v0.47.0

0.47.0 (2026-07-31)

Features

• contracts: execute every rule the contracts package states, and gate it (83bb319)
• release: assert the console and the api are the same build (91c2ca8)

Bug Fixes

• auth: close four request-boundary gaps (1a7b381)
• boot-smoke: a completed WebSocket upgrade no longer fails the probe (afc3169)
• ci: make the path filter fail open instead of silently skipping gates (689049c)
• cors: admit the header the console now sends, from one declaration (5564b85)
• release: a rehearsal must not move latest either (dc4ba44)
• release: a rehearsal must not move latest either (32c97b4)
• release: a rehearsal must not move production, and must bake an identity (d5d0259)
• release: a rehearsal must not move production, and must bake an identity (9869f2d)
• release: the console deploy was publishing to a project it invented (7c0057a)
• release: the console job had no pnpm, so the build could never have run (48de455)
• release: the console job had no pnpm, so the build could never have run (828bdfd)
• test: make the SIGTERM stop barrier a barrier (0c3cbae)
• web: move the Vercel build command into the repo and off the package name (fcd45c4)

v0.46.1

0.46.1 (2026-07-27)

Bug Fixes

• api: require complete BoxLite terminal environments (#180) (891f53e)
• boxlite: retry failed runtime preflight probes (#180) (f2f5951)

Operational Notes

• Managed sandbox environments validated under a pre-v3 contract are marked stale and must be revalidated after upgrading.
• The BoxLite host daemon remains operator-supplied; this release does not change stock BoxLite 0.9.7 host file-size-limit behavior.

v0.46.0

0.46.0 (2026-07-26)

Features

• terminal: restore native live terminal attachments (#178) (68c0907)

v0.45.3

0.45.3 (2026-07-24)

Bug Fixes

• boxlite: resolve the daemon's nested extraction layout before part reassembly (#177) — BoxLite 0.9.5 extracts /files uploads into an extracted/ subdirectory, breaking cat-based part reassembly. The parts directory is now resolved in-box (both layouts). Full chunked-injection chain proven live against the real daemon with a byte-exact round trip.

v0.45.2

0.45.2 (2026-07-24)

Bug Fixes

• boxlite: wrap each archive part in a single-entry tar envelope (#176) — the BoxLite /files endpoint extracts the uploaded body at path, so v0.45.1's raw part slices were rejected with 400 failed to extract tar. Parts now travel as single-entry tar envelopes (proven live against the daemon); FakeBoxLiteClient models the extraction contract so tests cannot regress.

v0.45.1

0.45.1 (2026-07-24)

Bug Fixes

• boxlite: chunk archive injection under the daemon body limit and surface transfer progress (#175) (1d64a01)
• resolve verify findings for chunk-archive-injection-with-progress (#175) (1dbbfbe)

Upgrade notes

• BoxLite deployments: archive injection now transfers repo copies as body-limit-safe verified parts. Optional tuning: CAP_BOXLITE_ARCHIVE_PART_BYTES (default 1572864). Post-upgrade checklist in deploy/DEPLOY.md §13.
• Live transfer percent on the task page requires durable admission v2 (deploy/TASK_ADMISSION_V2_CUTOVER.md); legacy admission keeps the diagnostics timeline only.

v0.45.0

0.45.0 (2026-07-23)

Features

• acquire repo content copies at import time and inject them into sandboxes (#173) (7f885bb)

Bug Fixes

• wire repo deletion cascade and name the injection variant in diagnostics (#173) (06a1be4)
• release: create the attestation out dir before the atomic temp write (#174)

Upgrade notes

• New compose named volume repo-store mounted into the api at CAP_REPO_STORE_DIR (default /repo-store).
• Existing repos surface as copyStatus missing after upgrade — refresh each once via the Console before creating new tasks (running tasks are unaffected).
• Rollback channel: CAP_WORKSPACE_GIT_FALLBACK_ENABLED=true restores the legacy in-sandbox network clone.

v0.44.0

0.44.0 (2026-07-22)

Features

• release: generate task-model attestation in CI and apply it through both upgrade seams (#171) (55d2ebf)

v0.43.4

0.43.4 (2026-07-21)

Bug Fixes

• sandbox: relax the git low-speed abort window to 5 minutes (329b7cc)
• sandbox: relax the git low-speed abort window to 5 minutes (1fbd1cd)

v0.43.3

0.43.3 (2026-07-21)

Bug Fixes

• sandbox: transfer retry must wrap the detached dual-gate path, not only the inline exec (428052a)
• sandbox: transfer retry must wrap the detached dual-gate path, not only the inline exec (062284f)