v0.9.0

Added

• Version-skew marker in the TUI status bar (#852). While
  the daemon's version and the client's differ, the workspaces
  status line carries a warning-colored marker after the URL
  naming both versions (msksd 1.2.3 ≠ client 1.2.4); the
  CLI's one-line notice with its remedy keeps its own behavior.
  The marker refreshes on the listing's five-second reload, a
  /health connection that fails leaves the standing marker in place,
  and the marker leaves when the versions agree. The URL and the
  state summary crop before the marker does, so the marker stays
  visible at 80 columns.

• Open-shell counts in the TUI (#858). Every interactive
  msks ssh writes a heartbeat session record under
  ~/.local/state/msks/sessions (relocatable with the state_dir
  key / MSKSC_STATE_DIR), and the workspaces list shows the live
  count beside a row's status word (»2) and on the detail strip
  (shells »2); the workspace page's header carries the count
  beside the status (2 shells open). The count covers the shells
  open on the host the TUI runs on, survives a tree restart, and a
  session killed without cleanup stops counting about twenty
  seconds after its death. Windows the tree opens carry the
  workspace's name and the session record's five-character token in
  their title (msks tree-vm f8x2n); a later release will use the
  token to match a session to its window.

• Detail strip at the bottom of the workspaces list (#849).
  A two-line strip renders at the bottom of the listing's box
  and carries the focused workspace's quick facts: name, id,
  image, cpu count, memory, egress mode, the mounts-issue count,
  and the storage the workspace charges the state disk (the same
  root-plus-home cost msks storage reports). The strip follows
  the selection and refreshes on the list's standing cadence;
  the storage figure uses a cached capacity report, so moving
  the selection costs no roundtrip. An empty list hides the
  strip.

• State summary in the TUI status bar (#853). The workspaces
  count now carries a summary of the fleet's states:
  4 workspaces · all stopped when every row holds one state,
  or each state's count (4 workspaces · 1 running 3 stopped)
  when they mix. The summary follows the standing five-second
  refresh. The daemon's URL comes after the summary, and it crops
  first when the terminal runs narrow.

• ? key overlay in the TUI (#851). Every page of the tree
  answers ? with an overlay listing that page's bindings,
  hidden ones included (the escape leaves among them), each with
  its action label. Any key closes the overlay. The footer stays
  as it was. The overlay is where the full key list lives.

• Sortable listing columns in the TUI (#854). Clicking a column
  header in the workspaces list sorts by that column; clicking the
  active header flips the direction, and the arrow in the header
  shows the active sort. CREATED sorts by creation date (newest
  first by default), STATUS in lifecycle order, the other columns
  by their text. You sort by clicking a header; the keymap stays
  as it was, and the sort holds across the standing refresh.

• Agent reference card (#842). msks agent-card prints the agent
  reference card: one markdown text grouped by task (read state,
  lifecycle, run inside, egress consent) with the status vocabulary
  and the exit-code table whole. The same text is the
  Agent Reference Card
  docs chapter. The card covers the status vocabulary, the exit-code
  table, and the non-interactive egress-consent flow.

• Machine-readable CLI (#841). Every printing msks command takes
  --json: the mutating commands emit the affected workspace row as one
  JSON document (create, clone, start, stop, resize, mount,
  umount; rm prints one JSON line per removed id), the read commands
  emit their documents, and failures print
  {"error": {"status": ..., "detail": ...}} on stderr. The exit codes
  are a documented table (docs/cli.md): 3 not found, 4 name conflict,
  5 wrong state. msksd doctor --json prints its check rows as one
  document. Human output is unchanged.

• host.msks (#816). Every egress workspace's resolver answers the
  name with its own tap address, so a guest connects to the gateway by name
  (https://host.msks:8660 with a -R 8660:localhost:8660 proxy stored)
  instead of discovering it through ip route show default. The name
  answers in every consent mode, feeds no policy row or address pin, and
  a well-formed internet-class query for it is never sent upstream.

• The proxies docs chapter (#814). docs/proxies.md owns the whole
  proxies story in one place: the persistent proxy port concept, the
  -L/-R directions in ssh's grammar, the live status vocabulary, and
  worked examples for both the CLI and the TUI. The networking, CLI, and
  TUI chapters link to it where they introduce proxies.

• The TUI's proxies page (#809, part of #807). Each workspace's
  page opens its own proxies page (the action row, or p), which adds
  and removes that workspace's persisted -L/-R proxies with the
  same spec grammar msks proxy add reads, and shows live status —
  refreshed on every proxy transition the daemon publishes beside a
  five-second standing re-read. The workspace page carries a compact
  port-pair line (8888 -> 8889 | 8881 <- 8882), each pair green
  while it listens and red while its bind refused.

• msks proxy (#808). A new command manages the daemon's
  persisted workspace proxies: add with ssh's own spec shape
  (-L [BIND:]PORT:HOST:PORT binds the daemon host and bridges to
  the workspace; -R RPORT:HOST:TPORT binds the workspace's
  gateway and bridges to a daemon-side service), ls with live
  status, and rm. The daemon owns every listener, rows live in its
  database, every workspace start re-establishes them, and add
  is idempotent for an identical spec. Part of #807.

Changed

• The workspaces list's ID column (#849). The EGRESS column
  became an ID column: each row carries its immutable workspace
  id. The egress posture reads on the detail strip instead,
  beside the row's other facts. Clicking the ID header sorts by
  the id itself; the NAME header keeps the name sort.

• Graded status colors in the TUI listing (#850). The
  workspaces list colors the status column by state class:
  running keeps the success color, stopped and created
  render in the muted text color, starting, stopping, and
  paused in the warning color, and absent and unknown in
  the error color. A fleet at rest reads calm. The transitional,
  paused, or lost row is the one the eye finds. The ✗N mounts-issue
  marker keeps the warning color beside whatever color the
  status word takes.

• The arm64 stop caveat is documented (#826). cloud-hypervisor's
  arm64 power button (the PL061 gpio key) delivers only the first
  press, so a msks stop cannot rescue a lost press by re-pressing.
  The fallback kill at the MSKSD_SHUTDOWN_TIMEOUT_S deadline carries
  the stop instead. Size that setting to cover the guest's slowest
  clean shutdown. A value above 120s outlives the client's wait, and
  the client reports a timeout while the daemon still finishes the
  stop.

Breaking

• terminal_title / MSKSC_TERMINAL_TITLE removed (#858). The
  window title template setting is gone; every terminal window msks
  opens for a workspace shell now carries one fixed title,
  msks <workspace-name> <token>, and windows msks does not open keep
  the terminal emulator's own title. The client refuses a config
  file that still carries the terminal_title key, on every
  command, until the key is deleted — delete it from your
  msks.yaml and unset the variable. The refusal names the key.

Fixed

• The legacy create default cmdline (#833). A create with
  explicit kernel/rootfs paths and no cmdline now boots with
  this host's console device in the default: ttyAMA0 on an
  aarch64 daemon, ttyS0 elsewhere. The console answers on
  both; the catalog-record path was already per-arch and is
  unchanged.

• msks doctor qemu-kvm apk hint (#832). The hint now
  prints this host's Alpine emulator package:
  qemu-system-aarch64 on an aarch64 host,
  qemu-system-x86_64 elsewhere.

• msks doctor cloud-hypervisor install hint (#831). The
  hint now prints this host's release assets: the -aarch64
  builds on an aarch64 host, the unsuffixed x86-64 builds
  elsewhere. The installation chapter states the same
  architecture distinction beside its install block, and
  installs ch-remote under the unsuffixed command name the
  demo and dev tooling calls.

• Egress slice release on a failed teardown (#828). A detach
  whose table or tap delete raised left the workspace's slice
  claimed with no retry path, so the next msks start was refused
  with "held by another live workspace" until the daemon
  restarted. A failed teardown now leaves a record the
  workspace's next stop or start retries, and the slice releases
  when that retry completes.

• Workspace starts after a guest-initiated poweroff (#825). A
  VMM that exited outside the stop flow — the guest's own poweroff,
  or a guest landing its shutdown just past a stop deadline — left a
  stale entry that refused every later msks start with "VM already
  exists" until an operator passed a stop. The start now reconciles
  the dead VMM's residue (its tracked entry, share daemons, and tap)
  and boots.

• Fedora guest's sshd address-wait wiring (#819). The Fedora
  image's sshd ordering dropin now lands in sshd.service.d (Fedora's
  own unit names) instead of Debian's ssh.service.d, so
  msks-wait-address.service actually runs on a Fedora egress
  workspace and sshd listens once the NIC has its address. The image
  build fails when the wiring names a unit the image does not ship.

• *...

fedora aarch64 image (e7af55a9e0f1)

Built from 193a791. What changed: 41d80f2...193a791

debian aarch64 image (e3be6765b5e1)

Built from 193a791. What changed: 7797422...193a791

fedora x86_64 image (a4ffa33bcc75)

Built from 193a791. What changed: 41d80f2...193a791

nixos aarch64 image (774b1d3f6552)

Built from 193a791. What changed: 7797422...193a791

debian x86_64 image (6ef2f0c789a5)

Built from 193a791. What changed: 7797422...193a791

nixos x86_64 image (3fc8f4251f7a)

Built from 193a791. What changed: 7797422...193a791

v0.8.3

Fixed

• msks ssh after a host-share change (#803). A changed mount
  set renews the workspace's seed at the next start, and the
  re-provisioning guest regenerates its ssh host keys. The
  workspace's identity row now serves a seed epoch (a counter,
  one bump per bake or renewal), and the client rotates its
  host-key pin on it, so the next session re-pins the new key
  instead of refusing it.

What's Changed

• Rotate the ssh host-key pin on a seed renewal (#803) by @mcdonc in #804

Full Changelog: v0.8.2...v0.8.3

v0.8.2

Breaking

• The client flake output is gone (#793). The flake's
  client package and devenv's outputs.client are removed.
  The wheel installs every console script, so msksd (the
  default flake output) and outputs.server carry the client CLI
  in the daemon closure. Install .#msksd (or .#server /
  devenv build outputs.server) for everything the client output
  and outputs.client used to provide. Wheel installs with pip or
  uv do not change.

Added

• The Debian image ships apt list state; the NixOS guest turns
  on nix-command and flakes (#783). A fresh Debian workspace's
  first apt-get install resolves with no update run — the image
  stages the trixie main InRelease and Packages index under the
  names apt itself derives. The NixOS guest's nix.conf enables
  both experimental nix features, so a flake-carrying checkout
  builds before any per-user override.
• Workspace rows read stopping through a stop's graceful
  window (#789). A stop request now writes stopping before
  the graceful shutdown begins, so msks ls and a second TUI
  see the truth for a window that lasts up to the shutdown
  timeout. The row lands on stopped when the shutdown finishes,
  and returns to the status it carried before the stop when the
  shutdown times out. A daemon crash mid-stop heals on the next
  watcher scan, and the gates that read the status (volume
  moves, resize, clone) refuse while the row reads stopping.
  The TUI's stop action dims with "workspace is stopping", and
  the attach commands (msks ssh, msks console, msks forward,
  msks rsync) wait out the window instead of booting into the
  shutdown.

Changed

• New workspaces default to 4 vCPUs (#791). A create that
  leaves the count unset boots 4 vCPUs, up from 2. The 1–64 bound
  is unchanged, an explicit --cpus still wins, and existing
  workspaces keep their stored count.

• shutdown_timeout_s defaults to 90 seconds (#787). A
  workspace stop now waits up to 90s for the guest to power off
  (was 20s). An idle guest still answers in seconds.
  MSKSD_SHUTDOWN_TIMEOUT_S still overrides. The dev daemon's
  supervised stop grace moves to 180s to cover the longer stop
  cycle, matching the product unit's window.

• New workspaces default to a 20 GiB root overlay (#784). The
  create default for root_mib moves from 10240 to 20480 on every
  surface (TUI create form, CLI, API) — NixOS guests' nix store
  outgrows 10 GiB after a few rebuilds. MSKSD_ROOT_MIB still
  overrides the default, an explicit size on create still wins
  over both, and existing workspaces keep the size they were
  created with. The create form's root placeholder names the
  daemon's real default on every healthy load (it always did for
  home), and the first-run config template's home_mib comment
  now states the real 20480 default (it read 2048).

• The create form's image dropdown shows the import date and
  sorts newest-first (#781). Each option now carries the import
  date beside the reference, and the options order by distro name
  A→Z with each distro's newest build first — the newest build of
  a release leads instead of the oldest. The designated default
  row is marked with a trailing asterisk (the blank option's own
  line names the marker), where it read "— default" before.
  Options for the same reference still resolve by hash, and the
  plain reference still names the build the daemon itself
  resolves it to.

What's Changed

• Show import date in the create form's image dropdown and sort newest-first (#781) by @mcdonc in #782
• Bump the default root size for new workspaces to 20G (#784) by @mcdonc in #786
• Raise the default shutdown timeout to 90 seconds (#787) by @mcdonc in #788
• Honest stopping status for workspaces mid-stop (#789) by @mcdonc in #790
• Raise the default workspace vCPU count to 4 (#791) by @mcdonc in #792
• Collapse the client and msksd flake outputs into one derivation (#793) by @mcdonc in #794
• Ship apt list state in the Debian image; enable nix-command and flakes in the NixOS guest (#783) by @mcdonc in #802

Full Changelog: v0.8.1...v0.8.2

nixos x86_64 image (f83c13483c1d)

Built from 7797422. What changed: cb01598...7797422