v0.6.0

Added

• Added provider: daytona for Daytona sandbox leases using Daytona's SDK/toolbox for sync and command execution, with short-lived SSH access available through crabbox ssh.
• Added Daytona CLI profile auth fallback so daytona login --api-key ... can satisfy Crabbox Daytona auth without duplicating DAYTONA_API_KEY.
• Added provider: islo for delegated Islo sandbox runs using the Islo Go SDK.
• Added a provider backend registry and authoring guide so delegated and SSH-backed providers can live in provider-owned packages while core keeps command parsing, rendering, and capability validation.
• Added --tailscale-exit-node and --tailscale-exit-node-allow-lan-access so managed Linux leases can route egress through an approved tailnet exit node.
• Added broker capacity hints for AWS leases, including selected market, attempted regions, quota/capacity advice, and configurable high-pressure class warnings.
• Added crabbox code and per-lease /code/ portal URLs for authenticated code-server access on --code Linux leases.
• Added per-lease portal detail pages with bridge status, access-panel copy commands, recent run links, and a stop action.
• Added portal run detail pages with command metadata, result summaries, dense viewport-fitted portal tables, provider/OS badges, active/ended/provider/target filters, sticky portal chrome, and copyable retained log previews.
• Added latest lease telemetry snapshots for coordinator-backed Linux leases, including load, memory, disk, and uptime in status --json and the portal detail view.
• Added bounded lease telemetry history with portal sparklines and stale/high-resource badges on lease detail pages.
• Added run-level telemetry summaries with start/end Linux resource snapshots in run history JSON, human history output, and portal run tables/details.
• Added live run telemetry samples for longer Linux commands, including bounded coordinator storage and portal load/memory/disk trend lines on run detail pages.
• Added portal visibility for external Blacksmith Testbox runners synced from crabbox list --provider blacksmith-testbox, with owner-scoped runner rows, stale markers, GitHub Actions links, status badges, stuck filters, detail pages, and copyable local stop commands.
• Added admin portal visibility for non-owned runner leases, including mine/system filters and matching detail/code/VNC drilldowns for operator sessions.
• Added crabbox desktop launch --webvnc --open to launch a desktop browser/app and immediately bridge the same lease into the WebVNC portal.
• Added crabbox webvnc --daemon/--background plus --status/--stop for background WebVNC bridges without tmux.
• Added crabbox media preview for creating motion-trimmed GIF previews and optional trimmed MP4 clips from desktop recordings.
• Documented the prebaked runner image boundary: provider-owned AMIs/snapshots hold machine capabilities while repo/runtime caches stay in QA workflows or warm leases.

Changed

• Changed AWS capacity fallback to route configured CRABBOX_CAPACITY_REGIONS across both brokered and direct AWS launches, with the deployed coordinator defaulting to a wider multi-region pool for better headroom.
• Changed coordinator lease requests to omit the default capacity block, preserving mixed-version broker compatibility while still sending explicit market, strategy, fallback, multi-region, availability-zone, or hint opt-out settings.
• Changed coordinator-backed CLI lease output to print broker capacity hints when AWS routing, quota, Spot fallback, or configured high-pressure classes are involved.
• Changed the portal lease table to merge external Blacksmith Testbox runners into the main grid as muted, disabled rows instead of rendering a separate external-runners table.
• Refactored built-in provider backend implementations into internal/providers/<name> packages while keeping command orchestration and rendering core-owned.

Fixed

• Fixed Daytona SDK sync so tar creation and Daytona toolbox upload stream from disk instead of buffering large archives in memory.
• Fixed Daytona resource override handling so snapshot-only sandboxes reject generic --class and --type flags instead of accepting no-op compute settings.
• Fixed Islo delegated runs so shell-mode commands preserve raw shell strings and truncated exec streams fail instead of silently reporting success.
• Fixed provider-owned flags and target/capability validation to run through registered provider specs while preserving script-facing list JSON compatibility for coordinator and Blacksmith backends.
• Fixed Blacksmith Testbox queued/outage failures so users see the upstream queue state and practical fallback guidance instead of an opaque timeout.
• Fixed Blacksmith Testbox repo inference for mirrored repositories and portal runner sync for stale or external Testbox rows.
• Fixed managed Linux desktop/browser leases to preinstall video capture and native addon build helpers, avoiding per-scenario apt installs in browser QA runs.
• Fixed managed Linux desktop leases to use a slim XFCE session instead of bare Openbox, preserving a real panel/window-manager desktop while avoiding the full XFCE meta package.
• Fixed SSH readiness progress logs to distinguish open TCP ports, failed SSH authentication, and failed Crabbox ready checks.
• Fixed auto-shell command reconstruction so arguments with spaces stay quoted when shell operators such as && are present.
• Fixed managed Linux bootstrap ordering so SSH is reachable before slow desktop/browser package setup while readiness still waits for the full desktop/browser contract.
• Fixed managed desktop/browser warmups so slow cloud-init bootstraps get a longer readiness window, retry once after SSH timeout, and clean up failed leases instead of leaking unusable VMs.
• Fixed brokered cloud server names so friendly-slug collisions with stale provider VMs do not block new leases.
• Fixed human WebVNC desktop launches to keep browser windows windowed by default and reserve fullscreen for explicit capture/video workflows.
• Fixed WebVNC portal status text and bridge commands so waiting/reset states explain the exact local bridge command to run.
• Fixed the Code portal waiting state so it shows bridge status, copy/reload controls, and automatically opens the workspace once the local bridge connects.
• Fixed crabbox webvnc --stop so daemon shutdown terminates the active child bridge, not only the supervisor.
• Fixed portal command rows so their copy affordance copies the matching local command instead of only labelling the section.
• Fixed portal Windows target badges to show compact win and win (wsl2) labels instead of windows / normal.
• Fixed portal access and time columns to use compact capability icons, relative time labels, and sortable time metadata instead of wide action buttons and Zulu timestamps.
• Fixed lease detail layout so local commands live inside the access panel instead of forcing a separate full-width commands section above recent runs.
• Fixed portal run detail layout density, responsive action alignment, and run telemetry readability so long-lived run pages fit operator viewports cleanly.
• Fixed generated docs-site navigation so the sidebar scroll position is preserved while moving between pages.
• Fixed Windows WebVNC credential handling so generated portal links preserve special characters and managed TightVNC sessions copy service passwords into the logged-in user's registry profile.
• Fixed managed Linux browser setup so Chrome/Chromium launches skip first-run and default-browser prompts.
• Fixed managed Linux browser cloud-init setup so Chrome/Chromium policy and wrapper generation cannot break YAML parsing.
• Fixed WebVNC portal passwords with escaped special characters and kept the bridge alive across viewer resets and transient coordinator EOFs.