CLI v1.75.2

Bug Fixes

• Certificate serials Caddy can always read
• Forge gets its own scoped token instead of the twg one

Bug Fixes

• List-components --json shows a template's repos and ports

Features

• List-components tells team files from personal ones

Features

• List workbench templates in the normal output
• Monoceros-docs as a curated MCP connector

Testing

• The failing stand-in reads its input before it exits

Features

• Monoceros create-version
• Monoceros create-template

  Bug Fixes

  • Leave the team's workflow to the team
  • --help says the description goes in quotes
  • Create-template refuses a description without quotes

  Features

  • Mark local entries, list templates, add --copy
  • Keep your own MCP servers in templates/mcp-servers
  • Versioned service descriptors, merged on upgrade

  Bug Fixes

  • A template file that is not here never stops apply
  • A version file that does not fit is left out, not a stop
  • An older version stays readable without its current file

  Features

  • Show which service image loads and how far it is

  Features

  • Gradle, Maven and npm caches survive apply

  Bug Fixes

  • Follow an app log from its first line

  Features

  • Name an outdated runtime the way the CLI names its update

  Bug Fixes

  • A private GHCR image is pulled with the git token

  Features

  • The agent knows the memory and CPU limits

  Features

  • Memory and CPU limits per workbench container

  Features

  • Builders keep their own service descriptors

  Bug Fixes

  • Seed and ask for the credentials of MCP servers a template carries
  • The custom-image scaffold shows connectionEnv

  Testing

  • Give the suite an empty MONOCEROS_HOME of its own

  Features

  • Dev users in their own file, so production gets the realm without them

  Bug Fixes

  • One name per container on the machine-wide proxy network

  Bug Fixes

  • Name docker's reason when the compose up fails

  Features

  • SQL Server as a curated service

  Features

  • The global env template holds only what every workbench needs
  • The global env template names the Bitbucket repo token

  Documentation

  • Name MONOCEROS_HOST_PORT where comments still said routing.hostPort

  Features

  • Machine-wide settings live in the global env, the global yml is gone
  • The install script migrates the global yml, the CLI does it at start

  Bug Fixes

  • Ask only for values a switched-on tool reads and nobody set yet

  Documentation

  • 0061 names the commands that run the migration

  Features

  • Headless Chromium plus the Playwright MCP server

  Bug Fixes

  • Reconcile retries a target that exits too early
  • The workspace root is a working directory wherever Claude starts

  Features

  • Apps come back after a container restart

  Bug Fixes

  • One status line, compose's own lines only on a failure

  Features

  • Read the design before planning and build from a fresh copy
  • Default each role to a model and an effort level
  • Each credential question says whether its value is already set
  • --down removes the containers and keeps everything else

  Bug Fixes

  • Say why Docker Compose or Buildx does not work, before the build
  • Bash on macOS loads the completion, and bash 3.2 runs it clean
  • Find Rancher Desktop's plugins, and print commands that paste
  • Stop --service completes the workbench's own services
  • A reused pid no longer passes for a running app

  Testing

  • Give the pwsh run room for a cold start

  Features

  • Three more, on both sides of the line

  Bug Fixes

  • A service from a template gets its credentials too

  Chores

  • 1.60.0

  Bug Fixes

  • One question block, and no clone into someone else's container

  Features

  • Start from a template, and ask for what only the builder knows

  Features

  • The planner decides, the implementer records the ADR

  Features

  • The published catalog carries the setup, not just the options

  Features

  • An env scaffold, because only the Caddyfile knows the keys

  Bug Fixes

  • The category is called features

  Features

  • The tools are current when you get the shell

  Testing

  • Keep the first-apply service pull out of the unit tests

  Bug Fixes

  • One warning, about the thing the yml declares

  Features

  • The yml says which agent plugins a workbench has
  • Apply refreshes a marketplace it did not just clone

  Bug Fixes

  • A failed plugin install says why, and a missing token is caught first
  • A workbench with plugins and no repos can authenticate its clone
  • The marketplace urls survive normalizeOptions
  • Plugin update needs plugin@marketplace, and the warning must not claim absence

  Refactor

  • Every warning block leaves through the same door

  Bug Fixes

  • A service-image fix reaches a workbench that already exists

  Bug Fixes

  • The update notice names the installer the builder can run

  Bug Fixes

  • A proxy in a pipeline is published, and healthy when it answers

  Bug Fixes

  • The agent gets the addresses it was promised, and the deploy variables

  Features

  • Caddy as a curated service, for one origin per workbench
  • The workbench's HTTP services go to the phone too
  • An exposed service gets an address, not a foreground command

  Features

  • The CLI wins over an MCP server that could do the same

  Bug Fixes

  • Twg agrees to the consent up front, because stdin is no longer read
  • The failure tail shows the cause, not BuildKit's frame

  Bug Fixes

  • Its build output is ignored container-wide, not per repo
  • The skills survive a session that is not in auto mode

  Bug Fixes

  • The graph becomes the first stop, enforced by a hook

  Bug Fixes

  • One role set per workbench, and removing it removes its files

  Features

  • Graphify, so the agent can ask the code instead of grepping

  Chores

  • The package points at the site, not at its own README

  Features

  • Pasting an image reaches the host clipboard too

  Bug Fixes

  • Seven command descriptions stop promising a diff

  Features

  • A server that signs in with OAuth is prepared for, and check stops calling it broken

  Bug Fixes

  • An npm-installing feature waits for the pinned Node
  • The piped output carries the description it promised

  Refactor

  • The yml header names the connector and links its page
  • Every catalog entry names itself and links its page

  Features

  • MCP servers are catalog components, named in the yml with one line

  Bug Fixes

  • Rovo Dev gets its own scoped token, and a bad one no longer strands the apply

  Bug Fixes

  • A > inside a quoted argument is not a redirect

  Features

  • Phase 0 asks what the user wants, not how it is built

  Bug Fixes

  • Apply refuses a model or effort it knows is wrong
  • Each role's model and effort sit together in the yml

  Features

  • Each role gets its own effort level

  Bug Fixes

  • An acceptance command that cannot fail is worse than none

  Features

  • The same plan/implement/review split for Claude Code

  Bug Fixes

  • The guard stops denying stderr redirects

  Features

  • --in offers to create a directory that is not there yet

  Features

  • The language servers actually report something

  Features

  • The theme and the language servers come from the yml

  Bug Fixes

  • A one-off command keeps its output in Ghostty

  Documentation

  • The git identity comes from declared sources only

  Bug Fixes

  • The container identity follows its source, in both directions

  Bug Fixes

  • The identity message names both env files

  Bug Fixes

  • The identity comes from the env, with no yml entry required

  Bug Fixes

  • Every container gets an identity, and check says when it does not

  Features

  • A slug is enough, plans live per app
  • Three entry points, whoever is called leads

  Bug Fixes

  • The conflict hint names the container
  • The planner was locked out of its own plans directory
  • Persist the XDG state dir, not just config and data
  • The roles answer in the user's language
  • The implementer leaves the app running and names the next step
  • The plan carries the user's language
  • The plan carries the user's language, the planner hands over
  • The reviewer produces evidence, the language arrives first
  • The planner may write its own plan
  • The plan command names the plans dir absolutely

  Features

  • Ship the plan/implement/review split as a component
  • Phase 0, the planner grills before it writes

  Bug Fixes

  • Allow the briefing files apply points the agent at
  • The external-directory rule follows the mount
  • Logs follows a terminal, dumps into a pipe

  Bug Fixes

  • Restore the terminal when a session dies with its container

  Features

  • Say why a shell-started server costs the agent minutes

  Bug Fixes

  • Add-port joins a portless container to the proxy network
  • Read back a backup that carries root-owned files

  Testing

  • Stop piping stdin into a paste-mode relay call

  Features

  • A launch target that cannot start, before you start it
  • A copy inside the container lands on your clipboard

  Bug Fixes

  • A session ending no longer strands the bridge daemon

  Features

  • Catch a target that cannot start, and teach readyTimeout in the example

  Features

  • Toolchain caches survive apply, and a slow server can name its window

  Features

  • Three more rules, and status marks what cannot answer

  Bug Fixes

  • Mark an app target the yml does not expose, and print no URL for it

  Bug Fixes

  • Stop crying wolf on the pnpm store and on own variable names

  Features

  • Rules first, long chapters as imports
  • Monoceros check catches an ignored briefing

  Features

  • Pipeline compose blocks in the catalog, service data in volumes

  Bug Fixes

  • Deliver gh/glab tokens via containerEnv so they survive non-login SSH shells

  Features

  • Env-based auth, Bitbucket via twg, per-provider token strategy (ADR 0035)

  Bug Fixes

  • Add read:user to the documented PAT scopes
  • Persist shell history across apply

  Refactor

  • Drop vestigial --yes/confirm plumbing; ports stop claiming a rebuild

  Bug Fixes

  • --forward-ports to coexist with IDE port auto-forwarding

  Build & CI

  • Ship catalog.json in the npm package for the docs MCP

  Bug Fixes

  • Array-wrap pwsh token lists so dynamic completion works

  Features

  • Self-contained PowerShell completer, no per-Tab WSL call

  Bug Fixes

  • Reflect real launch defaults and volume paths
  • Stop a blank .env value from masking monoceros-config.env

  Documentation

  • Point install links at installer/ and document the managed Windows path

  Bug Fixes

  • Move the Ctrl+C hint to a closing line

  Bug Fixes

  • Group the LAN banner by target with a single glyph

  Bug Fixes

  • Advertise the Windows LAN IP on WSL so LAN devices connect

  Bug Fixes

  • Keep monoceros-proxy alive for stopped port-containers

  Bug Fixes

  • Surface devcontainer-up failures instead of exiting mute

  Bug Fixes

  • Survive private-repo clone failure and Docker cold-start on WSL

  Bug Fixes

  • Run in-container monoceros-ctl as node, not root

  Documentation

  • Hand the realm volume to the agent as a copy-ready yaml block

  Bug Fixes

  • Drop consola's per-line timestamp so output icons stay aligned
  • Sweep the fixed-name container on image to compose switch

  Bug Fixes

  • Clear root-owned files with rm -rf, not busybox find -delete

  Chores

  • Bump to 1.38.10 to republish the remove fix

  Bug Fixes

  • Advertise the real Windows LAN IP on WSL, guide mirrored mode

  Bug Fixes

  • Print the full banner before starting the terminator

  Bug Fixes

  • Silence Caddy, pull before the banner, Windows-facing CA path

  Bug Fixes

  • Drop internal ADR refs from user-facing command descriptions

  Bug Fixes

  • Render a service's descriptor briefing into AGENTS.md

  Bug Fixes

  • Accept targets key (canonical) alongside configurations

  Bug Fixes

  • Accept positional ports/packages for remove-port + remove-apt-packages

  Bug Fixes

  • Accept positional ports/packages for add-port + add-apt-packages

  Bug Fixes

  • Per-machine CA name + always brief the launch config

  Features

  • Serve HTTPS over the LAN via a machine-local CA

  Bug Fixes

  • Ship twg workspaceEnv via CLI so container auth actually reaches the shell

  Bug Fixes

  • Blank defaults.git.user block no longer forces an identity prompt

  Bug Fixes

  • Blank container git.user placeholders no longer force an identity prompt

  Bug Fixes

  • Don't prompt for git identity when every repo self-identifies

  Chores

  • Finish the root -> installer/ move

  Features

  • Slim the monoceros-config.env template, deeplink the token guide

  Bug Fixes

  • CLAUDE.md tells Claude to read AGENTS.md, not a bare import (#37)

  Features

  • Resolve repo tokens for provider features without a repo (#33)
  • Plainer wording for the repo/CLI token log line

  Bug Fixes

  • Log "CLI token" for repo-less provider features, not "Repo token"
  • Actually persist the ambiguous-token pick to .env

  Features

  • Drop the modify diff/confirm prompt; add-repo warns like apply

  Features

  • Scope apply-failure output to the failing phase, red header

  Bug Fixes

  • Seed monoceros-config.env so token setup is discoverable

  Features

  • Global monoceros-config.env layer under per-container env (#33)
  • Resolve repo PAT from env into git-credentials (#33)
  • PAT setup hints + gate fast-path to GitHub/GitLab (#33)
  • Auto-add gh/glab CLI feature authed from the repo PAT (#33)
  • Seed monoceros-config.env from a documented template (#33)
  • Init always writes a lean yml, no catalog dump
  • Note unauthenticated gh/glab at apply (Option B, #33)
  • Account-labeled tokens + repo-driven token selection (#33)
  • Add-repo/init add the provider CLI feature to the yml (#33)
  • Apply resolves repo provider tokens from the global env (#33)
  • Convention-based repo token resolution, drop host keychain (#33)
  • Missing repo token is non-fatal, warn prominently at end (#33)
  • Make the unauthenticated-repos warning stand out (#33)

  Bug Fixes

  • GitHub PAT hint + template require read:org scope (#33)
  • No silent unauthenticated CLI; warn on keychain-only clone (#33)
  • Self-hosted login hint uses --hostname (#33)
  • Don't claim auth for self-hosted GitHub Enterprise Server (#33)
  • Accurate apply note for self-hosted GH Enterprise with a token (#33)

  Refactor

  • Remove dead documented-mode generator

  Other

  • Roll back #33 token/feature implementation to rebuild per ADR 0031

  Bug Fixes

  • Open browser via PowerShell Start-Process, not cmd start

  Bug Fixes

  • Open the host browser via interop under WSL

  Bug Fixes

  • Back up root-owned container files via docker on EACCES

  Bug Fixes

  • Pre-create missing host dirs for non-data service volumes (#31)

  Bug Fixes

  • Restyle occupied-:80 pre-flight messages

  Chores

  • Release 1.36.5

  Bug Fixes

  • Classify occupied :80 holder + carry hostPort into briefing URLs (#30)

  Bug Fixes

  • Stop/status/logs include deferred services (keycloak)

  Features

  • Monoceros share — expose an app's ports to the LAN

  Bug Fixes

  • WSL ssh port out of Hyper-V reserved range + lowercase compose project name

  Bug Fixes

  • Shell completion for the status <app|service> positional

  Features

  • Restore running apps across apply (#23) + stack-overview status

  Features

  • Start an app's default set together, in order (#24)

  Bug Fixes

  • Refresh the briefing after a hot-reload modify (add/remove-port, add-repo)
  • Clean status line for container start/stop instead of raw devcontainer output

  Features

  • Per-app launch config + monoceros-ctl for long-running app servers (#13)

  Bug Fixes

  • Bridge daemon inherits the parent loader (execArgv)

  Features

  • Scaffold @monoceros/cli with citty subcommand stubs
  • Implement monoceros create
  • Implement monoceros shell
  • Implement monoceros run
  • Implement start/stop/status/logs as docker compose passthroughs
  • Implement monoceros add-language / add-service with diff preview
  • Switch default template to monoceros-runtime:dev
  • Auto-install Claude Code VS Code extension; add Stage D test plan
  • Add monoceros down
  • Wire @monoceros/plugin into generated solutions
  • Claude wrapper auto-loads plugin from bind-mount
  • Load monoceros plugin via Claude Code's marketplace, drop binary wrapper
  • Scaffold projects/ folder and .code-workspace at create time
  • Add monoceros apply to rebuild the devcontainer after add-*
  • Add monoceros add-apt-packages for arbitrary apt installs
  • Add monoceros add-feature for arbitrary devcontainer features
  • Add monoceros add-from-url for HTTPS curl-bash installers
  • Add monoceros add-repo for idempotent git clones into projects/
  • Auto-forward host SSH-agent for add-repo solutions
  • Fetch host git credentials per apply for HTTPS repos
  • Capture host git identity (with prompt fallback) per create/apply
  • Add yml solution-config schema and round-trip I/O
  • Add initial yml templates (bare, nodejs-github, python)
  • Add `monoceros init `
  • Add yml-driven apply [] flow
  • Route bare apply through state.json origin
  • Route add-* through yml when state.json is present
  • Add remove-* command family
  • Migrate legacy stack.json solutions on first apply
  • Add monoceros-config.yml + retire monoceros create
  • Introduce claude-code as a devcontainer feature
  • Per-container home state model + atlassian feature + Claude API key
  • Catalog reader + merge with OR-semantics on booleans
  • Replace templates/yml with components + --with composition
  • Add list-components command + docs for the new init flow
  • More languages + clean up documented-init layout
  • Bind-mount compose service data on /data/
  • Add monoceros remove and drop down
  • Mask secrets in apply/run/compose output streams
  • Support <lang>:<version> syntax for language components
  • Add monoceros restore <backup-path>
  • Add PR-CI workflow (typecheck, test, lint, format)
  • Add release-runtime workflow + switch BASE_IMAGE to GHCR
  • Publish-ready CLI + release-cli workflow + install scripts
  • Grouped help output + shell completion for bash/zsh
  • Auto-install shell completion + flush-left help groups
  • Show ~-prefixed full paths in lifecycle output
  • Bundle feature manifests with the npm package
  • Render manifest descriptions + usageNotes as inline hints
  • Add usageNotes to claude-code, atlassian, github-cli
  • Structured output with section markers + feature pre-announce
  • Sectioned, coloured output
  • Accept defaults=null so the shipped template is one block
  • HTTPS-only repos with provider-aware pre-flight checks
  • Render full repos block with commented hint lines per entry
  • Transparently sg-reexec when docker group isn't loaded yet
  • Refuse rootless Docker at install + apply with clear hint
  • Add-port / remove-port as yml-only mutations
  • Traefik singleton + network membership
  • Dynamic-config writer + hot-reload from add-port/apply
  • Pre-flight host-port check with actionable error
  • Monoceros port — list a container's Traefik URLs
  • --default flag for promoting a port to position 0
  • --with-ports flag to pre-seed routing.ports at init
  • Merge .code-workspace on apply, don't overwrite
  • Persist apply-prompt identity to global / container / both
  • Prompt for git identity when --with-repo is used
  • On-the-fly clone when the container is running
  • Builder-facing format overhaul + robust round-trip writers
  • Accept catalog short-names instead of forcing the full OCI ref
  • Context-aware flag + value autocomplete via __complete subcommand
  • Manifest-driven option key + boolean value autocomplete for add-feature
  • Accept catalog short-names; error messages echo the user-typed form
  • Emit the same manifest-driven header block init does
  • Add monoceros tunnel for TCP forwarding via foreground socat sidecar
  • Generic service config model with per-service env + secrets
  • Clone repos host-side before compose up + honest reachability errors
  • Explicit per-category --with-* flags, drop the magic --with
  • Scaffold a gitignored .env stub with an info header
  • Interpolate ${VAR} in feature options too, not just services
  • ${VAR} placeholders for credential options + .env seeding
  • : form for an explicit in-container port
  • Curated services render ${VAR} env + seed .env defaults + ship healthcheck
  • Resolve git.user from .env with cascade + scaffold placeholders
  • Uniform alignment + spacing in COMMANDS, hide completion/__complete
  • Mirror apply output to per-container log file (ADR 0013 step 1)
  • Phase spinner, --verbose escape hatch, summary block (ADR 0013 step 2)
  • Clean SIGINT teardown — clear spinner, close log, exit 130
  • Render credential options as active ${VAR} placeholders
  • Write AGENTS.md / CLAUDE.md / commands.md at apply (M6.3, ADR 0014)
  • Wrap CLAUDE.md in monoceros markers; refine M6.3 closeout
  • IDE-state persistence, .code-workspace enrichment, runtime image pinning + upgrade (#1)
  • MONOCEROS_FEATURES_DIR_OVERRIDE so e2e tests branch feature source
  • Add --in flag to run a command in a sub-directory
  • Monoceros login — host-side browser OAuth for in-container tools
  • Connection env for curated services + detached-serve guidance
  • Host-browser bridge for interactive runs (terminal-agnostic)
  • Pre-approve Claude's trust + external-import prompts per cwd
  • Default permission mode via yml option, written at apply
  • Machine-global state — last-upgrade timestamp + built-image registry
  • Tool-freshness model — refresh, prune, staleness nudge (ADR 0018)
  • Default permission mode = Auto Mode (not bypass)
  • Print a summary (tools / base / pruned / recorded)
  • Relay repeated browser-opens + tell the agent it can open the app
  • Default Maven + Gradle for java; add component-taxonomy ADR
  • Unified component descriptor schema + loader (ADR 0020, phase 1)
  • Devcontainer-feature.json generator + feature descriptors (ADR 0020, phase 2)
  • Port language + service descriptors with parity tests (ADR 0020, phase 3a)
  • Presets + selector name, descriptor->selectable expansion (ADR 0020, phase 3b-i)
  • Bundle descriptors + move list-components onto them (ADR 0020, phase 3b-ii)
  • Source LANGUAGE/SERVICE catalogs + init catalog from descriptors (ADR 0020, phase 3 complete)
  • Surface language options in the yml, object form (ADR 0020, decision 4)
  • Always surface the version inline (name:defaultVersion)
  • The flip - generate manifests from descriptors, delete old sources (ADR 0020, phase 4)
  • Descriptor-driven connection env (no hardcoded service names)
  • Add OpenCode feature with declarative model/provider config
  • Pre-approve workspace briefing dirs for external_directory
  • Allow writes under projects/ via external_directory
  • Add GitLab CLI (glab) feature
  • Per-instance connection env for multiple databases (ADR 0021)
  • Add pgvector, mongodb, rustfs, mailpit to the catalog
  • Install DB client CLIs into the workspace (ADR 0020)
  • Mongosh client for mongodb via npm (completes client wave)
  • Give rustfs an awscli client (apt)
  • Per-container SSH attach config for apply/remove (ADR 0022)
  • Persist VS Codium IDE state too (ADR 0022 Schicht 4)
  • Add monoceros open <name> <tool> + apply --open (ADR 0022)
  • Add --open to start, like apply (ADR 0022)
  • Image-mode lifecycle for start/stop/status (ADR 0022)
  • Deterministic workspace container name + richer image status
  • Persist JetBrains IDE state, shared backend (ADR 0022)
  • Windows/WSL bridge for the SSH IDE attach (ADR 0022)
  • Open finds the Windows editor under WSL without PATH (ADR 0022)
  • Atlassian Forge sub-tool + feature workspace env (ADR 0023)
  • Add-feature merges sub-tool selectors additively (ADR 0024)
  • List-components --json + committed catalog.json for the skill
  • Deferred service start (second wave) for cloned-file services
  • Keycloak service (deferred-start realm import) + service command field
  • Commented volumes scaffold for curated services (Keycloak mount)
  • Recommend language + feature extensions in the .code-workspace
  • Self-update notice — check npm for a newer version on every command
  • Make Claude usable via the desktop "Connect to SSH host" attach (#17)
  • Windows direct-port attach + stable host keys (#17)
  • Restart the running dev-container group after a Docker restart (#22)

  Bug Fixes

  • Align compose project name with @devcontainers/cli and fix postgres 18 volume
  • Route monoceros start through devcontainer up
  • Silence the implicit up step in monoceros run/shell
  • Preprocess argv so inner --help/--version no longer hit citty
  • Apply uses label-based container removal, not docker compose down
  • Apply cleanup uses name+label removal, detects VS Code race
  • Pipe install URLs to sh, not bash <(…)
  • Regenerate post-create.sh on apply, not just on add-*
  • Honor INIT_CWD so pnpm cli finds the user's true cwd
  • Pin image-mode workspaceMount/workspaceFolder
  • Copy local Monoceros features into .devcontainer/features/
  • Persist individual home files + Rovo Dev TUI state
  • Seed persistent home files with feature-supplied content
  • Catch truncated --with lists + sync docs with new languages
  • Stitch shell-split --with tokens back together via rawArgs
  • Help shows positionals before [OPTIONS] for every command
  • --no-backup now actually skips the backup
  • Interactive option for shell/run so bash gets a real TTY
  • Set expectations before the first-apply image pull
  • Dim the first-apply info line so it reads as ambient context
  • Seed ~/.monoceros/ with monoceros-config.sample.yml
  • Require bash explicitly, document curl prerequisite
  • Ship monoceros-config.yml directly, drop the rename ritual
  • Also filter by devcontainer.local_folder label
  • Recover from partial-apply remnants instead of refusing
  • Emit idmap on bind-mounts when host docker is rootless
  • Use idmap=true form instead of bare idmap flag
  • Linux GitHub hint now points to brew, not docs URL
  • Skip git identity prompt when no repos / no git config
  • Rootless-refusal message — describe the actual failure mode
  • Polish the rootless→rootful switch instructions
  • Plumb ports + vscodeAutoForwardPorts through normalizeOptions
  • Pre-flight must query docker even without a DockerExec override
  • Substitute in routing block + emit vscodeAutoForward hint
  • Pre-flight probe must connect, not bind (Linux EACCES)
  • Strip workbench-internal docs/ADR refs from builder-facing output
  • Pin workspaceMount + workspaceFolder in image-mode
  • Set credential.helper inline for the on-the-fly clone
  • Re-prompt when persisted-only and no global defaults
  • String-insert git.user instead of yaml AST mutation
  • Uncomment-in-place when the commented git block already exists
  • Surface flags via Tab once cursor sits past all positionals
  • No trailing space after value-flags so --with-ports=3000 works directly
  • No trailing space after add-feature -- key either; install.sh wires zsh menu-completion
  • Relocate leaked section comments in mutate() so EVERY add-/remove- preserves yml layout
  • Also strip the per-feature header comment from the previous sequence-item's trailing comment
  • Drop unused portNumber import that tripped CI's max-warnings=0
  • Clean up root-owned bind-mount data via a throw-away alpine container
  • ASCII-only user-facing strings so PS 5.1 conhost doesn't render ?
  • Rework Docker hints — per-user winget, prose+command layout, no doc refs
  • Simpler Node hints, 'fresh PowerShell' for re-run
  • Strip npm's monoceros.ps1 shim so PS picks .cmd
  • Clean up containers on Windows (label case + MSYS path conv + tr noise)
  • Drop bash from docker cleanup pipeline so Windows works
  • Silence expected 'network not found' on image-mode remove
  • Kick Traefik on dynamic-config writes for Windows (inotify-on-bind-mount)
  • Normalize drive letter on remaining devcontainer.local_folder filters
  • Approve credentials after fill so GCM persists them across applies
  • Show the Homebrew bootstrap command in brew-based provider hints
  • Show build/start phases in compose mode (spinner was stuck on 'cleaning…')
  • Emit per-feature home binds in prod (read manifests from CLI bundle)
  • Surface run's --in flag (and don't leak it past --)
  • Suppress Docker Desktop CLI hints in spawned commands
  • Use claude auth login, stop parallel TTY writes
  • Tell the agent to build under projects/, not the workspace root
  • Recover from the VirtioFS "bind source path does not exist" race
  • Global upgrade refreshes only running containers
  • Format sync-components.mjs so precheck format:check passes
  • Surface object form + inline version, matching init (ADR 0020)
  • Tell Claude Code to register self-scaffolded projects in .code-workspace
  • One workspace-folder per top-level projects/ dir, not per sub-project
  • Also pre-allow the workspace file and logs/ for external_directory
  • Wire the browser bridge into monoceros shell
  • Restore connection env via catalog lookup (1.25.0 regression)
  • Serialise connectionEnv so renamed instances get their env
  • Run rustfs as root so it can write its bind-mounted /data
  • Trust host rm, not busybox find's exit code, for root-owned cleanup
  • Start sshd via postStartCommand, not the entrypoint
  • Share only the JetBrains backend dist, not session state
  • Re-apply no longer warns on the read-only Windows SSH key (ADR 0022)
  • Quiet the deferred-service image pull in the second wave
  • Hold deferred services back with a compose profile, not runServices
  • Route deferred second-wave output to the log, not the screen
  • Run the deferred second wave as a spinner phase before "container ready"
  • Complete run --in with workspace directories (#14)
  • Gate the Windows direct-port block on runtime >= 1.3.4 (#17)
  • Start the Windows ssh-bridge forwarder (sudo-stripped env) + stop stale browser auto-open (#17)
  • Write the direct-port block (not ProxyCommand) in the unix config.d on WSL (#17)
  • Start sshd from the entrypoint so it survives a docker restart / reboot (#20)
  • Drop the default restart policy so the whole compose group stays down after a Docker restart (#19)
  • Give monoceros-proxy a restart policy so it survives a Docker restart (#21)

  Refactor

  • Introduce MONOCEROS_HOME, separate from workbench root
  • Apply takes only , no cwd, no path
  • Add-/remove- take as first positional
  • Lifecycle commands take as positional
  • Use canonical OCI refs in yml, redirect to local in dev
  • Switch namespace to getmonoceros + add migration hint
  • Routing block — ports + vscodeAutoForward + hostPort
  • Trim the .env stub to one line and the success output
  • Derive DEFAULT_RUNTIME_VERSION from images/runtime/VERSION (single source)
  • Retire monoceros login; generalize the browser bridge
  • Drop the externalServices feature

  Documentation

  • Add Stage E for M2 pipeline + fix plugin wiring
  • Command reference for add-apt-packages + add-feature, plus index
  • Add reference.yml as exhaustive schema example
  • Replace real name+email with Your Name / you@example.com
  • Anonymize the ghcr.io/kamann/ namespace placeholder
  • Explain why dev DB passwords aren't masked
  • Install scripts are the only documented install path
  • Flesh out monoceros-config.sample.yml with every option
  • Uncomment git:/features: category markers in sample
  • Replace stale --with= references with the per-category --with-* flags
  • Remove docs/commands, point command reference to the website
  • List gitea in the add-repo --provider help

  Testing

  • Cover the .claude.json initial-content seed
  • Stub containerLookupDocker on baseOpts to keep runAddRepo tests off the host docker daemon
  • Stub proxyDocker so maybeStopProxy doesn't hit real CI docker
  • Make prod-path home-bind test independent of manifests:sync

  Build & CI

  • Inject CLI_VERSION from package.json at build time

  Chores

  • Bump CLI to 0.1.0-dev and rework local test workflow
  • Bump to 1.0.1
  • Bump to 1.5.1 — ship the all-commented monoceros-config.yml
  • Bump to 1.6.0 — HTTPS-only repos, provider model, two-stage pre-flight
  • Bump to 1.9.0
  • Clear four warnings that were tripping the precheck pipeline
  • Bump to 1.10.0
  • Bump to 1.11.0
  • Rip out Windows-host-specific code, bump to 1.12.0
  • Bump to 1.16.1 (compose-mode apply progress phases)
  • Release 1.26.2 (connectionEnv per renamed service instance)
  • Release 1.26.3 (rustfs runs as root; connectionEnv per instance)
  • Release 1.26.4 (remove: robust root-owned data cleanup on Linux)
  • Release 1.26.5 (drop externalServices)
  • Release 1.27.0 (SSH IDE attach + open command, ADR 0022)
  • Release 1.28.0 (JetBrains IDE-state persistence, ADR 0022)
  • Release 1.29.0 (Windows/WSL SSH bridge, ADR 0022)
  • Release 1.29.1 (open finds Windows editor under WSL)
  • Release 1.29.2 (re-apply no longer warns on the Windows SSH key)
  • Release 1.30.0 (Atlassian Forge + feature workspaceEnv, add-feature additive merge)
  • Release 1.31.0
  • Release 1.31.1
  • Relicense from MIT to Apache-2.0

  Other

  • Drop the idmap mount option — Docker doesn't support it
  • 1.7.0 — M5 Task 2 (port-management via Traefik)
  • Smoother first-run (execution policy, WSL backend, pull hint)
  • Drop host-side repo clone + reachability probe (ADR 0012)
  • Drop the 1.23.1 external_directory pre-approval