v0.2.4

Added

• Repo-local .machine.toml config: bare machine up can infer a project from
  the current directory, use the repo's origin remote when repos is omitted,
  and make bare ssh/claude/down/destroy/secrets target that local VM.
• machine create [name]: an interactive wizard that writes a project entry
  to projects.toml (repos, profiles, shell, agent forwarding) or edits an
  existing one — prompts default to the entry's current values, and comments
  elsewhere in the file are preserved. machine up <new-name> and a bare
  machine up (when no default VM or entry exists yet) launch the wizard
  first, then continue into provisioning; machine up default keeps the
  zero-config scratch-VM behavior. Unknown names no longer get the bare
  "create a base VM? [y/N]" prompt.
• Per-project forward_agent = false in projects.toml: the generated Lima
  template overrides ssh.forwardAgent, so the VM gets no channel to the host
  SSH agent — pair it with a per-repo deploy key for the strictest setup.
  machine up warns (instead of failing) when the clone needs that deploy
  key, and the agent self-heal step skips such VMs.

Changed

• README, SECURITY.md, and the docs site now describe what agent forwarding
  actually grants: the VM never reads private keys, but while a forwarded
  connection is open it can sign and authenticate with every key the agent
  holds — any repo the key authorizes, not just the project's. A new
  "Restricting the forwarded agent" section covers per-use approval
  (1Password), confirmation-gated keys (ssh-add -c), and deploy keys.

Removed

• machine tab (the macOS new-tab helper). It drove Terminal.app via
  AppleScript and did not work reliably.

Fixed

• machine ssh and machine claude now rebuild a stale Lima SSH master that
  forwards an empty agent, so 1Password-backed commit signing works once the
  agent is available.
• The host-side ssh-add -l agent probe is now time-boxed (5s). A wedged or
  locked 1Password SSH agent accepts the socket connection but never answers,
  which previously hung machine ssh/machine claude indefinitely at the
  self-heal step; the timeout now counts as "no keys" so the command proceeds.

v0.2.3

Fixed

• machine ssh lands in the project's configured login shell again. The SSH
  ControlMaster opened during machine up provisioning stayed pinned to the
  pre-chsh shell (the golden image bakes zsh before base.sh sets the
  project's shell), so sessions reused the wrong shell. machine up now
  closes the master after provisioning.
• Provisioned zsh config adds ~/.local/bin and ~/bin to PATH. zsh does
  not read ~/.profile, where bash/sh get those entries, so tools installed
  there (e.g. claude) were not found under default_shell = "zsh".

v0.2.2

Added

• modern opt-in profile: bat, delta, fzf, lazygit, helix — opt in per
  project; rg remains in the base VM.
• CI smoke workflow: boots a real Lima VM (qemu/KVM on a Linux runner) on
  push to main and nightly; runs the full in-VM smoke suite.

Fixed

• machine down is idempotent when the VM is already stopped.

v0.2.1

What's Changed

• Zero-config default VM by @katspaugh in #3
• Add Nix flake by @katspaugh in #4
• Auto-detect the SSH agent — drop MACHINE_USE_1PASSWORD by @katspaugh in #5
• Robustness fixes: deps-install warnings, guest workdir, secrets reachability by @katspaugh in #6

Full Changelog: v0.2.0...v0.2.1

v0.2.0

What's Changed

• Lima-native architecture: delete the GUI, replace the provisioning DSL with Lima templates by @katspaugh in #2

Full Changelog: v0.1.6...v0.2.0

v0.1.6

Full Changelog: v0.1.5...v0.1.6

v0.1.2

Full Changelog: v0.1.1...v0.1.2

v0.1.1

What's Changed

• CLI polish: wrapped provisioning output and richer ps by @katspaugh in #1

New Contributors

• @katspaugh made their first contribution in #1

Full Changelog: v0.1.0...v0.1.1