v0.40.0

0.40.0 - 2026-07-19

Added

• Added provider: cloud-run-sandbox (gcrun-sandbox, google-cloud-run-sandbox, cloudrun-sandbox) for Google Cloud Run sandboxes in public preview: stateful lifecycle through the in-container sandbox CLI or a durable-routing gateway, archive sync, local claim scoping, doctor checks, and live smoke hooks. Thanks @zozo123.
• Added bidirectional cp over resolved SSH leases and a readiness-gated, loopback-only tunnel command with owned process-tree teardown. Thanks @onmax.
• Added bounded JSON Schema validation for required run artifacts across supported standard drafts, with local references and redacted failure diagnostics. Thanks @dwin-gharibi.
• Added native local macOS SSH leases through Lume, cloning a stopped golden VM per lease with isolated SSH identity, durable clone and storage recovery, and verified stop-before-delete lifecycle handling. Thanks @madhavajay.
• Added a local Zed task-launcher extension for Crabbox lifecycle and remote execution workflows. Thanks @zozo123.
• Added the generic Crabbox Agent Skill at the ecosystem installer
  skills/crabbox convention while retaining its repo-discoverable .agents
  projection, plus digest-verified domain discovery under
  /.well-known/agent-skills/ and a draft-compatible cross-vendor AI Catalog.

Fixed

• Made cp over resolved SSH prefer rsync secluded arguments whenever the remote rsync supports them, so remote paths travel over the rsync protocol instead of the remote shell command line. This sidesteps an upstream rsync 3.4.4 safe_arg() bug that appends one uninitialized heap byte after a backslash-escaped wildcard (e.g. \[), which intermittently corrupted remote copy paths; remotes without secluded-args support (such as macOS openrsync) keep the previous shell-transported behavior. Thanks @zozo123.
• Kept Cloud Run sandbox creation and cleanup fail-closed: indeterminate creates retain exact recovery claims while definitive conflicts drop provisional ownership, cleanup serializes against active work and concurrent reclaim, absolute lease TTLs are enforced, failed destroys remain tracked and reported for retry, direct payloads travel on stdin instead of argv, and remote gateways must confirm durable routing plus synchronous deletion. Thanks @zozo123.
• Bound GitHub OAuth callbacks independently to each initiating browser flow and bound sessions, durable ownership, admin grants, and revocations to immutable GitHub account IDs instead of reassignable emails or logins, with a fail-closed operator recovery path for legacy records. Thanks @zozo123.
• Made the default crabbox init Agent Skill include standards-compliant
  SKILL.md metadata, enforced conformant skill destinations, and allowed
  --skill to target multiple agent discovery paths with an all-target
  existence preflight.
• Made the Zed package recognize both supported Crabbox configuration
  filenames without advertising the unsupported .crabbox.yml suffix.
• fix(egress): replaced egress sessions can no longer resurrect and clobber their replacement — the coordinator refuses tickets and connects for superseded session IDs, and the host/client daemon exits fatally when replaced.
• Enforced explicitly declared zero-byte artifact sizes during pull while preserving legacy manifests that omit size.
• Prevented apple-container orphan cleanup from deleting claims reclaimed during its resource snapshot, including same-value rewrites, while retaining stored SSH keys when ownership cannot be proven safe to remove. Thanks @anagnorisis2peripeteia.
• Prevented local-container orphan cleanup from deleting claims reclaimed during its resource snapshot while retaining stored SSH keys when ownership cannot be proven safe to remove. Thanks @anagnorisis2peripeteia.
• Prevented external-provider orphan cleanup from deleting claims reclaimed during its resource snapshot while retaining routing state when ownership cannot be proven safe to remove. Thanks @anagnorisis2peripeteia.
• Prevented apple-vm orphan cleanup from deleting claims reclaimed during its resource snapshot while retaining stored SSH keys when ownership cannot be proven safe to remove. Thanks @anagnorisis2peripeteia.
• Prevented Incus cleanup from deleting expired instances reclaimed during its resource snapshot, while retaining stored SSH keys when ownership cannot be proven safe to remove.