v0.57.0

0.57.0 - 2026-09-11

Highlights

• Run commands on existing Daytona fixed-ID leases. The new crabbox exec streams commands without workspace sync or hydration and keeps repository ownership protected until transport cleanup finishes.
• Smoother XFCE desktops. Prevent duplicate panels and notification-area warnings, start the visible terminal inside the desktop session, and refresh panel styling without restarting the rest of the desktop.
• Safer Daytona fixed-lease cleanup and expiry recovery. Verify API-key organization identity during cleanup, reconcile leases deleted by native TTL or external actions, and use stop --current-repo for repository-scoped cleanup.
• See more provider settings offline. Inspect Freestyle, Crownest, OpenComputer, OpenSandbox, and CUA configuration in text and JSON, including providers that are not currently selected.

Upgrade notes

• exec initially supports completed direct Daytona fixed-ID Linux leases; stop --current-repo provides repository-scoped cleanup for that direct fixed-ID route. Check capabilities with crabbox exec --check --provider daytona before allocating; other providers, ordinary leases, coordinator routes, and Windows targets are not supported by these execution and cleanup modes. PR 2119.
• exec leaves the SSH account's initial working directory unchanged and requires piped or redirected stdin; use </dev/null when no input is needed and an explicit shell command to change directories. Non-PTY streams preserve bytes; --pty uses terminal semantics. PR 2119.
• Daytona fixed-lease cleanup with API keys requires organization metadata from the current-key endpoint. Older servers that omit it require an OAuth organization profile for cleanup; a bare 404 or elapsed TTL does not prove that a sandbox has been removed. PR 2111.
• New XFCE bootstrap runs retain crabbox-desktop-session.service as an alias of crabbox-desktop.service so released clients can still reset the desktop. Panel refresh does not clear existing terminal color or menu caches. PR 2117.

Changes

• Add crabbox exec for commands on completed Daytona fixed-ID leases without workspace sync or hydration. Forward non-PTY streams without rewriting their bytes, resolve fresh SSH access, and retain the repository claim through command execution and local transport cleanup. PR 2119. Thanks @steipete.
• Add offline exec --check capability discovery and stop --current-repo cleanup for supported fixed-ID leases. Validate repository ownership under the same lock used for deletion, so cleanup waits for active exec commands and a previous owner cannot delete a lease after another repository reclaims it. PR 2119. Thanks @steipete.
• Let XFCE own its panel, window manager, desktop renderer, and visible-terminal autostart. Apply theme changes through the matching user session, restart only the existing panel when its CSS changes, and leave unchanged styling alone to prevent duplicate components and notification-area warnings. PR 2117. Thanks @steipete.
• Daytona: verify fixed-lease cleanup with API keys against current-key organization metadata and reconcile acquired fixed leases after confirmed native TTL or external deletion. Inspection records a terminal tombstone without issuing deletion or recreating the fixed ID; incomplete or ambiguous cleanup retains the claim. PR 2111. Thanks @steipete.
• Show Freestyle, Crownest, OpenComputer, OpenSandbox, and CUA settings in offline config show text and JSON, including unselected providers. Preserve explicit zero/false values and URL redaction, report only already-loaded key presence, and avoid credential discovery, external default resolution, or SDK bridge execution. PR 2104, PR 2112. Thanks @steipete.
• Include recognized workspace-owner protocol states in child and phase-witness inspection errors, making ownership failures easier to diagnose while preserving ownership decisions and retry behavior. PR 2106. Thanks @steipete.

Maintenance

• Go installation verification: retry recognized checksum-service and module-ZIP HTTP/2 interruptions once during dependency download, retaining checksum enforcement and the unchanged offline install checks. PR 2113, PR 2118. Thanks @steipete.
• Move existing local, cloud, VPS, and runtime configuration displays into provider adapters while preserving published fields, text positions, redaction, and zero/false/null/empty values. PR 2110, PR 2116, PR 2120, PR 2121, PR 2127. Thanks @steipete.
• Share default and compact JSON request construction across provider adapters while retaining exact wire formats, nil-body handling, request replay, and provider-owned authentication, timeout, and retry policies. PR 2122, PR 2124, PR 2125. Thanks @steipete.
• Share buffered JSON response decoding for E2B, CubeSandbox, and Azure Dynamic Sessions while keeping body closing, successful header copies, and typed API errors in their adapters. PR 2126. Thanks @steipete.
• Reuse the shared exact tag codecs in DigitalOcean, Linode, and Scaleway without changing their tag formats. PR 2091. Thanks @vincentkoc.
• Select Linode paginated resource types at their call sites, preserving page traversal, ordering, duplicates, and results collected before a later page fails. PR 2123. Thanks @steipete.
• Reuse shared loopback-host validation and request-envelope test assertions while preserving URL validation errors and exact wire checks. PR 2129, PR 2130. Thanks @vincentkoc and @steipete.