v0.6.5

Fugaro v0.6.5

Install:

• Homebrew: brew install dimipaun/tap/fugaro
• Go: go install github.com/dimipaun/fugaro/cmd/fugaro@v0.6.5
• Or download an archive below and verify it against checksums.txt (see docs/release.md).

Highlights

• A repository can now use several named Claude accounts instead of one: you define accounts in your own local config (claude_accounts, never published), store each token with fugaro secrets set claude-oauth-token-<name>, and pick one per run with fugaro run --token NAME or per repository with agent.oauth_token in fugaro.yaml; each account gets its own job, fugaro ls and diagnose show which account a run used, and fugaro doctor checks that every allowed account has a stored token and that a repository's chosen account is allowed.
• When a run fails because its Claude account hit its usage limit, the plugin skills can now relaunch the work on another account the repository is allowed to use (fugaro accounts ls lists them; an explicit --token on a follow-up now switches the account, one account at most once per task, and the skill stops when all are tried). The exact usage-limit wording Claude Code prints has not been verified, so a missed match simply means no automatic switch.
• fugaro now tells you when you are behind the latest release: at most once a day it checks the latest stable GitHub release (in the background, never slowing or failing a command) and prints one line on stderr with the brew upgrade command, only on a terminal and never in CI or the runner; fugaro doctor always reports it as a warning, and FUGARO_NO_UPDATE_CHECK=1 or update_check: false in your local config turns the nag off.
• Named accounts are opt-in: a repository that configures none behaves exactly as before.

For operators

1. Upgrade every CLI and CI pin first (brew upgrade dimipaun/tap/fugaro), then run fugaro upgrade in each checkout to rebuild the job images: a named-account run is refused on a job image built before 0.6.5 (its runner would reject the new oauth_token field), and an older CLI refuses the new agent.oauth_token key in fugaro.yaml.
2. The secret-name prefix claude-oauth-token- is now reserved: a workflow secrets: entry in fugaro.yaml that uses it (other than through claude_accounts) is refused by this release (rename the secret and run fugaro secrets set again).
3. To adopt named accounts, add them to your local config's claude_accounts (with the repositories each may serve), store each token with fugaro secrets set claude-oauth-token-<name> in your own terminal, then run fugaro init per repository so each allowed account gets its own job; removing an account later plans deletes that need --allow-delete / --allow-job-delete.
4. Not yet verified against live infrastructure: minting a second account's token with claude setup-token and how Claude Code reports an expired or revoked token (docs/gcp-live-checklist.md, checks 33 and 35).

Changelog

• release: highlights for v0.6.5 (#298)
• release number: rename named-oauth-tokens release from 0.6.1 to 0.6.5 (#297)
• update warning: daily release check, one stderr line, doctor's cli-version, update_check switch (#296)
• named oauth tokens task 9b: usage-limit account switching (skills, accounts ls, follow-up --token override) (#295)
• named oauth tokens task 9: docs, the setup skill and the live-check additions (#294)
• named oauth tokens task 6: fugaro run --token, agent.oauth_token, follow-up inheritance, version gate (#293)
• named oauth tokens task 5: fugaro secrets set/ls and init know named Claude accounts (#292)
• named oauth tokens task 8: doctor checks that every named Claude account has a stored token (check 2 follows Task 6) (#291)
• named oauth tokens task 4: infra builds one job variant per allowed account (#290)
• named oauth tokens task 2: gcp.WorkflowVariant, the identity-for-default naming key (#287)
• named oauth tokens task 3: task.Spec.OAuthToken, its schema and validation (gate wired in Task 6) (#286)
• named oauth tokens task 7: fugaro ls/diagnose show which account a run used (#289)
• named oauth tokens task 1: config.ClaudeAccount, its validation and the local config field (#288)
• design: named OAuth tokens (multiple Claude accounts) and its plan (#241)

Base images

Published by the images workflow for this tag:

• ghcr.io/dimipaun/fugaro-web-node:0.6.5
• ghcr.io/dimipaun/fugaro-web-node:0 (moves to the highest release of the major)
• ghcr.io/dimipaun/fugaro-go:0.6.5 and ghcr.io/dimipaun/fugaro-go:0
• ghcr.io/dimipaun/fugaro-java-services:0.6.5 and ghcr.io/dimipaun/fugaro-java-services:0
• ghcr.io/dimipaun/fugaro-history:0.6.5 and ghcr.io/dimipaun/fugaro-history:0 (the sweeper and history job's image)

The images workflow then pulls each one with no login and fails if it is not public or lacks linux/amd64; each image's digest is in that run's summary.

The Terraform modules, the schemas and the plugin are versioned by this same tag.