v0.49.1

0.49.1 - 2026-09-04

Users upgrading from v0.48.1 also receive the v0.49.0 changes, previously available through the Go module release.

Highlights

• Image-pinned GCP ready pools. Reuse hydrated Linux runners tied to exact boot images or disk snapshots, with capacity fallback across zones and ownership checks throughout creation and cleanup.
• Faster runner startup. Skip redundant Git lookups and unnecessary APT downloads, and share Azure/GCP token refreshes across concurrent requests.
• Safe sync and correct artifacts. Cloudflare and Upstash Box preserve existing workspaces when transfers fail. Blacksmith collects artifacts from the prepared execution workspace that produced them.
• Daytona script support. Run --script and --script-stdin through private SSH with literal arguments, environment profiles, activity refreshes, and cancellation support.
• Correct sandbox targeting and trustworthy cleanup. Canonical IDs no longer resolve to unrelated slug aliases. Failed bootstrap rollback stops further allocation, Hetzner waits for confirmed deletion, and interrupted AWS warmups remain stoppable. Providers retain recovery claims when cleanup fails and preserve the original command result.
• Predictable commands and environment profiles. Preserve literal arguments across delegated providers, isolate each run's uploaded profile, and clean failed uploads without touching replacement claims.
• Clearer failures and more reliable Windows bootstrap. Preserve failed-stage, fallback, terminal-recording, and Machine0 output diagnostics; fresh AWS Windows/WSL2 leases bootstrap through their advertised SSH route.
• Isolated AWS image qualification for maintainers. An opt-in workflow and dedicated authority verify candidate image publication and rollback with bounded cloud access, provider credentials kept out of candidate code, and independent cleanup.

Upgrade notes

• GCP typed ready pools require an updated coordinator and authoritative boot-image or disk-snapshot evidence; machine-image checkpoints and older leases without that evidence cannot join. Coordinator credentials need compute.instances.get and compute.disks.get for typed identity operations. PR 1620, PR 1621.
• Tenki workspace/project settings are now accepted only for recovering older scoped leases. Stop those leases before removing the settings, then use tenki login to select the workspace for new leases. PR 1741.

Changes

• Collect Blacksmith artifacts from execution workspaces selected by a trusted .git/crabbox-artifact-root symlink, pinning the artifact directory before the workload and rejecting invalid bindings before execution while retaining existing exit and publication guards. PR 1840. Thanks @steipete.
• Preserve Upstash Box and SmolVM stream cancellation and timeout causes in run outcomes, and skip command submission when cancellation is already known after an acknowledged environment upload without skipping cleanup. PR 1838. Thanks @steipete.
• Keep canonical lease IDs separate from slug aliases in shared claim lookup and provider routing, preventing missing IDs from selecting, running on, or stopping a different sandbox while preserving provider recovery behavior. PR 1839. Thanks @steipete.
• Clean partial Upstash Box environment uploads after failure or cancellation, isolate each profile, and refuse stale file cleanup while preserving discovery-only reuse and original command outcomes. PR 1834. Thanks @steipete.
• Preserve literal Tensorlake and OpenSandbox profile arguments through final execution, including environment-wrapped commands, and fix Tensorlake's inferred single-string shell execution. PR 1835. Thanks @steipete.
• Preserve literal Agent Sandbox profile arguments through pod stdin execution and share checked workspace/environment command wrapping with Nomad. PR 1831. Thanks @steipete.
• Preserve literal SmolVM and Upstash Box profile arguments, accept inferred single-string shell commands, and share source rendering without adding another shell. PR 1833. Thanks @steipete.
• Read all AWS recovery inventory pages and retain cleanup debt when pagination is incomplete; describe interrupted provisioning without assuming a deployment caused it. PR 1832. Thanks @steipete.
• Preserve literal profile arguments through CodeSandbox, OpenComputer, and Docker Sandbox execution, sharing command-intent parsing without changing provider shells or environment transports. PR 1830. Thanks @steipete.
• Clean failed SmolVM environment-profile uploads with bounded original-claim checks, isolate each run's profile, and reuse shared shell-profile handling without requiring Bash. PR 1829. Thanks @steipete.
• Made interrupted direct AWS warmups stoppable by recording exact instance ownership before readiness, retained recovery claims through EC2 visibility delays, and selected the Ubuntu HTTPS primary archive for automatically chosen stock Ubuntu 26.04 amd64 images. PR 1816. Thanks @steipete.
• Added typed GCP ready-pool cohorts bound to exact boot-image or disk-snapshot provenance while allowing capacity fallback across zones. PR 1621. Thanks @vincentkoc.
• Typed GCP identity generation and registration now observe the owned VM boot disk to bind exact numeric image or snapshot provenance without adding image or snapshot reads to ordinary GCP launches; create cleanup custody requires a numeric VM ID, interrupted token-bound creates capture or retry that ID only through exact ownership lookups and strict rereads, and fully bound pre-upgrade leases may use their lossy historical numeric ID only to corroborate a raw ID during fenced deletion or expiry cleanup before an exact reread. PR 1620. Thanks @vincentkoc.
• Preserve existing Cloudflare container workspaces when sync upload or extraction fails, clean partial archives, and enforce full-checkout size limits before fresh allocation. PR 1814. Thanks @steipete.
• Preserve Upstash Box workspaces when archive upload or extraction fails, clean partial Upstash Box/Tensorlake uploads, and check complete archive limits before creating either sandbox. PR 1820. Thanks @steipete.
• Report SmolVM decoder, file-write and extraction failures instead of false upload success, isolate temporary upload files, and preserve existing files when decoding fails. PR 1826. Thanks @steipete.
• Run direct Daytona --script and --script-stdin commands through the private SSH runner with literal trailing arguments, environment profiles, and provider activity refreshes; keep managed SSH credentials out of process arguments. PR 1781. Thanks @steipete.
• Preserve literal profile arguments and assignment-shaped executable names across Cloudflare Sandbox, Superserve, Crownest, Vercel Sandbox, and Nomad command transports without reinterpreting them as shell syntax. PR 1818. Thanks @steipete.
• Stop direct AWS, Azure, GCP, and Hetzner bootstrap retries from allocating another machine when rollback reports a cleanup failure, preserving both the original failure and cleanup diagnostics. PR 1819. Thanks @steipete.
• Reject inconsistent Hetzner creation/readiness identities before SSH, and keep failed-acquisition cleanup bound to the original server and key; share exact ID/name validation with RunPod. PR 1821. Thanks @steipete.
• Wait for brokered Hetzner delete-action success and exact server absence before reporting cleanup complete or removing managed SSH keys; retain durable recovery evidence through pending or uncertain deletion and expose it in inspect --json. PR 1799. Thanks @steipete.
• Remove local SSH connections, keys, and trust files after fixed-ID AWS lease release, preserving the terminal receipt so failed local cleanup can be retried without repeating provider deletion. PR 1797. Thanks @steipete.
• Closed and joined lease-owned SSH connection masters after confirmed brokered deletion, preserving native connection reuse and lease/host-key isolation while retaining failed local cleanup for a local-only retry. PR 1774. Thanks @steipete.
• Cloudflare: retain recovery claims when teardown fails, preserve command/cancellation outcomes, and fence reuse and cleanup against replaced local claims. PR 1817. Thanks @steipete.
• Report OpenSandbox cleanup failures instead of silently succeeding, preserve the original command exit when cleanup also fails, and finalize timing/session results after cleanup without weakening reuse admission or absolute TTL checks. PR 1804. Thanks @steipete.
• Protect Nomad runs from overwriting replacement claims or recreating retired leases, and expose standard run-session handles with cleanup-aware final outcomes that preserve the original command exit. PR 1810. Thanks @steipete.
• Avoid unnecessary Git metadata lookups during configuration loading, lease claim refreshes, and sync planning while preserving repository and credential trust boundaries. PR 1783. Thanks @steipete.
• Skip unnecessary APT translation, AppStream, and command-not-found downloads during minimal Linux bootstrap while preserving required package indexes, signature checks, and later operator defaults. PR 1794. Thanks @steipete.
• Reuse one Azure or GCP token refresh across concurrent requests, reducing duplicate authentication traffic while preserving credential isolation, refresh margins, and retry behavior. PR 1802. Thanks @steipete.
• Restore current Tenki CLI inventory and legacy-claim recovery, and retain ownership claims until the exact session acknowledges termination; obsolete workspace/project settings now give migration guidance before creating a lease. PR 1741. Thanks @eddiewang.
• Allow fresh brokered AWS Windows and WSL2 leases to bootstrap through advertised SSH port 22 while preserving an explicitly selected final workload port. PR 1801. Thanks @steipete.
• Fix GCP metadata authentication in workerd by using supported redirect handling while continuing to reject redirected token responses without following them. PR 1815. Thanks @steipete.
• Report the correct install, build, or test failure stage from supported phase markers, preserving original exit codes and keeping later artifact-collection failures separate. PR 1795. Thanks @steipete.
• Preserve individual AWS, Azure, and GCP candidate failures in successful leases' provisioning history across market and regional fallback, including previously omitted GCP on-demand failures. PR 1811. Thanks @steipete.
• Preserve finish-submission and receipt-verification errors, attempt counts, and recovery guidance when terminal run recording times out, without changing retry limits or receipt verification. PR 1782. Thanks @steipete.
• Capture complete Machine0 native CLI JSON responses through private regular files on POSIX hosts, reject incomplete captures explicitly, and retain bounded output instead of accepting truncated responses. PR 1780. Thanks @steipete.
• Added a credential-isolated AWS image-qualification transport and non-public per-run authority with fixed sandbox policy, bounded intent reconciliation, verified resource ownership, and eventual-consistency-aware teardown, without changing normal AWS credential behavior. PR 1778. Thanks @vincentkoc.
• Added an opt-in pre-merge AWS image-qualification workflow with isolated candidate builds, deployment-bound proof, publication/rollback checks, and an independent cleanup reaper; enabling it requires the dedicated authority and protected environment. PR 1775. Thanks @vincentkoc.
• Clarify SSH cancellation, safe retained-workload recovery, and Bash login-shell exit behavior, and correct the default local-container image note. PR 1685, PR 1686. Thanks @steipete.
• Fix native macOS readiness test fixtures when temporary directories inherit a different group from the process, without changing production ownership checks. PR 1686. Thanks @steipete.
• Reject changed Azure VM identities during acquisition readiness and use identity-checked VM/companion cleanup for failed acquisitions instead of blind name-based rollback. PR 1827. Thanks @steipete.
• Clean partial Tensorlake environment-profile uploads after failure or cancellation, fence cleanup to original ownership, and share isolated profile lifetimes and source-failure handling with Modal. PR 1825. Thanks @steipete.
• Preserve Cloudflare and Azure Dynamic Sessions cancellation when an incomplete command stream ends with clean EOF, without replacing accepted completion events or scanner errors. PR 1825. Thanks @steipete.