v1.1.1

Corv v1.1.1

Corv v1.1.1 is a focused reliability update for long-running agent work. It
does not change the connection, vault, or retained-log formats used by v1.1.

• Detached command payloads are byte-count verified before launch, so an
  interrupted upload cannot execute a partial script.
• Persisted job identity uses a vault-keyed opaque fingerprint, so it detects
  credential changes without exposing an offline password verifier. Existing
  records migrate when their saved connection is next resolved, without
  discarding active runs.
• Command history distinguishes unfinished runs from completed commands whose
  real remote exit code is 75.
• Self-update syncs replacement binaries before installation and reports a
  failed rollback explicitly.

Recoverable detached work

• corv jobs lists active and recently retained run IDs with their last known
  state, without exposing host addresses or credentials.
• Old records that have not been observed recently are shown as unknown, not
  running. corv output <run-id> probes the remote state; if its files are
  gone, Corv reports run_expired without inventing an exit code or completion
  timestamp.
• corv output <run-id> returns a bounded recent-output snapshot while a run is
  active and finalizes the retained result when the remote process exits.
• Plain audit history includes run IDs, and corv log --json exposes the
  existing structured audit entries.

Safer retries

--run-key gives a mutating command a stable replay identity:

corv prod-api --json --run-key change-42 -- ./deploy.sh

Retrying the same key and command on the same saved connection reattaches to the
active run or returns its retained result. Completed replay records remain for
24 hours; runs without a known outcome retain their key. An expired key remains
reserved until the operator verifies the remote effect and chooses a new key.
Reusing the key with a different command or changed connection state returns
run_key_conflict and does not execute. Run keys must not contain secrets.

The guarantee is intentionally retention-bounded. Corv remains an SSH client,
not a permanent distributed transaction coordinator.

Replay records belong to one local Corv state directory and saved connection.
Two clients with separate state directories can each execute the same run key;
this is not fleet-wide deduplication. Retries must use the same client state.

Command history

corv log --clear erases the entire local audit log, including older entries.
Audit history has no automatic rotation or retention limit; the 24-hour
retention for saved run output does not apply to it.

Clearer local diagnostics

• Vault failures identify unavailable Windows user/profile context or Unix
  keychain access while preserving the underlying error for detailed diagnosis.
• corv doctor verifies that encrypted connection state and referenced stored
  credentials are readable. Default output remains privacy-safe; --full
  exposes local diagnostic detail only when requested.
• Diagnostics distinguish missing local state from state that exists but
  cannot be inspected, and broker inspection failures are no longer reported
  as healthy.
• corv output --json always includes error_kind; local, broker, metadata,
  and finalization failures use stable categories instead of requiring message
  parsing.

Recovery correctness

• A keyed result remains recoverable when completion is finalized through
  corv output or after a broker restart.
• Persisted job state retains nonzero remote exit codes.
• If terminal job state cannot be saved locally, Corv keeps the remote output
  and leaves finalization retryable, returning local_error instead of a
  durable success. Final state is recorded only after the retained log is
  durable, and remote files are removed only after both writes succeed.
• If a remote exit status exists but its log is missing, Corv preserves the
  known outcome and reports output_unavailable; it does not relabel the exit
  status as unknown.
• Active progress snapshots are byte-bounded and do not consume the saved
  output offset.
• Detached run duration is recorded at remote completion instead of being
  inflated by a later poll, while legacy run records remain readable.
• Remote cleanup ages new run records from completion, so a long silent task is
  not removed because its start time crossed the retention boundary.
• Structured output reports lossy: true if invalid UTF-8 bytes were replaced;
  reassuring counters such as 0 failed are excluded from highlights.
• SSH config import preserves OpenSSH Include context and global defaults.
  Imported keys, credentials, and profiles are rolled back together if the
  final profile save fails.
• Unix broker directories and sockets enforce owner-only permissions. A local
  history write failure is reported without changing the remote command's
  result.
• Interactive sessions and connection diagnostics read profiles and credentials
  from one consistent local-state snapshot.
• CLI connection replacement switches to a new credential reference only after
  the new profile is durable. A referenced credential that is missing is
  reported consistently in interactive and brokered execution.
• Broker replacement distinguishes the recorded process from a reused process
  ID, including legacy endpoint records, and broker-log creation failures are
  surfaced at startup.
• Audit tail reads and detached completion checks no longer materialize the
  complete history, and OS keychain commands have a bounded deadline.

Runtime requirements

The encrypted store is bound to the OS user profile that created it. Agents and
services invoking Corv need that same profile and keychain context. Remote
scripts execute under POSIX sh; bash-specific syntax requires an explicit
bash -lc on a host where Bash is available.

Release artifacts are published only after build, vet, static analysis,
formatting, tests with the Linux race detector, and vulnerability scanning pass.
Third-party actions are pinned to commit SHAs, and analysis tools use fixed
module versions. Release builds use Go 1.26.8 and golang.org/x/crypto 0.56.0.

v1.1

Corv v1.1

Corv v1.1 is a reliability and compatibility release. It keeps the existing
connection-manager workflow while hardening the paths that matter during long,
automated remote operations.

Existing v1.0 and v1.0.1 installations can upgrade in place with:

corv update

Saved connections and credentials remain compatible. The release does not
require an on-disk migration or remote software.

Highlights

Predictable output for agents

• Every agent-facing response has a fixed byte budget. Large output preserves
  its beginning and end instead of filling the model context.
• Corv retains up to 20 MiB per completed run locally. Larger logs keep the
  first 4 MiB and the final section, with explicit truncation metadata.
• corv output <run-id> [pattern] returns a bounded view and filters before
  applying the output budget.
• JSON reports run state, exact exit codes, error classification, and output
  size metadata consistently, including local and infrastructure failures.

Reliable detached work

• Long commands remain detached on the remote host and can be recovered after
  client, broker, or network interruption.
• Persisted job identity prevents an identical command from being executed
  twice during recovery.
• Completed responses are rendered from the finalized log, so late output and
  final error lines are not lost.
• Remote files are removed only after the retained local log is durably saved.

Connection and broker resilience

• SSH handshakes, control operations, and local IPC waits are bounded.
• Keepalives detect half-open connections, and dead connections receive one
  controlled redial.
• Per-connection channel limits queue concurrent work instead of overrunning a
  server's SSH session limit.
• A changed profile cannot reuse a connection or job belonging to the previous
  target or credentials.
• Updated binaries detect and replace stale resident brokers before serving
  commands.

Local state integrity

• Connection profiles, vault data, broker job state, retained logs, imported
  keys, and endpoint metadata use crash-safe atomic writes.
• CLI and TUI connection mutations share a cross-process lock.
• The vault records its key backend while preserving compatibility with
  existing encrypted state.
• Broker IPC is owner-restricted, and detached remote files use a private
  per-user directory.

New diagnostics and recovery

• corv test <name> checks resolution, TCP connectivity, jump routing, SSH
  handshake, host-key trust, and authentication without running a command.
• corv status shows warm connections and active runs without starting the
  broker.
• corv vault reset provides an explicit, confirmed recovery path for damaged
  or unavailable stored credentials.

Operational notes

• Remote command execution requires a POSIX shell. Windows OpenSSH servers are
  not supported as remote execution targets.
• Warm SSH connections do not preserve shell state between commands.
• Local run logs and completed remote remnants are retained for 24 hours.
• Release artifacts include SHA256SUMS; the installers and corv update
  verify downloaded binaries.

The release workflow runs build, vet, static analysis, formatting checks, the
full test suite, the Linux race detector, and a reachable-vulnerability scan
before publishing any artifacts.

v1.0.1

Full Changelog: https://github.com/khalid-src/corv-client/commits/v1.0.1