v0.2.1

fix: instance .env is owner-only — it holds forwarded provider API keys

renderEnv forwards every provider key present in the caller's shell into
the instance's .env, but the file was written with the default umask, so
on a normal macOS setup live API keys sat at 0644. Found a stale, never-used
instance still holding a readable Google key.

.env is now written 0600 and the instance state directory (including its
config/ child, which one recursive mkdirSync covers) 0700. load() runs on
essentially every command, so it also heals instances created by older
versions — guarded, because a foreign-owned or read-only .env must not take
down a plain `list`.

Verified live: a fresh create lands 0700/0700/0600 with a key really in the
file, and both pre-existing instances went 0644 -> 0600 on the next command.

Closes #3

v0.2.0

feat: --publish maps extra loopback-only host ports into the instance

An agent could start a dev server inside a sandbox but nothing except the
MCP bridge (and optionally --api-port/--web) reached the host, so the
operator could not open what the agent built. `create --publish` repeats
and takes docker's -p order: bare `5173` reuses the number on the host,
`18090:8090` remaps when the host port is taken.

Host ports are checked against the instance's own MCP/web/api ports and
against the machine before anything is written, so a bad flag leaves no
half-created instance. Pairs persist in .env as PUBLISH=host:container,...
and render as literal 127.0.0.1 entries on the opencode service — compose
cannot expand one variable into a list, so API_PORT keeps its ${} form and
--publish does not.

Closes #2

v0.1.2

feat: credential-free work extraction — fetch-url and export

- fetch-url <name>: prints a git fetch line that pulls a branch out of
  the instance over docker exec stdio (ext transport); no credentials
  ever enter the container — the host reviews, then pushes itself
- export <name> <dir>: copy /workspace to a host directory (inverse of
  --seed, reads the volume directly so it works while stopped); refuses
  a non-empty destination

v0.1.1

fix seed hygiene and container HOME; add --api-port and worktree-seed…

v0.1.0

v0.1.0 — first release

create/list/url/destroy over per-instance compose projects built from
ghcr.io/hsb3/opencode/{backend,web,mcp}. Verified end to end: two instances side
by side, seeded workspace read through the MCP bridge, destroy removing exactly
its own volumes.