owned VM boot disk to bind exact numeric image or snapshot provenance without adding image or snapshot reads to ordinary GCP launches; create cleanup custody requires a numeric VM ID, interrupted token-bound creates capture or retry that ID only through exact ownership lookups and strict rereads, and fully bound pre-upgrade leases may use their lossy historical numeric ID only to corroborate a raw ID during fenced deletion or expiry cleanup before an exact reread. [PR 1620](https://github.com/openclaw/crabbox/pull/1620). Thanks @vincentkoc.
- Preserve existing Cloudflare container workspaces when sync upload or extraction fails, clean partial archives, and enforce full-checkout size limits before fresh allocation. [PR 1814](https://github.com/openclaw/crabbox/pull/1814). Thanks @steipete.
- Preserve Upstash Box workspaces when archive upload or extraction fails, clean partial Upstash Box/Tensorlake uploads, and check complete archive limits before creating either sandbox. [PR 1820](https://github.com/openclaw/crabbox/pull/1820). Thanks @steipete.
- Report SmolVM decoder, file-write and extraction failures instead of false upload success, isolate temporary upload files, and preserve existing files when decoding fails. [PR 1826](https://github.com/openclaw/crabbox/pull/1826). Thanks @steipete.
- Run direct Daytona `--script` and `--script-stdin` commands through the private SSH runner with literal trailing arguments, environment profiles, and provider activity refreshes; keep managed SSH credentials out of process arguments. [PR 1781](https://github.com/openclaw/crabbox/pull/1781). Thanks @steipete.
- Preserve literal profile arguments and assignment-shaped executable names across Cloudflare Sandbox, Superserve, Crownest, Vercel Sandbox, and Nomad command transports without reinterpreting them as shell syntax. [PR 1818](https://github.com/openclaw/crabbox/pull/1818). Thanks @steipete.
- Stop direct AWS, Azure, GCP, and Hetzner bootstrap retries from allocating another machine when rollback reports a cleanup failure, preserving both the original failure and cleanup diagnostics. [PR 1819](https://github.com/openclaw/crabbox/pull/1819). Thanks @steipete.
- Reject inconsistent Hetzner creation/readiness identities before SSH, and keep failed-acquisition cleanup bound to the original server and key; share exact ID/name validation with RunPod. [PR 1821](https://github.com/openclaw/crabbox/pull/1821). Thanks @steipete.
- Wait for brokered Hetzner delete-action success and exact server absence before reporting cleanup complete or removing managed SSH keys; retain durable recovery evidence through pending or uncertain deletion and expose it in `inspect --json`. [PR 1799](https://github.com/openclaw/crabbox/pull/1799). Thanks @steipete.
- Remove local SSH connections, keys, and trust files after fixed-ID AWS lease release, preserving the terminal receipt so failed local cleanup can be retried without repeating provider deletion. [PR 1797](https://github.com/openclaw/crabbox/pull/1797). Thanks @steipete.
- Closed and joined lease-owned SSH connection masters after confirmed brokered deletion, preserving native connection reuse and lease/host-key isolation while retaining failed local cleanup for a local-only retry. [PR 1774](https://github.com/openclaw/crabbox/pull/1774). Thanks @steipete.
- Cloudflare: retain recovery claims when teardown fails, preserve command/cancellation outcomes, and fence reuse and cleanup against replaced local claims. [PR 1817](https://github.com/openclaw/crabbox/pull/1817). Thanks @steipete.
- Report OpenSandbox cleanup failures instead of silently succeeding, preserve the original command exit when cleanup also fails, and finalize timing/session results after cleanup without weakening reuse admission or absolute TTL checks. [PR 1804](https://github.com/openclaw/crabbox/pull/1804). Thanks @steipete.
- Protect Nomad runs from overwriting replacement claims or recreating retired leases, and expose standard run-session handles with cleanup-aware final outcomes that preserve the original command exit. [PR 1810](https://github.com/openclaw/crabbox/pull/1810). Thanks @steipete.
- Avoid unnecessary Git metadata lookups during configuration loading, lease claim refreshes, and sync planning while preserving repository and credential trust boundaries. [PR 1783](https://github.com/openclaw/crabbox/pull/1783). Thanks @steipete.
- Skip unnecessary APT translation, AppStream, and command-not-found downloads during minimal Linux bootstrap while preserving required package indexes, signature checks, and later operator defaults. [PR 1794](https://github.com/openclaw/crabbox/pull/1794). Thanks @steipete.
- Reuse one Azure or GCP token refresh across concurrent requests, reducing duplicate authentication traffic while preserving credential isolation, refresh margins, and retry behavior. [PR 1802](https://github.com/openclaw/crabbox/pull/1802). Thanks @steipete.
- Restore current Tenki CLI inventory and legacy-claim recovery, and retain ownership claims until the exact session acknowledges termination; obsolete workspace/project settings now give migration guidance before creating a lease. [PR 1741](https://github.com/openclaw/crabbox/pull/1741). Thanks @eddiewang.
- Allow fresh brokered AWS Windows and WSL2 leases to bootstrap through advertised SSH port 22 while preserving an explicitly selected final workload port. [PR 1801](https://github.com/openclaw/crabbox/pull/1801). Thanks @steipete.
- Fix GCP metadata authentication in workerd by using supported redirect handling while continuing to reject redirected token responses without following them. [PR 1815](https://github.com/openclaw/crabbox/pull/1815). Thanks @steipete.
- Report the correct install, build, or test failure stage from supported phase markers, preserving original exit codes and keeping later artifact-collection failures separate. [PR 1795](https://github.com/openclaw/crabbox/pull/1795). Thanks @steipete.
- Preserve individual AWS, Azure, and GCP candidate failures in successful leases' provisioning history across market and regional fallback, including previously omitted GCP on-demand failures. [PR 1811](https://github.com/openclaw/crabbox/pull/1811). Thanks @steipete.
- Preserve finish-submission and receipt-verification errors, attempt counts, and recovery guidance when terminal run recording times out, without changing retry limits or receipt verification. [PR 1782](https://github.com/openclaw/crabbox/pull/1782). Thanks @steipete.
- Capture complete Machine0 native CLI JSON responses through private regular files on POSIX hosts, reject incomplete captures explicitly, and retain bounded output instead of accepting truncated responses. [PR 1780](https://github.com/openclaw/crabbox/pull/1780). Thanks @steipete.
- Added a credential-isolated AWS image-qualification transport and non-public per-run authority with fixed sandbox policy, bounded intent reconciliation, verified resource ownership, and eventual-consistency-aware teardown, without changing normal AWS credential behavior. [PR 1778](https://github.com/openclaw/crabbox/pull/1778). Thanks @vincentkoc.
- Added an opt-in pre-merge AWS image-qualification workflow with isolated candidate builds, deployment-bound proof, publication/rollback checks, and an independent cleanup reaper; enabling it requires the dedicated authority and protected environment. [PR 1775](https://github.com/openclaw/crabbox/pull/1775). Thanks @vincentkoc.
- Clarify SSH cancellation, safe retained-workload recovery, and Bash login-shell exit behavior, and correct the default local-container image note. [PR 1685](https://github.com/openclaw/crabbox/pull/1685), [PR 1686](https://github.com/openclaw/crabbox/pull/1686). Thanks @steipete.
- Fix native macOS readiness test fixtures when temporary directories inherit a different group from the process, without changing production ownership checks. [PR 1686](https://github.com/openclaw/crabbox/pull/1686). Thanks @steipete.
- Reject changed Azure VM identities during acquisition readiness and use identity-checked VM/companion cleanup for failed acquisitions instead of blind name-based rollback. [PR 1827](https://github.com/openclaw/crabbox/pull/1827). Thanks @steipete.
- Clean partial Tensorlake environment-profile uploads after failure or cancellation, fence cleanup to original ownership, and share isolated profile lifetimes and source-failure handling with Modal. [PR 1825](https://github.com/openclaw/crabbox/pull/1825). Thanks @steipete.
- Preserve Cloudflare and Azure Dynamic Sessions cancellation when an incomplete command stream ends with clean EOF, without replacing accepted completion events or scanner errors. [PR 1825](https://github.com/openclaw/crabbox/pull/1825). Thanks @steipete.

## 0.49.0 - 2026-09-03

### Highlights

- **Sync that keeps working.** Unreachable Git origins fall back to full-file sync, symlink retargets reach the runner, and Git overlays transfer a consistent snapshot while later edits wait for the next sync.
- **Keep the evidence when runs fail.** Brokered artifact publishing is restored, and Blacksmith can return requested artifacts after confirmed normal failures with exit codes 1–127 while preserving the original result.
- **More predictable creation and checkpoints.** Reuse stable lease IDs for managed checkpoint forks, inspect your admission count and limit without allocating, and cancel or recover creation without losing its original readiness deadline.
- **Easier Daytona setup.** Reuse browser OAuth login and select native container tiers with `--class`, while preserving custom and checkpoint snapshots.
- **More reliable Windows runs and private Mac setup.** Managed native Windows setup now checks and repairs the Visual C++ runtime, SSH command input no longer depends on EOF, and macOS bootstrap passwords stay out of shell traces and process arguments.
- **Clearer failures and trustworthy results.** Get better out-of-memory guidance for local containers and original Tart startup errors, avoid double-counting aliased JUnit reports, and keep late events from rewriting finalized run summaries.

### Upgrade notes

- Managed fixed-ID checkpoint forks and `crabbox capacity` require an updated coordinator; older coordinators reject these requests without falling back to ordinary creation or direct providers. [PR 1692](https://github.com/openclaw/crabbox/pull/1692), [PR 1752](https://github.com/openclaw/crabbox/pull/1752).
- On Linux images using cloud-init, native checkpoint preparation now requires completed initialization, the distro Python/cloud-init module, and a runtime directory on `tmpfs`; preparation failures stop before image creation. [PR 1692](https://github.com/openclaw/crabbox/pull/1692).
- Fixed-ID creation cancellation requires the updated coordinator. After a coordinator rollback, version-2 admission records stay fenced; upgrade the coordinator again before confirming pre-allocation stop. [PR 1749](https://github.com/openclaw/crabbox/pull/1749).
- Managed native Windows runtime repair requires access to the pinned Microsoft downloads. Reboot-required or interrupted installations block readiness until an external reboot and retry; static/BYO hosts remain operator-managed. [PR 1753](https://github.com/openclaw/crabbox/pull/1753).
- Blacksmith artifact collection requires remote `timeout` support for `--kill-after`; incompatible timeout implementations now fail preflight before the user command starts. [PR 1736](https://github.com/openclaw/crabbox/pull/1736).
- Legacy Islo claims remain name-bound. Recreate leases to obtain ID-bound claims; provider deletion still uses the name-based API rather than an atomic delete-by-ID operation. [PR 1708](https://github.com/openclaw/crabbox/pull/1708).
- Ordinary sync fingerprints advance to v6, causing one safe resync; Git-overlay fingerprints remain v1 and no configuration migration is required. [PR 1736](https://github.com/openclaw/crabbox/pull/1736).

### Changes

- Kept sync working when runners cannot authenticate to or reach Git origins by falling back to a full manifest, preserving internal Git-control exit codes, and recognizing disconnected sockets without mistaking URL digits for authentication failures. [PR 1622](https://github.com/openclaw/crabbox/pull/1622), [PR 1744](https://github.com/openclaw/crabbox/pull/1744). Thanks @vincentkoc.
- Restored brokered artifact publishing with complete production storage configuration and atomic deployment of bucket-scoped signing credentials, preserving the existing storage and signed-read design. [PR 1732](https://github.com/openclaw/crabbox/pull/1732), [PR 1737](https://github.com/openclaw/crabbox/pull/1737).
- Added replay-safe `checkpoint fork --lease-id` for coordinator-managed native checkpoints, reusing the same child for matching requests while refusing changed, canceled, or terminal attempts. [PR 1692](https://github.com/openclaw/crabbox/pull/1692). Thanks @Copilot.
- Made fixed-ID creation cancellable at coordinator admission before allocation, preserving exact owner binding and cancellation across restart, duplicate replay, and reservation races without inventing lease records or treating unknown IDs as released. [PR 1749](https://github.com/openclaw/crabbox/pull/1749).
- Added `crabbox capacity` and `GET /v1/capacity` for read-only snapshots of the authenticated owner's admission-equivalent count and effective limit across all months and orgs, without changing monthly usage or allocating resources. [PR 1752](https://github.com/openclaw/crabbox/pull/1752). Thanks @steipete.
- Preserved the original provisioning deadline after recovering an uncertain coordinator create response, so readiness is neither cut short by the recovery window nor restarted with a fresh budget; caller cancellation and cleanup ownership remain intact. [PR 1740](https://github.com/openclaw/crabbox/pull/1740).
- Kept canceled AWS creates from continuing into another region, preserved the `409 create_canceled` result and reason, and kept cleanup confirmation separate from cancellation. [PR 1743](https://github.com/openclaw/crabbox/pull/1743).
- Preserved native AWS, Machine0, and Daytona lease claims through reused-run preparation so concurrent heartbeats cannot invalidate command admission; AWS renewals also preserve fixed-create ownership tags. [PR 1692](https://github.com/openclaw/crabbox/pull/1692).
- Retained accepted AWS and Hetzner checkpoint identities through interrupted readiness waits, and recorded AWS backing snapshots before AMI deletion so partial cleanup remains retryable. [PR 1692](https://github.com/openclaw/crabbox/pull/1692).
- Kept running Linux checkpoint sources cloud-init-ready while requiring restored VMs to complete their own initialization. [PR 1692](https://github.com/openclaw/crabbox/pull/1692).
- Applied configured SSH ports on socket-activated Linux and prepared images by refreshing systemd's SSH socket configuration. [PR 1692](https://github.com/openclaw/crabbox/pull/1692).
- Prevented failed coordinator maintenance from postponing earlier queued work, while rearming consumed overdue wakeups and reporting retry-scheduling failures. [PR 1767](https://github.com/openclaw/crabbox/pull/1767).
- Bound typed ready-pool capacity to canonical provider identities, migrated desired state to fixed-size v2 keys without legacy-reader exposure, and routed returns to fail-closed drain cleanup when provider or lease identity evidence changes. [PR 1619](https://github.com/openclaw/crabbox/pull/1619). Thanks @vincentkoc.
- Kept managed macOS bootstrap passwords out of shell traces and process arguments, made new password files private from creation, and corrected Screen Sharing guidance to keep port 5900 closed in custom ingress rules. [PR 1723](https://github.com/openclaw/crabbox/pull/1723).
- Preserved native Windows SSH input framing with asynchronous reads that do not wait for EOF or close borrowed stdin, and staged input through the workspace witness for fresh one-shot runs as well as reused leases. [PR 1724](https://github.com/openclaw/crabbox/pull/1724).
- Added verified Visual C++ v14 runtime checks and repair to shared managed native Windows bootstrap before readiness, preventing missing-runtime failures while leaving WSL2 unchanged. [PR 1753](https://github.com/openclaw/crabbox/pull/1753).
- Included symlink target identity in ordinary sync fingerprints without following links, so same-content retargets no longer leave stale remote links. [PR 1736](https://github.com/openclaw/crabbox/pull/1736).
- Made Git-overlay transfers use accepted immutable snapshots for payloads, manifests, fingerprints, and index validation, leaving later edits for the next sync and preserving primary errors through cleanup and fallback. [PR 1624](https://github.com/openclaw/crabbox/pull/1624). Thanks @vincentkoc.
- Hardened reused Git-overlay workspaces against hidden index changes and incomplete fingerprints while preserving verified ignored caches. [PR 1623](https://github.com/openclaw/crabbox/pull/1623). Thanks @vincentkoc.
- Made Git-coherence branch selection honor explicit `sync.baseRef` before inferred defaults, avoiding deleted topic or stale default branches when a valid containing branch exists while preserving the selected commit and tree. [PR 1759](https://github.com/openclaw/crabbox/pull/1759).
- Kept late run events in the audit log without rewriting finalized run summaries or receipts. [PR 1736](https://github.com/openclaw/crabbox/pull/1736).
- Deduplicated explicit relative and absolute aliases of JUnit reports while preserving distinct reports and target-platform path semantics. [PR 1736](https://github.com/openclaw/crabbox/pull/1736).
- Made local-container OOM retry guidance use observed retained-container limits and reported runtime total RAM, with read-only diagnostics in `inspect` and non-wait `status --json` and conservative unknown-capacity fallback that preserves the workload exit. [PR 1734](https://github.com/openclaw/crabbox/pull/1734).
- Collected requested Blacksmith artifacts after confirmed normal workload failures with exit codes 1–127 in the original invocation, preserving the workload result and requiring complete receipts, clean transport completion, and unchanged ownership before publishing evidence. [PR 1733](https://github.com/openclaw/crabbox/pull/1733).
- Validated artifact-glob and required-artifact patterns by path component, accepting ordinary names such as `result..json` and rejecting explicit `.git` or `.crabbox` paths before lease acquisition while preserving traversal checks. [Issue 1751](https://github.com/openclaw/crabbox/issues/1751). Thanks @coygeek.
- Preserved literal Blacksmith stdout/stderr control bytes outside the reserved receipt namespace and checked timeout support before user code could have side effects. [PR 1736](https://github.com/openclaw/crabbox/pull/1736).
- Used ASCII Box's advertised SSH host and port for readiness, sync, execution, and status while retaining the older IP-and-port-22 fallback. [PR 1728](https://github.com/openclaw/crabbox/pull/1728). Thanks @shunkakinoki.
- Preserved ASCII Box deletion-operation references across interrupted cleanup and required confirmed operation completion and inventory absence before removing ownership claims. [PR 1731](https://github.com/openclaw/crabbox/pull/1731). Thanks @shunkakinoki.
- Recognized Daytona CLI browser OAuth profiles, honoring `DAYTONA_CONFIG_DIR` and preserving explicit credentials and API-key precedence; expired tokens direct users to `daytona login`. [PR 1772](https://github.com/openclaw/crabbox/pull/1772).
- Added direct Daytona class selection through native container snapshots, validating custom and checkpoint snapshots without replacing or resizing them and cleaning up mismatched allocations. [PR 1773](https://github.com/openclaw/crabbox/pull/1773).
- Bounded direct Daytona control requests to 60 seconds, including stalled response bodies, without cutting off long-running commands or archive uploads; earlier caller deadlines and exact allocation-recovery ownership remain intact. [PR 1750](https://github.com/openclaw/crabbox/pull/1750). Thanks @SebTardif.
- Recorded Islo sandbox IDs in ownership claims, validated identity before status and cleanup, and clarified delegated-run behavior and the distinction between sandbox identity and lease addressing. [PR 1705](https://github.com/openclaw/crabbox/pull/1705), [PR 1708](https://github.com/openclaw/crabbox/pull/1708). Thanks @zozo123.
- Allowed exactly owned completed Blacksmith Testboxes to finish local claim and SSH-key cleanup when no Actions run URL was assigned, without relaxing native-table framing or ownership checks. [PR 1746](https://github.com/openclaw/crabbox/pull/1746).
- Preserved delayed Tart startup failures and bounded stderr through readiness and cleanup so later IP, guest-agent, or SSH errors no longer hide the original cause. [PR 1738](https://github.com/openclaw/crabbox/pull/1738).
- Preserved bounded Hetzner error codes and messages from multiline provider responses without changing allocation recovery or secret redaction. [PR 1771](https://github.com/openclaw/crabbox/pull/1771). Thanks @steipete.
- Preserved recognized workspace-owner renewal failure states alongside transport errors without changing exit 7 or fail-closed collection and cleanup. [Issue 1712](https://github.com/openclaw/crabbox/issues/1712). Thanks @coygeek.
- Exposed effective generic lease `ttl` and `idleTimeout` in `config show` text and JSON without changing defaults or lease behavior. [PR 1757](https://github.com/openclaw/crabbox/pull/1757).
- Made `doctor --help` and `-h` show diagnostic modes and primary options before the complete provider flag reference, so the installed CLI explains how to inspect providers, leases, recorded runs, and ponds. [Issue 1754](https://github.com/openclaw/crabbox/issues/1754). Thanks @coygeek.
- Simplified post-publication Homebrew updates into the ordinary tag-based tap handoff, with independently retryable channel smokes and no need to rebuild or republish a release when the tap update fails. [PR 1735](https://github.com/openclaw/crabbox/pull/1735).
- Removed extra PR-approval ruleset and administrative-freeze prerequisites from release publication while retaining signed-source, immutable-asset, native-verification, and immediate publication readback checks.
- Aligned copyable full race-test commands with CI's 15-minute package timeout and added a regression check to prevent documentation drift. [PR 1736](https://github.com/openclaw/crabbox/pull/1736). Thanks @coygeek for the timeout report.

## 0.48.1 - 2026-09-01

### Changes

- Corrected nested JUnit totals and preserved failed-case details so `--fail-on-test-failures` catches failures even when suite counters are missing or zero, without double-counting parent aggregates.
- Fixed signed receipt/log mismatches by keeping retained output valid UTF-8 before signing and storage, preserving raw captures and full-stream hashes, and marking incomplete retained logs as truncated.
- Kept automatic POSIX SSH failure bundles focused on the current uploaded script instead of earlier uploads and neighboring files. Explicit artifact and download selections remain independent.
- Reduced SSH startup round trips by avoiding redundant successful-login checks and skipping telemetry when no coordinator run handle exists.
- Made run summaries, timing JSON, and recovery guidance distinguish confirmed release from retained or pending cleanup, report local cleanup errors separately, and preserve an existing workload failure's exit code.
- Made coordinator-backed `stop` use one five-minute cancellation budget across inspection, claim waits, cleanup, release, and observation; local daemon lock waits now honor cancellation without reversing confirmed cleanup.
- Fixed coordinator-managed AWS cleanup during creation by tracking the exact allocation before readiness, continuing to observe pending cleanup, and retaining recovery evidence when storage or deletion is uncertain.
- Prevented ready-pool leases from being borrowed concurrently across typed and legacy pools, including existing duplicate records, and blocked expired or quarantined borrows from returning to ready.
- Honored explicit empty YAML lists for environment forwarding, JUnit paths, and preflight probes while preserving omitted-key inheritance, additive profile/sync lists, and independent automatic result discovery.
- Honored explicit advertised SSH-port selection on ordinary reused coordinator leases without changing host trust or provider cleanup; ready-pool connections retain their pool-recorded endpoint.
- Exposed local-container settings in `config show` text and JSON, including effective work-root defaults when selected, without Docker discovery or daemon access.
- Kept brokered native checkpoint creation waiting through coordinator-owned capture recovery without submitting another capture, while respecting cancellation, timeouts, and terminal failures. Thanks @Copilot.
- Restored machine-readable missing-checkpoint inspection after managed deletion without treating unresolved capture bindings or coordinator failures as confirmed deletion.
- Unblocked ordinary Machine0 source cleanup when a failed checkpoint capture is proven not to have attempted image submission; interrupted or uncertain submissions retain their recovery records.
- Added `checkpoint abandon` for unresolved ordinary Machine0 captures: dispose of the verified source through its existing ownership claim while retaining the unresolved image record and blocking image reuse, deletion, or pruning.
- Preserved the original coordinator heartbeat transport error when HTTP fallback also fails or has no time left, without changing successful fallback behavior.
- Fixed Parallels clone placement under the configured parent directory, leaving VM bundle naming and creation to Parallels.

### Upgrade notes

- Previously ignored SSH-port overrides now take effect on ordinary reused coordinator leases and reject unadvertised ports. Remove obsolete `--ssh-port`, `ssh.port`, or `CRABBOX_SSH_PORT` settings to retain automatic selection; explicit selection disables port fallback.
- Empty YAML `env.allow`, `results.junit`, and `run.preflightTools` lists now clear inherited values. Omit the key to inherit instead; clearing JUnit paths does not disable `results.auto`, and profile allowlists remain additive.
- Automatic POSIX SSH failure bundles no longer include the retained `.crabbox/scripts` store. Explicitly select additional files you need; use `--download-on-failure` for eligible Linux SSH failure downloads.

## 0.48.0 - 2026-08-30

### Highlights

- **Keep the evidence when a run fails.** Linux SSH runs can download selected artifacts after a confirmed workload failure with `--download-on-failure`; `--require-artifact-change` can reject stale, unchanged evidence instead of accepting files left by an earlier run.
- **More capable checkpoints.** Brokered native checkpoints gain coordinator-owned admission limits, audit events, and optional unused-checkpoint expiry. Incus gains durable fixed lease IDs and private container disk checkpoints that survive source deletion.
- **Smoother remote runs.** IPv6 sync and uploads work correctly, overloaded SSH multiplexed sessions recover without replacing the lease, and active lease operations no longer block unrelated runs.
- **Safer cleanup and trusted defaults.** More providers require exact, unchanged ownership before reuse or destruction; shipped Ubuntu container images are digest-pinned, and the built-in Tart image is verified before boot.
- **More reliable Windows and WSL2 execution.** WSL2 uses a verified SFTP command envelope with bounded cleanup and complete exit results; native Windows state updates preserve open readers and private routing state.

### Upgrade notes

- **WSL2 now requires SFTP.** Enable the Windows OpenSSH SFTP subsystem and verify Doctor's `wsl2-sftp` probe before upgrading; the v0.47.0 stdin fallback has been removed.
- **Native Windows requires Windows 10 version 1709+ or Windows Server 2019+.**
- **Blacksmith Testbox stop and reuse require exact local claims.** For legacy or missing claims, independently verify the organization and Testbox, stop it with the native CLI, confirm terminal status, and create a new lease; `--reclaim` does not bypass this requirement.
- **Blacksmith Testbox rejects `--no-sync`.** Remove it from runs, prewarm probes, and named jobs; Testbox manages workspace synchronization.
- **Static SSH architecture settings are assertions.** Explicit or inherited architecture settings, including `amd64`, must match fresh host evidence; remove the explicit setting to use automatic discovery.

### Added

- Added Linux SSH `--download-on-failure` retrieval after an owned nonzero workload exit, preserving the exit code and collecting selected evidence before failure bundles and teardown.
- Added opt-in Linux SSH `--require-artifact-change` checks with bounded content snapshots, created/changed/unchanged/missing timing states, and collection of only accepted bytes.
- Added coordinator-owned brokered native checkpoints with transactional checkpoint and fork-claim admission limits, bounded recent audit events, opt-in unused-checkpoint expiry, and promotion-safe cleanup.
- Added durable fixed-ID Incus leases and private container disk checkpoints that survive source deletion, with ownership-checked cleanup and fresh SSH identity before fork startup.
- Added replayable native checkpoint capture-and-retire with `--checkpoint-id`, `--retire-source`, read-only `--prepare-only` admission, and explicit `--discard-failed` recovery on supported providers; Hetzner source retirement remains unavailable.
- Added `providers sizes machine0 --with-context --json` to show effective native size and region selection alongside the live catalog, preserving configured defaults and exact fixed-lease replay.

### Fixed

- Prevented active lease operations from blocking unrelated claim discovery, slug allocation, and Testbox runs while preserving exact ownership checks and cleanup fencing.
- Fixed IPv6 workspace sync and artifact/egress uploads by using private SSH transport aliases, preserving authentication, host trust, Windows/WSL routing, and transfer cleanup.
- Recovered overloaded SSH multiplexed sessions with one exact-diagnostic retry and a direct-connection fallback while preserving the original lease and command. Thanks @excelsier.
- Rendered failure recovery guidance after automatic cleanup, omitting lease commands only after confirmed release while preserving retained and uncertain cleanup recovery.
- Printed failed-run output tails once after the digest, preserving both streams, bounded output, capture notices, redaction, and failure bundles. Thanks @coygeek.
- Rejected lease-output aliases of captures and success/failure downloads before acquisition, preserving retained lease handles and existing output bytes.
- Released run-owned workspace authority after static SSH one-shot cleanup so the surviving host can be reused immediately, while preserving guarded owner checks and destructive-provider cleanup ordering.
- Preserved SIGINT and SIGQUIT behavior for kept and reused POSIX SSH workloads without weakening child ownership checks or changing caller umasks. Thanks @coygeek.
- Preserved the remote caller's umask for workspace-owned POSIX and WSL2 commands while keeping staged scripts, stdin, and owner state private.
- Reported POSIX and WSL2 workspace-owner setup failures separately from SSH readiness, with bounded pre-start cleanup and fail-closed recovery when child observation is denied.
- Fixed static SSH architecture admission across Linux, macOS, Windows, and WSL2: configured values, including inherited `amd64`, now require fresh matching evidence after read-only ownership checks and before guarded claim publication; remove explicit architecture settings for automatic discovery, with measured or unknown evidence reported separately from offline defaults.
- Simplified WSL2 SSH execution into one verified, privately blinded SFTP envelope with a derived fixed-control startup/work/completion budget, LF helpers on Windows builds, identity-checked cleanup, and no replay after publication uncertainty; SFTP is now required, replacing the v0.47.0 stdin fallback (enable it and verify Doctor's `wsl2-sftp` probe before upgrading). Thanks @vincentkoc.
- Kept WSL2 partial-cleanup hashing within its cancellation budget and published complete workload exit results atomically, preserving staged ownership checks and rejecting malformed statuses. Thanks @vincentkoc.
- Made native Windows state replacement and cleanup preserve open readers; the CLI now requires Windows 10 version 1709+ or Windows Server 2019+.
- Kept Windows external routing state readable after publication by creating it with current-user ownership and private ACLs.
- Pinned the built-in Tart macOS image and verified cloned disk, NVRAM, and configuration contents before boot, retaining custom-image overrides, recording verified provenance, and waiting for the guest agent before SSH setup. Thanks @coygeek.
- Pinned shipped Local Container and Apple Container Ubuntu defaults to reviewed multi-platform OCI digests, verified Apple images before bootstrap, and preserved explicit custom-image overrides. Thanks @coygeek.
- Disabled automatic host clipboard and audio passthrough for Tart VMs.
- Kept automatic egress client tickets off SSH, remote shell, and helper process arguments with a foreground bounded-input handoff to the detached client, preventing SSH teardown from truncating ticket delivery.
- Kept secret SSH usernames out of VNC/WebVNC and pond tunnel arguments and daemon state, retained private configs through attached teardown or authenticated detached listener readiness, and preserved pond child environment filtering and overrides.
- Preserved replacement and backend-retained claims after delegated stops in `pond release` by leaving claim finalization to the provider.
- Fixed cleanup of Docker checkpoint forks from fixed-ID source leases by clearing inherited allocation ownership, including when forking older checkpoint images.
- Required exact Modal sandbox and native scope bindings for stop, reuse, and one-shot cleanup, fencing claim changes and retaining uncertain or legacy resources until termination is confirmed. Thanks @coygeek.
- Required exact Tensorlake resource and API-key scope bindings for reuse and cleanup, fencing claim changes and retaining legacy or uncertain sandboxes until termination is confirmed. Thanks @coygeek.
- Required exact Apple Machine ownership claims bound to daemon storage and an acquisition-only marker, fencing cleanup and retaining legacy, replaced, or uncertain machines without implicit adoption. Thanks @coygeek.
- Required exact ASCII Box ownership claims for reuse and deletion, pinning creation identity and endpoint/organization routing, fencing teardown and rollback, and retaining uncertain resources until deletion is confirmed. Thanks @coygeek.
- Required exact SmolVM ownership claims for deletion and reuse, binding machine identity and endpoint before startup, fencing cleanup against claim changes, and retaining legacy or uncertain resources without implicit adoption. Thanks @coygeek.
- Fenced Nomad stop, cleanup, run teardown, and setup rollback against concurrent claim changes, preserving successor jobs and retaining claims until remote absence is confirmed. Thanks @coygeek.
- Required durable Incus ownership claims for stop and cleanup, preserving legacy instances and keys without implicit adoption, keeping status read-only, and rechecking identity after stop. Thanks @coygeek.
- Required exact, unchanged Proxmox cleanup claims bound to the cluster scope, VMID, and native generation ID, retaining unclaimed or ambiguous VMs and keys and preventing endpoint refreshes from rebinding ownership. Thanks @coygeek.
- Required exact, unchanged Tart cleanup claims bound to the VM's storage and ownership marker, preserving unclaimed, legacy, replaced, or ambiguous VMs and local keys.
- Kept public AWS lease release independent of other instances’ image and network readiness, while fencing ingress writes with fresh lease authority and access state.
- Prevented guest cleanup of confirmed deleted coordinator leases, bounded ordered guest cleanup before authoritative release, and kept prewarm cleanup behind the release owner.
- Preserved managed Daytona cleanup responsibility after lost create responses, with native TTL for kept sandboxes, early exact-resource tracking, and original-context deletion confirmed by provider observation.
- Cleaned exact-owned interrupted Azure public-IP and NIC provisioning prefixes while restoring ordered SKU fallback and preserving immutable-identity cleanup fences. Thanks @excelsier and @vincentkoc.
- Retained scoped direct-AWS fixed-lease cleanup receipts for canonical stop replay after inventory disappears, with fresh account, region, identity, and inventory checks; older compact tombstones remain unchanged and fail closed.
- Required exact scoped Blacksmith Testbox claims for stop/reuse, fenced acquisition rollback and key ownership, and confirmed terminal cleanup before dropping state while preserving active-command cancellation and truthful cleanup results. Thanks @coygeek.
- Reconciled failed Blacksmith stops only after fresh exact-Testbox terminal confirmation, retaining exact claims when local artifact cleanup fails and reporting independent verification failures without losing native exit codes or original command failures.
- Made native checkpoint source retirement replayable, preserving pending operation and image identity across interruption, fencing ordinary release after capture reservation, binding Machine0 retirement to its captured account, and refusing forks from discarded images without restarting a retiring Machine0 source or discarding unresolved ownership records; Hetzner retirement remains unavailable until its project identity can be attested.
- Preserved explicit repository reclaim for existing Machine0 leases and unified fixed replay, inspection, and cleanup around attested native details and early durable UUID binding; retained ambiguous attempts and empty legacy records without duplicate creation or inferred cancellation.
- Attested fixed Machine0 checkpoint-fork replay from identity-checked VM details when inventory omits the pinned image version, preserving key semantics and refusing mismatches without duplicate creation.
- Repaired Machine0 UUID lookups through validated inventory and identity-verified full details by name, preserving UUID ownership and rejecting incomplete or changed identities.
- Resolved full Machine0 default SSH-key metadata before preflight so public keys are not rejected when list summaries omit their local filenames.
- Rejected proven Machine0 PUBLIC-key identity mismatches before VM creation without changing key selection or treating unverified keys as mismatches, and avoided blocking extraction on special files.
- Made Machine0 doctor check the same SSH-key prerequisites as new creation and reject missing legacy key pairs when no default is selected, without mutating keys or blocking existing fixed-lease replay. Thanks @coygeek.
- Preserved configured Machine0 executable paths and polling settings during checkpoint verification, deletion, and pruning while retaining exact image/version ownership checks and local records on uncertain failures.
- Preserved Machine0 missing-version cleanup refusals while distinguishing confirmed version removal from whole-image absence, including lost remove responses without erasing sibling versions or unresolved metadata.
- Marked Machine0 creation-only selectors in provider discovery and excluded them from prewarm follow-ups, with invalid projected provider configuration rejected before allocation.
- Honored explicit Tencent Cloud Spot and on-demand market selections while preserving hourly billing when no market is configured, with invalid values rejected before provider access. Thanks @exAClior.
- Restored Ubuntu ARM64 local-container browser provisioning with signed native Mozilla Firefox packages instead of Snap transition packages, while preserving working browsers and advancing past broken distro candidates. Thanks @coygeek.
- Bounded coordinator lease reads, doctor probes, and HTTP heartbeats to 30 seconds, and stop's preliminary lookup to ten seconds, preserving provisioning budgets, provider-scoped release, caller cancellation, and cleanup evidence.
- Bounded best-effort foreground lease refreshes to 20 seconds so stalled maintenance does not block SSH-backed copy and connection commands for the coordinator's full HTTP budget, while preserving claim checks and caller cancellation.
- Bounded best-effort Testbox portal bookkeeping to one five-second budget and delayed final warmup completion/timing until it ends, preserving successful allocations and retained leases on sync failure.
- Honored cancellation during Code bridge reconnect and code-server readiness waits, preserving the existing retry delays while returning promptly on Ctrl+C. Thanks @SebTardif.
- Honored cancellation during Hostinger bootstrap SSH retry delays while preserving ownership-checked rollback and recovery state. Thanks @SebTardif.
- Reaped WebVNC daemon SSH tunnels across child restarts and orderly shutdown, retaining exact ownership records and reporting failure when cleanup cannot be confirmed.
- Bounded VNC/WebVNC credential reads to 30 seconds and 64 KiB, discarding partial credentials on any failure while preserving connection defaults, caller cancellation, and transport cleanup. Thanks @SebTardif.
- Bounded WebVNC bridge response-header waits to 30 seconds without limiting established WebSocket sessions or bypassing configured HTTP transports. Thanks @SebTardif.
- Preserved macOS WebVNC authentication timeout diagnostics when a connection deadline closes the browser transport before negotiation returns.
- Honored `pond connect` flags after the pond name so the documented `pond connect <name> --export` form starts tracked daemons instead of blocking in foreground mode.
- Validated generated prewarm probes through the provider's run contract before backend configuration, ready-pool checks, or ACL changes, preserving follow-up routing and reuse intent.
- Rejected Blacksmith Testbox `--no-sync` with exit 2 before acquisition or reuse instead of silently delegating sync, including nonblank `prewarm --probe-command` and named jobs with `noSync: true` before warmup or dry-run planning.
- Reported bounded, secret-safe remote Git seed failure phases and categories across ordinary sync, local Actions hydration, and native Windows, while preserving file sync and Git coherence behavior. Thanks @coygeek.
- Made config path diagnostics honor `CRABBOX_CONFIG`, matching the file selected for reads and writes. Thanks @coygeek.
- Exposed resolved Incus settings in `config show --json`, with endpoint credential redaction and no daemon access.
- Reported omitted local-container architecture as `native` in config diagnostics without probing the runtime or changing explicit architecture assertions. Thanks @coygeek.
- Preserved bounded Docker and Podman diagnostics when runtime identity probes return empty successful output, without accepting missing identities. Thanks @coygeek.
- Omitted speculative `&&` failure diagnostics for compound shell commands while retaining simple-chain explanations and workload exit behavior. Thanks @coygeek.
- Put copy-command usage, path syntax, and examples before the provider flag reference in `cp --help`. Thanks @coygeek.
- Clarified uploaded-script path semantics in the Agent Skill, including when to run a synced repository script in place for adjacent assets. Thanks @coygeek.

## 0.47.0 - 2026-08-28

### Added

- Added direct Daytona filesystem checkpoints with explicit stop consent, source restart, verified snapshot forks, and ownership-bound snapshot cleanup.
- Added an experimental Boxd SSH-lease provider with interactive HTTPS login, immutable ownership claims, and safe rejection of the vendor's currently non-isolated production VMs. Thanks @MichielMAnalytics.
- Added explicitly opt-in, image-pinned typed ready pools with exact repository/cache identities and rollback-isolated coordinator storage. Thanks @vincentkoc.
- Added targeted `stop --force` recovery through verified provider adoption or exact coordinator lease inspection without weakening ownership checks.
- Added replay-safe fixed lease IDs to checkpoint forks and machine-readable JSON output to checkpoint creation and forking.
- Added strict, provider-neutral Linux image readiness manifests with shared CLI/coordinator capability verification and safe legacy-image migration. Thanks @vincentkoc.
- Added fixed idempotent `--lease-id` replay to local-container warmups, with exact container-intent matching and single-use released IDs.

### Fixed

- Clarified static SSH stop/run documentation and added command-path regression coverage for existing best-effort connection cleanup before local unclaiming, without changing runtime behavior.
- Unified provider-owned routing for stop, retry, rescue, and WebVNC commands, preserving scope, explicit false release settings, and Kubernetes environment selectors without exposing URL credentials.
- Saved automatic failure bundles in private user state when the project capture destination is unwritable, retaining verified directories through creation, publication, and cleanup to prevent path substitution while preserving the command exit status.
- Refreshed coordinator runtime and Worker development dependencies, including Nano ID and Undici advisory fixes.
- Preserved Daytona recovery claims and lookup errors when `stop` cannot verify the sandbox, instead of reporting release from an unverified not-found response.
- Fixed portable Node coordinator control heartbeats deadlocking subsequent lifecycle operations, releases, and graceful shutdown.
- Made direct Daytona sandboxes private, preserved dependencies across syncs, enforced native TTL and idle heartbeats, reported authoritative readiness, and verified allocation rollback and credential-safe redirects.
- Fixed brokered Windows bootstrap on images with built-in OpenSSH by sharing the CLI's installed/system/PATH command resolution; centralized common bootstrap fragments, pinned downloads, and portable OS metadata across both runtimes.
- Unified E2B, Modal, and Cloudflare Sandbox run retention, bounded cleanup, and final timing; preserved command exit codes on cleanup failure, applied Modal keep-on-failure to setup/sync failures, and checked Modal archives before creation with staged workspace replacement.
- Required exact host/project-scoped Semaphore job ownership claims and fresh provider verification before stopping jobs.
- Required exact API-scoped Morph instance ownership claims and fresh provider verification before pause or deletion.
- Returned machine-readable missing checkpoint verdicts and made checkpoint deletion idempotent when local records or coordinator-owned resources are already absent.
- Required exact pool-scoped VM ownership claims and fresh provider verification before XCP-ng release or cleanup deletion.
- Kept local-container bootstrap mounts under the user cache directory for desktop Docker VMs and retained cleanup recovery state when cache settings change. Thanks @johan-eilertsen.
- Required exact, scope-bound ownership claims and fresh provider verification before Sprites deletion or Tenki session termination.
- Required exact, scope-bound local ownership claims before Namespace Devbox and Compute Instance lifecycle mutations, with ownership-verified forced recovery for exact Compute Instance IDs.
- Made direct Daytona SDK commands honor caller deadlines without the default one-minute HTTP cutoff or a separate one-hour execution cap. Thanks @arisylafeta.
- Removed coordinator URL credentials from Code and WebVNC browser links, opener arguments, and viewer bootstrap form actions. Thanks @coygeek.
- Redacted configured and runtime-only credentials from coordinator-stored run failure diagnostics while preserving raw command output. Thanks @coygeek.
- Retried temporary Machine0 read outages within the existing operation deadline while keeping provider mutations single-attempt.
- Added actionable Machine0 recovery hints for unclaimed lease IDs without treating short name hashes as proof of lease ownership.
- Removed idle gaps throughout media previews while preserving every moving interval, so long recordings produce short GIFs without hiding late changes.
- Exposed coordinator cleanup state in brokered `inspect --json`, preserving pending, error, and retry signals plus the distinction between omitted and explicit `releaseDeletesServer: false`.
- Reduced Machine0 provisioning reads about twelvefold by polling every 60 seconds by default while preserving fresh fixed-lease ownership checks.
- Failed local-container acquisition and status waits promptly when the exact claimed container exits, while preserving fenced recovery and cleanup for retained leases.
- Redacted coordinator URL credentials, query parameters, and fragments from run-context portal and logs links.
- Preserved Machine0 command deadline, cancellation, and signal failures with partial output and ran independent doctor probes concurrently.
- Required an exact, locked local ownership claim before releasing ordinary AWS instances, preventing tag-matched resources from being terminated without durable lease authority.
- Streamed artifact-collection scripts through SSH stdin so multiple artifact globs no longer overflow macOS OpenSSH multiplexed session requests.
- Allowed Windows and WSL2 SSH readiness checks enough time for delayed native OpenSSH handshakes without slowing Linux or macOS readiness.
- Kept WSL2 workspace-owner commands below the Windows command-line limit by streaming their POSIX scripts over SSH stdin.
- Fenced Linode heartbeats and Tailscale metadata updates with exact account-, scope-, and instance-bound claims, preserving legacy instance claims, idle-timeout intent, and safe release continuity.
- Made two timing-sensitive tests robust on loaded CI runners.
- Required exact, locked resource ownership claims before Tencent Cloud, Nebius, Vast, Orgo, Upstash Box, Coder, and EC2 Mac host lifecycle mutations, preventing name-matched, stale, cross-namespace, or concurrently renewed resources from being destroyed.
- Added authoritative Machine0 machine-class discovery while preserving explicit native size selections and the five-provider legacy class compatibility boundary.

## 0.46.0 - 2026-08-20

### Added

- Added fixed idempotent `--lease-id` replay to the Machine0 provider: an identical warmup adopts the existing VM instead of creating a second one, a drifted request fails with `lease_id_conflict`, and a released ID is single-use.

### Fixed

- Rejected oversized delegated-run workspaces before any paid or stateful provider resource is created, so size-limit failures no longer leave billable resources behind.
- Made E2B and Azure Dynamic Sessions workspace sync transactional so a failed upload no longer destroys the previous remote workspace, and honored `--keep-on-failure` for sync and setup failures.
- Stopped losing track of possibly-created billable resources: ambiguous Vast instance creation and failed AWS Lambda MicroVM rollbacks now persist recovery claims and surface errors naming the exact resource instead of failing silently.
- Enforced coordinator-provided SSH host keys before first transport and removed per-lease local SSH credentials after confirmed brokered release.
- Required exact local ownership before destructive cleanup across Cloudflare Dynamic Workers, DigitalOcean, Linode, and Vultr, fencing deletions with revisioned claims so concurrent sessions or stale state can no longer remove the wrong resource.
- Retained evidence for uncertain Cloudflare Dynamic Workers completions - runs are kept with recovery claims instead of reporting not-kept over unreconciled provider state - and documented that stop removes metadata only and cannot cancel active runs.
- Honored documented waiting and cancellation behavior: W&B `status --wait` now actually waits, Blaxel stops its remote process when polling is interrupted, and status waits bound each in-flight provider call by the requested timeout.
- Made doctor configuration fail with a clear provider error instead of panicking when a backend lacks doctor capability.
- Bounded delegated-provider subprocess captures and background cleanup with explicit limits, deadlines, and visible truncation instead of unbounded growth.
- Preserved exact lease claim revisions across coordinator registration, endpoint refresh, and Tailscale metadata updates so lifecycle cleanup cannot fail with stale authorization and leak provider resources.
- Made canceled Tenki readiness waits report cancellation instead of timeout.
- Consolidated cross-provider infrastructure into shared engines - lifecycle polling (30 providers), cross-origin redirect security (17), cross-process operation locking (9), doctor configuration (66), the AWS/Machine0 fixed-lease mechanism, JSON subprocess exchanges, strict claim matching, and nine smaller helper clusters - preserving every provider-specific behavior, error message, and on-disk path.
- Documented which acquisition and delegated-run lifecycle responsibilities deliberately remain provider-owned and why centralizing them was rejected.

## 0.45.0 - 2026-08-19

### Added

- Added a built-in Machine0 SSH-lease provider with live size and GPU pricing, persistent VM lifecycle, explicit suspend/resume, native versioned images, and tunneled Linux desktop support.
- Added authoritative, target-aware machine-class catalogs to both JSON provider discovery commands while preserving the initial default-target class summaries.
- Added `tiny` and `small` machine classes for lower-cost smoke checks and small repositories.
- Added artifact globs and required-artifact proof gates for SSH-backed macOS targets with non-following, protected-path-safe matching. Thanks @coygeek.
- Added an opt-in `cmake --version` preflight probe for POSIX, WSL2, and native Windows targets. Thanks @coygeek.

### Fixed

- Rejected nil or unsupported process-wide HTTP transports with a clear setup error instead of panicking or bypassing host network policy, while preserving explicitly injected clients. Thanks @SebTardif.
- Kept explicit Hetzner server-type requests exact instead of continuing through class fallback candidates after capacity errors.
- Made private draft verification resolve the exact draft by tag and numeric release ID instead of relying on a release-list endpoint that can omit drafts.

## 0.44.0 - 2026-08-18

### Added

- Added concrete primary machine types, vCPU counts, and RAM sizes to `crabbox providers` class reporting.
- Added credential-free `crabbox providers describe` discovery for canonical provider-scoped run flags and compiled defaults. Thanks @coygeek.
- Added supported versioned `go install` as a CLI-only installation channel, with clean module dependency semantics, source-derived release and revision versions, and hermetic release verification. Thanks @coygeek.
- Added an opt-in Linux/WSL2 `raw_socket` preflight probe that distinguishes direct, non-interactive-sudo, unavailable, and missing-interpreter states without sending packets or elevating workloads. Thanks @coygeek.
- Added checkpoint last-use tracking and composable `checkpoint prune --unused-for` cleanup for inactive local records and provider artifacts.
- Added provider-native create, verify, delete, and fork lifecycle for direct Hetzner project-snapshot checkpoints, including exact local-claim image deletion.
- Added `crabbox heartbeat` so external SSH drivers can refresh owned lease idle deadlines and optionally update the idle timeout.
- Added credential-free `crabbox claims list` output for deterministic, secret-safe inspection of unverified local lease claims across providers. Thanks @coygeek.
- Added retained local-container `--lease-output` run-session handles with pre-sync emission and exact cleanup on output failure. Thanks @coygeek.

### Fixed

- Kept local source and worktree builds on the `dev` identity instead of trusting Go 1.26 pseudo-versions synthesized from VCS metadata in another checkout.
- Prevented confirmed `run --stop-after always` teardown from racing workspace-owner renewal and replacing successful, evidence-backed runs with exit 7. Thanks @coygeek.
- Retried brief GitHub API failures during browser login and kept exhausted post-exchange attempts safely retryable instead of turning the next CLI poll into a terminal failure.
- Bounded `crabbox claims list` inventory reads to 1 MiB per local claim while preserving valid partial output for oversized files. Thanks @coygeek.
- Made local-container heartbeat authorize recorded dynamic runtime scopes and durably compare-and-swap exact claim lifecycle state without recreating or overwriting changed claims. Thanks @coygeek.
- Made AWS image deletion resume from owner-level durable snapshot claims after AMI deregistration or catalog cleanup failures, preventing stale ordinary and capability-variant records from remaining selectable.
- Made static SSH heartbeats persist touched timestamps and explicit idle-timeout replacements across fresh CLI processes, while omitted overrides preserve the stored timeout. Thanks @coygeek.
- Bounded Lambda MicroVM runner response-header waits without limiting uploads or streamed executions, while preserving injected HTTP clients. Thanks @SebTardif.
- Fixed native local-container checkpoint forks to complete their recorded Docker runtime scope before claim creation, allowing immediate commands and safe normal stop while preserving exact claim validation.
- Split fallback E2B HTTP ownership so finite lifecycle calls cannot hang indefinitely while uploads and process streams remain caller-controlled. Thanks @SebTardif.
- Split fallback HTTP ownership for Azure Dynamic Sessions, Blaxel, Cloudflare Sandbox, Freestyle, Orgo, and SmolVM so finite control calls cannot hang while data-plane lifetimes remain caller-controlled. Thanks @SebTardif.
- Rejected ambiguous or extra `crabbox heartbeat` identifiers before configuration or provider resolution, preventing malformed commands from reaching lease mutation. Thanks @coygeek.
- Rejected native Jujutsu and other unsupported local sync sources before delegated archive providers can provision or execute a remote sandbox.
- Accepted explicit local-container architecture assertions only when the selected Docker or Podman daemon reports a matching native architecture, without enabling emulation. Thanks @coygeek.
- Omitted coordinator-only history commands from failure digests when run history is unavailable, while preserving direct lease recovery guidance.
- Bypassed reusable-workspace ownership for fresh non-retained local-container runs while preserving ownership for retained and reused leases.
- Framed workspace-owner scripts outside native Windows SSH command arguments so retained runs avoid `cmd.exe` limits, preserve finite stdin and nonzero exits, and clean up promptly.

## 0.43.0 - 2026-08-15

### Added

- Added opt-in `python` and `python3` preflight probes that check the literal executable on POSIX, WSL2, and native Windows targets.

### Fixed

- Bounded fallback HTTP clients for finite provider control calls without truncating uploads, downloads, or streaming executions. Thanks @SebTardif.
- Selected native WSL rsync and OpenSSH correctly on Windows, while x64 no-WSL transfers now keep direct control on System32 OpenSSH and bind native rsync to its sibling OpenSSH.
- Made default `run --emit-proof` headings context-neutral instead of claiming every run occurred after a patch or fix.
- Preserved authoritative recorded-run and lease-claim provider routes while keeping unselected inspection and archive dry-run output provider-neutral.
- Bound coordinator release, heartbeat, and Tailscale mutations to the CLI-selected provider, preventing cross-provider lease deletion or metadata changes.
- Made Actions hydration waits, coordinator lease-release retries, and managed Windows VNC waits return promptly when cancelled during backoff. Thanks @SebTardif.

## 0.42.0 - 2026-08-14

### Added

- Added a checksummed, validated archive fallback for SSH-backed `cp` from POSIX operator hosts to native Linux or macOS leases (not WSL2) when local rsync is missing or older than 3.4.3, including stock macOS OpenRsync. Thanks @coygeek.

### Fixed

- Coordinator lease metadata can no longer switch an explicit or configured provider selection or authorize a different local adapter.
- Provider-native checkpoint identifiers no longer reroute through coincidentally matching Static or External lease identities.
- Required explicit provider intent before lifecycle commands initialize a backend, while preserving claim and recorded-run routing and keeping bare doctor provider-neutral. Thanks @coygeek.
- Prevented Azure orphan-sweep release failures from writing secret-bearing diagnostics to Worker console logs while retaining redacted details in sweep records.
- Rejected native Jujutsu workspaces before Git-manifest sync can fall through to an outer checkout, while preserving colocated Git workspaces and `--no-sync`. Thanks @atimmer.
- Redacted compound environment assignments, cookie and security-token headers, and camel-case API-token fields from client-visible coordinator diagnostics while preserving surrounding operational context. Thanks @dwin-gharibi.

## 0.41.6 - 2026-08-13

### Fixed

- Restricted sensitive generated local files, including managed attestation keys and signed-URL artifact outputs, to the current OS user on POSIX and Windows. Thanks @dwin-gharibi.
- Made POSIX workspace ownership independent of the remote account's login shell by transporting owner scripts through a private `/bin/sh` launcher, fixing static macOS sync under zsh, Bash, and Fish. Thanks @osouthgate and @hosmelq.
- Derived implicit Static SSH macOS work roots from the resolved SSH user while preserving explicit roots and EC2 Mac defaults. Thanks @osouthgate.
- Routed implicit `status` and `inspect` lease identifiers through the provider recorded in local claims before initializing the configured provider, while preserving explicit-provider precedence and missing-claim fallback. Thanks @coygeek.
- Reported explicit stdout and stderr capture paths and byte counts in emitted run proofs without reading or embedding captured content. Thanks @coygeek.
- Kept repeated repository sync and finalization idempotent across shallow and complete Git workspaces while preserving command exits and clearing witnessed ownership state. Thanks @osouthgate and @hosmelq.
- Made `cache stats --json` emit an empty array for empty inventories while live smoke accepts legacy null and object reports but rejects other scalar shapes before workloads. Thanks @excelsier.
- Rejected invalid or overlong coordinator-requested lease slugs before provisioning while preserving exact fixed-ID replays created under the legacy length behavior. Thanks @dwin-gharibi.
- Bound valid caller-declared artifact SHA-256 digests into signed broker upload grants, rejected malformed nonblank digests instead of silently disabling integrity checks, and made object storage reject mismatching payloads. Thanks @dwin-gharibi.
- Made GitHub team authorization fail closed on malformed selectors, enforced same-org team scope, and invalidated membership and device proofs when the normalized policy changes. Thanks @dwin-gharibi.
- Preserved pinned AWS SSH ingress and dynamic CIDRs from the other IP family when broker heartbeats refresh access, while replacing obsolete same-family dynamic sources. Thanks @jalehman.
- Kept the exact updated lease-claim snapshot through one-shot run registration and replacement retries so task-owned local containers can clean up without weakening concurrent replacement fences. Thanks @coygeek.

## 0.41.5 - 2026-08-12

### Fixed

- Kept Git-tracked regular files under ambiguous built-in artifact directories in sync manifests while preserving authoritative project excludes, untracked-output filtering, ordered re-includes, and bounded path-and-pattern warnings. Thanks @salmonumbrella.
- Clarified that POSIX SSH `run --script` uploads a content-hashed standalone copy whose `$0` points under `.crabbox/scripts/`, and documented synced-path execution for scripts that need adjacent repository assets. Thanks @coygeek.
- Classified per-run local-container cgroup OOM-kill increments as memory resource exhaustion, with bounded evidence collection and actionable memory/concurrency guidance while ignoring historical OOM counts on reused leases. Thanks @coygeek.
- Made bare `crabbox doctor` report compiled-default provider provenance and skip that unchosen provider's credential readiness without weakening explicitly configured provider checks. Thanks @coygeek.
- Retained keep-enabled local containers after SSH readiness failures behind durable exact-resource pending claims, with fenced recovery and cleanup commands, while preserving full rollback for one-shot leases. Thanks @coygeek.
- Reconciled exact-owned Azure VM, NIC, public IP, and managed OS disk orphan sets with stable-identity quarantine and fail-closed durable deletion progress. Thanks @chsong1.
- Invalidated adopted Actions workspace readiness markers before full resync and rehydrated the canonical workspace before running commands. Thanks @vincentkoc.
- Stopped sparse-checkout and skip-worktree omissions from deleting in-scope remote files, and kept staged gitlink removals out of file-deletion manifests. Thanks @vincentkoc.
- Deferred ordinary coordinator lease provider cleanup to durable alarm-owned retries while preserving synchronous force-admin deletion and visible retry state. Thanks @fuller-stack-dev.
- Made future Linux developer-image preparation use root-owned Corepack state while source, candidate, and promoted smoke checks exercise Corepack and pnpm as the runtime user. Thanks @fuller-stack-dev.
- Made local sync report actionable non-Git workdir diagnostics and fail before lease acquisition, resolution, preparation, or ready-pool borrowing. Thanks @bunlongheng.

## 0.41.3 - 2026-08-11

### Fixed

- Included the normalized, secret-redacted command beside the durable run ID in failure bundle metadata. Thanks @goutamadwant.
- Serialized each reused SSH lease's complete workspace lifecycle across clients and watch iterations, from hydration-state and fingerprint inspection through sync, execution, evidence collection, failure capture, and pool scrub/return, with fenced stale-owner recovery on POSIX, WSL2, and native Windows. Reused Git workspaces now also keep `HEAD`, the index, the requested tree, and sync fingerprints coherent without advancing symbolic branches. Thanks @vincentkoc.
- Stopped market-independent AWS Spot launch request errors from being retried as On-Demand while preserving fallback for Spot-recoverable capacity, quota, and unsupported-market failures. Thanks @vincentkoc.
- Made plain source builds report `dev` instead of the stale `0.15.0` release identity while preserving injected release versions and tagged Go module build information. Thanks @coygeek.
- Preserved custom local-container image `PATH` entries across managed SSH logins, including when users add or switch login-profile files after bootstrap. Thanks @coygeek.
- Routed implicit `run --id` and `watch --id` reuse through the provider recorded in the local lease claim before validating the configured provider. Thanks @coygeek.

## 0.41.2 - 2026-08-10

### Fixed

- Updated the checksum-pinned Ubuntu 26.04 Apple VM image to the current immutable Canonical release. Thanks @coygeek.
- Redacted configured credentials reflected by provider-controlled Orgo, FastAPI Cloud, and DigitalOcean response diagnostics before they reach terminal or CI output. Thanks @coygeek.
- Made canceled ordinary coordinator creates durable and token-bound, including concurrent same-token replay, atomic cleanup claims, late provider cleanup evidence, generation-fenced retained AWS Mac reactivation, and bounded cancellation retries while fixed-ID creates remain replay-owned. Thanks @fuller-stack-dev.

## 0.41.1 - 2026-08-09

### Fixed

- Made caller-supplied `warmup --lease-id` creation idempotent across direct AWS and coordinator restarts, with exact-PUT coordinator recovery, exactly-once post-lock acquisition acknowledgment, at-most-once and attempt-attested direct AWS launch reconciliation, explicit SSH-CIDR intent binding, downgrade-safe `aws-fixed-v1` claims, stable conflicts on request drift, and compact terminal tombstones that prevent operation-ID reuse after release or missing-resource cleanup.

## 0.41.0 - 2026-08-06

### Added

- Added an admin-only Daytona snapshot bootstrap route and protected
  default-branch workflow with bounded resources, immutable base images,
  applied-capacity and active-snapshot verification, sanitized proof, and
  completion-verified builder cleanup.
- Added a protected broker soak workflow that records sanitized AWS/Azure
  maintenance evidence and runs one bounded, cleanup-verified Daytona canary
  without direct provider credentials or a warm pool.
- Added a protected default-branch workflow for rotating the coordinator admin
  token from a one-time environment secret without exposing it on argv.
- Added exact brokered lease image identity and provider startup phase timings,
  plus Azure OS disk snapshot promotion and automatic scoped selection. Thanks
  @vincentkoc.
- Added checksum-pinned TruffleHog to Linux, macOS, Windows, Azure, and WSL2
  developer environments, plus a protected workflow for publishing and proving
  promoted AWS images.
- Added use-case and pricing guides, an accessible workload router with
  runnable provider recommendations, and a project vision that keeps agent
  orchestration and model credentials outside Crabbox. Thanks @zozo123.
- Documented Tensorlake's public `tl-crabbox` image and Pi coding-agent skill
  discovery.
- Added coordinator-owned ready-pool desired capacity with atomic fill claims, provider-neutral compatibility keys, borrow heartbeats, abandoned-borrow quarantine, stale-record pruning, and pool counters.
- Added reserved `CRABBOX_LEASE_ID`, `CRABBOX_RUN_ID`, and `CRABBOX_SLUG` metadata to every remote command, with Crabbox-owned values taking precedence over forwarded environment variables.
- Added browser-initiated, owner-bound coordinator pairing grants and revocable credential-free device tokens for read-only lease status.
- Redesigned the portal, OAuth results, WebVNC and Code interstitials, and CLI-served pages with the Carapace design system, added run and provider charts, and fixed clipped or stretched layouts. Thanks @vincentkoc.

### Fixed

- Expanded protected release-tag signing from one maintainer to the approved
  release-admin key set.
- Allowed the release-admin team to bypass approval only through pull requests,
  while a protected cross-repository ruleset workflow independently enforces the
  release snapshot build and separate no-bypass rules retain protected history
  and stable release tag immutability.
- Retried idempotent remote workspace setup, Git and manifest sync preparation,
  sync finalization, and post-sync Actions hydration marker cleanup once after
  a transient SSH transport failure, while preserving redacted terminal
  diagnostics.
- Kept brokered Daytona on its operator-managed snapshot across coordinator
  deployments while preserving account-default mode and an explicit clear path.
- Recovered exact-owned Azure public IPs, network interfaces, and tagged OS
  disks when a coordinator deployment interrupted provisioning before the VM
  existed, while rejecting ambiguous or mismatched resource sets.
- Reconciled brokered leases whose provider provisioning was interrupted by a
  coordinator deployment, recovering any owned cloud resource for cleanup and
  failing resource-free leases with a durable reason.
- Made Blacksmith doctor report all-organization inventory scope and a
  nonterminal active Testbox count for capacity-aware callers.
- Kept default-derived Azure images out of normal broker lease requests so
  coordinator-managed image policy no longer requires admin-token auth.
- Made brokered Daytona usable with Crabbox auth alone, added a read-only
  fallback readiness probe with truthful control/data-plane diagnostics, and
  made repeated sandbox cleanup idempotent. Thanks @vincentkoc.
- Quarantined exact-owned AWS and Azure orphan candidates across consecutive successful inventories before deletion, and added bounded provider reconciliation backoff after inventory failures.
- Made AWS developer-image publication prove the exact promoted AMI was selected, and skip redundant base-package APT bootstrap on verified prebaked Linux images.
- Prevented Hyper-V provisioning from hanging while Windows guests boot and
  made plain templates install a checksum-pinned OpenSSH package without
  depending on Windows Features on Demand.
- Forwarded explicit ARM64 and AMD64 guest architecture selections to Apple
  Container while preserving the implicit native ARM64 path.
- Bounded device membership revalidation to one GitHub revalidation per token per minute while preserving immediate token revocation, fail-closed errors, and a distinct re-pairing response for expired OAuth grants.
- Kept ready-pool reconciliation rollout-compatible with older CLIs and coordinators, preserved unexpired in-flight claims across policy changes, and required actual ready capacity for `pool ensure` success.
- Authorized RunPod SSH access with the configured public key while rejecting missing, empty, or invalid key files before creating a paid pod. Thanks @morluto.
- Restored Blaxel runs against current APIs with lifecycle policies, full-document label updates, absolute filesystem paths, and bounded workload-readiness retries. Thanks @arcabotai.
- Made Apple VM helper termination polls cancellation-aware while preserving bounded cleanup after a cancelled start. Thanks @SebTardif.
- Rejected authority-changing Semaphore pagination links before authenticated requests can leave the configured origin. Thanks @SebTardif.
- Kept provider-backed details out of coordinator WebSocket error logs and removed narrowing conversion from inherited WebVNC listener descriptors. Thanks @vincentkoc.

## 0.40.1 - Unpublished

- No tag or GitHub release was published. Its prepared changes are included in
  0.41.0.

## 0.40.0 - 2026-07-19

### Added

- Added `provider: cloud-run-sandbox` (`gcrun-sandbox`, `google-cloud-run-sandbox`, `cloudrun-sandbox`) for Google Cloud Run sandboxes in public preview: stateful lifecycle through the in-container `sandbox` CLI or a durable-routing gateway, archive sync, local claim scoping, doctor checks, and live smoke hooks. Thanks @zozo123.
- Added bidirectional `cp` over resolved SSH leases and a readiness-gated, loopback-only `tunnel` command with owned process-tree teardown. Thanks @onmax.
- Added bounded JSON Schema validation for required run artifacts across supported standard drafts, with local references and redacted failure diagnostics. Thanks @dwin-gharibi.
- Added native local macOS SSH leases through Lume, cloning a stopped golden VM per lease with isolated SSH identity, durable clone and storage recovery, and verified stop-before-delete lifecycle handling. Thanks @madhavajay.
- Added a local Zed task-launcher extension for Crabbox lifecycle and remote execution workflows. Thanks @zozo123.
- Added the generic Crabbox Agent Skill at the ecosystem installer
  `skills/crabbox` convention while retaining its repo-discoverable `.agents`
  projection, plus digest-verified domain discovery under
  `/.well-known/agent-skills/` and a draft-compatible cross-vendor AI Catalog.

### Fixed

- Made `cp` over resolved SSH prefer rsync secluded arguments whenever the remote rsync supports them, so remote paths travel over the rsync protocol instead of the remote shell command line. This sidesteps an upstream rsync 3.4.4 `safe_arg()` bug that appends one uninitialized heap byte after a backslash-escaped wildcard (e.g. `\[`), which intermittently corrupted remote copy paths; remotes without secluded-args support (such as macOS openrsync) keep the previous shell-transported behavior. Thanks @zozo123.
- Kept Cloud Run sandbox creation and cleanup fail-closed: indeterminate creates retain exact recovery claims while definitive conflicts drop provisional ownership, cleanup serializes against active work and concurrent reclaim, absolute lease TTLs are enforced, failed destroys remain tracked and reported for retry, direct payloads travel on stdin instead of argv, and remote gateways must confirm durable routing plus synchronous deletion. Thanks @zozo123.
- Bound GitHub OAuth callbacks independently to each initiating browser flow and bound sessions, durable ownership, admin grants, and revocations to immutable GitHub account IDs instead of reassignable emails or logins, with a fail-closed operator recovery path for legacy records. Thanks @zozo123.
- Made the default `crabbox init` Agent Skill include standards-compliant
  `SKILL.md` metadata, enforced conformant skill destinations, and allowed
  `--skill` to target multiple agent discovery paths with an all-target
  existence preflight.
- Made the Zed package recognize both supported Crabbox configuration
  filenames without advertising the unsupported `.crabbox.yml` suffix.
- fix(egress): replaced egress sessions can no longer resurrect and clobber their replacement — the coordinator refuses tickets and connects for superseded session IDs, and the host/client daemon exits fatally when replaced.
- Enforced explicitly declared zero-byte artifact sizes during pull while preserving legacy manifests that omit size.
- Prevented apple-container orphan cleanup from deleting claims reclaimed during its resource snapshot, including same-value rewrites, while retaining stored SSH keys when ownership cannot be proven safe to remove. Thanks @anagnorisis2peripeteia.
- Prevented local-container orphan cleanup from deleting claims reclaimed during its resource snapshot while retaining stored SSH keys when ownership cannot be proven safe to remove. Thanks @anagnorisis2peripeteia.
- Prevented external-provider orphan cleanup from deleting claims reclaimed during its resource snapshot while retaining routing state when ownership cannot be proven safe to remove. Thanks @anagnorisis2peripeteia.
- Prevented apple-vm orphan cleanup from deleting claims reclaimed during its resource snapshot while retaining stored SSH keys when ownership cannot be proven safe to remove. Thanks @anagnorisis2peripeteia.
- Prevented Incus cleanup from deleting expired instances reclaimed during its resource snapshot, while retaining stored SSH keys when ownership cannot be proven safe to remove.

## 0.39.0 - 2026-07-17

### Added

- Added external-provider desktop access for remote macOS, Windows, and WSL2 machines while keeping desktop credentials local. Thanks @MuduiClaw.
- Added a Herdr plugin for Crabbox lease controls and repository workflows, with workspace-aware actions and managed panes. Thanks @zozo123.
- Added a single `open --editor=<name>` lease handoff for external editors, starting with Zed Remote Projects and preserving lease activity while the editor is connected. Thanks @zozo123.
- Added experimental read-only CUA diagnostics and existing-sandbox inventory while failing all remote lifecycle mutations closed until upstream exposes safe creation and deletion ownership primitives. Thanks @coygeek.
- Added a searchable, filterable Features capability explorer with responsive light and dark layouts, deep-linked state, and browser interaction proof. Thanks @zozo123.
- Added Modal environment selection and named Secret injection without passing Secret values through Crabbox. Thanks @simonMoisselin.
- Added GitHub Codespaces direct Linux SSH leases with token-scope preflight, repository and machine selection, durable pre-create recovery, exact claim-bound ownership, generated OpenSSH configuration, and guarded lifecycle smoke coverage. Thanks @coygeek.

### Fixed

- Prevented Apple-container cleanup from force-deleting stopped containers without an exact resource-bound local claim. Thanks @coygeek.
- Limited failed Blacksmith warmup cleanup to Testbox IDs emitted by that invocation, preventing config-matched concurrent Testboxes from being stopped. Thanks @anagnorisis2peripeteia.
- Prevented Tart cleanup from deleting lease claims and stored SSH keys created or rebound by concurrent acquisitions. Thanks @anagnorisis2peripeteia.
- Failed Node coordinator startup on malformed trusted-proxy CIDRs, warned on untrusted forwarded client headers, and kept environment-backed provider failures out of top-level request logs.
- Kept pond SSH forwards process-owned and grouped each member's ports into one connection, so terminal teardown reaps tunnels and helpers without hiding genuine failures or multiplying handshakes. Thanks @anagnorisis2peripeteia.
- Preserved foreground container-runner output buffered behind slow HTTP clients when the detached-descendant drain cap expires.
- Stopped a previously started egress host daemon during non-daemon egress starts so it cannot clobber the new foreground session, and held the per-lease lock until the foreground host joins so concurrent replacement starts cannot interleave.
- Fixed non-daemon egress start to actually run the foreground host bridge; it previously exited with a usage error right after starting the remote client.
- Delivered server-first mediated-egress bytes after the local proxy handshake without letting one slow stream block unrelated connections. Thanks @anagnorisis2peripeteia.
- Serialized complete per-lease egress host-daemon starts and stops and atomically replaced the remote client, preventing concurrent lifecycle commands and ordinary restarts from leaving untracked or stale processes. Thanks @anagnorisis2peripeteia.
- Closed code-server WebSockets whose upstream dial completes after bridge shutdown, preventing orphaned connections and reader goroutines. Thanks @anagnorisis2peripeteia.
- Stopped failed runs' telemetry samplers promptly so long-lived CLI processes do not retain ticker goroutines or continue probing released leases. Thanks @anagnorisis2peripeteia.
- Preserved WebVNC reconnect attempt state across consecutive connection failures so retry delays increase instead of repeatedly hammering the coordinator. Thanks @anagnorisis2peripeteia.
- Prevented repository-local configuration from retaining billable GitHub Codespaces or overriding trusted lifetime and deletion policy. Thanks @coygeek.

## 0.38.4 - 2026-07-16

### Fixed

- Restored native Homebrew verification by using the supported GitHub Actions artifact archive media type.
- Made SSH readiness retries return promptly when cancelled while preserving the original cancellation cause.
- Rejected Blacksmith delegated runs when Git hides omitted tracked paths, before those paths could be misread as remote deletions.

## 0.38.3 - 2026-07-14

### Fixed

- Made provider IP and loopback VNC waits return promptly when their context is cancelled. Thanks @SebTardif.

## 0.38.2 - Unpublished

- Publication blocked because the protected signed tag annotation did not satisfy release policy.

## 0.38.1 - 2026-07-13

### Added

- Exposed authoritative AWS instance-profile attachment state in `inspect --json` provider metadata for admission-policy enforcement across direct and brokered leases.

### Fixed

- Protected portal and isolated Code sessions with browser-enforced host-only cookies, rejected duplicate session cookies, and retired legacy cookie names to prevent sibling-origin shadowing. Thanks @coygeek.

### Fixed

- Scrubbed successful ready-pool workspaces through credential-free branch recovery and commit-bound Actions hydration, while draining failed or unverifiable leases before return.

## 0.38.0 - 2026-07-11

### Added

- Added a dedicated ECS Fargate deployment for small private AWS workspaces with task-role credentials, exact account/Region and instance allowlist preflight, encrypted gp3 volumes, no public IP or SSH, IMDSv2, SSM bootstrap/log evidence, route-scoped workspace lifecycle, and idempotent cleanup.
- Added optional authoritative pre-boot SSH host public keys to coordinator-backed Linux lease inspection for fail-closed identity pinning.
- Redesigned the documentation site around first-class provider discovery, with complete provider navigation, multi-category filtering, responsive tables and mobile navigation, and accessibility improvements. Thanks @zozo123.
- Added explicit GCP metadata-server authentication for brokered coordinators, with hardened token validation, bounded retries, source-aware readiness diagnostics, and preserved service-account-key defaults. Thanks @dani29.

### Fixed

- Bootstrapped strict Tailscale AWS leases through their rendered tailnet hostname while preserving public and automatic network selection, allowing same-account EC2 operators without public-IP reachability to create leases successfully. Thanks @SebTardif.
- Confined explicit JUnit result collection to final paths inside the remote workdir on POSIX and Windows while preserving safe in-workdir symlinks and absolute paths. Thanks @coygeek.
- Verified Node.js release archives against published SHA-256 checksums before local Actions hydration installs or reuses them, preventing unverified setup-node downloads from reaching the workflow PATH. Thanks @coygeek.
- Limited shared egress status to coarse active visibility unless the caller has manage access, keeping per-side host and client connection state private. Thanks @coygeek.
- Counted live managed leases against monthly reserved-USD budgets after UTC month rollover until cleanup commits a terminal state, preventing overlapping reservations from bypassing configured cost caps. Thanks @coygeek.
- Bounded coordinator lease and workspace history scans and kept saturated cleanup retry batches scheduled promptly, preventing large retained histories from exhausting Durable Object memory or stranding cleanup.

## 0.37.1 - 2026-07-11

### Added

- Added Orgo Linux workspaces with API-key authentication, image and region selection, exact workspace-bound claims, WebVNC support, guarded cleanup, credential provenance checks, and a full live-smoke workflow. Thanks @zozo123.

### Fixed

- Preserved the Foundation Developer ID and notarization trust of the embedded Apple VM daemon at runtime instead of replacing its accepted signature with an ad-hoc one.
- Rebuilt production releases as a local-produced, signed, notarized, draft-first pipeline with protected default-branch verification, exact source provenance, native execution proof, serialized publication, and separately verified Homebrew installation.
- Authenticated the complete packaging-tool closure before exposing signing credentials, kept credential-free release builds read-only, and made signed-tag publication tests deterministic across Linux and macOS CI.

## 0.37.0 - 2026-07-10

### Added

- Added Sealos DevBox Linux SSH leases through the Kubernetes CRD with exact provider/resource-bound claims, conflict-safe explicit `--reclaim` adoption, claim-locked release and cleanup, controller-owned Secret SSH routing, and guarded zero-residue lifecycle proof. Thanks @coygeek.
- Added a Unikraft Cloud service-control provider for claimed OCI-image instances, with endpoint- and instance-bound ownership, guarded cleanup, and live create/status/list/stop verification. Thanks @zozo123.
- Added capability-aware AWS image promotion and lease selection by minimum OS, SDK/runtime versions, browser, WebView2, and desktop support, with fail-before-lease rejection when no promoted image satisfies every requirement.
- Added provider-neutral Ed25519-signed run receipts through `crabbox run --attest` and integrity verification through `crabbox verify`, with collision-safe signing-key handling and explicit self-signed trust reporting. Thanks @yetval.
- Documented a provider-neutral hermetic-agent evidence pattern with separate writer contexts, QA arbitration, required proof artifacts, and sync-safe local downloads. Thanks @zozo123.
- Added `sync-plan --json` with candidate and dirty-delta sizes, configured guardrail status, deleted-path counts, and ranked file and directory hotspots for automation. Thanks @zozo123.
- Added a CubeSandbox delegated-run provider with E2B-compatible lifecycle and envd execution, archive sync, CubeProxy routing, exact API-endpoint/sandbox-bound ownership claims, conflict-safe explicit adoption, and guarded cleanup. Thanks @zozo123.
- Added coordinator-managed Daytona Linux leases with a Worker-held API key, exact ownership cleanup, expiring SSH-token refresh, CLI secret redaction, and production Cloudflare configuration. Thanks @vincentkoc.

### Fixed

- Sealed short-lived WebVNC handoff credentials with their one-use tickets and removed ticket material from storage keys, preventing coordinator storage reads from bypassing the browser handoff. Thanks @coygeek.
- Kept brokered Daytona SSH tokens owner- and admin-only across lease reads and management responses, and skipped token refresh for shared viewers, preventing `use` or `manage` shares from receiving direct sandbox credentials. Thanks @coygeek.
- Kept expired provider-consuming leases inside active capacity limits and rejected heartbeats after their deadline, preventing cleanup-pending leases from bypassing coordinator caps. Thanks @coygeek.
- Redacted passwordless URL userinfo and common OAuth and cloud credential aliases consistently from CLI and coordinator diagnostics, including truncated provider error bodies. Thanks @coygeek.
- Bound artifact uploads to private snapshots and manifest hashes to rooted validated file handles, then replaced generated outputs through root-confined temporary files, preventing path races from reading or overwriting files outside the bundle. Thanks @coygeek.
- Kept AWS developer-image minting compatible with macOS system Bash when AWS region selection is automatic.
- Preserved exact coordinator organization identities in collision-free authorization keys, preventing distinct labels from sharing leases, runs, bridges, workspaces, runners, or usage limits after lossy normalization. Ambiguous legacy records now fail closed for non-admin access while remaining available for admin cleanup. Thanks @coygeek.
- Confined Nomad API redirects to the configured scheme, hostname, and effective port before replaying ACL tokens or request bodies, while keeping rejected Location secrets out of diagnostics. Thanks @coygeek.
- Confined OVH API redirects to the configured scheme, hostname, and effective port before replaying signed credential headers, while keeping rejected Location secrets out of diagnostics. Thanks @coygeek.
- Confined Scaleway SDK redirects to the configured scheme, hostname, and effective port before replaying provider tokens, while keeping rejected Location secrets out of diagnostics. Thanks @coygeek.
- Escaped terminal controls and Unicode formatting characters in human JUnit result, shard, and failure-digest output while preserving raw JSON values. Thanks @coygeek.
- Launched native Windows desktop apps directly in the active interactive session without scheduled tasks, waiting for a visible window and reporting its process ID, session, and title.
- Unified direct macOS WebVNC with the authenticated portal: Tart and Parallels viewers now use the same chrome and controls as Linux and Windows when coordinator login is configured, with provider-lifetime registration and the local viewer retained as the offline fallback.
- Replaced WebVNC password and username URL fragments with one-time credential handoff tickets, and made repeated `--open` calls reuse and focus the existing lease viewer tab when the browser supports cross-tab handoff.
- Required E2B stop and automatic cleanup to hold an unchanged API-endpoint-, sandbox-, lease-, slug-, and provider-bound local claim across deletion; claimless recovery now requires explicit `--reclaim`. Thanks @coygeek.
- Prevented config and `.crabboxignore` negations, including case aliases, from re-including Crabbox-owned env profiles, uploaded scripts, logs, captures, and run artifacts in sync manifests. Thanks @zozo123.
- Allowed ordered `!` re-includes in `.crabboxignore` and `sync.exclude`, with `\!` for literal leading-bang paths. Thanks @chsong1.
- Completed coordinator diagnostic redaction for non-Bearer authorization schemes, GCP signed URLs, and every configured provider credential field. Thanks @coygeek.
- Reconciled idle admin WebVNC, Code, egress, and control sockets during direct and Node scheduled maintenance after admin-token or GitHub-admin rotation. Thanks @coygeek.
- Bound accepted WebVNC and Code backend agents to the manager grant that created them, closing attributable agents after share or credential revocation while preserving pre-upgrade hibernated sockets. Thanks @coygeek.
- Bound non-admin shared-token WebVNC, Code, and egress bridges to the credential active at ticket creation, closing active and restored sessions after token rotation or removal. Thanks @coygeek.
- Made Parallels macOS WebVNC use managed VNC credentials, authenticated screenshots, pointer and direct keyboard input, explicit host-side macOS routing, collision-safe local tunnels, XWayland-aware desktop input, and safe clipboard fallback.
- Started delegated-provider sync timeouts at archive creation, matching SSH sync semantics and avoiding pre-transfer expiry during local Git manifest planning.
- Kept macOS listener ownership checks responsive when mounted filesystems make full `lsof` metadata scans slow.
- Routed Azure orphan-sweep deletion through the exact lease-, provider-scope-, resource-, companion-, and immutable-disk-bound owned-delete path instead of deleting by retained VM name alone.
- Kept sync manifest writes compatible with minimal BusyBox guests instead of requiring a GNU-only `dd` option, and preserved complete Phala gateway hostnames so later status and SSH reconnects keep working.
- Restored lease-scoped SSH host-key pinning for Namespace Instance, Phala, and Islo proxy connections instead of accepting unverified server identities. Thanks @coygeek.
- Corrected the CLI command map, coordinator API methods, and provider architecture reference to match the implemented commands, routes, and backend capabilities. Thanks @zozo123.
- Advertised Daytona's direct toolbox archive sync so `--sync-only` and `--force-sync-large` work while preserving brokered Crabbox rsync. Thanks @zozo123.
- Partitioned unauthenticated GitHub OAuth starts by caller with an atomic per-source limit and guarded global backstop, preventing one source from exhausting login for every user. Thanks @coygeek.
- Disabled inherited SSH agent and X11 forwarding across CLI-managed SSH, rsync, SCP, VNC, and port-forward transports, preserving per-lease credential boundaries. Thanks @coygeek.
- Collected runtime-only provider credentials through provider-owned diagnostic hooks and redacted opaque OpenSandbox and W&B upstream errors before they reach CLI output. Thanks @coygeek.
- Redacted complete punctuation-bearing authorization, API-key, and bearer values from CLI and coordinator diagnostics while preserving whitespace-separated routing context. Thanks @coygeek.
- Limited framing of proxied Browser Code responses to the same isolated Code origin, preventing sibling same-site pages from clickjacking an authenticated session without breaking code-server webviews. Thanks @coygeek.
- Revalidated non-admin GitHub grants when WebVNC and Code agent tickets are consumed, matching the existing egress fail-closed boundary after logout, emergency revocation, membership loss, or membership-check failure. Thanks @coygeek.
- Bound coordinator Azure managed-disk cleanup to a durable immutable disk claim captured from the live VM association, preventing stale adopted ownership tags from authorizing deletion. Thanks @coygeek.
- Required direct Azure release and cleanup to hold an unchanged subscription-, resource-group-, VM-name-, immutable-VM-, lease-, slug-, and provider-key-bound local claim across deletion, with durable companion-resource identities for interruption-safe cleanup. Thanks @coygeek.
- Required direct GCP release and cleanup to hold an unchanged project-, zone-, name-, numeric-instance-, lease-, slug-, and provider-key-bound local claim across deletion. Thanks @coygeek.
- Prevented repository-defined External lifecycle commands from placing inherited `external.config` values on process arguments without an exact, trusted non-secret argv contract. Thanks @coygeek.
- Prevented repository-controlled External SSH endpoint templates and adapter output from silently using ambient or operator-managed SSH credentials, with source-bound opt-ins for environment-derived fields and provider-returned destinations. Thanks @coygeek.
- Made Sealos DevBox preflight work with tenant-scoped RBAC, rendered the runtime class, storage request, scheduling constraints, and SSH port contract required by hosted Sealos clusters, updated the SSHGate default to port 2233, bootstrapped missing sync tools, and cleaned local claims safely when a DevBox is already absent. Thanks @coygeek.
- Changed portal logout to an authenticated, same-origin `POST` with a read-only `GET` confirmation page, preventing cross-site top-level navigation from clearing portal cookies or revoking isolated Code viewer sessions. Thanks @coygeek.
- Bound non-admin GitHub WebVNC, Code, and egress bridges to their encrypted user grant and portal session, closing active or restored bridges after logout, emergency revocation, membership loss, or membership-check failure without persisting plaintext GitHub credentials. Thanks @coygeek.
- Prevented Git seed from forwarding embedded HTTP(S) origin credentials or password-bearing credentials in other URL-style remotes to Linux or Windows lease runners; Crabbox now warns without printing the remote and falls back to file sync. Thanks @coygeek.
- Confined Islo API redirects to the configured scheme, hostname, and effective port before replaying authorization or request bodies, while keeping rejected Location secrets out of diagnostics. Thanks @TurboTheTurtle.
- Redacted colon-delimited and line-folded bearer credentials from CLI and coordinator diagnostics. Thanks @TurboTheTurtle.
- Required coordinator AWS, Azure, and GCP release and provisioning-failure cleanup to re-read the stored cloud resource and verify exact provider, resource, lease, owner, and slug ownership before deletion; Azure now persists the exact subscription/resource-group scope for deferred retries and fails legacy unscoped cleanup closed for manual resolution. Thanks @coygeek.
- Required Lambda inventory, stop, and cleanup to use an unchanged instance-bound local claim, with claim-bound SSH-key deletion and durable unique-instance recovery for ambiguous creates. Thanks @coygeek.
- Required exe.dev reuse and deletion to match canonical ownership tags, random resource generation, deterministic VM name, unchanged SSH endpoint and exact local claim, authenticated account fingerprint, and current control route; lifecycle lookups now remain account-local and failed deletion retains the claim. Thanks @coygeek.
- Kept brokered artifact reads signed by default even when a display base URL is configured; explicit public reads now use a random per-grant namespace and report their access policy. Thanks @coygeek.
- Required coordinator Hetzner cleanup to re-read the stored server and verify exact canonical lease ownership labels before deletion. Thanks @coygeek.
- Required DigitalOcean, Linode, Scaleway, and Vultr inventory and destructive actions to use canonical lease identities and exact provider/resource-bound local claims, with explicit `--reclaim` adoption for claimless resources and recovery-safe Vultr instance/key rollback ordering. Thanks @coygeek and @vincentkoc.

## 0.36.0 - 2026-07-05

### Changed

- Renamed the `apple-vz` provider to `apple-vm`; the old provider name/aliases, `appleVZ:` config keys, `--apple-vz-*` flags, and `CRABBOX_APPLE_VZ_*` environment variables keep working as deprecated aliases, existing leases and claims stay manageable, and the state directory migrates automatically.
- Replaced the Code-Hex/vz cgo dependency with `crabbox-apple-vm-vmd`, a dependency-free Swift Virtualization.framework daemon embedded in the now pure-Go `crabbox-apple-vm-helper`; the helper installs and entitlement-signs the daemon itself, so Crabbox no longer copies or codesigns helper binaries.

- Updated Go SSH and OS support libraries, including upstream authentication-attempt, malformed-session, key-size, KDF, and known-host validation hardening.
- Updated the Node/PostgreSQL coordinator to pg 8.22 and pg-boss 12.25, including current protocol parsing, startup retry, queue-cache, migration-deadlock, and scheduling fixes.

### Fixed

- Centralized credential redaction for provider and `doctor` diagnostics, covering configured secrets, authorization headers, signed URLs, secret-bearing JSON fields, and private keys, and applied it to Sprites API errors. Thanks @coygeek.
- Restricted production releases to default-branch repository dispatches for existing version tags in reviewed history, so tag pushes and ref-selectable manual workflows cannot run credentialed release configuration. Thanks @coygeek.
- Kept explicit `CRABBOX_CONFIG` files inside the active repository in the repository trust domain, including symlink aliases, so they cannot redirect inherited provider credentials. Thanks @coygeek.
- Pinned mediated-egress connections to validated public DNS results and rejected private, loopback, link-local, and reserved destinations, preventing allowlisted hostnames from rebinding into the operator network. Thanks @coygeek.
- Confined artifact manifest fetches, downloads, and brokered uploads to same-origin redirects, preventing signed URLs and upload grants from reaching another origin. Thanks @coygeek.
- Scoped user-visible usage totals to both the authenticated owner and organization, excluding same-owner leases from other organizations. Thanks @coygeek.
- Wrote captured capsule manifests and failed Actions logs with private Unix permissions, repairing broader modes when an output path is reused. Thanks @coygeek.
- Revalidated signed GitHub user tokens against current allowed organization and team membership every five minutes, failed closed on GitHub errors, and added narrow owner/login revocations without rotating every session. Thanks @coygeek.
- Bound GitHub OAuth CLI token release to a one-use callback on the initiating device, so forwarding an authorization URL cannot hand the resulting user token to another terminal. Thanks @coygeek.
- Honored an explicit broker URL and freshly issued credential during immediate post-login identity verification, even when ambient coordinator overrides point elsewhere.
- Kept coordinator restarts, run history, lease detail pages, and Azure orphan sweeps memory-bounded with exact lease restores, paged record scans, and batched terminal-run pruning after a configurable 30-day retention period.
- Redacted coordinator URL userinfo, queries, and fragments from adapter relay connection status. Thanks @coygeek.
- Closed restored legacy Code viewer sessions that lack a complete organization-bound principal during restore and after lease share revocation. Thanks @coygeek.
- Required a canonical public origin for GitHub OAuth and bound callbacks to the initiating origin before exchanging codes or issuing sessions. Thanks @coygeek.
- Redacted configured credentials, authorization headers, signed URLs, URL userinfo, and secret-bearing JSON fields before coordinator provider diagnostics are stored or returned. Thanks @coygeek.
- Redacted broker URL userinfo, queries, and fragments from `login`, `whoami`, and `doctor` text and JSON output. Thanks @coygeek.
- Redacted Parallels top-level, template, and fleet-host SSH private keys from `config show --json` while preserving non-secret routing metadata. Thanks @coygeek.
- Redacted Proxmox token IDs, secrets, and authorization values from provider HTTP error bodies before returning diagnostics. Thanks @coygeek.
- Prevented FastAPI Cloud bearer credentials from following cross-origin redirects, preserved caller redirect policies, and rejected unsafe credential-destination URL components. Thanks @coygeek.
- Treated malformed percent-encoded portal cookies as absent instead of throwing before normal authentication handling. Thanks @coygeek.
- Verified downloaded GitHub Actions runner archives against the exact upstream release-asset SHA-256 digest before replacing or extracting the installed runner. Thanks @coygeek.
- Required an unchanged region-bound local claim before direct AWS cleanup can terminate an instance discovered through provider tags. Thanks @coygeek.
- Revalidated live AWS, Azure, and GCP instance identity, ownership, lease binding, cleanup eligibility, and any destructive companion-resource identity immediately before direct cleanup deletion. Thanks @coygeek.
- Required W&B sandbox reuse, status, and stop to match an exact endpoint/entity/project/resource-bound local claim plus provider inventory ownership. Thanks @coygeek.
- Required RunPod stop to use an exact pod ID/name-bound local claim, with conflict-safe explicit `--reclaim` adoption for unclaimed or legacy pods. Thanks @coygeek.
- Made coordinatorless generic provider live smokes skip coordinator-only history and always clean up acquired leases after later lifecycle failures.
- Replaced privileged managed Linux Code Server and Tailscale installer scripts with checksum-verified archives or Tailscale's signed package repository with a pinned keyring in both CLI and coordinator bootstrap paths. Thanks @TurboTheTurtle.

## 0.35.0 - 2026-07-04

### Added

- Documented the deterministic perf evidence contract for future reproducible metric budgets, separating fuel/instruction-style gates from existing wall-clock timing and benchmark ledger behavior.
- Documented the delegated-runner contract and live proof bar required before built-in non-SSH provider adapters can advertise a hosted runner integration.
- Added a delegated HashiCorp Nomad provider with create-only owned jobs, archive sync, retained lease reuse, exact-claim lifecycle cleanup, optional env-only ACL auth, and zero-residue live-smoke coverage. Thanks @coygeek.
- Added `crabbox shard` to fork a checkpoint into parallel leases, run templated commands through the normal sync/history pipeline, stream per-shard output, merge JUnit results, and release every fork on success, failure, or interruption. Thanks @yetval.
- Added `crabbox watch` to reuse one warm SSH lease, coalesce qualifying local changes into sequential runs through the normal sync/history pipeline, and release newly acquired leases on bounded idle or exit. Thanks @yetval.
- Added `crabbox checkpoint fork -- <command...>` to run the normal `crabbox run` flow across fork fan-out leases with `{{index}}`, `{{total}}`, `{{lease}}`, and `{{slug}}` template variables.
- Added Vast.ai direct Linux GPU SSH leases with guarded offer cost and reliability selection, per-lease keys, account-bound cleanup, required-tool bootstrap, and billable live-smoke coverage. Thanks @coygeek.
- Added an exact-origin `CRABBOX_WEBVNC_AGENT_BASE_URL` override for deployments that route portal APIs and outbound WebVNC agent sockets separately.

### Fixed

- Revalidated cached GitHub and bearer admin grants against the current deployment before restoring bridge sockets or consuming durable bridge tickets and Code sessions, closing or downgrading sessions after revocation. Thanks @coygeek.
- Redacted reflected provider credentials, lifecycle command URLs, and configured endpoint userinfo from error diagnostics and `config show` output while preserving useful failure detail. Thanks @coygeek.
- Rejected cross-origin Morph and Railway redirects before credentials or request bodies can be replayed, and redacted rejected credential-bearing redirect destinations. Thanks @coygeek.
- Required explicit browser-navigation intent for portal HTML routes, preventing ambient subresource requests from silently creating authenticated portal sessions.
- Required exact endpoint-bound local claims before Daytona sandbox reuse, status, or deletion, including delayed provider inventory recovery. Thanks @coygeek.
- Reported Apple VZ helper startup failures deterministically instead of racing them into misleading readiness timeouts. Thanks @coygeek.
- Preserved the configured controller identity binding when rendering redacted configuration and launching controller subprocesses.
- Released checkpoint forks with a fresh cleanup context after post-acquire provisioning failures or caller cancellation. Thanks @yetval.
- Required canonical Hetzner labels plus an exact server-bound local claim before direct stop or cleanup can delete a server, and kept canonical lease IDs from falling through to slug or name aliases. Thanks @coygeek.
- Kept WebVNC framebuffer and heartbeat traffic responsive while desktop themes apply, and fully detached long-lived Wayland wallpaper processes from their launching SSH sessions.
- Required an exact local or explicit `stop --reclaim` deployment claim before stopping an out-of-band Railway service, binding adoption to the configured endpoint, project, environment, service, and deployment. Thanks @coygeek.
- Refused repository-selected Static SSH, Parallels, and exe.dev control destinations when they would inherit trusted or ambient SSH authentication; explicit host overrides remain available for operator approval. Thanks @coygeek.
- Removed the Code viewer bootstrap bearer ticket from redirect URLs and browser history by handing it to the isolated lease origin through a no-store, POST-only form. Thanks @coygeek.
- Replaced raw generated VNC credentials in copied WebVNC links with short-lived, one-time, authorization-checked handoff tickets. Thanks @coygeek.
- Closed restored WebVNC viewer sockets that lack a complete current organization-bound principal instead of retaining owner-only legacy authorization. Thanks @coygeek.
- Enforced key-only OpenSSH authentication across managed Windows desktop, core, and WSL2 bootstraps while retaining generated Windows passwords for console and VNC use. Thanks @coygeek.
- Compared coordinator admin, shared-operator, runtime-adapter, proxy, and signed-session secrets without mismatch-position or early length exits. Thanks @coygeek.
- Prevented direct Azure list, stop, and cleanup paths from treating weak `crabbox=true` tags as ownership; destructive operations now require canonical Azure ownership tags and an exact matching lease ID, and successful deletion removes local lease keys. Thanks @coygeek.
- Restricted brokered Azure image and OS-disk selectors to admin-authenticated requests while preserving user-selectable Azure placement. Thanks @coygeek.
- Required exact provider, resource, and local-claim ownership before Hyper-V, Multipass, or Parallels release and cleanup paths can delete virtual machines. Thanks @coygeek.
- Required exact resource-bound local lease claims before Apple Container, local-container, or Apple VZ stop operations can delete provider resources; legacy unbound claims require explicit `--reclaim` adoption before stop. Thanks @coygeek.
- Hardened Azure Windows snapshot forks to fail closed through credential rehydration and quarantine cleanup, reuse only writable NIC payloads, reject unknown differential disks, and retry in-use security-group cleanup. Thanks @fcoury-oai.
- Rolled back brokered Hetzner servers when post-create readiness fails, deleting only lease-owned SSH keys created by the failed attempt after server cleanup succeeds while preserving explicit no-delete retention until a later delete. Thanks @coygeek.

## 0.34.0 - 2026-07-02

### Added

- Added configurable Azure snapshot and restored OS-disk storage SKUs, concurrent snapshot-fork prerequisites, and verified parallel resource cleanup. Thanks @fcoury-oai.
- Added direct Azure Windows managed OS-disk checkpoints and snapshot-backed forks with source restart, fresh SSH/Windows/VNC credentials, and loopback-only desktop access. Thanks @fcoury-oai.
- Added a foreground, loopback-only `crabbox vnc --native-handoff` contract for native viewers, including one-time workspace grants that relay VNC through the coordinator without exposing its SSH key; credentials and grants use private pipes and tunnel lifetime remains owned by the client process.
- Enabled desktop-capable runtime-adapter workspaces instead of discarding Crabfleet's requested desktop capability, and report native VNC separately from browser VNC.
- Added direct FastAPI Cloud application and deployment inspection through `status`, `list`, and `doctor`, including configured default application support. Thanks @zozo123.
- Added `crabbox checkpoint fork --count` for provider-neutral fan-out from archive checkpoints, native checkpoints, and direct Parallels snapshots without adding runtime-specific fork flags.
- Added `provider: vultr` for direct Linux SSH leases with per-lease keys, account-bound cleanup, optional existing firewall/VPC attachment, and guarded live smoke coverage. Thanks @coygeek.
- Added the Crownest delegated-run provider for hosted Linux Workspace Runs with staged archive sync, streamed output, reusable sandbox claims, and guarded lifecycle cleanup. Thanks @tristanmanchester.
- Added normalized provider runtime, reachability, and lifecycle capabilities plus matching `--runtime`, `--reachability`, and `--lifecycle` filters to `crabbox providers` and `crabbox providers recommend`.
- Added `crabbox providers recommend` profiles for fan-out testing, offline validation, failure diagnostics, warm starts, resource observability, code interpretation, disposable execution, web-app smoke, and interactive debugging.

- Added a provider live-smoke contract for adapters that need credentials, quota, local runtimes, or private control planes, and kept credentialless local runtime smoke paths visible in `crabbox providers recommend live-smoke`.
- Expanded the guarded `scripts/live-smoke.sh` matrix to Apple Container, Local Container, Docker Sandbox, SmolVM, Superserve, Vercel Sandbox, Linode, DigitalOcean, Nebius, OVHcloud, NVIDIA Brev, Phala, Anthropic Sandbox Runtime, OpenSandbox, Proxmox, XCP-ng, Multipass, and Tart.
- Added live-smoke documentation and dispatch regression coverage for Agent Sandbox, Scaleway, KubeVirt, Daytona, Namespace Devbox, Namespace Compute, Semaphore, Sprites, and W&B.
- Added live-smoke workflow, configuration, and credential preflight coverage for Blacksmith Testbox, Incus, External, E2B, Modal, Tenki, and Morph.
- Documented local runtime live-smoke coverage for Apple Container, Local Container, Multipass, Tart, and Apple VZ.

- Added reusable `--lease-output` run-session metadata for Cloudflare Sandbox, Vercel Sandbox, CodeSandbox, OpenSandbox, Upstash Box, Azure Dynamic Sessions, Freestyle, Tensorlake, Superserve, SmolVM, OpenComputer, Agent Sandbox, and Apple Machine.

### Fixed

- Bound GitHub browser-login owners to verified email addresses, recorded that provenance in a versioned user-token schema, and invalidated legacy tokens that could retain unverified owner identities. Thanks @coygeek.
- Required exact local claims before Freestyle or Islo delete, pause, resume, and SSH reuse operations, while preserving explicit `--reclaim` adoption and read-only canonical-name recovery. Thanks @coygeek.
- Required a valid isolated per-lease origin before serving browser Code HTTP or WebSocket traffic, preventing lease-controlled pages from inheriting coordinator portal authority. Thanks @coygeek.
- Restricted brokered AWS and GCP resource selectors to admin-authenticated requests so normal users cannot steer coordinator cloud credentials toward caller-selected networks, images, projects, tags, or instance identities. Thanks @coygeek.
- Pinned NodeSource and Docker APT signing fingerprints across managed Linux image preparation and local-container Docker CLI bootstrap, preserving existing trust files, stopping image preparation on mismatch, and using distro packages for local-container fallback. Thanks @coygeek.
- Bound non-admin coordinator provider-key names and automatic cleanup to verified, persisted lease ownership metadata, rejecting unsafe AWS and Hetzner name collisions while retaining legacy and Hetzner provider-unique shared key identities. Thanks @coygeek.
- Pinned the Windows developer-image Node MSI and Docker Engine archive to reviewed SHA-256 digests before privileged installation, with fail-closed digest requirements for version overrides. Thanks @coygeek.
- Restored direct and brokered AWS Windows developer-image candidate capture by routing the guarded mint wrapper through native AMI checkpoints while retaining brokered promotion.
- Prevented direct AWS raw-instance release from reaching deletion unless canonical Crabbox ownership tags match the resolved lease, with a second guard at the destructive provider boundary. Thanks @TurboTheTurtle.
- Prevented Sprites API credentials from targeting unsafe endpoint URLs or following redirects outside the configured API origin. Thanks @coygeek.
- Recovered ASCII Box release when the service temporarily requires a recent snapshot by shortening the sandbox TTL, waiting for the managed stop transition, and retrying deletion.
- Isolated brokered artifact uploads by opaque organization and owner namespaces so identities and caller prefixes cannot collide across authorization scopes. Thanks @coygeek.
- Prevented ASCII Box API credentials from reaching unsafe explicit base URLs by requiring HTTPS except for loopback development endpoints, rejecting ambiguous URL components, and supporting config discovery in the current Box CLI. Thanks @coygeek.
- Pinned the Google Linux package signing fingerprint, preserved its source-scoped APT keyring across Chrome installation, and failed closed to Chromium when verification fails. Thanks @coygeek.
- Hardened coordinator image deletion so admin `image delete` requests fail closed unless stored Crabbox-created metadata proves ownership of the AWS, Azure, or GCP image or snapshot.
- Prevented unused WebVNC and Code bridge tickets from surviving manager share revocation. Thanks @coygeek.
- Prevented revoked lease managers from retaining mediated-egress bridges after lease sharing was removed or downgraded. Thanks @coygeek.
- Prevented the Code portal proxy from forwarding coordinator authentication context to lease-controlled code-server requests. Thanks @coygeek.
- Rejected GitHub login callback origins that differ from the selected broker unless explicitly allowlisted as a trusted alias, preventing OAuth callbacks from silently redirecting stored credentials. Thanks @TurboTheTurtle.
- Rejected WebVNC, Code, and egress bridge tickets in URL query strings by default while retaining an explicit temporary legacy opt-in. Thanks @TurboTheTurtle.
- Required manage access for post-create run lease attribution, preventing use-share users from retagging unrelated runs into another owner's audit history. Thanks @TurboTheTurtle.
- Derived omitted coordinator lease provider keys from the finalized lease ID instead of a shared fallback, preventing cross-lease SSH key reuse. Thanks @TurboTheTurtle.
- Rejected portal OAuth return targets containing HTTP header control characters, preventing malformed redirect responses from breaking login completion. Thanks @TurboTheTurtle.
- Prevented Cloudflare Sandbox bridge credentials and request bodies from following redirects outside the configured bridge origin while preserving same-origin redirects. Thanks @coygeek.
- Dropped invalid allowlisted environment names before rendering remote POSIX or Windows commands, preventing shell metacharacters in ambient names from creating unintended commands. Thanks @coygeek.
- Pinned Windows Chocolatey image bootstrap to a checksum-verified versioned package before privileged installation. Thanks @TurboTheTurtle.
- Redacted Daytona API and upload credentials from provider error diagnostics, including reflected authorization headers and token-bearing JSON fields. Thanks @TurboTheTurtle.
- Recognized current Windows 11 Sandbox host processes during run monitoring and cleanup, preventing false early exits and orphaned sandboxes on 24H2 and newer builds. Thanks @paulcam206.
- Replaced fixed-size Xvfb/x11vnc desktops on managed Linux workspaces with loopback-only TigerVNC displays that honor native viewer resize requests while preserving VNC authentication and existing-service health fallbacks.
- Mounted the implicit local-container Docker-socket cache root at `/work/crabbox` while preserving explicit work roots, restoring access for the unprivileged guest user. Thanks @hxy91819.
- Rewrote credential-bearing user config atomically so failed updates preserve the previous readable file, owner-only permissions, and configured symlinks. Thanks @clawsweeper.
- Scoped managed AWS security groups per coordinator actor and preserved lease-declared CIDRs across heartbeats, preventing concurrent leases from revoking SSH and WebVNC access.
- Allowed owners to reactivate their own retained EC2 Mac instances without admin-token pinning, avoiding replacement launches while the single-capacity host is occupied or undergoing AWS's post-termination sanitization.
- Bridged native Windows VNC locally through SSH instead of sending oversized POSIX lifecycle scripts through PowerShell, restoring WebVNC startup on Windows guests.
- Provisioned complete VNC, noVNC, and XFCE services when Linux Parallels leases request desktop capability, including upgrades from stale core-only readiness markers.
- Forced managed AWS macOS leases onto Apple's socket-activated Remote Login port 22, preventing inherited SSH-port settings from producing unreachable lease metadata and stalled WebVNC bridges.
- Restored incomplete Linux Node.js toolchains through NodeSource when `npm` or Corepack is missing, preventing source installers from failing on otherwise valid images.
- Rejected AWS developer-tool images older than Node.js 24 during candidate smoke validation.
- Added the documented `--ssh-port` lease-creation override so provider warmups can select the target SSH port without environment-only configuration.
- Preserved direct remote Parallels host identity in logs, inventory labels, errors, checkpoint previews, and follow-up lifecycle routing.
- Enabled macOS Remote Login while preparing Parallels clones so disabled source templates fail fast into a usable SSH lease instead of waiting for readiness timeout.
- Made remote Parallels proxy SSH non-interactive with a bounded connection attempt, preventing encrypted host keys from stalling lease and WebVNC readiness.
- Switched Windows desktops to TightVNC service mode and removed the broken per-user startup path, restoring authenticated WebVNC sessions for already logged-in guests.
- Fixed Tart SSH readiness on hosts where OpenSSH can reach the guest but Go's raw TCP probe cannot. Thanks @kmcquade.
- Revoked active WebVNC and Code viewers when their lease share access is removed while preserving owner, admin, and still-authorized sessions. Thanks @coygeek.
- Prevented E2B and Upstash Box credentials from following redirects outside each request's trusted origin while preserving same-origin redirects. Thanks @coygeek.
- Prevented SmolVM API credentials from following redirects outside the configured API origin while preserving same-origin redirects. Thanks @coygeek.
- Made direct and brokered Azure Windows desktop leases converge on working SSH/SFTP, first-logon readiness, terminal extension state, retryable disk cleanup, and actionable bootstrap diagnostics. Thanks @fcoury-oai.

## 0.33.0 - 2026-06-22

### Added

- Added `provider: nebius` for direct Nebius AI Cloud Linux SSH leases through the native CLI, with profile-owned authentication, managed networking and disks, and claim-backed lifecycle hardening. Thanks @coygeek.
- Added an opt-in local benchmark timing ledger with repeated provider runs and evidence-aware reports. Thanks @TurboTheTurtle.
- Added the Phala confidential Intel TDX CVM provider with default-on hardware attestation, exact Compose binding, TLS-authenticated SSH, and fail-closed claim-backed lifecycle cleanup. Thanks @anagnorisis2peripeteia.
- Added reusable E2B run-session handles and cleanup commands for `--keep --lease-output`. Thanks @kiranmagic7.
- Added reusable Modal run-session handles and cleanup commands for `--keep --lease-output`. Thanks @kiranmagic7.
- Added the Scaleway direct Linux SSH-lease provider with per-lease IAM keys, claim-backed lifecycle recovery, and guarded live smoke coverage. Thanks @coygeek.
- Added reusable W&B run-session handles and cleanup commands for `--keep --lease-output`.
- Added Linux CPU capacity to lease telemetry and portal status details.

### Changed

- Consolidated lifecycle cleanup, credential routing, artifact boundaries, and run-history recovery guarantees across the README and operational documentation.
- Refreshed the bundled Crabbox agent skill for current remote-proof, job, pool, artifact, desktop, and provider-boundary workflows. Thanks @coygeek.
- Defined Crabbox's supported single-user and cooperative-team security boundary, clarified repository configuration as trusted project automation, and separated vulnerability reporting from compatibility-preserving hardening.

### Fixed

- Verified pinned OpenSSH, Git for Windows, TightVNC, and versioned Ubuntu WSL bootstrap artifacts before privileged extraction, installation, or import. Thanks @coygeek.
- Preserved valid JUnit summaries when sibling reports are malformed, stopped silently truncating auto-discovered reports, and added opt-in failure status for parsed test failures. Thanks @coygeek.
- Redacted WebVNC viewer URLs, usernames, and passwords from command output by default while preserving explicit private-terminal reveal. Thanks @coygeek.
- Prevented repository-local KubeVirt config from selecting operator SSH key paths while preserving inline public keys. Thanks @coygeek.
- Restricted lease sharing rosters to owners, admins, and `manage` recipients while keeping shared leases visible to `use` recipients. Thanks @coygeek.
- Redacted credential-bearing Proxmox API URL userinfo from text and JSON `config show` output. Thanks @coygeek.
- Restricted EC2 Mac Dedicated Host inventory to admins or callers with a visible attached lease, and required admin authentication for explicit brokered host pinning. Thanks @coygeek.
- Restricted runtime-adapter service credentials to workspace lifecycle and desktop-connection routes, excluding interactive terminal attachment. Thanks @coygeek.
- Rejected cross-origin Azure Dynamic Sessions redirects before command, environment, upload, or management bodies can be replayed. Thanks @coygeek.
- Kept manual release publication on the reviewed default-branch GoReleaser configuration instead of allowing a selected tag to replace credentialed release behavior. Thanks @coygeek.
- Rejected cross-origin coordinator redirects before bearer, Access, or local identity headers can be replayed. Thanks @coygeek.
- Redacted configured Upstash Box API keys from HTTP and streamed error diagnostics. Thanks @coygeek.
- Redacted configured Semaphore API tokens from provider response diagnostics. Thanks @coygeek.
- Kept GitHub Actions runner registration tokens off remote SSH command arguments. Thanks @coygeek.
- Redacted Cloudflare runner bearer tokens from HTTP and streamed error diagnostics. Thanks @coygeek.
- Confined remote failure-bundle links to the generated archive subtree and omitted unsafe special entries. Thanks @coygeek.
- Required actual Islo sandbox identifiers to already be canonical before raw-ID recovery can reach provider operations. Thanks @coygeek.
- Required canonical generated Freestyle VM names before raw-ID recovery can reuse or delete provider resources. Thanks @coygeek.
- Rejected plaintext non-loopback E2B API endpoints before provider credentials can be attached. Thanks @coygeek.
- Rejected cross-origin RunPod REST redirects before bearer credentials or pod-create bodies can be replayed. Thanks @coygeek.
- Rejected non-canonical signed browser-session tokens so suffix changes cannot bypass Code portal logout revocation. Thanks @coygeek.
- Required a matching local claim before Cloudflare container reuse, status, or stop operations can reach the runner. Thanks @coygeek.
- Redacted configured Freestyle API keys from lifecycle, command, and file-operation error diagnostics. Thanks @coygeek.
- Redacted configured OpenComputer API keys from control-plane and upload error diagnostics. Thanks @coygeek.
- Rejected cross-origin Cloudflare runner redirects before command, environment, or upload bodies can be replayed. Thanks @coygeek.
- Validated AWS region inputs before building SigV4-signed service endpoints, preventing request-selected hostname escapes. Thanks @coygeek.
- Required run artifacts now reject dangling symlinks and symlinks to directories instead of treating them as proof files. Thanks @coygeek.
- Rejected symlinked and non-regular artifact bundle entries before publish side effects, preventing files outside the selected bundle from being uploaded. Thanks @coygeek.
- Kept `CRABBOX_ENV_ALLOW` authoritative over selected profile allowlists while preserving explicit `--allow-env` additions. Thanks @coygeek.
- Made desktop paste/type and POSIX launch/proof success depend on verified clipboard delivery or live/visible launch state, including clipboard-manager and wrapper handoffs. Thanks @coygeek.
- Released newly created SSH leases when prewarm hydration, probe, or ready-pool registration fails, preventing paid lease leaks. Thanks @coygeek.
- Preserved transient run-history creation retries until a replacement lease attaches successfully.
- Stopped lease-local mediated egress daemons during ordinary lease stop before provider release.
- Revoked isolated Code viewer sessions when their GitHub portal session logs out, preventing stale viewer cookies from retaining prior-owner lease access. Thanks @coygeek.
- Prevented unauthenticated Cloudflare Access key fetches and bounded key-set refresh work for invalid JWT key IDs. Thanks @coygeek.
- Blocked normalized empty-segment variants of internal coordinator routes and stripped caller-supplied internal headers before fleet dispatch. Thanks @coygeek.
- Source-bound Azure Dynamic Sessions bearer tokens to operator-approved endpoints instead of repository-selected destinations. Thanks @coygeek.
- Made coordinator-backed `crabbox list` query the user's active orchestrator leases directly, reserving admin-wide machine inventory for `--all` and avoiding stale admin-token warnings during ordinary listing.
- Let Islo use tenant defaults for implicit sandbox image and capacity while preserving every explicit config, environment, and flag override. Thanks @zozo123.
- Made new runtime-adapter ticket claims provisional until agent connection or lease registration, allowing authenticated recovery of expired inactive first claims while preserving all existing and confirmed adapter IDs.
- Separated shared automation tokens from signed user-token keys, preserving shared-token-only automation while requiring distinct session signing material for GitHub login.
- Required retained coordinator ownership records before orphan sweeps delete AWS or Azure machines or release EC2 Mac hosts, while keeping tag-only and legacy candidates visible in reports.
- Verified the pinned GitHub CLI release artifacts before installing them in the default Cloudflare sandbox image and preserved true AMD64/ARM64 target selection during cross-platform builds.
- Pinned and verified the default Proxmox template cloud image before conversion, while preserving custom image URLs with a required matching SHA256.
- Kept Code, WebVNC, and Egress bridge tickets out of WebSocket URLs while preserving ordinary coordinator authentication, older-coordinator bearer retries, and legacy-client compatibility.
- Added opt-in per-lease Code portal origins with one-time viewer bootstrap and lease-scoped browser sessions, isolating proxied workspace content from coordinator and other lease origins without changing existing Code URLs. Thanks @coygeek.
- Source-bound broker and direct-provider credentials to repository-configured endpoints, while preserving same-source custom deployments and explicit environment or CLI overrides.
- Restricted Crabbox-managed Windows credential files to the managed user, Administrators, and SYSTEM without changing desktop credential consumers. Thanks @coygeek.
- Created default artifact bundles and retained run logs/metadata with private local permissions while preserving explicit shared-output directories. Thanks @coygeek.

## 0.32.0 - 2026-06-15

### Added

- Documented the end-to-end runtime adapter topology, trust boundaries, request paths, startup order, and failure signals.
- Added `crabbox connect <lease-id-or-slug>` to open an interactive SSH session to key-, certificate-, and proxy-authenticated provider targets while keeping `crabbox ssh` as the print-only command surface for token-as-username providers.
- Added `crabbox adapter ingress` as a provider-neutral authenticated HTTP and WebSocket bridge for loopback fleet services.
- Added JSON API initiation of generation-fenced runtime-adapter workspace deletion through explicit registered lease release.
- Added reusable Cloudflare container run-session handles with exact cleanup commands for `--keep --lease-output`. Thanks @zozo123.

### Fixed

- Pinned GitHub Actions workflow dependencies to reviewed immutable commits and added CI enforcement against mutable references. Thanks @coygeek.
- Hardened XCP-Ng repository config so it cannot override trusted provider credentials. Thanks @coygeek.
- Replaced browser-native portal confirmation and clipboard prompts with themed, keyboard-accessible HTML dialogs.
- Hardened GCP operator inventory and workspace recovery by requiring deterministic Crabbox instance names plus canonical provider labels before accepting resources. Thanks @coygeek.
- Hardened shared-lease run auditability by preserving actor attribution while granting lease owners read-only access to runs, logs, events, telemetry, and portal history. Thanks @coygeek.
- Pinned shipped runtime container base images to reviewed multi-platform digests and enforced the pins in CI. Thanks @coygeek.
- Redacted manage-only WebVNC bridge commands and egress session details from `use` share viewers. Thanks @coygeek.
- Created run downloads, captures, proofs, and failure bundles with private POSIX permissions. Thanks @coygeek.
- Rejected broker-supplied GitHub login URLs that do not use the expected HTTPS GitHub authorization endpoint.
- Preserved single-use bridge tickets when presented to the wrong lease, role, or runtime-adapter endpoint. Thanks @coygeek.
- Required lease manage access before resetting another operator's WebVNC bridge. Thanks @coygeek.
- Aligned the `apple-container` provider fallback image with the portable OS default while preserving explicit image choices. Thanks @coygeek.
- Fixed `apple-container` inventory parsing for Apple container 1.0 object-form status and nested network addresses. Thanks @coygeek.
- Added a dedicated route-scoped service credential for Crabfleet workspace lifecycle requests without granting general coordinator access.
- Kept accepted workspace creates successful when post-persist prewarm maintenance is temporarily unavailable.

## 0.31.0 - 2026-06-14

### Added

- Added configurable organization-wide workspace prewarming with cross-owner adoption, immediate replenishment while busy, and automatic idle drain.
- Added `crabbox webvnc local` on macOS and Linux for token-gated browser access to an existing loopback VNC tunnel, with the VNC password accepted only through stdin and kept out of process arguments, environment variables, URLs, and viewer files.
- Added authenticated Crabfleet workspace terminals with bounded SSH/WebSocket bridging, durable tmux resume, and lifecycle revocation.
- Added `crabbox adapter connect`, an outbound ticket-authenticated relay for the narrow `crabfleet/v1` runtime-adapter API, with a current-user-owned peer-verified Unix-socket transport, per-request local-token reload, bounded bodies, configurable desktop request timeouts, and reconnecting coordinator login refresh.
- Added `crabbox adapter serve`, a generic authenticated Linux/macOS-hosted workspace lifecycle API with a no-follow descriptor-verified lock in a private current-user-owned state directory, read-only state validation, crash-owned lifecycle children including bounded provider discovery, fixed TTL/idle and machine-shape override policy, explicit idempotent fixed-ID provider contracts, immutable full-identity status adoption and full-identity pre-release validation even before claim persistence, per-attempt provider route/config scopes, exact fixed external identities with crash-reclaimable fully fsynced slug reservations, restart-safe gated provider-side-effect durability with immediate memory-retried credential-bridge revocation on failed terminal writes, adapter-only side-effect-free WebVNC restarts with ordinary daemon heartbeats preserved, scope/state/resource-bound daemon reuse, per-workspace daemon OS locking, verified WebVNC supervisor/process-tree revocation, exact remote websockify socket/process ownership plus authenticated noVNC WebSocket readiness, full-identity refreshed-absence cleanup, bounded process-tree orchestration, no-follow token loading, exact-owned non-forking loopback SSH tunnels on Linux/macOS/Windows, and a public open-source Linux desktop bootstrap with noVNC/websockify, private user-owned VNC credentials, and a narrowly privileged desktop reset helper.
- Added `provider: ovh` for direct OVHcloud Public Cloud Linux SSH leases with signed API authentication, local claim-backed ownership, guarded recovery, and live lifecycle coverage. Thanks @coygeek.
- Added `provider: codesandbox` for delegated CodeSandbox Linux environments with archive sync, retained lifecycle, pause/resume, preview URLs, exact SDK pinning, truthful running-state checks, command exit propagation, and live lifecycle coverage; archive-sync orchestration is now shared across CodeSandbox, OpenComputer, OpenSandbox, Superserve, and Vercel Sandbox. Thanks @coygeek.
- Added `provider: cloudflare-dynamic-workers` for authenticated Worker-runtime module execution through Cloudflare Dynamic Workers, including blocked-by-default egress, stable caching, durable run metadata, lifecycle commands, and isolated live smoke coverage. Thanks @coygeek.
- Added `provider: agent-sandbox` for delegated Linux runs through Agent Sandbox `v0.5.0rc1` `v1beta1` warm pools, using the operator's `kubectl` for dependency-light discovery, lifecycle, archive sync, exec, guarded ownership cleanup, and live smoke coverage. Thanks @coygeek.
- Added `provider: vercel-sandbox` for delegated Linux microVM runs through the official Vercel Sandbox SDK, including archive sync, streamed output, retained-session resume, ownership-guarded lifecycle operations, and guarded live smoke coverage. Thanks @coygeek.
- Added generic Job evidence fields plus bounded Islo single-file `--require-artifact` and `--download` support, with provider capability gating and secret-safe archive upload errors. Thanks @zozo123.
- Added owner-scoped outbound runtime-adapter relays so registered workspaces can be created and deleted through a provider-neutral lifecycle API without exposing the provider control plane, including confirmed Delete actions in the portal.

### Fixed

- Hardened Agent Sandbox repository-config workload and workdir selection, mount-safe replacement sync, pinned pod-container execution, absolute and multi-file kubeconfig handling, controller-enforced TTL expiry with retained exact-claim cleanup, warm-pool/lifecycle/downstream identity validation, one-shot cleanup arming, cleanup dry-run identity checks, root-rechecked missing-claim handling, downstream-missing claim retention, recoverable ambiguous-create reconciliation, terminal status detection, retained activity bookkeeping, local claim removal reporting, and UID-pinned recovery leases when failed-readiness cleanup cannot reach Kubernetes; thanks @coygeek.
- Added an explicit `webvnc local --security-type vnc` mode that forces standard VNC password authentication when a server advertises account authentication first.
- Fixed coordinator hibernation recovery to preserve unambiguous live bridges while rejecting duplicate or stale restored endpoints.
- Fixed portable Node coordinator startup when the production bundle loads the external CommonJS `ssh2` dependency.
- Fixed CodeSandbox ownership tags, one-shot SDK bridge shutdown, mount-safe root workspace replacement, runtime-only resume responses, and authenticated preview URLs, preventing lifecycle rejection, command hangs, archive-sync failures, and unusable private port links.
- Hardened runtime-adapter relays with end-to-end absolute deadlines, durable generation-scoped dispatch fences retained across ambiguous connector failures, atomic owner-only legacy cleanup, rejection of unfenced proxy deletes, per-owner in-flight quotas, post-cancellation accounting, response-delivery grace, connector-matched request validation, restart-safe TTL-first live-bridge revocation, retry-safe upstream rejection handling, generation-fenced confirmed-absence acknowledgments, and cleanup-fenced workspace bindings.
- Fixed Cloudflare Dynamic Workers lifecycle reads, compatibility identity, bundle validation, and live-smoke credential isolation.
- Fixed Windows local-container sync to avoid unusable WSL command shims, support Docker Desktop mount roots, and fall back to native rsync when WSL lacks native SSH tooling. Thanks @brokemac79.
- Fixed brokered Tailscale cleanup to avoid privileged deletion from client-posted device IDs, preserve connectivity across normal reboots, and fail live preflight on application-level errors.
- Fixed Crabfleet workspaces to use any configured brokered provider and route the OpenClaw deployment through its canonical OAuth host and verified AWS backend with isolated, ephemeral key-only SSH access, stock-image cloud-init, and readiness-gated, pinned, Workers-compatible terminal attachment.
- Kept controller-acknowledged post-acquire failures behind the durable provider-release gate, accepted coordinator token-command authentication in outbound adapters, dispatched relay requests concurrently with reserved delete capacity and disconnect cancellation, held auto-selected local WebVNC ports under host-wide lifetime reservations across workspace daemons, and made Windows controller sidecar replacement/removal write-through durable.
- Made controller create/delete durability acknowledgments retryable, durably gated the complete raw acquisition identity and exact returned coordinator adapter/workspace binding before readiness, retained started pre-acknowledgment attempts through stable-absence or exact-identity recovery cleanup, moved ready identity drift into expected-identity cleanup without first-adopting later resolve output, retained terminal desktop revocation intent until the stopping transition persists, deferred coordinator deregistration and claim/routing removal until stable provider absence, loaded exact persisted external routing for controller inspect/inventory/stop even without a claim, required raw external release attestations including declarative raw acquire/resolve `json-lease` output, complete declarative and protocol-command inventory, and an exact `cloudId` argument in every declarative release command, fsynced external routing temporaries before rename plus the installed directory and full ancestor chain afterward, made confirmed-absence claim/routing/reservation deletions directory-durable before terminal acknowledgment, boot-bound Linux slug-reservation owners to the kernel boot ID plus PID/start ticks, required full WebVNC provider identity checks, ignored unrelated partial inventory while failing closed on partial target matches, failed closed on oversized inventory without repeating successful release, gated startup child recovery on a directory-synced state snapshot, suppressed ordinary registered auto-WebVNC daemons during controller child warmup, honored controller policy flag precedence before validating environment duration fallbacks, namespaced direct-SSH WebVNC identities by a domain-separated public controller/provider owner ID while keeping raw owner tokens out of daemon argv, status, and logs, allocated their remote loopback ports under a host-wide lock with occupied-port and bind-collision retries plus exact chosen-port persistence, bound Linux controller and WebVNC process identities to the current boot plus PID/start/nonce, required exact local listener ownership before direct-SSH credential retrieval, authentication, or viewer URL emission, restricted remote reset termination to the complete persisted process identity, budgeted SSH tunnel readiness across the configured connect timeout plus listener verification, restarted WebVNC after foreground SSH tunnel death, installed noVNC, Websockify, and util-linux in generated Linux desktop bootstraps, honored absolute `XDG_CONFIG_HOME` overrides for external routing state on every platform while rejecting invalid values, used native Windows process APIs for daemon identity checks, and fixed the desktop reset helper to trusted absolute commands.

## 0.30.0 - 2026-06-13

### Added

- Added an idempotent workspace adapter over coordinator leases, with durable owner-scoped lifecycle mapping and truthful capability negotiation for external control planes.
- Added `provider: nvidia-brev` for direct Linux GPU workspaces through the Brev CLI and generated SSH config, including normal Crabbox sync/run access, guarded ownership cleanup, and live `nvidia-smi` smoke coverage. Thanks @coygeek.
- Added a generated provider decision matrix with checked metadata for execution model, access, substrate, GPU fit, lifecycle, cleanup, and provider caveats; docs validation now fails on provider drift. Thanks @coygeek.
- Added confirmed lifecycle actions to portal lease rows, with provider shutdown for coordinator-managed boxes and explicitly metadata-only deregistration for client-managed boxes.
- Added `provider: superserve` for delegated Linux sandbox runs through the Superserve control and data planes, including archive sync, retained leases, ownership-guarded lifecycle operations, and credentialed live smoke coverage. Thanks @coygeek.
- Added `provider: namespace-instance` (`namespace-compute`) for short-lived Namespace Compute Linux leases through `nsc`, including per-lease SSH keys, proxy-backed sync/run, duration safeguards, ownership-filtered cleanup, and guarded live smoke coverage. Thanks @coygeek.
- Added comprehensive guides for deploying the portable Node/PostgreSQL coordinator and integrating private control planes through generic external providers, registered inventory, sharing, and outbound WebVNC.
- Added `provider: linode` for direct Linux SSH leases with per-lease keys, account-bound cleanup, preserved operator tags, interface-aware existing firewalls, and guarded live smoke coverage. Thanks @coygeek.
- Added `provider: windows-sandbox` for disposable native Windows runs through Microsoft Windows Sandbox, including mapped workspace sync, streamed output, timeout and cancellation cleanup, and keep-on-failure inspection. Thanks @zozo123.
- Added `provider: smolvm` for delegated Linux microVM runs through the hosted smolfleet API, including archive sync, retained leases, status, cleanup, and repository-scoped ownership checks. Thanks @zozo123.
- Added guarded SmolVM live E2E coverage for retained reuse, archive replacement, environment forwarding, command exit propagation, diagnostics, and targeted cleanup.
- Added non-mutating Proxmox storage, bridge, pool, template, and cluster inventory readiness diagnostics plus guarded live lifecycle smoke coverage, with safer failed-create and cleanup claim handling. Thanks @coygeek.
- Added direct SSH login helpers for kept Islo sandboxes through the official Islo CLI proxy. Thanks @zozo123.
- Added a portable Node.js and PostgreSQL coordinator runtime with durable pg-boss maintenance jobs, WebSocket bridges, trusted reverse-proxy identity support, container packaging, and the existing Cloudflare Worker/Durable Object runtime preserved as an adapter over the same fleet implementation.
- Added refreshable coordinator bearer authentication through a shell-free JSON argv token command, including HTTP and reconnecting WebSocket bridges behind expiring upstream identity proxies.

### Fixed

- Fixed pond ACL bootstrap to preserve Tailscale HuJSON comments, ordering, trailing commas, and unrelated policy sections while failing closed on ambiguous shapes. Thanks @coygeek.
- Fixed Tailscale bootstrap and cleanup determinism with opt-in pinned static installs, recorded client/device metadata, coordinator preflight smoke coverage, and best-effort device cleanup on release.
- Fixed brokered Tailscale tag-ownership failures to return actionable exact-match and `tagOwners` guidance while preserving the raw API error.
- Fixed managed Linux Tailscale bootstrap to deliver auth keys through stdin instead of exposing them in `tailscale up` process arguments.
- Fixed trusted reverse-proxy identity deployments to support a secret-bound assertion when direct coordinator access cannot be network-isolated.
- Fixed direct VNC and WebVNC SSH forwards to bind explicitly to workstation loopback even when user SSH configuration enables gateway ports.
- Fixed the portal and connected WebVNC desktops to default to the current system appearance by migrating away from legacy two-state browser theme preferences.
- Fixed Cloudflare container runs to fail when streamed stdout or stderr cannot be written instead of silently reporting success after output loss.
- Fixed Proxmox bridge readiness on PVE 8 by falling back to its compatible local-bridge and SDN-vnet inventory filter.

## 0.29.0 - 2026-06-12

### Added

- Added repeatable `--local-container-volume host:container[:ro]` bind mounts for explicit local-container runs. Thanks @anagnorisis2peripeteia.
- Added provider-neutral coordinator registration for direct SSH leases, with owner-scoped inventory and sharing, outbound WebVNC, automatic bridge daemons for kept desktops, and coordinator-safe metadata-only release and expiry.
- Added provider-optional `crabbox pause` and `crabbox resume` lifecycle commands, with Islo sandbox pause/resume support that preserves local lease claims. Thanks @zozo123.
- Added `provider: opensandbox` for delegated Linux sandbox runs through the OpenSandbox API, including archive sync, retained lease reuse, off-argv environment forwarding, status, and cleanup. Thanks @coygeek.
- Added `provider: anthropic-sandbox-runtime` (`srt`) for local one-shot command execution through Anthropic Sandbox Runtime, including filesystem/network policy handoff, doctor checks, config overrides, and live enforcement coverage. Thanks @coygeek.
- Added `provider: hostinger` for direct Linux VPS leases with read-only catalog and payment-method discovery, explicit purchase opt-in, setup-time SSH keys, ambiguous-purchase recovery, stopped-VPS reuse, and stop-only billing-aware release. Thanks @coygeek.
- Added `provider: apple-vz` for full ARM64 Ubuntu VMs through Apple's `Virtualization.framework`, including verified cloud images, secret-safe signed URL handling, loopback VSOCK SSH, retained leases, native helper packaging, failure rollback, and live lifecycle coverage. Thanks @coygeek.
- Added `provider: digitalocean` for direct Linux SSH leases backed by DigitalOcean Droplets, including flat-tag ownership, per-lease SSH keys, docs, and guarded live smoke coverage. Thanks @coygeek.
- Added a delegated Freestyle provider that runs commands in Freestyle VMs through the Freestyle REST API, with env-only authentication, archive sync, and automatic VM cleanup. Thanks @zozo123.
- Added `provider: hyperv` for local Windows VM SSH leases through Microsoft Hyper-V, including differencing-disk provisioning, OpenSSH and MinGit bootstrap, password-less dev-image initialization, retained lease reuse, and cleanup. Thanks @anagnorisis2peripeteia.
- Added an opt-in Islo userspace Tailscale plane with tailnet-aware pond peers, proxy-routed tailnet traffic, and URL-bridge fallback for leases without `--tailscale`. Thanks @zozo123.
- Added `provider: xcpng` for SSH leases on XCP-ng pools through the XenAPI control plane, including template cloning, fresh ISO installs, retained lease reuse, cleanup, diagnostics, and guarded live E2E coverage. Thanks @coygeek.

### Fixed

- Fixed `stop` and `pond release` to preserve claims, SSH credentials, lifecycle metadata, and restart routing when providers intentionally retain reusable stopped resources.
- Fixed external lease commands to reuse each lease's persisted provider routing after the current external configuration changes.
- Fixed `local-container` stop cleanup when a Docker container was removed externally, including stale claim and stored-key removal. Thanks @hxy91819.
- Fixed Apple VZ release artifacts to target macOS 13, bounded guest serial logs without blocking noisy VMs, escaped terminal controls in diagnostics, and preserved retained lease state when helper inventory lookup fails.
- Fixed DigitalOcean capability-tag persistence, provider config visibility and precedence, account-scoped ambiguous Droplet/SSH-key create recovery, retryable cleanup, and unnecessary monitoring-agent installation.
- Fixed Namespace Devbox setup instructions to use the current browser workspace approval flow instead of obsolete token environment variables.
- Fixed XCP-ng XenAPI integer encoding, trusted endpoint configuration, template validation, HVM config-drive attachment, deterministic guest-network selection, retained-lease IP fallback, YAML-safe usernames, collision-resistant ISO runs, required networking for fresh ISO VMs, Windows 11 disk and vTPM requirements, bounded guest-network discovery, failure-recoverable VM ownership, copied-disk and local-key cleanup, generated Windows answer media, pre-boot answer attachment, and bounded ISO E2E cleanup.

## 0.28.0 - 2026-06-11

### Added

- Added `provider: opencomputer` for delegated Linux sandbox runs through the OpenComputer REST API, including archive sync, retained leases, optional burst capacity, status, and cleanup. Thanks @zozo123.
- Added local-container checkpoint forks that launch a fresh Docker lease from a committed checkpoint image while replaying and validating its recorded daemon scope. Thanks @anagnorisis2peripeteia.
- Added opt-in native Docker local-container checkpoints with immutable image identity, daemon-scope-aware verification and deletion, mounted-workspace guards, and live lifecycle coverage. Thanks @anagnorisis2peripeteia.
- Added `provider: morph` for Morph Cloud Linux SSH leases, including snapshot boot, Morph API key/config plumbing, per-instance SSH key retrieval, pause-on-release reuse, and provider docs. Thanks @coygeek.
- Added a built-in Incus provider for local or remote Linux containers and virtual machines, including socket, TLS, and OIDC control-plane authentication, optional SSH proxy devices, retained lease reuse, and live lifecycle verification. Thanks @coygeek.
- Added Tart macOS desktop leases with native Screen Sharing, a token-gated host-side WebVNC bridge, and documented local-network exposure boundaries. Thanks @anagnorisis2peripeteia.
- Added native Azure Windows ARM64 lease support with explicit Windows ARM64 images, Cobalt ARM64 SKU inference, and `CRABBOX_AZURE_WINDOWS_ARM64_IMAGE` broker configuration for ARM64 validation.
- Added persistent Apple Container 1.0 development machines through the local `apple-machine` provider.
- Added local Windows sandbox execution through Microsoft Execution Containers with explicit filesystem, network, DACL-fallback, and Win32k capability controls plus an execution-backed doctor check.

### Changed

- Removed the stale root OpenClaw plugin package and its npm publishing surface; Crabbox releases now version only the Worker package and Go CLI artifacts.
- Expanded release, smoke, installer, provider-contract, cleanup, and race coverage across the CLI, Worker, and provider adapters.

### Fixed

- Fixed kept Tart VMs stopping when the Crabbox command that launched them exited.
- Hardened provider lifecycle ownership, claims, retained-resource metadata, rollback, cleanup timeouts, and partial-failure reporting across Apple Container, ASCII Box, AWS, Azure, Azure Dynamic Sessions, Blacksmith Testbox, Cloudflare, Daytona, Docker Sandbox, E2B, exe.dev, external providers, GCP, Hetzner, Islo, Local Container, Modal, Multipass, Namespace, Parallels, Proxmox, Railway, RunPod, Semaphore, Sprites, SSH, Tart, Tenki, Tensorlake, Upstash Box, and Weights & Biases.
- Fixed static SSH requested slugs, delegated synthetic lease IDs, provider bridge targets, service inventory pagination, Windows share validation, and provider-specific configuration validation.
- Fixed Linux and macOS developer-tool installers, AWS account and orphan guards, image-minting and WSL2 smoke cleanup, coverage isolation, live-smoke JSON handling, and release workflow tag checkout ordering.
- Fixed CI deadcode, script sandboxing, and Cloudflare cleanup race failures found during release validation.

## 0.27.0 - 2026-06-09

### Added

- Added ordered declarative external lifecycle steps with optional acquire rollback, allowing multi-command private provider setup without shell wrappers.

## 0.26.1 - 2026-06-09

### Added

- Added declarative `external.lifecycle` command configuration, provider resource-name mapping, and coordinator-free WebVNC over SSH for deterministic private devbox CLIs.
- Added Podman runtime compatibility for `provider: local-container`, including runtime selection, provider flags on SSH commands, and Podman-safe local lease claim scopes. Thanks @sallyom.
- Added `sync.include` / `sync.includes` whitelists for root-relative sync plans, SSH sync, native Windows sync, local Actions hydration, and archive-sync providers. Thanks @anagnorisis2peripeteia.
- Added generic `kubevirt` SSH leases and a versioned `external` executable provider so private or proprietary VM/devbox control planes can integrate through configuration without provider-specific Crabbox forks.
- Added Tenki to the live provider smoke harness, including authenticated create/run coverage and a paused-session check that proves `status --wait` does not resume the sandbox.

### Changed

- Extended GitHub broker login user tokens to 180 days by default, exposed token expiry in login/doctor identity output, and made the lifetime configurable with `CRABBOX_USER_TOKEN_TTL_SECONDS`.
- Added optional GitHub user-token admin allowlists via `CRABBOX_GITHUB_ADMIN_OWNERS` and `CRABBOX_GITHUB_ADMIN_LOGINS`, and removed committed capacity-admin identities from the reusable Worker config.

### Fixed

- Fixed brokered provider doctor output so expired or rejected broker tokens tell maintainers to renew Crabbox login instead of misreporting AWS, Azure, GCP, or Hetzner credential failures.
- Fixed delegated run artifact collection so Blacksmith Testbox can satisfy `--require-artifact` and `--artifact-glob` before one-shot lease cleanup.
- Fixed malformed AWS, Azure, and GCP SSH CIDR configuration to fail closed instead of falling back to broad SSH access. Thanks @coygeek.
- Fixed local-container warmup on Windows by mounting the generated bootstrap directory instead of passing the script inline to Docker. Thanks @anagnorisis2peripeteia.
- Fixed SSH-backed status waits to honor `--wait-timeout` while allowing Tenki readiness probes without resuming paused sessions. Thanks @aki-luxor.
- Fixed Tenki JSON lease listings to expose the Crabbox lease ID instead of an unset numeric provider ID.
- Fixed brokered Azure lease creation to persist in-flight leases before VM provisioning, keep failed creates visible, and sweep orphaned Azure VMs from coordinator maintenance. Fixes https://github.com/openclaw/crabbox/issues/215.
- Fixed brokered lease release races so leases released while provisioning cannot be reactivated or lose cleanup retry state.
- Fixed Islo provider status, streaming exec, archive upload, share, and delete handling for the current Islo API contract. Thanks @zozo123.
- Restricted shared `use` viewers from mutating lease heartbeat or Tailscale metadata, and hardened archive sync for option-like filenames while preserving sync cancellation. Thanks @zozo123.

### Removed

## 0.26.0 - 2026-06-02

### Added

- Added `provider: multipass` for local Ubuntu VM SSH leases through Canonical Multipass, including cloud-init bootstrap, Crabbox sync/run lifecycle, cleanup, and cache-volume support. Thanks @jwmoss.

### Changed

### Fixed

- Fixed the README latest-release badge to use Badgen so GitHub release status does not depend on Shields' token pool. Thanks @zozo123.

### Removed

## 0.25.0 - 2026-06-01

### Added

- Added `provider: apple-container` for local Apple silicon macOS Linux leases, including SSH sync/run lifecycle and provider-backed cache volumes. Thanks @zozo123.
- Added a repo-local Blacksmith Testbox workflow and Crabbox config so delegated Testbox validation has workflow/job defaults.
- Added `crabbox prewarm` to lease and hydrate reusable test-ready boxes from configured GitHub Actions, with provider-owned handling for delegated runners such as Blacksmith Testbox.
- Added broker ready pools for hydrated reusable leases, including `prewarm --pool`, `run --pool`, `pool ready/register/borrow/return/ensure`, and the broker ready-pool API.
- Added `crabbox doctor --all --prepare-check` to report provider matrix readiness, resolved test machine types, and hydration workflow/job setup without creating leases.
- Added `crabbox webvnc daemon list` to show alive and stale local WebVNC helper daemons after agent runs.

### Changed

- Raised the coordinator fleet-wide and org-wide reserved monthly caps while keeping per-owner and active lease limits in place, so trusted operators are not blocked by stale reserved-cost accounting.
- Tuned XFCE/WebVNC desktops for smoother interactive use with low-latency `x11vnc`, 60fps WayVNC, and low-compression noVNC defaults.
- Updated Go and Worker dependencies, including Wrangler, Vitest, oxlint, Cloudflare Workers types, AWS SDK, Daytona SDK, Google API modules, OpenTelemetry, and the Go toolchain.

### Fixed

- Fixed GNOME desktop leases to follow the same persisted light/dark theme selection as XFCE, including GTK settings, panel restart, and browser color-scheme flags.
- Fixed GNOME theme toggles to restart the desktop panel inside the active session so the top and bottom bars stay visible.
- Fixed WebVNC GNOME theme switching on existing leases without the dynamic helper, including black GNOME Terminal profiles for dark mode.
- Fixed GNOME WebVNC terminal title bars to follow light/dark theme changes by updating labwc window decorations.
- Fixed GNOME WebVNC terminal menubars to follow light/dark theme changes and added a generated desktop background for GNOME sessions.
- Fixed XFCE desktop leases to drag and resize windows opaquely instead of using the wireframe destination box, with full move/resize opacity and XFWM compositing disabled for the Xvfb/VNC path.
- Fixed Apple Container bootstrap on hosts whose runtime does not inherit DNS by passing detected host resolvers while preserving explicit `--apple-container-extra-run-args --dns` overrides.
- Fixed Apple Container runs to fail as soon as the container exits during SSH bootstrap and include a short container log tail instead of waiting for the full SSH timeout.
- Classified Blacksmith Testbox cleanup, sync-marker, cancelled Actions, and post-ready stall failures as retryable infra stages instead of generic unknown failures.
- Fixed Azure VM provisioning so slow creates time out quickly, continue through SKU/region fallback, and use a Worker Azure region list separate from AWS regions.
- Fixed local Actions hydration after warmup SSH port fallback so prewarmed SSH-backed boxes reuse the resolved reachable endpoint instead of retrying the configured port.

### Removed

- Removed the stale root OpenClaw plugin package and its npm publish surface.

## 0.24.0 - 2026-05-31

### Added

- Added provider-backed cache volumes for rebuildable dependency caches, including `cache.volumes`, `CRABBOX_CACHE_VOLUMES`, repeatable `--cache-volume [name=]key:path`, `crabbox cache volumes`, Blacksmith Testbox sticky-disk forwarding, Local Container Docker volume mounts, and claim-backed required-volume checks for reused leases.

### Fixed

- Scoped the README Release badge to `?event=push` so it reflects tag-push release runs instead of cancelled `workflow_dispatch` runs. Fixes https://github.com/openclaw/crabbox/issues/189. Thanks @zozo123.

## 0.23.0 - 2026-05-30

### Added

- Added `provider: ascii-box` for [ASCII Box](https://box.ascii.dev) Ubuntu sandbox SSH leases, using the documented `box --json` CLI for create/list/status/stop/delete and standard Crabbox SSH sync/run. Thanks @zozo123.
- Added Azure `--azure-os-disk ephemeral-preview` / `azure.osDisk: ephemeral-preview` for opt-in ephemeral OS disk full caching through Azure Compute API `2025-04-01`. Thanks @jwmoss.
- Added configurable capacity-admin owner caps for coordinators that need elevated active lease limits for trusted operators.

### Changed

- Raised the default coordinator monthly budget caps so configured capacity pools are less likely to reject trusted brokered leases before provider quota is reached.

### Fixed

- Fixed brokered Azure Linux lease creation so a stalled coordinator request times out with a concrete cleanup/retry hint instead of sitting silently in the leasing phase for the full coordinator HTTP timeout.
- Fixed brokered Azure Spot VM fallback so `on-demand-after-*` windows bound VM create waits, on-demand retries use separate VM names, and timed-out Spot cleanup is retried from Fleet maintenance.

## 0.22.1 - 2026-05-29

### Added

- Added `--arch arm64` / `architecture: arm64` for Linux ARM leases on Azure and AWS, including Azure Dpsv6/Dpdsv6 and AWS Graviton class fallback plus matching Ubuntu ARM64 image resolution.

### Fixed

- Fixed brokered lease creation diagnostics so long coordinator requests print progress, timed-out create requests do not retry non-idempotent POSTs through curl, and Azure ARM errors preserve the useful conflict message.

## 0.22.0 - 2026-05-29

### Added

- Added `provider: azure-dynamic-sessions` for delegated Linux runs through Microsoft Azure Container Apps custom container Dynamic Sessions, including a Crabbox runner image, archive sync, streaming commands, local claims, status/list/stop, and provider docs. Thanks @zozo123.
- Added `crabbox pond` peer discovery, bridge, and SSH-mesh support for multi-lease networking, including bridge adapters for Cloudflare, E2B, Islo, Modal, Railway, and Tensorlake.
- Added Azure backend routing so `provider: azure` can select `azure.backend: dynamic-sessions` or `--azure-backend dynamic-sessions` while still reporting the canonical `azure-dynamic-sessions` provider.
- Added Islo delegated run session handles so `crabbox run --provider islo --keep --lease-output <file>` returns stable lease metadata and cleanup commands for orchestrators. Thanks @zozo123.
- Added `crabbox init --detect` to scan common Go, Node, Rust, and Makefile project markers and generate a repo-local `jobs.detected` remote check plus matching preflight tools. Thanks @zozo123.

### Fixed

- Fixed Azure VM provisioning to automatically use region-scoped shared VNet/NSG names when a Crabbox-managed base network already exists in another Azure region.
- Fixed brokered Azure regional fallback so region-scoped shared network names are computed per lease instead of mutating the Worker client's configured vnet/NSG names.
- Hardened Azure Dynamic Sessions endpoint validation, claim boundaries, token destinations, missing-response handling, lifecycle edges, shell string preservation, and runner image behavior.
- Fixed Islo run session handles to preserve resolved and claimed slugs, keep explicit lease IDs authoritative, return handles after lease creation, and quote cleanup commands safely.
- Fixed `crabbox stop` to accept `--id <lease>` like every other lease command, and updated the stop hint that `crabbox run` prints so it can be pasted back verbatim. Thanks @edihasaj.
- Fixed lease commands (`run`, `status`, `stop`, `ssh`, `inspect`, `screenshot`, `vnc`, `webvnc`, `actions`, `artifacts`, `checkpoint`, `egress`) to auto-route `--id static_<slug>` ids to `--provider ssh` and restore the original static host from the local lease claim, so static SSH leases no longer require repeating routing flags after `crabbox warmup`.
- Fixed `crabbox init --detect` to run nested detected package checks from the package directory and validate generated preflight tools.
- Fixed Blacksmith Testbox workflow fallback selection so generic Actions hydration workflows are not mistaken for Testbox workflows, and fixed native Windows wrapper commands so PowerShell-based Node bootstraps can run before JavaScript runtime preflight checks.
- Fixed brokered AWS provisioning to compact stale Crabbox SSH ingress after EC2 reports the security group rule limit, then retry the current source rule before failing.
- Fixed coordinator lease cleanup so expired AWS leases whose EC2 instance is already gone still clean provider keys before closing.
- Fixed AWS EC2 Mac host cleanup and selection so stale pending hosts are released by the orphan sweep and hosts with no reported launch capacity are skipped.
- Fixed Worker AWS Linux user-data compression and hardened command/security boundaries found by CodeQL.
- Fixed provider documentation tables to match the registered provider capabilities for Azure, GCP, and Railway.

## 0.21.0 - 2026-05-27

### Added

- Added `--desktop-env gnome` for a GNOME-apps desktop profile on labwc/WayVNC with GNOME Panel taskbars and Xwayland-backed app launches.
- Added native Windows support for GitHub-runner Actions hydration so workflows can prepare Windows leases before Crabbox attaches to the hydrated workspace.
- Added a portable `--os`/`os` lease selector with Ubuntu 26.04 as the preferred Linux image where provider catalogs support it, while preserving explicit provider image overrides.
- Added Azure `capacity.regions` fallback with region-scoped managed network names and Azure capacity hints, matching the AWS capacity-routing model.
- Added a repo-local Crabbox hydrate workflow and documented Azure as the preferred Windows/WSL2 provider when Azure quota or credits are available.
- Added `crabbox run --lease-output <file>` for reusable delegated-run session JSON, starting with Blacksmith Testbox. Thanks @RomneyDa.

### Fixed

- Fixed failed-run summaries so application output mentioning provider auth no longer looks like a provider/auth blocker, shell `&&` command chains explain short-circuit behavior, observed phases identify the likely failed phase, and opt-in automatic JUnit discovery can add structured test failures.
- Fixed Azure Spot VM provisioning to send `billingProfile.maxPrice: -1` explicitly in both direct and brokered mode, keeping Crabbox leases on Spot pricing without price-threshold evictions.
- Fixed coordinator-backed lease creation to wait long enough for slow cloud bootstraps such as Azure Windows/WSL2 before timing out locally.
- Fixed Azure failed-candidate cleanup retries to emit Worker-side progress logs while Azure waits out NIC and public IP dependency locks.
- Fixed brokered Azure region ordering so an explicit request or `CRABBOX_AZURE_LOCATION` is attempted before the coordinator default.
- Fixed native Windows `--fresh-pr` runs so PR checkout, local patch application, and post-bootstrap SSH port changes work over PowerShell.
- Fixed native Windows Actions env handoff so `crabbox run` can consume bash-style hydrate env files and reuse hydrated Node/pnpm paths.
- Fixed AWS coordinator EC2 polling to tolerate transient `InvalidInstanceID.NotFound` after instance creation and to report parsed AWS XML errors.
- Fixed AWS coordinator provisioning retries so wrapped opaque `RunInstances` errors are retried instead of failing immediately.
- Fixed Daytona provider sandbox inventory to use Daytona's cursor-based listing API.
- Removed OpenClaw-specific hosted broker defaults and documentation from the generic Crabbox broker login flow.

## 0.20.0 - 2026-05-26

### Added

- Added default artifact manifests for `crabbox artifacts publish`, plus `crabbox artifacts list` and `crabbox artifacts pull` for URL-backed proof handoff with size and SHA256 verification.
- Added `crabbox providers` to print the registered provider capability matrix, including targets, backend kind, coordinator mode, aliases, and feature flags.
- Added failed-run follow-through output with a compact digest that shows the failed phase, likely area, retryability, next commands, and a short redacted tail.
- Added `crabbox doctor --from-run <run-id>` to load provider, target, class, type, lease, and phase context from recorded run history before diagnostics.
- Added `crabbox logs --tail`, `crabbox events --type`, `crabbox events --phase`, and `crabbox results --failed-only` for faster recorded-run triage.

### Fixed

- Fixed Blacksmith Testbox runs so repo-level env allowlists for SSH-backed providers no longer block delegated Testbox warmup.
- Fixed AWS Linux desktop bootstrap so generated theme helpers include the latest WebVNC desktop styling on fresh leases.
- Fixed AWS Linux desktop bootstrap so existing desktop services are restarted after profile changes instead of leaving stale XFCE/X11 services running under a Wayland profile.
- Changed the experimental Wayland desktop bootstrap to use labwc, giving WebVNC sessions normal draggable, decorated windows instead of Sway tiling defaults.
- Fixed the W&B Sandboxes provider default endpoint to follow the current upstream `api.cwsandbox.com` API host.
- Fixed Linux WebVNC desktop panel styling so status and taskbar items avoid harsh high-contrast borders in dark mode.
- Fixed Linux WebVNC terminal windows so the XFCE Terminal menu bar follows the dark desktop theme.

## 0.19.0 - 2026-05-25

### Added

- Added `provider: wandb` for W&B/CoreWeave Sandbox delegated runs through the native gRPC API. Thanks @zozo123.
- Added AWS doctor capacity readiness checks that surface Spot and On-Demand vCPU quota pressure before warmup. Thanks @jwmoss.
- Added an experimental Linux `--desktop-env wayland` profile using labwc, WayVNC, Wayland browser launch env, and `grim` screenshots while keeping XFCE as the default desktop.

### Fixed

- Fixed coordinator-backed AWS SSH ingress so active lease source CIDRs are preserved through provider-owned access reconciliation instead of core AWS special cases. Thanks @obviyus.
- Fixed coordinator-backed one-shot runs to replace a lease once when SSH drops after sync but before the command starts, stopping the stale lease and retrying sync on the replacement.
- Fixed Linux desktop theme setup so WebVNC sessions install and prefer native Arc-Dark/other dark XFCE themes instead of custom-painting panel and window chrome.
- Fixed Linux WebVNC desktop sessions so they follow the portal light/dark toggle and system theme changes after the remote desktop has already connected.
- Fixed run failure summaries and timing JSON to classify likely blocked stages, redact known HTML auth challenge bodies from failure excerpts, and reject unsupported Blacksmith environment forwarding before warmup.
- Fixed desktop browser launches so Linux WebVNC browser sessions inherit the dark desktop theme, advertise dark color-scheme preference to web apps, and repair older managed browser wrappers before launch.

## 0.18.0 - 2026-05-23

### Added

- Added `provider: upstash-box` for delegated Upstash Box sandbox runs through the Box REST API, including archive sync, `run`, `warmup`, `list`, `status`, `stop`, config/env overrides, and provider docs.

### Fixed

- Fixed portal and documentation theme toggles so dark mode shows only the sun icon and light mode shows only the moon icon.
- Fixed remote Parallels hosts so `prlctl` is found on standard Mac install paths, and made snapshot fork dry-runs reject non-forkable power-on snapshots consistently.

### Changed

- Changed Linux desktop/WebVNC leases to seed and apply XFCE, GTK, GSettings, and terminal dark theme settings, and changed the portal theme toggle to preserve a system-synced mode.

## 0.17.1 - 2026-05-22

### Added

- Added `crabbox run --emit-proof` support for Blacksmith Testbox delegated runs, including bounded local stdout/stderr, timing, and metadata artifacts for successful proof runs.
- Added local-container Docker socket pass-through with host-visible work roots so `provider: docker` leases can run Docker-based test suites through the host daemon.

### Fixed

- Fixed local-container Docker socket pass-through on Docker Desktop, OrbStack, Colima, and similar local VM runtimes by mounting the daemon-visible socket path instead of the client context socket path.
- Fixed local-container Docker socket sync on local VM runtimes that reject rsync mtime updates on host-mounted work roots.
- Fixed local-container Docker socket bootstrap to prefer Docker's current Debian/Ubuntu CLI package before falling back to distro `docker.io`.
- Fixed `crabbox cleanup --provider docker` support for stale local-container leases.
- Fixed `provider: docker` stop/release cleanup so host-visible per-lease work directories created for Docker socket pass-through are removed with the lease.
- Fixed local Actions hydration for repo-local composite actions, cache no-ops, simple input conditions, safe `hashFiles`, secret-expression rejection, and Node 24.x setup on minimal Debian images.
- Fixed Parallels linked-clone provisioning to require an explicit source snapshot so `prlctl` cannot create a template-side linked-clone snapshot implicitly.

## 0.17.0 - 2026-05-21

### Added

- Added `provider: parallels` for local and remote Mac Parallels Desktop fleets, including template and snapshot-backed cloning, direct checkpoints, desktop/VNC forwarding, and Linux, macOS, and Windows guests.
- Added `provider: runpod` for RunPod public TCP SSH leases through the RunPod REST API, including Crabbox sync/run, `crabbox ssh`, `crabbox doctor`, and provider docs. Thanks @zozo123.
- Added a thin macOS developer-tools image mint wrapper that keeps paid host allocation explicit while wiring the reusable prep script, promotion, checkpoint proof, and lifecycle evidence defaults.
- Added AWS Linux and Windows developer-image prep scripts plus a guarded mint wrapper for baking Docker, Node 24, pnpm, GitHub CLI, and common developer tooling into fast-booting Crabbox AMIs.
- Added explicit AWS Fast Snapshot Restore promotion support for hot developer-image AMIs via `crabbox image promote --fast-snapshot-restore --fsr-az <az>` and the AWS developer-image mint wrapper.
- Added `crabbox image fsr-status` and the coordinator Fast Snapshot Restore status route for checking live AWS snapshot/AZ state after promotion.
- Added a light/dark mode toggle to the Crabbox documentation site that defaults to the system color scheme, persists the choice in local storage, and applies before first paint to avoid a flash.
- Added `provider: local-container` with `docker`, `container`, and `local-docker` aliases for local Linux container leases and optional desktop/browser/WebVNC smoke boxes through Docker-compatible runtimes such as Docker Desktop, OrbStack, and Colima.

### Changed

- Changed the portal lease table filter bar from a long single-choice pill list to grouped state, provider, OS, kind, and admin ownership selectors.
- Changed the macOS developer-tools mint wrapper to default to a full Xcode macOS 15 / Swift 6.2 toolchain on newer EC2 Mac host families, while keeping CLT-only image bakes explicit.

### Fixed

- Fixed direct GCP leases so new VMs set GCP `maxRunDuration` with `DELETE` for the TTL hard cap, install a guest-side idle expiry guard for expired ready/active leases when possible, and `crabbox cleanup --provider gcp` removes stale local GCP claim files after provider inventory no longer contains the lease.
- Fixed Windows developer-image bootstrap readiness so setup completion is written before restarting SSH and native Windows bakes wait for a stable SSH window before continuing.
- Fixed the Windows developer-image mint wrapper so the final PowerShell prep chunk decodes and runs inline instead of relying on a separate post-upload command.
- Fixed Windows developer-image prep so Docker Engine installation is deferred until after the required Containers feature reboot.
- Fixed Windows developer-image bakes so the Docker Containers feature can interrupt SSH without aborting the image mint, as long as the reboot marker is present.
- Fixed Windows developer-image warmup proof so the mint wrapper keeps the source lease alive with an SSH command instead of waiting on stale coordinator readiness.
- Fixed Windows developer-image prep so fresh Chocolatey and Node shims are visible in the active PowerShell session, and first-pass Docker feature installs exit cleanly before final tool verification.
- Fixed Windows developer-image Docker Engine installation to use static Docker binaries instead of the stale DockerMsftProvider package feed.
- Fixed Windows developer-image AMI prep to reset EC2Launch state before capture so candidate instances run per-lease user data and accept the new Crabbox SSH key.
- Fixed Windows developer-image prep to leave Crabbox-managed OpenSSH in place instead of installing Chocolatey's OpenSSH package over the active lease transport.
- Fixed Windows developer-image minting to retry idempotent prep-script chunk uploads, run long prep through a detached scheduled task, and require a stable post-reboot SSH window before the second prep pass.
- Fixed AWS developer-image bakes behind configured security groups so coordinator heartbeats still refresh the configured Crabbox SSH ports, and aligned the Worker Windows bootstrap ordering with the CLI path.

## 0.16.0 - 2026-05-18

### Added

- Added `provider: exe-dev` for exe.dev VM SSH leases through the exe.dev SSH API, including Crabbox sync/run, `crabbox ssh`, and provider docs.
- Added the Railway delegated provider for redeploying an existing Railway service, streaming build/runtime logs, and reporting deployment status through `crabbox run`, `status`, `stop`, and `list`. Thanks @zozo123.
- Added direct `crabbox doctor` readiness for all built-in providers without creating provider resources.
- Added direct `crabbox doctor --provider exe-dev` readiness through the exe.dev inventory API without creating VMs.
- Added Cloudflare runner readiness to `crabbox doctor --provider cloudflare` so runner URL, auth, and container bindings are checked without creating a sandbox. Thanks @altaywtf.
- Added `crabbox doctor --json`, provider error classification and hints, direct-check timeout/API/mutation labels, optional `--doctor-probe-ssh`, and `scripts/live-doctor-smoke.sh` for maintainer live coverage checks.
- Added `--slug` for `crabbox warmup`, fresh `crabbox run` leases, and `crabbox checkpoint fork`, plus `--label` for human-readable run history/timing metadata.
- Added a light/dark mode toggle to the crabbox portal header that defaults to the system color scheme, persists the choice in local storage, and applies before first paint to avoid a flash.
- Added a reusable macOS developer-tool prep script for image bakes that verifies Command Line Tools, installs Homebrew plus common CLI tooling, activates Node 24/pnpm, and exposes stable SSH-visible tool shims.
- Added an account-guarded EC2 Mac Dedicated Host quota request helper for turning macOS lifecycle smoke quota evidence into a dry-run or explicit AWS Service Quotas request.
- Added a no-spend macOS coordinator remediation audit helper that bundles provider identity, IAM policy, host quota, host allocation dry-run, guarded IAM apply dry-run, and guarded quota request dry-run evidence into `summary.json`.

### Changed

- Changed Actions hydration to run repo workflow setup locally over SSH by default, auto-hydrate `crabbox run` when `actions.workflow` is configured, and keep GitHub self-hosted runner registration behind `--github-runner` fallback.
- Changed AWS macOS AMI selection so newer `mac-m*` EC2 Mac leases use macOS 15 images while `mac2*` and legacy `mac1.metal` continue using launchable macOS 14 images.
- Hardened macOS image lifecycle smoke so source, candidate, and promoted images must expose Command Line Tools-compatible Apple developer tools, Swift, Homebrew, and common Node/pnpm developer tooling before promotion, with stricter macOS 15 and Swift tools 6.2 defaults for `mac-m*` host families.
- Clarified WebVNC docs to include coordinator-backed AWS macOS desktop leases in the supported portal bridge surface.

### Fixed

- Fixed AWS macOS lease bootstrap so EC2 Mac instances explicitly install the Crabbox SSH key, enable Remote Login on configured ports, and treat Screen Sharing as available for WebVNC even when a dedicated host lease predates the `desktop=true` label.
- Fixed AWS WebVNC reconnects so coordinator lease heartbeats refresh SSH ingress from the caller source before local bridge startup retries.
- Fixed the portal so configured AWS macOS Dedicated Hosts appear as lease-like dedicated rows with host detail pages, attached-lease access actions, and local start/WebVNC commands for host-pinned desktop leases.
- Fixed WebVNC daemon restarts so the background bridge keeps its lease claim after a repo checkout changes.
- Fixed macOS WebVNC bridge churn by using a smaller bridge pool for macOS Screen Sharing instead of opening the default multi-slot VNC pool.
- Fixed macOS WebVNC portal performance by using latency-biased noVNC compression and quality defaults for Screen Sharing sessions.
- Fixed WebVNC portal credential failures so bare or stale macOS links stop with a clear status instead of opening a blank retry loop.
- Fixed WebVNC local bridge startup so resolved SSH fallback ports are reused for the foreground VNC tunnel instead of falling back during probes and then tunneling the stale configured port.
- Fixed Railway `crabbox run` redeploys to use Railway's deployment redeploy mutation so live Docker-image services return the new deployment ID reliably.
- Fixed pinned AWS macOS host/image launches so region fallback cannot silently route a candidate image proof onto a different region or host.
- Fixed direct AWS AMI checkpoint create, inspect, delete, and fork paths so source instances are validated before host preparation and recorded account/direct-backend metadata is honored even after coordinator configuration changes.
- Fixed direct AWS macOS AMI checkpoint forks so resolved and recorded EC2 Mac Dedicated Host pins are reused after coordinator routing is disabled.
- Fixed AWS macOS native checkpoint selection so brokered and direct macOS checkpoints use AMI-backed snapshots by default instead of raw EBS snapshot forks that EC2 Mac cannot reliably relaunch.
- Fixed macOS image lifecycle smoke checkpoint forks so EC2 Mac host recycle waits require stable availability and retry once after transient host recycle failures.
- Fixed macOS image lifecycle smoke checkpoint forks so forked macOS leases request desktop/WebVNC metadata before collecting WebVNC evidence.
- Fixed macOS image lifecycle smoke summaries so paid EC2 Mac Dedicated Host allocation failures preserve stderr, blocker text, and remediation guidance instead of writing an empty blocker.
- Fixed EC2 Mac Dedicated Host state parsing so live AWS `DescribeHosts` responses are recognized as reusable by macOS lifecycle smoke instead of falling through to a new host allocation path.
- Fixed existing AWS macOS lease commands so `crabbox run --id ... --target macos` defaults the irrelevant capacity market to On-Demand instead of failing Spot validation before reaching the lease.
- Fixed recursive run artifact globs so `**` works on older Bash without crossing unintended path segments.
- Fixed `crabbox doctor` local tool checks so providers that do not use local SSH/rsync do not fail on those tools.

## 0.15.0 - 2026-05-17

### Added

- Added `crabbox capsule` for local GitHub Actions failure replay manifests, including capture, inspect, replay, promotion, and documentation for how capsules compose with actions hydration and checkpoints. Thanks @zozo123.
- Added AWS macOS support to native `crabbox checkpoint` snapshot/image creation and forks, including host-pin metadata and On-Demand fork defaults.
- Added direct AWS AMI checkpoint creation so non-brokered AWS Linux/macOS leases can use `crabbox checkpoint create --mode native` or `--strategy image` without a coordinator.
- Added `--take-control` for WebVNC portal handoffs so opened browser viewers can automatically become the keyboard and mouse controller after connecting.
- Added `scripts/macos-image-lifecycle-smoke.sh` for guarded AWS EC2 Mac host allocation, source macOS lease boot, WebVNC bridge proof, AMI creation, candidate-image smoke, promotion, promoted-image smoke, cleanup, and durable `summary.json` evidence.
- Added a no-spend macOS host region preflight helper for checking reusable EC2 Mac Dedicated Hosts, dry-run allocation readiness, and Dedicated Mac host quota across configured AWS regions before approving paid allocation.
- Added an account-guarded macOS image lifecycle IAM apply helper for trusted operators remediating coordinator AWS permissions from smoke artifacts, including automatic local AWS profile matching.
- Added parsed IAM policy target details to `crabbox admin providers identity --provider aws --json` so operators know which role or user needs the macOS image lifecycle policy.
- Added provider-scoped admin entrypoints: `crabbox admin providers identity`, `crabbox admin providers policy`, and `crabbox admin hosts` for host lifecycle operations. Existing `admin aws-*` and `admin mac-hosts` commands remain compatibility aliases.
- Added provider-neutral `CRABBOX_HOST_ID` / `hostId` config for host-pinned leases while keeping `CRABBOX_AWS_MAC_HOST_ID` / `aws.macHostId` as AWS compatibility aliases.
- Added provider-neutral coordinator admin routes for host lifecycle and provider identity operations, while keeping the legacy AWS routes as compatibility fallbacks.
- Added compatibility aliases `crabbox admin mac-hosts`, `crabbox admin aws-identity`, `crabbox admin aws-policy`, and `crabbox admin aws-policy --mac-hosts` for existing AWS macOS operator workflows.
- Added a broker-side AWS orphan sweep that periodically scans configured AWS capacity regions from the Durable Object alarm and can terminate confirmed Crabbox-tagged EC2 orphans.
- Added an AWS orphan-audit script for trusted operators to find Crabbox-tagged EC2 instances left behind in old provider accounts after credential or account rotation.
- Added macOS image lifecycle evidence files for host discovery, quota, dry-run, allocation, image creation, image promotion, warmup, host wait, WebVNC daemon startup, WebVNC status, and artifact directories for blocked, partial, and completed runs.
- Added regression coverage for the guarded macOS image lifecycle smoke and configurable WebVNC post-start grace period.

### Changed

- Hardened the macOS image lifecycle smoke so native checkpoint snapshot creation, checkpoint forks, WebVNC proof, and checkpoint cleanup run before candidate-image promotion.
- Hardened the macOS image lifecycle smoke so EC2 Mac Dedicated Host scrubbing, WebVNC daemon cleanup, active portal bridge checks, and Mac host family fallback are covered before image promotion.
- Changed AWS promoted image records to be scoped by target, architecture, server type, and region so macOS AMIs do not become the default image for Linux or Windows leases.
- Changed native checkpoint records to preserve the source provider server type so macOS snapshot forks reuse the matching EC2 Mac host family unless `--type` is explicitly overridden.
- Changed AWS macOS instance fallback candidates to include current Apple silicon Mac host families before the legacy `mac1.metal` fallback.
- Changed EC2 Mac Dedicated Host quota checks to use direct Service Quotas lookups for known Mac host families before falling back to broader quota listing.
- Changed the macOS host preflight and image lifecycle smoke to use the provider-neutral admin host/provider commands and `CRABBOX_HOST_ID` when pinning leases to an allocated host.
- Changed the macOS image lifecycle smoke artifact to include the coordinator provider identity used for IAM remediation.
- Changed macOS image lifecycle smoke blocker commands to use portable evidence filenames with the guarded IAM apply helper for coordinator permission remediation.
- Changed macOS image lifecycle smoke summaries to record artifact-relative evidence paths so published bundles do not expose local checkout paths.
- Changed macOS image lifecycle blocked summaries to include a `blocker.reason` alias for automation that expects a short blocker reason.
- Changed standalone macOS host region preflight blockers to use the guarded IAM apply helper instead of manual account-match shell snippets.
- Updated Go provider SDKs and Worker runtime/toolchain dependencies.
- Documented the AWS account-match and IAM remediation flow for attaching the combined macOS image lifecycle policy to the coordinator role or user.
- Clarified the EC2 Mac host IAM policy, including create-time tag permissions, Dedicated Mac host quota checks, and the split between baseline AWS provider permissions and paid macOS image bake, WebVNC, promotion, and cleanup permissions.
- Clarified AWS security guardrail docs so IAM Access Analyzer external-access analyzers are created in every configured capacity region, while S3 Block Public Access and IAM password policy remain account-level controls.

### Fixed

- Fixed code-scanning findings in container command execution, Worker sanitizers, docs link/build helpers, and JSON error responses.
- Fixed live smoke scripts so provider-specific missing workflow, snapshot, CLI, Python client, or Semaphore config prerequisites fail before allocating resources, and added Sprites coverage to the live provider smoke.
- Fixed live coordinator auth smoke so GitHub-authenticated coordinator identities are accepted and Cloudflare Access credential gaps print an actionable prerequisite error.
- Fixed raw SSH-provider JS package command failures so Crabbox probes obvious `pnpm`, `npm`, `node`, `corepack`, `yarn`, and `bun` entrypoints before syncing and fails with hydration/setup guidance instead of an empty `exit 127` tail.
- Fixed `crabbox webvnc --open` so opened portal links make the lease visible to authenticated org users instead of showing a misleading 404 when CLI auth and browser auth differ.
- Fixed WebVNC portal click forwarding so controller clicks reach the remote desktop while preserving focus and browser context-menu suppression.
- Fixed WebVNC `--take-control` handoff links so the portal keeps retrying the automatic control claim until the opened viewer is registered as an observer.
- Fixed remote macOS screenshots so `crabbox screenshot` captures the Screen Sharing/VNC framebuffer instead of relying on `screencapture` from non-interactive SSH sessions.
- Fixed remote macOS screenshots against no-auth VNC servers by reading the RFB 3.8 security result before framebuffer negotiation.
- Fixed brokered AWS macOS launches so stale host ids, missing Mac hosts, regional AMI gaps, and unavailable default Mac capacity can fall back to usable host, region, image, or alternate Mac host family candidates.
- Fixed brokered AWS macOS launches so newer `mac-m*` Mac host fallback candidates resolve macOS 15 AMIs instead of reusing the earlier Apple silicon macOS 14 AMI query.
- Fixed coordinator-backed macOS lease reuse so follow-up `run`, sync, and image smoke commands use the brokered `/Users/ec2-user/crabbox` work root instead of Linux's `/work/crabbox`.
- Fixed coordinator-backed macOS checkpoint metadata so an auto-discovered provider host id is preserved for snapshot forks.
- Fixed AWS image deletion so scoped promoted macOS images cannot be deleted until another image is promoted.
- Fixed brokered Azure leases so the CLI only sends `azureOSDisk` when the user explicitly configures it, preserving the coordinator default while keeping new Azure leases checkpointable by default. Thanks @jwmoss.
- Fixed managed Windows bootstraps so native Windows leases skip desktop/VNC setup unless `--desktop` is requested, while WSL2 leases keep their Windows core and Linux setup paths separate. Thanks @jwmoss.
- Fixed macOS image lifecycle cleanup and release paths so script-allocated hosts and local WebVNC daemons are stopped after source-only, candidate-only, blocked, partial, and completed runs.
- Fixed macOS image lifecycle cleanup so script-allocated EC2 Mac Dedicated Hosts are released from failure traps when host release is requested.
- Fixed EC2 Mac Dedicated Host allocation and release handling so paid host IDs returned by AWS are not retried in another availability zone after post-allocation describe failures, and failed `ReleaseHosts` results are surfaced instead of reported as released.
- Fixed macOS image lifecycle region-preflight blockers so they preserve guarded IAM helper remediation commands from the region preflight evidence instead of falling back to manual account-match snippets.
- Fixed macOS image lifecycle and host-region preflight blockers so remediation commands use neutral `crabbox` commands and the guarded IAM apply helper instead of embedding local binary paths, checkout paths, or manual account-match snippets.
- Fixed macOS image lifecycle blocked summaries so quota preflight failures, EC2 Mac host dry-run IAM failures, rerun commands, and short `blocker.reason` aliases are preserved in evidence.
- Fixed macOS image lifecycle evidence and artifact summaries so paths are only populated after the matching files or directories are captured.
- Fixed EC2 Mac host dry-run JSON output so AWS authorization failures do not expose raw provider error details in operator logs.
- Fixed EC2 Mac host quota checks so unsupported regional Mac quota resources return an empty quota result instead of a 502 preflight error.
- Fixed missing coordinator Mac host admin endpoints so they report a blocked preflight instead of an empty preflight failure.
- Fixed external macOS AMI promotion so x86 Mac images are keyed by their described architecture instead of defaulting to Apple silicon metadata.
- Fixed provider-neutral admin command errors so older coordinators report the neutral route and the legacy compatibility route that both returned 404.
- Fixed provider-neutral host pin requests and lease records so the public JSON field is `hostId`, while `hostID` remains accepted for compatibility.

## 0.14.0 - 2026-05-15

### Added

- Added `crabbox admin lease-audit` so operators can compare expired brokered AWS lease records against live cloud instance state and fail automation when a record still maps to a live instance.
- Added `crabbox checkpoint` native disk-snapshot checkpoints for brokered AWS, Azure, and GCP Linux leases, optional provider image checkpoints via `--strategy image`, local workspace archives for generic POSIX SSH leases, inspect/list/delete flows, archive restore, and checkpoint forks into fresh leases.
- Added checkpoint audit and cleanup management with `crabbox checkpoint list --verify`, `inspect --verify`, and `prune --older-than`.
- Added `provider: cloudflare` delegated runs for Cloudflare Containers through a Worker runner, including archive sync, warm containers, local claim cleanup, and deployment docs. Thanks @altaywtf.
- Added Cloudflare runner deploy-smoke tooling, CI coverage for the container runner Go module, and redacted `crabbox config show` output for Cloudflare runner auth.
- Added `crabbox list --refresh` so local Cloudflare claims can be checked against live runner state on demand.
- Added brokered provider snapshot/image deletion for AWS EBS snapshots and AMIs, Azure managed disk snapshots and managed images, and GCP disk snapshots and machine images.
- Added Modal and Tensorlake to the top-level provider docs and delegated sandbox configuration examples. Thanks @stainlu.
- Added provider feature flags for workspace checkpoint, fork, restore, and native snapshot capabilities. Thanks @stainlu.

### Changed

- Improved checkpoint documentation with clearer native vs archive distinction, workflow mechanics, security warnings, and command reference examples.

### Fixed

- Fixed delegated Blacksmith Testbox warmup/run flows so successful allocations refresh the coordinator runner portal instead of waiting for a later manual list.
- Fixed Code bridge upstream URL handling so browser-controlled paths cannot select a non-loopback upstream target, and clamped `CRABBOX_AWS_ROOT_GB` parsing to valid `int32` values.
- Fixed `crabbox admin lease-audit --fail-on-live` so recently terminated AWS instances returned by `DescribeInstances` do not fail cleanup automation as live resources.
- Fixed checkpoint archive restores so large archives stream over SSH without buffering the full tarball in memory and unpack through a per-restore remote temp file. Thanks @stainlu.
- Fixed Daytona toolbox archive sync so failed remote extracts still remove the uploaded `/tmp/crabbox-*.tgz` archive. Thanks @stainlu.
- Fixed Islo exec-upload fallback cleanup so failed archive decodes or extracts still remove temporary upload files. Thanks @stainlu.
- Fixed Cloudflare runner URL validation so configured runner URLs cannot include query or fragment components that corrupt API request paths. Thanks @stainlu.
- Fixed Cloudflare stop so missing runner containers prune their stale local claims instead of leaving users to run cleanup manually. Thanks @stainlu.
- Fixed the Crabbox plugin provider schema so current providers and aliases such as `modal`, `tensorlake`, and `cf` can be selected. Thanks @stainlu.
- Fixed coordinator TTL cleanup so provider deletion failures keep leases active with retry metadata instead of silently expiring while cloud instances continue running.
- Fixed direct AWS security-group maintenance so stale Crabbox-owned SSH ingress rules are pruned before adding the current source CIDRs.
- Fixed E2B sync cleanup so remote upload archives are removed even when extraction fails. Thanks @stainlu.
- Fixed Hetzner Cloud server-list parsing so `private_net` arrays from the API no longer break list, doctor, warmup, or reused-run flows. Thanks @muqsitnawaz.
- Fixed installed tagged builds so `crabbox --version` and proof metadata report the Go module build version instead of the development fallback. Thanks @stainlu.
- Fixed Modal sync cleanup so remote upload archives are removed even when extraction fails. Thanks @stainlu.
- Fixed native provider checkpoint creation so AWS, Azure, and GCP snapshot/image checkpoints flush source filesystem writes before calling the provider API.
- Fixed `crabbox actions hydrate --id tbx_...` so Blacksmith Testbox IDs skip owned-cloud runner registration instead of failing on GitHub self-hosted-runner permissions.
- Fixed Tensorlake timing JSON so delegated runs include the lease slug and reused sandboxes preserve the stored claim slug. Thanks @stainlu.
- Fixed Tensorlake workdir validation so broad sandbox paths are rejected before sync or command execution. Thanks @stainlu.

## 0.13.0 - 2026-05-13

### Added

- Added `provider: modal` delegated runs for Modal Sandboxes through the local Modal Python client, including archive sync, env allowlist forwarding, docs, and no-live-credential tests.
- Added `crabbox run --full-resync` / `--fresh-sync` to reset stale remote workdirs before syncing, plus `--env-helper` for reusable profile-backed env wrappers on POSIX SSH leases.
- Added native Windows support for `crabbox run --script` / `--script-stdin` and a real native Windows `--preflight` probe.
- Added configurable `crabbox run --preflight` tool probes via `--preflight-tools`, `CRABBOX_PREFLIGHT_TOOLS`, and `run.preflightTools`.

### Changed

- Improved sync and SSH watchdog output so long quiet syncs and dead SSH waits include concrete retry/replace hints.
- Clarified hosted broker access for non-allowlisted users and documented the minimum self-hosted broker setup. Thanks @alan-mathison-enigma.

### Fixed

- Fixed AWS broker security-group maintenance so stale Crabbox-owned SSH ingress rules are pruned before adding the current source CIDRs. Thanks @obviyus.
- Fixed Proxmox VM bootstrap to wait for the guest IP and bootstrap over SSH after clone/start, avoiding fragile guest-agent exec behavior. Thanks @mine-13-zoom.
- Fixed AWS Windows WSL2 exact `--type` requests so instance families without nested virtualization fail before leasing with a targeted repair hint.
- Fixed coordinator-backed AWS acquisition so readiness failures delete the just-created instance before retrying, while CLI retries still require an explicit cleanup signal.
- Fixed coordinator-backed acquisition so repeated confirmed stale AWS instance cleanups get a larger retry budget instead of failing after the second stale instance.
- Fixed `crabbox code` on leases that fall back from SSH port 2222 to 22, and improved foreground tunnel startup errors to include SSH failure details.
- Fixed `crabbox run --preflight --preflight-tools none` so it prints only the workspace summary without running remote probes.
- Fixed native Windows `crabbox run --preflight` so user and cwd diagnostics are always printed alongside configurable tool probes.
- Fixed native Windows `--script` and `--env-from-profile` uploads so non-ASCII PowerShell source and profile values stay UTF-8 under Windows PowerShell.
- Fixed native Windows `--env-from-profile` uploads so allowed profile values are written relative to the synced workdir and failures include the remote PowerShell error.

## 0.12.0 - 2026-05-12

### Added

- Added Azure native Windows desktop/VNC and Windows WSL2 lease support, matching the AWS Windows capability boundary. Thanks @jwmoss.
- Added `provider: proxmox` for direct Proxmox VE Linux QEMU VM leases, including template clone, cloud-init SSH key injection, guest-agent bootstrap, docs, and cleanup support.
- Added `provider: tensorlake` delegated runs for Tensorlake Firecracker sandboxes through the `tensorlake` CLI, including archive sync, env allowlist forwarding, docs, and live-provider coverage. Thanks @zozo123.
- Added `crabbox run --preflight`, `--capture-stderr`, automatic failure bundles, env-forwarding summaries, and `CRABBOX_PHASE:<name>` timing markers for easier live/provider run debugging.
- Added `crabbox run --keep-on-failure` so failed one-shot runs can leave the exact lease available for SSH inspection until idle/TTL expiry.
- Added `crabbox run --script <file>` and `--script-stdin` so larger remote commands can be uploaded and executed as files instead of quoted shell strings.
- Added `crabbox run --env-from-profile <file>` and repeatable `--allow-env <name>` for redacted, first-class live-secret forwarding from local profile files.
- Added `crabbox run --fresh-pr <owner/repo#number>` for fresh remote GitHub PR checkouts, with optional `--apply-local-patch`.
- Added `crabbox azure login` so direct Azure users can persist the active `az login` subscription, tenant, and location without manually exporting service-principal environment variables. Thanks @galiniliev.
- Added `azure.network` / `CRABBOX_AZURE_NETWORK` so Azure direct leases can SSH through private VNet addresses when using VPN/private-network access. Thanks @galiniliev.
- Added `scripts/proxmox-build-template.sh` to build a Crabbox-ready Ubuntu 24.04 Proxmox template from a public cloud image. Thanks @VACInc.

### Changed

- Changed sync guardrails to count the dirty delta when local changes are present while still printing the full candidate size, making dirty-worktree iteration less noisy.
- Expanded default sync excludes for common generated churn such as `.ignored`, `.vite`, `playwright-report`, `test-results`, and local `.crabbox` log/capture directories, and added top-directory hints for large sync candidates.
- Changed automatic failure-bundle stdout/stderr capture to cap implicit temp logs while still allowing explicit `--capture-stdout` / `--capture-stderr` files for full local streams.
- Documented `--fresh-pr ... --apply-local-patch` as the preferred fast path for PR iteration from noisy local checkouts.
- Documented Azure CLI login setup, private-network SSH selection, and regional constraints for reused Azure VNet/subnet/NSG resources. Thanks @galiniliev.
- Clarified that Blacksmith delegated runs cannot forward CLI-side `--env-from-profile` values and should use workflow-side secrets.
- Documented Islo's `islo ssh --setup` host-alias flow for ad-hoc SSH access to Islo sandboxes. Thanks @zozo123.

### Fixed

- Fixed shared-token coordinator auth so caller-supplied `X-Crabbox-Owner` and `X-Crabbox-Org` headers cannot select the authenticated owner/org. Thanks @Hinotoi-agent.
- Fixed Code, WebVNC, and Egress bridge ticket creation so `use`-shared lease users cannot mint lease-side bridge-agent tickets without manage access. Thanks @Hinotoi-agent.
- Fixed repo-local `env.allow: ["*"]` so it no longer forwards every local environment variable to remote commands. Thanks @Hinotoi-agent.
- Fixed Windows SSH sync by disabling unsupported OpenSSH ControlMaster multiplexing and preferring WSL rsync/path conversion when available. Thanks @galiniliev.
- Fixed Tensorlake slug resolution so stale claims from other providers cannot shadow an active Tensorlake sandbox slug.
- Fixed Sprites and Namespace Devbox work-root validation so broad roots are rejected before create/prepare flows. Thanks @stainlu.
- Fixed Sprites list pagination so missing or repeated continuation tokens fail instead of spinning or accepting malformed pages. Thanks @stainlu.
- Fixed Namespace Devbox prepare error reporting so prepare failures are not hidden behind earlier SSH config fallback errors. Thanks @stainlu.

## 0.11.0 - 2026-05-11

### Added

- Added `crabbox job list/run` and repo-local `jobs:` config for named warmup → Actions hydrate → run → cleanup workflows.
- Added Daytona and Namespace Devbox lanes to `scripts/live-smoke.sh` so delegated live smoke coverage can run through the shared harness.
- Added `provider: gcp` for Google Cloud Compute Engine Linux SSH leases, including direct ADC auth, brokered service-account auth, class fallback, Spot/on-demand fallback, docs, and cleanup support.
- Added `crabbox cleanup --provider namespace-devbox` to remove Crabbox-owned Namespace SSH snippets and keys.
- Added `scripts/openclaw-wsl2-tests.sh` for one-command OpenClaw full-suite runs on AWS Windows WSL2 Crabbox leases.

### Changed

- Aligned direct GCP provisioning with Google's official Compute Go SDK (`cloud.google.com/go/compute/apiv1`) and project-wide aggregated instance discovery.
- Moved OpenClaw Blacksmith Testbox run safeguards into Crabbox, including one-shot slug reporting and stalled sync termination.
- Improved `crabbox media preview` and `artifacts collect --gif` defaults to generate higher-quality 1000px/24fps GIFs with Floyd-Steinberg palette dithering and optional gifsicle optimization. Thanks @obviyus.

### Fixed

- Fixed the Blacksmith Testbox sync-stall guard to match current `blacksmith` CLI sync start and completion messages.
- Fixed GCP leases so exact `--type` requests still use configured zone and Spot-to-on-demand fallback, aliases derive GCP class defaults, explicit brokered tags replace Worker default tags, custom networks and ingress policies get separate SSH firewall rules, and brokered pool views include instances outside the Worker's default zone.
- Fixed `crabbox actions hydrate/register` so AWS Windows WSL2 leases can use Linux GitHub Actions hydration instead of being rejected as Windows targets, including root-runner and stale apt-list handling.
- Fixed `scripts/openclaw-wsl2-tests.sh` so follow-up hydrate/run/cleanup commands keep the AWS Windows WSL2 target configuration and warmup failures print captured output.
- Fixed `scripts/openclaw-wsl2-tests.sh` so dirty-sync package graph changes refresh workspace dependencies before the full OpenClaw test command runs.
- Fixed first `crabbox run` syncs after GitHub Actions hydration so tracked checkout files are not treated as stale remote files before the initial dirty-worktree sync.
- Fixed `crabbox run` history finish recording to allow large final log payloads enough time to reach the coordinator.
- Fixed Namespace Devbox release-only resolution so `crabbox stop --provider namespace-devbox --namespace-delete-on-release <name>` deletes without re-preparing SSH.
- Fixed Namespace Devbox release cleanup so stopping a Crabbox Devbox removes its local `~/.namespace/ssh/crabbox-*` snippet and key files.
- Fixed `crabbox webvnc daemon start` so it starts with a fresh bridge log and waits briefly for the bridge-ready marker before returning.

## 0.10.0 - 2026-05-10

### Added

- Added `crabbox run --capture-stdout <path>` and repeatable `--download remote=local` for binary-safe proof capture without streaming arbitrary bytes into the terminal or run-log previews.
- Added `crabbox desktop terminal` for visible terminal smokes, including Sixel-friendly Git-for-Windows `mintty` launch defaults on native Windows.
- Added `crabbox desktop record` plus `desktop terminal --screenshot/--record` for one-command visual proof capture, including native Windows MP4 recording through interactive desktop frames.
- Added automatic contact-sheet PNGs for desktop recordings, `crabbox desktop proof` for one-shot visual proof bundles, recorder diagnostics, and direct PR publishing from terminal/proof captures.

### Changed

- Updated docs for output capture, desktop terminal/proof capture, Windows desktop bootstrap, artifact contact sheets, and managed-provider readiness checks.
- Reworked the WebVNC share dialog into an inline Google-style sharing flow with add-user, org access, copy-link, and done actions.

### Fixed

- Fixed delegated run providers so unsupported `--capture-stdout` and `--download` requests fail instead of streaming stdout and skipping downloads.
- Fixed E2B sandbox creation so Crabbox caps default lease timeouts to E2B's one-hour API limit instead of failing live smoke warmups.
- Fixed `crabbox run` output capture validation so malformed `--download` specs, bad download destinations, and bad `--capture-stdout` paths fail before leasing, syncing, or running remotely.
- Fixed interrupt handling so a second `Ctrl-C` can terminate slow cleanup after the first signal starts graceful cancellation.
- Fixed `crabbox doctor --provider ...` so coordinator secret readiness checks only run for managed brokered providers.
- Fixed `crabbox desktop terminal --provider ssh -- ...` so static SSH command arguments are not consumed as lease IDs.
- Fixed `crabbox run --capture-stdout` so local capture write failures report as capture errors instead of remote command exits.
- Fixed brokered provider preflight so `crabbox doctor --provider azure` reports missing Worker secrets and lease creation returns `provider_not_configured` instead of a coordinator `500`.
- Fixed interrupted one-shot runs so `SIGINT`/`SIGTERM` cancel through the CLI context and still run best-effort lease cleanup.
- Fixed SSH readiness progress logs to include per-port probe state in timeout errors.
- Fixed managed AWS Windows desktop bootstrap so WebVNC/screenshot targets start TightVNC reliably and screenshots are not covered by Windows' first-network flyout.
- Fixed Windows `desktop launch` argument handling so terminal commands such as `bash -lc '...'` and other quoted GUI launches are passed losslessly.
- Fixed the source-built CLI version so unreleased local builds no longer report the previous release.

## 0.9.0 - 2026-05-10

### Added

- Added `provider: sprites` for Sprites microVM SSH leases through the `sprite` CLI/API, including Crabbox sync/run, `crabbox ssh`, and live smoke docs.
- Added `provider: namespace-devbox` for Namespace Devbox SSH leases through the `devbox` CLI, with Crabbox sync/run layered on the returned SSH endpoint.
- Added live smoke checklists and script coverage for direct E2B and Semaphore provider validation. Thanks @stainlu.

### Changed

- Updated Worker runtime dependencies and Go provider SDKs, including noVNC, fast-xml-parser, AWS EC2, Daytona, Islo, and related Go runtime libraries.

### Fixed

- Fixed signed portal user tokens so caller-provided admin claims are rejected instead of granting admin access. Thanks @Hinotoi-agent.
- Fixed Islo workdir containment so absolute paths and parent-directory escapes are rejected before sandbox creation, sync, or run. Thanks @Hinotoi-agent.
- Fixed Islo archive sync uploads to use the API's multipart file contract instead of falling back after server-side `500` responses.
- Fixed Semaphore host configuration so dashboard URLs normalize to hosts while API paths, query strings, fragments, and user info are rejected. Thanks @stainlu.
- Fixed WebVNC portal input focus so controller typing stays in the remote desktop and right-clicks no longer open the browser context menu.
- Fixed Semaphore list output so locally claimed jobs show their lease slugs.
- Fixed E2B relative workdirs so they resolve under the configured E2B user's home instead of always `/home/user`.
- Fixed E2B workspace guardrails so broad roots such as `/`, `/home`, and `/tmp` are rejected before sync creates, deletes, or extracts files.
- Fixed E2B sandbox creation so unsafe workdirs are rejected before the API call. Thanks @stainlu.
- Fixed E2B user validation so path-like users are rejected before sandbox or process calls. Thanks @stainlu.
- Fixed stale Code, WebVNC, and egress bridge clients so expired or missing leases stop polling/restarting after terminal coordinator responses. Thanks @vincentkoc.
- Fixed `crabbox desktop paste` for terminal windows so symbol-heavy text falls back to direct typing instead of sending a literal `Ctrl+V` into xterm-like sessions.
- Removed the vulnerable transitive `fast-xml-builder` Worker dependency by updating fast-xml-parser.

## 0.8.0 - 2026-05-09

### Added

- Added `provider: azure` for managed Azure Linux and native Windows SSH leases, including direct and brokered provisioning, shared Azure networking, SKU fallback, Azure docs, and cleanup support. Thanks @jwmoss.
- Added `provider: e2b` for delegated E2B sandbox runs using E2B sandbox REST/envd APIs. Thanks @zozo123.
- Added `provider: semaphore` for direct Semaphore CI testbox leases over SSH. Thanks @loadez.
- Added an authenticated coordinator control WebSocket for low-latency run attach streams and lease heartbeats, with HTTP polling/heartbeat fallback for older brokers. Thanks @vincentkoc.
- Added rescue-first desktop/WebVNC failure output that names the failing layer and prints exact `rescue:` or native VNC fallback commands when bridges, viewers, browser launches, VNC targets, or input stacks hang.
- Added collaborative WebVNC observer mode, with one active controller, read-only observers, and a portal takeover button that shows who is controlling the session.
- Added first-class `crabbox artifacts` commands for desktop screenshots, MP4 recordings, trimmed GIFs, logs, metadata, Mantis/OpenClaw QA templates, and PR-ready publishing through broker-owned artifact storage, AWS S3, or Cloudflare R2.

### Changed

- Expanded Semaphore and E2B documentation across provider, configuration, CLI, and command pages so direct providers have first-class setup, auth, lifecycle, and troubleshooting guidance.
- Changed `crabbox attach` to prefer the coordinator control WebSocket, drain retained backlog pages, and then stream live run output with less polling latency.
- Changed WebVNC portal sharing to open as an in-session modal, added a standalone share-page back action, and simplified collaboration controls into a single stateful control button.
- Raised the Go core coverage gate to 90% and added regression coverage around provider claims, config parsing, bootstrap defaults, run-log previews, and slug fallbacks.

### Fixed

- Fixed the portal provider filters so Azure leases show their own filter badge and provider icon. Thanks @stainlu.
- Fixed Azure broker SSH security rules so repeated primary/fallback SSH ports are de-duplicated before writing network security group rules.
- Fixed `crabbox run` transport chatter by keeping SSH multiplexers alive longer, retrying fallback SSH ports for streaming commands, and batching stdout/stderr preview events into larger coordinator chunks. Thanks @vincentkoc.
- Fixed macOS WebVNC cursor visibility by enabling noVNC's dot-cursor fallback when Screen Sharing sends a transparent or zero-sized cursor.
- Fixed managed AWS macOS bootstrap so VNC password generation does not abort under `pipefail` before Screen Sharing readiness is installed.
- Fixed WebVNC daemon start-by-slug so coordinator-backed leases use the resolved target OS in the background bridge command.
- Fixed coordinator-backed `crabbox list` so a stale admin token no longer blocks normal logged-in users; the CLI now falls back to active user-visible leases instead of failing with `401 unauthorized`.
- Fixed desktop, screenshot, VNC, and WebVNC SSH helpers so they retry live fallback ports when a coordinator lease advertises an SSH port that is not ready yet.

### Fixed

- Fixed stale Code, WebVNC, and egress bridge clients so expired or missing leases stop polling/restarting after terminal coordinator responses. Thanks @vincentkoc.

### Fixed

- Fixed Blacksmith Testbox shell command rendering so multiline `--shell` payloads with trailing blank whitespace do not produce a spurious shell syntax failure after the remote command succeeds.

## 0.7.0 - 2026-05-07

### Added

- Added mediated egress commands and browser wiring so Linux desktop leases can proxy selected app traffic through the operator machine via the coordinator bridge.
- Added WebVNC portal clipboard controls for sending local clipboard text into the remote session and copying remote clipboard text back to the local browser.
- Added lease sharing for individual users or the owning org, including `crabbox share`, `crabbox unshare`, API access checks, and a portal share control on lease detail pages.

### Fixed

- Fixed `egress start --coordinator` so live public-route egress starts work when the local default coordinator is Cloudflare Access-protected.
- Fixed Tailscale exit-node bootstrap paths to prefer tailnet metadata and fail clearly when remote exit-node egress is not active.
- Fixed `run --no-sync` timing summaries so they report `sync_skipped=true`.
- Fixed native Windows command output so first-use PowerShell progress records do not leak CLIXML into run logs.
- Fixed Islo provider sync so `crabbox run --provider islo` uploads the local workspace, uses the correct `/workspace/<workdir>`, and falls back to chunked exec upload while the archive API returns server errors.
- Fixed Code and WebVNC bridge websocket auth so upgraded brokers receive short-lived bridge tickets in the `Authorization` header instead of logging them in URL query strings, while preserving query fallback for older brokers.
- Fixed managed AWS macOS desktop leases so readiness and WebVNC use a writable `ec2-user` work root, call `crabbox-ready` by absolute path, and read the generated Screen Sharing password via sudo.

## 0.6.0 - 2026-05-07

### Added

- Added `provider: daytona` for Daytona sandbox leases using Daytona's SDK/toolbox for sync and command execution, with short-lived SSH access available through `crabbox ssh`.
- Added Daytona CLI profile auth fallback so `daytona login --api-key ...` can satisfy Crabbox Daytona auth without duplicating `DAYTONA_API_KEY`.
- Added `provider: islo` for delegated Islo sandbox runs using the Islo Go SDK.
- Added a provider backend registry and authoring guide so delegated and SSH-backed providers can live in provider-owned packages while core keeps command parsing, rendering, and capability validation.
- Added `--tailscale-exit-node` and `--tailscale-exit-node-allow-lan-access` so managed Linux leases can route egress through an approved tailnet exit node.
- Added broker capacity hints for AWS leases, including selected market, attempted regions, quota/capacity advice, and configurable high-pressure class warnings.
- Added `crabbox code` and per-lease `/code/` portal URLs for authenticated code-server access on `--code` Linux leases.
- Added per-lease portal detail pages with bridge status, access-panel copy commands, recent run links, and a stop action.
- Added portal run detail pages with command metadata, result summaries, dense viewport-fitted portal tables, provider/OS badges, active/ended/provider/target filters, sticky portal chrome, and copyable retained log previews.
- Added latest lease telemetry snapshots for coordinator-backed Linux leases, including load, memory, disk, and uptime in `status --json` and the portal detail view.
- Added bounded lease telemetry history with portal sparklines and stale/high-resource badges on lease detail pages.
- Added run-level telemetry summaries with start/end Linux resource snapshots in run history JSON, human history output, and portal run tables/details.
- Added live run telemetry samples for longer Linux commands, including bounded coordinator storage and portal load/memory/disk trend lines on run detail pages.
- Added portal visibility for external Blacksmith Testbox runners synced from `crabbox list --provider blacksmith-testbox`, with owner-scoped runner rows, stale markers, GitHub Actions links, status badges, stuck filters, detail pages, and copyable local stop commands.
- Added admin portal visibility for non-owned runner leases, including `mine`/`system` filters and matching detail/code/VNC drilldowns for operator sessions.
- Added `crabbox desktop launch --webvnc --open` to launch a desktop browser/app and immediately bridge the same lease into the WebVNC portal.
- Added `crabbox webvnc --daemon`/`--background` plus `--status`/`--stop` for background WebVNC bridges without tmux.
- Added `crabbox media preview` for creating motion-trimmed GIF previews and optional trimmed MP4 clips from desktop recordings.
- Documented the prebaked runner image boundary: provider-owned AMIs/snapshots hold machine capabilities while repo/runtime caches stay in QA workflows or warm leases.

### Changed

- Changed AWS capacity fallback to route configured `CRABBOX_CAPACITY_REGIONS` across both brokered and direct AWS launches, with the deployed coordinator defaulting to a wider multi-region pool for better headroom.
- Changed coordinator lease requests to omit the default capacity block, preserving mixed-version broker compatibility while still sending explicit market, strategy, fallback, multi-region, availability-zone, or hint opt-out settings.
- Changed coordinator-backed CLI lease output to print broker capacity hints when AWS routing, quota, Spot fallback, or configured high-pressure classes are involved.
- Changed the portal lease table to merge external Blacksmith Testbox runners into the main grid as muted, disabled rows instead of rendering a separate external-runners table.
- Refactored built-in provider backend implementations into `internal/providers/<name>` packages while keeping command orchestration and rendering core-owned.

### Fixed

- Fixed Daytona SDK sync so tar creation and Daytona toolbox upload stream from disk instead of buffering large archives in memory.
- Fixed Daytona resource override handling so snapshot-only sandboxes reject generic `--class` and `--type` flags instead of accepting no-op compute settings.
- Fixed Islo delegated runs so shell-mode commands preserve raw shell strings and truncated exec streams fail instead of silently reporting success.
- Fixed provider-owned flags and target/capability validation to run through registered provider specs while preserving script-facing list JSON compatibility for coordinator and Blacksmith backends.
- Fixed Blacksmith Testbox queued/outage failures so users see the upstream queue state and practical fallback guidance instead of an opaque timeout.
- Fixed Blacksmith Testbox repo inference for mirrored repositories and portal runner sync for stale or external Testbox rows.
- Fixed managed Linux desktop/browser leases to preinstall video capture and native addon build helpers, avoiding per-scenario apt installs in browser QA runs.
- Fixed managed Linux desktop leases to use a slim XFCE session instead of bare Openbox, preserving a real panel/window-manager desktop while avoiding the full XFCE meta package.
- Fixed SSH readiness progress logs to distinguish open TCP ports, failed SSH authentication, and failed Crabbox ready checks.
- Fixed auto-shell command reconstruction so arguments with spaces stay quoted when shell operators such as `&&` are present.
- Fixed managed Linux bootstrap ordering so SSH is reachable before slow desktop/browser package setup while readiness still waits for the full desktop/browser contract.
- Fixed managed desktop/browser warmups so slow cloud-init bootstraps get a longer readiness window, retry once after SSH timeout, and clean up failed leases instead of leaking unusable VMs.
- Fixed brokered cloud server names so friendly-slug collisions with stale provider VMs do not block new leases.
- Fixed human WebVNC desktop launches to keep browser windows windowed by default and reserve fullscreen for explicit capture/video workflows.
- Fixed WebVNC portal status text and bridge commands so waiting/reset states explain the exact local bridge command to run.
- Fixed the Code portal waiting state so it shows bridge status, copy/reload controls, and automatically opens the workspace once the local bridge connects.
- Fixed `crabbox webvnc --stop` so daemon shutdown terminates the active child bridge, not only the supervisor.
- Fixed portal command rows so their copy affordance copies the matching local command instead of only labelling the section.
- Fixed portal Windows target badges to show compact `win` and `win (wsl2)` labels instead of `windows / normal`.
- Fixed portal access and time columns to use compact capability icons, relative time labels, and sortable time metadata instead of wide action buttons and Zulu timestamps.
- Fixed lease detail layout so local commands live inside the access panel instead of forcing a separate full-width commands section above recent runs.
- Fixed portal run detail layout density, responsive action alignment, and run telemetry readability so long-lived run pages fit operator viewports cleanly.
- Fixed generated docs-site navigation so the sidebar scroll position is preserved while moving between pages.
- Fixed Windows WebVNC credential handling so generated portal links preserve special characters and managed TightVNC sessions copy service passwords into the logged-in user's registry profile.
- Fixed managed Linux browser setup so Chrome/Chromium launches skip first-run and default-browser prompts.
- Fixed managed Linux browser cloud-init setup so Chrome/Chromium policy and wrapper generation cannot break YAML parsing.
- Fixed WebVNC portal passwords with escaped special characters and kept the bridge alive across viewer resets and transient coordinator EOFs.

## 0.5.1 - 2026-05-05

### Added

- Added `.crabboxignore` for repo-local sync-only exclude patterns shared by `run` and `sync-plan`.
- Added WebVNC portal controls for reconnect, fullscreen, and clipboard-ready bridge commands.

### Fixed

- Fixed managed AWS Windows WSL2 bootstrap by using the current Ubuntu WSL rootfs URL, downloading large rootfs files through `curl.exe`, and retrying empty or partial rootfs downloads instead of reusing a poisoned tarball. Thanks @vincentkoc.
- Fixed AWS Windows WSL2 mode overrides so they refresh the default instance type to a nested-virtualization-capable family. Thanks @steipete.
- Fixed AWS Windows WSL2 runs so mode overrides also refresh the default work root to `/work/crabbox` while keeping WSL2 sync on the fast rsync path.
- Fixed remote git seeding so an unfetchable local commit cannot leave an empty `.git` worktree that makes sync sanity report every tracked file as deleted.
- Skipped remote git seeding for local commits that are not present in any remote-tracking ref, avoiding slow doomed clone/fetch attempts before rsync.
- Fixed WebVNC bridge reconnects so reloading or reconnecting the browser no longer requires restarting the local bridge.
- Fixed Windows archive sync from macOS so Apple extended attributes do not spam remote tar warnings.
- Fixed the Homebrew formula test command so GoReleaser emits the expected formula syntax.

## 0.5.0 - 2026-05-04

### Added

- Added `--desktop`, `--browser`, and `crabbox vnc` for optional Linux UI/browser leases, including loopback-only VNC with per-lease passwords and headless browser support without a desktop.
- Added authenticated WebVNC portal support with `crabbox webvnc`, which bridges a desktop lease into the coordinator portal with short-lived bridge tickets and without exposing the remote VNC port.
- Added managed AWS Windows desktop leases with OpenSSH, Git for Windows, loopback TightVNC, per-lease VNC passwords, and `crabbox vnc`.
- Added managed AWS Windows WSL2 support for Linux command execution inside brokered Windows leases.
- Added AWS macOS desktop lease plumbing for EC2 Mac Dedicated Hosts, including Screen Sharing setup and per-lease credentials.
- Added `crabbox vnc --open` to start the SSH tunnel and launch the local VNC client for managed desktop leases.
- Added `crabbox desktop launch` to open a browser or app inside a visible desktop lease, including native Windows scheduled-task launch for the logged-in console session.
- Added `crabbox screenshot` to save a PNG from a desktop lease without opening a VNC client.
- Added optional Tailscale reachability for managed Linux leases with `--tailscale`, `--network auto|tailscale|public`, brokered OAuth auth-key minting, and non-secret tailnet metadata in status/inspect output.
- Added static macOS/Windows VNC endpoint discovery, including SSH-tunneled loopback VNC and trusted static direct VNC on `host:5900`.
- Added generated Windows console login details and auto-logon for managed AWS Windows desktop leases.
- Added a minimal XFCE desktop profile with panel/window manager for managed VNC leases.
- Added generated command help for grouped commands so `crabbox actions --help`, `crabbox cache --help`, `crabbox desktop --help`, and similar entrypoints exit cleanly.

### Changed

- Clarified static macOS/Windows VNC as existing-host access, not Crabbox-created boxes, so `--open` no longer launches an OS credential prompt unless `--host-managed` is passed.
- Switched top-level CLI routing to Kong while preserving existing per-command flags, passthrough remote commands, aliases, and exit-code behavior.

### Fixed

- Fixed WebVNC portal login redirects by canonicalizing broker origins before starting the browser login flow.
- Fixed AWS desktop provisioning and Windows SSH bootstrap issues that could leave managed desktop leases unreachable.
- Fixed passthrough command help such as `crabbox run --help` so it prints local usage instead of provisioning a remote lease.
- Fixed `crabbox desktop launch --browser` on freshly warmed desktop leases by creating the remote workdir before launching the app.
- Fixed failed Blacksmith Testbox warmups so printed, newly listed, or delayed `tbx_...` boxes are stopped instead of being left queued after an upstream workflow error.
- Fixed `crabbox run --junit` so all-passing JUnit files record results instead of leaving the coordinator run stuck when the failure list is empty.
- Fixed native Windows `--shell` runs so multi-statement PowerShell scripts keep their quotes instead of being re-parsed by a nested PowerShell process.
- Removed the static macOS managed-login path so static host VNC cannot be mistaken for a Crabbox-created external instance.
- Excluded macOS AppleDouble `._*` sidecar files from default sync manifests so native Windows archives do not transfer invalid TypeScript/package sidecars.
- Quoted `crabbox vnc` tunnel key paths so macOS `Application Support` lease keys can be pasted directly into a shell.
- Skipped Linux-only GitHub Actions hydration stop markers on native Windows static targets.
- Fixed brokered Tailscale requests on coordinators without OAuth secrets so they fail as disabled instead of entering the auth-key minting path.
- Fixed Worker deploy smoke to prefer the Crabbox-scoped Cloudflare token when it is present in the environment or local profile.

## 0.4.0 - 2026-05-03

### Added

- Added static SSH macOS and Windows targets with `--target macos|windows`, `--windows-mode normal|wsl2`, and config/env support for reusable hosts.

### Changed

- Brokered Hetzner and AWS leases now reject non-Linux targets clearly; use `provider: ssh` for macOS or Windows hosts.

### Fixed

- Made Blacksmith live smoke explicit opt-in so the default live smoke works in repositories without a Testbox workflow.

## 0.3.1 - 2026-05-03

### Added

- Added `actions.fields` config support so repository-specific workflow inputs are sent on every Actions hydration, with CLI `-f key=value` overrides. Thanks @vincentkoc.
- Added a command-doc drift check to `npm run docs:check` so every top-level CLI command has a matching command page and index entry. Thanks @stainlu.

### Fixed

- Deferred run-history creation against legacy coordinators until a lease is known, avoiding noisy `invalid_lease_id` failures before command execution. Thanks @vincentkoc.
- Suppressed repeated run-event append warnings when a legacy coordinator does not support the newer run-event path. Thanks @vincentkoc.
- Fixed recorded run logs so long noisy commands are stored in bounded chunks instead of losing the failure evidence between the first output events and the final tail.
- Forced SSH to use Crabbox's per-lease identity file so local SSH-agent keys cannot exhaust server auth attempts before the runner key is tried.

## 0.3.0 - 2026-05-02

Crabbox 0.3.0 makes brokered runs much easier to observe and debug, adds
trusted AWS image lifecycle commands, improves AWS and Blacksmith reliability,
and tightens coordinator auth boundaries.

### Added

- Added early durable run session handles and append-only run events, plus `crabbox events <run-id>` for inspecting the coordinator event log.
- Added `crabbox attach <run-id>` for following recorded events from active runs, plus `--after` and `--limit` pagination for `crabbox events`. Thanks @stainlu.
- Added `--timing-json` for `warmup`, `actions hydrate`, and `run` so provider comparisons can read stable sync, command, total, exit-code, and Actions run timing from one JSON record.
- Added `--market spot|on-demand` to `warmup` and `run` so AWS capacity market choice no longer requires environment-only overrides.
- Added `crabbox image create --id <cbx_id> --name <ami-name> [--wait]` for trusted operators to create AWS AMIs from active brokered AWS leases.
- Added `crabbox image promote <ami-id>` for trusted operators to promote an available AMI as the coordinator default for future brokered AWS leases.
- Added JSON output and wait polling for image creation, including `--wait-timeout` and `--no-reboot` controls.
- Added best-effort AWS vCPU quota preflight for brokered launch fallback, with concise quota-code attempt metadata when a requested instance type cannot fit the applied quota.
- Added Blacksmith Testbox timing JSON output that reports delegated sync in the same schema as AWS and Hetzner runs.
- Added coordinator-orphan hints to human `crabbox list` output when provider machines carry no active coordinator lease.
- Added the Access-protected coordinator route `https://broker-access.example.com` for service-token proof and hardened automation.
- Added Cloudflare Access service-token headers for coordinator CLI requests. Thanks @stainlu.
- Added optional GitHub team allowlisting for browser-login tokens with `CRABBOX_GITHUB_ALLOWED_TEAMS`. Thanks @stainlu.
- Added separate coordinator admin-token auth so shared operator tokens no longer grant admin routes.
- Added Cloudflare Access JWT verification before Access identity can affect bearer-token ownership.
- Added coordinator image routes for admin-token callers: `POST /v1/images`, `GET /v1/images/{ami-id}`, and `POST /v1/images/{ami-id}/promote`.
- Added AWS provider support for `CreateImage` and `DescribeImages`, with Crabbox-owned AMI tags.
- Added `docs/commands/image.md` and linked the image command from the CLI docs, command index, docs site, and source map.
- Added `npm run docs:check` with internal Markdown link validation plus docs-site generation, and wired it into CI.
- Added `scripts/live-smoke.sh` for opt-in AWS, Hetzner, and Blacksmith Testbox live smoke coverage from a real repository checkout.
- Added `scripts/live-auth-smoke.sh` for opt-in live proof that shared tokens cannot call admin routes, admin tokens can, Access edge auth works, and raw Access identity headers are ignored.
- Added `scripts/deploy-worker-smoke.sh` to run the Worker gate, deploy the coordinator, verify public health routes, and optionally include a short AWS lease smoke.

### Changed

- Hydrated runs now skip the expensive Git base-ref hydration fetch when the remote base is already current enough for the local base SHA.
- Brokered AWS class requests now fall back through provider candidates, account-policy launch rejections, and a small burstable fallback instead of failing on the first Free Tier-ineligible high-core type.
- Brokered AWS fallback now skips known quota-impossible candidates before calling `RunInstances`, while preserving explicit `--type` failure semantics.
- Brokered lease records now keep the requested AWS instance type plus concise provisioning-attempt metadata when fallback chooses a different type.
- Coordinator run history now records the resolved lease provider/class/type when a lease exists, avoiding stale requested-type entries after fallback.
- Brokered AWS lease creation now uses the promoted AWS image when no explicit `awsAMI` or `CRABBOX_AWS_AMI` override is supplied.
- Moved the deployed coordinator route to the OpenClaw Cloudflare account at `https://broker.example.com` and scoped default broker org/auth settings to `openclaw`.
- User config writes now force `0600` permissions, and `crabbox doctor` reports overly broad config permissions.
- Image route validation now rejects noncanonical lease IDs, invalid AMI IDs, invalid AMI names, non-AWS leases, and promotion attempts before an image reaches `available`.

### Fixed

- Recorded durable `run.failed` events reliably for coordinator-backed pre-command failures such as lease claim, bootstrap, sync, and remote workdir errors.
- Fixed retained run-log tails under concurrent stdout/stderr writes so `crabbox logs` does not drop lines while run events are being recorded.
- Included the GitHub Actions hydration run URL in `crabbox run --timing-json` output when an Actions-hydrated workspace marker carries a run ID.
- Preserved explicit AWS `--type` requests as exact instance-type requests; Crabbox now fails clearly instead of silently falling back when the user asked for a specific type.
- Fixed AWS On-Demand launches by omitting Spot request tag specifications when no Spot request is created.
- Fixed Blacksmith Testbox JSON list output so the CLI returns an empty array when Blacksmith reports no active testboxes.
- Fixed brokered AWS security-group creation by sending EC2's required `GroupDescription` parameter, restoring first-run AWS provisioning in fresh accounts.
- Fixed coordinator warmup waits to keep touching the lease during slow bootstrap so short idle timeouts do not release a box while the foreground CLI is still waiting.
- Fixed SSH known-host handling for macOS config paths containing spaces, restoring per-lease known-host isolation under `Library/Application Support`.
- Scoped SSH ControlMaster sockets by per-lease key path so fast IP reuse across ephemeral machines cannot inherit a stale control connection.
- Fixed `crabbox list --provider blacksmith-testbox --json` to return parsed JSON instead of rejecting the shared `--json` flag.
- Prevented caller-supplied Access identity headers from overriding signed GitHub user token identity. Thanks @stainlu.
- Canceled SSH bootstrap waits when the coordinator lease disappears or becomes inactive, and made wait progress include elapsed and remaining time.
- Warned before running JavaScript package-manager commands on an unhydrated raw box when the repo declares an Actions hydration workflow.
- Fixed the generated docs-site mobile menu icon so the hamburger bars remain visible on narrow iOS/Safari viewports.
- Fixed responsive padding on the generated docs-site frontpage body content.
- Documented self-hosted GitHub OAuth setup so external coordinator deployments can avoid `Invalid redirect_uri` login failures.

## 0.2.0 - 2026-05-01

Crabbox 0.2.0 hardens the brokered runner path after real AWS and Blacksmith Testbox use: browser login is safer, AWS SSH ingress is no longer world-open by default, SSH readiness waits for the Crabbox bootstrap marker, and fallback SSH ports are configurable instead of being hidden port-22 magic.

### Added

- Added GitHub browser login for `crabbox login`, including signed user tokens, polling-based CLI completion, `--no-browser`, and JSON output support.
- Added coordinator OAuth routes for GitHub login: `/v1/auth/github/start`, `/v1/auth/github/callback`, and `/v1/auth/github/poll`.
- Added signed non-admin user-token auth in the Worker while keeping the shared operator token for admin routes.
- Added GitHub org membership enforcement before minting browser-login tokens.
- Added the canonical coordinator endpoint configured for OAuth callback generation.
- Added Blacksmith Testbox workflow flags for `crabbox warmup` and `crabbox run`, enabling one-command Testbox runs without repo YAML or environment variables.
- Added configurable SSH fallback ports via `ssh.fallbackPorts` and `CRABBOX_SSH_FALLBACK_PORTS`.

### Changed

- Updated CLI defaults, docs, examples, and auth guidance to prefer `https://broker.example.com`.
- Clarified that Cloudflare Access OAuth and Crabbox CLI OAuth are separate GitHub OAuth apps with separate callback URLs.
- Scoped normal GitHub-login users to their own leases, run history, logs, and usage; shared-token admin auth remains required for pool and fleet-wide operator views.
- AWS coordinator-created security groups now allow SSH only from configured CIDRs, the CLI-detected outbound IPv4 CIDR, or the request source IP instead of adding world-open SSH ingress.
- Direct AWS security groups now honor the configured AWS SSH source CIDRs when creating managed SSH ingress.
- Direct and brokered AWS now open the same configured SSH port candidates that the CLI will try.

### Fixed

- Cleaned up Blacksmith Testbox local lease claims and per-lease SSH keys after failed warmups, explicit stops, and one-shot runs.
- Fixed `status` and `inspect` readiness reporting so active leases with a host are not marked ready until SSH and `crabbox-ready` actually respond.
- Fixed remote sync sanity failures to include the remote deletion count and sample paths instead of hiding the useful stderr behind `exit status 66`.
- Restricted Worker admin routes to shared-token admin auth so GitHub browser-login users cannot call admin endpoints.
- Fixed `whoami` reporting for GitHub browser-login tokens.
- Fixed exact `cbx_...` lookups bypassing owner-scoped slug authorization checks.
- Added cleanup and a pending-login cap for unauthenticated GitHub OAuth login starts.

## 0.1.0 - 2026-05-01

Crabbox 0.1.0 is the first public release: a Go CLI, Cloudflare Worker coordinator, and OpenClaw plugin for leasing fast remote Linux machines, syncing dirty worktrees, running commands, and releasing or reusing warm boxes safely.

### Highlights

- Lease remote Linux test boxes from the CLI, sync the current checkout, run a command over SSH, stream output locally, and return the remote exit code.
- Use stable canonical lease IDs such as `cbx_...` for APIs, scripts, paths, SSH keys, provider labels, and compatibility.
- Use friendly crustacean slugs such as `blue-lobster`, `swift-hermit`, and `amber-krill` anywhere a lease ID is accepted.
- Keep warm boxes ergonomic without runaway cost: kept leases auto-release after an idle timeout, defaulting to `30m`, while `--ttl` remains a maximum wall-clock cap.
- Hydrate a leased box through a project-owned GitHub Actions workflow so repositories define their own runtimes, services, secrets, caches, and readiness.
- Keep runner bootstrap intentionally tiny: SSH, Git, rsync, curl, jq, `/work/crabbox`, and cache directories only. Go, Node, pnpm, Docker, databases, and services belong to the repo setup layer.
- Drive Crabbox from OpenClaw through native plugin tools for run, warmup, status, list, and stop.
- Install via Homebrew with `brew install openclaw/tap/crabbox`, or download GoReleaser archives for macOS, Linux, and Windows.

### CLI

- Added `crabbox run` for one-shot remote command execution with automatic acquire, sync, heartbeat, command streaming, result collection, and release.
- Added `crabbox warmup` for reusable kept leases.
- Added `crabbox status`, `inspect`, `list`, `ssh`, `stop`, and compatibility aliases `release`, `pool list`, and `machine cleanup`.
- Added `crabbox cleanup` for direct-provider cleanup of expired machines.
- Added `crabbox init` to generate `.crabbox.yaml`, `.github/workflows/crabbox.yml`, and `.agents/skills/crabbox/SKILL.md`.
- Added `crabbox doctor`, `config`, `login`, `logout`, and `whoami` for local setup, broker auth, and identity checks.
- Added `crabbox admin leases`, `admin release`, and `admin delete` for trusted operator control of coordinator leases.
- Added `crabbox usage` for estimated runtime and cost reporting by user, org, fleet, or JSON output.
- Added `crabbox history` and `logs` for coordinator-recorded runs and retained log tails.
- Added `crabbox results` plus `run --junit` for JUnit summaries.
- Added `crabbox cache stats`, `cache warm`, and `cache purge`.
- Added `crabbox sync-plan` to inspect sync candidates, largest files, and largest directories without leasing a machine.
- Added `--json` output on inspection/status/history-style commands where machines or runs need scriptable output.

### Leases

- Added canonical immutable lease IDs with per-lease SSH keys under the Crabbox config directory.
- Added deterministic crustacean-style slug generation with collision suffixes when needed.
- Added slug-aware lookup for active leases while preserving exact `cbx_...` lookup precedence.
- Added provider-visible names and runner labels based on slugs while retaining canonical lease labels for cleanup.
- Added owner-scoped slug allocation in the coordinator and collision-safe slug allocation in direct-provider mode.
- Added `lastTouchedAt`, `idleTimeoutSeconds`, and recomputed `expiresAt` metadata.
- Added heartbeat/touch behavior for active operations, including `run`, `ssh`, cache commands, Actions hydration, and `status --wait`.
- Kept plain `status` read-only so status polling does not extend a lease forever.
- Added local claim files under the Crabbox state directory so reused leases stay associated with the repository that acquired them.
- Added `--reclaim` for intentionally moving a local lease claim between repositories.

### Coordinator

- Added a Cloudflare Worker API backed by a Fleet Durable Object for serialized lease state.
- Added brokered Hetzner and AWS provisioning so normal clients do not need provider API credentials.
- Added Durable Object alarms for lease expiry and cleanup.
- Added bearer-token coordinator auth for automation and local users.
- Added create, get, heartbeat/touch, release, admin lease, usage, run history, run log, and health endpoints.
- Added coordinator-owned slug allocation, idle expiry math, TTL caps, and provider metadata storage.
- Added cost guardrails for active leases and monthly reserved spend.
- Added provider-backed pricing from AWS Spot price history and Hetzner server-type prices, with static fallback rates.
- Added bounded HTTP dial/TLS timeouts and local `curl` fallback for coordinator transport failures.

### Providers

- Added Hetzner provisioning with SSH key import/reuse, class fallback, labels, server deletion, and direct debug mode.
- Added AWS EC2 Spot provisioning with signed EC2 Query API calls in the Worker, SSH key-pair import/reuse, security-group setup, Spot instance launch, tag propagation, and direct debug mode.
- Added AWS class fallback across broad C/M/R instance families.
- Added AWS direct-mode Spot placement score support across configured regions.
- Added provider labels/tags for canonical lease ID, slug, state, keep flag, created/touched/expiry timestamps, idle timeout, TTL, class, profile, and provider key.
- Added Hetzner-safe label encoding using Unix seconds and compact duration seconds.
- Added per-lease provider SSH key/key-pair cleanup when machines are deleted.

### Sync And Execution

- Added Git-backed sync manifests so Crabbox transfers tracked files plus nonignored untracked files instead of the full local tree.
- Added default sync excludes for `.git`, dependency folders, build caches, and other local-only directories.
- Added rsync checksum/delete options, sync timeouts, quiet-rsync heartbeats, and no-change fingerprint skips.
- Added sync preflight estimates and large-sync guardrails for file count and byte size.
- Added remote sanity checks for mass tracked deletions.
- Added remote Git seeding and shallow base-ref hydration for changed-test workflows.
- Stored sync metadata under `.git/crabbox` when the remote directory is a Git worktree, keeping the working tree clean.
- Added remote workdir creation for `--no-sync` runs.
- Added concise sync and command timing summaries for warmup, run, and Actions hydration.
- Added per-lease `known_hosts` files to avoid host-key conflicts when cloud providers reuse ephemeral IPs.

### GitHub Actions

- Added `crabbox actions register` to register leased machines as ephemeral GitHub Actions runners.
- Added `crabbox actions dispatch` to dispatch repository workflows.
- Added `crabbox actions hydrate` to register, dispatch, wait for readiness, and capture the hydrated workspace.
- Added workflow-dispatch input inspection so Crabbox skips optional inputs that older workflow refs do not declare.
- Added hydrated workspace detection so later `crabbox run --id <slug>` syncs into `$GITHUB_WORKSPACE`.
- Added non-secret environment handoff from the hydration workflow to later Crabbox commands.
- Added stop-marker writing so `crabbox stop` can ask the waiting Actions job to exit cleanly.
- Runner labels include `crabbox`, canonical lease labels, readable slug labels, and profile/class labels.

### OpenClaw Plugin

- Added a native OpenClaw plugin package at the repository root.
- Added `crabbox_run`, `crabbox_warmup`, `crabbox_status`, `crabbox_list`, and `crabbox_stop` tools.
- Added plugin tests that verify command construction and disabled-tool behavior.

### Results, Cache, And History

- Added JUnit XML parsing and summaries for remote test result files.
- Added stored result summaries in coordinator run history.
- Added bounded run-log tails so history remains useful without storing unbounded output.
- Added cache stats, warm, and purge helpers for pnpm, npm, Docker, and Git cache directories.
- Cache commands honor configured cache-kind toggles.

### Configuration And Docs

- Added YAML config loading from user config plus repo-local `crabbox.yaml` or `.crabbox.yaml`.
- Added environment overrides for coordinator, provider, class, server type, AWS, Hetzner, lease durations, sync behavior, Actions, results, cache, and env allowlists.
- Added scoped `lease.ttl` and `lease.idleTimeout` config.
- Removed pre-release JSON config compatibility before shipping.
- Added workflow-first top-level help with common flows, grouped commands, config pointers, environment variables, and aliases.
- Added command documentation under `docs/commands/`.
- Added feature docs for coordinator, providers, sync, lifecycle cleanup, Actions hydration, cache, test results, SSH keys, cost usage, auth/admin, and runner bootstrap.
- Added architecture, how-it-works, operations, performance, infrastructure, troubleshooting, security, CLI, orchestrator, and MVP docs.
- Added a dependency-free GitHub Pages docs builder and Pages deployment workflow.

### Release And CI

- Added GoReleaser configuration for macOS, Linux, and Windows archives.
- Added Homebrew tap publishing configuration for `openclaw/homebrew-tap`.
- Added release workflow hardening that skips Homebrew tap publication when the tap token is missing or invalid instead of failing after publishing release assets.
- Added CI for Go formatting, `go vet`, race tests, build, Worker formatting/lint/typecheck/tests/build, and snapshot release checks.
- Added strict local Go toolchain selection with `toolchain go1.26.2`, `GOTOOLCHAIN=local` in CI, and readonly trimmed builds.
- Added a Go core coverage gate enforcing at least `85%`; current coverage is above that threshold.
- Updated Worker dependencies to current Cloudflare Workers types, Wrangler, and TypeScript.
- Updated GitHub Pages actions to current major versions.

### Fixed

- Touch-only coordinator heartbeats no longer overwrite an existing lease idle timeout unless explicitly requested.
- Direct-provider slugs are collision-checked against active machines before provisioning.
- Direct-provider expiry is capped by the shorter of idle timeout and TTL.
- Direct-provider reuse refreshes `last_touched_at`, `expires_at`, and idle timeout labels.
- Slug lookup no longer lets malformed noncanonical `lease` labels shadow real slug labels.
- Direct Hetzner labels no longer contain invalid timestamp or duration characters.
- Coordinator slug and idle metadata are stored and returned through public lease routes.
- `crabbox-ready` now waits for a Crabbox bootstrap marker and writable work root so base-image tools cannot make machines look ready too early.
- Config-writing commands honor `CRABBOX_CONFIG`, keeping isolated login/logout tests out of the normal user config.
- Boolean flags for `logs` and admin lease actions work after positional IDs, such as `crabbox logs run_... --json`.
- `actions hydrate` retries without optional `crabbox_job` when an older workflow ref rejects the input.
- `cache warm` uses the hydrated GitHub Actions workspace and env handoff when a lease was prepared by `actions hydrate`.
- `doctor` accepts per-lease SSH keys as the default posture and validates explicit `CRABBOX_SSH_KEY` only when set.
- Local per-lease SSH keys move with coordinator-renamed lease IDs.
- Stored test-result summaries are bounded before run history persistence.