v1.2.2

Fixes

• Capturing state now re-checks each staged stack against the live source instead of trusting the earlier discovery snapshot, so a stack applied after discovery is captured correctly and one that genuinely has no state is recorded as such rather than reported as an outstanding gap.
• Status, and the module-version and state finalize reports, now tell apart entities that can never be captured (a stack never applied, a module version with no resolvable commit) from ones that simply haven't been captured yet — so a fully captured batch or estate reports as complete instead of appearing to always fall short, and the listing for an entity shows the recorded reason when nothing can be captured for it.

v1.2.1

No user-visible changes in this release.

v1.2.0

Features

• Added liftoff ui, an embedded browser interface (opt-in via --beta) that drives the exact same commands as the CLI. It shows a step rail tracking migration progress, a screen per step with the walkthrough readable alongside it, and a command explorer that lists every CLI command with a generated form for its flags, so new commands show up automatically. It only listens on the local machine, mints a fresh one-time session URL each run, and refuses to run under an agent — a person has to open it from their own terminal. --port picks a fixed port and --no-browser prints the URL instead of opening it, for a machine with no browser available.
• Skip reports, audit findings, the unrecoverable list from a mutate run, and single-entity lookups now include a link straight to that entity at its source, so following up on "why didn't this migrate?" no longer means searching for it by hand. The link travels in the piped/agent output on every applicable row, and shows up in the human-readable view at those decision points (it's left out of the two wide inventory tables to keep them readable, but is one click away in the piped output). Pass --no-urls to skip resolving links entirely for a leaner run over a large estate.

v1.1.0

Features

• Added liftoff model, a new way to inspect and correct the local migration data directly: list/get show every captured entity in full detail (with sensitive values redacted unless explicitly revealed), and set/unset let you fix or clear a single entity's value by hand. Changing a value that's already populated requires a person's approval, and the command tells you exactly which check to re-run afterward.
• Discarding the local database to re-discover from scratch, and re-staging a unit that's already migrated, now require explicit approval before they proceed. The approval prompt states exactly what would be lost — captured secrets, captured state, staged units, migrated units — so nothing is discarded silently.
• Added an audit check that flags a stack whose runner image can't actually be pulled by the worker pool it would run on (for example, a private image assigned to the public pool), and names the registry to point it at instead.
• Added an audit check that flags a module whose provider Spacelift would reject outright, catching the problem before it surfaces much later as a failed creation.
• Published guidance on choosing an AI model to drive a migration: what capabilities matter, the concrete ways a migration can go quietly wrong with a model that isn't up to the task, and how to check your own choice against that bar.

Fixes

• Fixed module version publishing being addressed by a module's bare name instead of its full registry identifier, which could push a version to the wrong module or fail outright.
• Fixed the duplicate-identifier audit check to compare modules by their real registry identifier instead of their bare name — this both removes false alarms when a stack and a module merely share a plain name, and now catches real collisions that share a registry identifier.
• Failed calls to the destination account now report which operation was refused, on which entity, and a specific next step based on the reason (not found, access denied, already exists, or an invalid value) instead of a generic error.
• Fixed a case where a person approving an action from their own terminal could be wrongly asked to supply a proof token that is only ever issued to an AI assistant.

Security Updates

• Closed a gap where an assistant could obtain the token proving it had read a required guidance page without the page's content ever actually reaching its context (for example, by filtering the command's output down to just the token). Such a token is now always accompanied by an explicit warning that it proves nothing unless the full content was read.
• Error text and details coming back from the destination account's API are now stripped of stray control characters before being printed, closing off a path where a malformed or malicious API response could inject terminal escape sequences.

v1.0.0

Features

• Stacks running a Terraform version (or tool) Spacelift's runner doesn't bundle now migrate as runnable CUSTOM stacks: they're bound to a runner image and a generated workflow-tool context instead of landing unable to run. A new setup key supplies the image, with a matching audit finding and repair that tags it per stack unless you tag it yourself.
• Commands that reach the source or apply to Spacelift now require proof that their guidance was read (a token printed at the end of the relevant help topic) and, for anything that actually changes something, an explicit human approval — an AI assistant driving the CLI cannot supply that approval itself, and the refusal names exactly which command a person needs to run.
• Applying a plan now needs a proof token plus an explicit confirm flag, replacing the old apply-token flow. A plan or apply log that scrolled past — a failed apply is the usual case — can now be replayed straight from Spacelift without re-running anything.
• Policies, policy sets, and run tasks are now discovered and surfaced as informational audit findings, so they aren't missed even though neither translates automatically (policy bodies use a different rule language, and run tasks have no direct equivalent) — you recreate each deliberately.
• Private registry providers are now migrated as real provider definitions; only their published version binaries are left for you to republish, since the source can't hand over those signed artifacts.
• Discovery now reads your Spacelift account before touching the source: it records the account's VCS integrations and worker pools, binds each stack and module to the integration that actually serves its repository (choosing automatically among several candidates, preferring a healthy one), and fails fast on bad Spacelift credentials or an account with nothing to run on. New audit findings catch a repository with no usable integration, one bound to an integration that isn't actually connected to its account, an unreachable integration, and an account with no available worker.
• A new setup key assigns generated stacks to a private worker pool, with matching audit and repair support; without it, stacks default to the public pool, and generation is only blocked when the account has no public pool to fall back on.
• Secret values held by a shared variable set (rather than a single workspace) can now be captured during the capture step, through a disposable workspace that never touches any of your real ones.
• A repair can now target a single entity instead of only a shared setting, so findings that previously had no fix at all — such as a stack with no VCS repository — can be repaired one stack at a time.
• Reviewed warning and informational findings can now be acknowledged to quiet them from later listings, without losing their annotation in the generated code; errors still have to be explicitly accepted at generate time.
• The flags for accepting, acknowledging, and allowing mutations now all accept a comma-separated list as well as repeated flags, so several rules or capabilities can be named in one go.
• The status command now reports capture progress — captured against total, and pushed against captured once finalize has run — for both the staged batch and the whole estate.
• Validating the configuration now also authenticates against Spacelift and names the account, user, and role each set of credentials resolves to, catching a misconfigured destination before anything runs.
• Commands now find the workspace by walking up from the current directory, so they work from a subdirectory without repassing the workspace location.

Fixes

• A repair no longer reports a finding as fixed when it wasn't: anything that could not actually be applied now shows up in a named list with a reason, and the hint printed after later steps now names the correct next command instead of the wrong one.
• Finalizing a batch now refuses to mark it migrated until every captured secret and state value has actually been pushed, closing a gap where a batch could be marked complete while still missing secrets or state; the state step also names each stack it skipped and why.
• Non-sensitive variable and file values in generated code are now marked explicitly readable, instead of inadvertently generating as write-only and becoming unreadable once applied.
• A Terraform version given as a range, rather than an exact version, is now correctly classified as needing the CUSTOM workflow tool when that range could reach a version the runner doesn't support.
• Captured secret values are now matched by variable kind as well as name, fixing a case where a Terraform variable and an environment variable sharing the same name could have their captured values swapped.
• The capture step now always reports how many secret values it captured versus skipped, instead of sometimes omitting that count from the report.
• The capture step now runs its capabilities one at a time instead of concurrently — running two together previously made them compete for the same account-level limits at the source, silently slowing or under-capturing one of them.
• Setting a configuration value no longer writes a resolved secret into the config file on disk — it keeps the original variable reference, so a token doesn't end up persisted in plaintext.
• Repeated discovery runs no longer report an agent pool as changed just because a volatile live counter ticked between runs.
• Accepting the finding for a stack with no VCS repository now renders a stack that can actually plan, instead of one missing a required argument.

v1.0.0-rc.4

Features

• Discovering an estate now authenticates against the destination Spacelift account before touching the source, so an invalid Spacelift credential is caught immediately instead of only surfacing later. The destination account's VCS integrations are now recorded and reported alongside the migrated estate.
• Discovering an estate now also records the destination account's worker pools, and the migration is now failed outright with a clear error if the account has no worker available to run anything on.
• Stacks and modules are now matched to a specific destination VCS integration automatically, or via an explicit setting when more than one integration could serve the same repository. A repository that can't be matched to any integration is now flagged as an error.
• Generated stacks and modules now name their bound VCS integration explicitly rather than relying on the account's default, and repositories that aren't tied to any VCS integration ("raw git") are now fully supported. A raw-git repository missing its URL is now flagged as an error.
• Stacks that use a custom workflow tool instead of Spacelift's built-in runner now generate as runnable: a runner image and a shared workflow definition are generated and attached automatically, instead of producing a stack with no way to actually execute.
• Policies and policy sets are now discovered and reported as needing manual attention, since they can't be automatically translated and have to be hand-rewritten on the Spacelift side.
• Run tasks are now discovered and reported as needing manual attention, since the external integration behind them has to be reconnected by hand.
• Private registry providers are now discovered and generated as real, migratable resources. Published provider versions still can't be captured, so the generated output and the migration report both call out that versions need to be re-published through your own pipeline.
• A new opt-in capability can recover secret values that were masked because they came from a shared variable set rather than a single workspace. It works through a disposable, throwaway workspace that is always cleaned up afterward, and is kept separate from ordinary secret capture so enabling one doesn't silently start doing the other.
• When more than one source-mutating capability is allowed in the same run, they now execute one at a time instead of concurrently, avoiding contention over the same account's resources.
• The most recently applied plan or apply log can now be replayed on demand, without re-running anything — useful when the original output has scrolled out of view.
• Commands that change the source system, or that apply a plan, now require an explicit approval from a person before proceeding. An AI agent driving the CLI can no longer approve its own mutation or apply step; it's refused and told which approval command a person needs to run instead.
• An AI agent driving discovery or a source-mutating run must now first read the relevant guidance and supply proof of having done so before the command will proceed. This has no effect when the CLI is run directly by a person.

Fixes

• Discovering an estate no longer records a live agent-pool count that fluctuates independently of the estate itself, so repeated discovery of an unchanged estate now produces stable, unchanging results.
• The choice between the open-source and custom Terraform workflow tool is now computed correctly for every form of version constraint (ranges, exclusive bounds, shorthand notation), fixing cases where a workspace could previously be generated with the wrong tool.
• Forcing generation of a stack with no VCS repository now produces a stack that can actually be planned, with clear placeholder values for the missing repository and branch, instead of an empty and invalid configuration.
• The guidance shown after a source-mutating run now lists the remaining steps in the correct order, and a migration can no longer be marked fully finished while it still holds captured secrets or state that haven't been pushed — that step now refuses to run until they are. Items skipped during that step are now listed individually along with the reason each was skipped.
• Piped, agent-facing output no longer fails outright when a result contains control characters (for example, from a captured, colorized plan) — they're stripped instead of causing the whole command to error.
• A run that successfully captures secrets now shows up with its captured and skipped counts in the summary, instead of that capability's result being silently absent from the report.

Security Updates

• Setting an unrelated configuration value no longer rewrites secret values into the configuration file in plaintext; secret references are now left untouched.
• Captured secret values are now matched by both their origin and their name, fixing a case where a Terraform variable and an environment variable sharing the same name could have the wrong value written back to one of them.
• Added guidance on securely disposing of the local working directory once a migration is verified, since it holds captured secret values and infrastructure state unencrypted on disk for the duration of the migration.

v1.0.0-rc.3

Features

• Discovering now first connects to the destination Spacelift account and records its VCS integrations and worker pools, so a bad Spacelift credential (or an account with nothing that can actually run a plan) fails immediately instead of after a long walk through the source estate.
• Exported stacks and modules are matched against the destination account's VCS integrations and, where exactly one match exists, bound to it; an account with more than one matching integration can be disambiguated with a new source setting. Generated code now renders that bound integration and, for repositories tracked by raw git, a dedicated block carrying the repository URL.
• Added an audit check that fails an account outright if it has no worker pool able to accept a run — no undrained worker in any private pool, and no usable public pool — since the generated migration itself needs somewhere to run.
• Added a context-secrets mutation capability: secret values held on a shared variable set, which previously always came over empty, can now be recovered (opt-in, same throwaway-and-revert discipline as the existing secret capture) alongside per-workspace secrets.
• Terraform private-registry providers are now discovered, audited, and generated as their Spacelift equivalent, placed in their real space; only the provider definition migrates, so a finding flags each one to re-publish its versions afterwards.
• Run tasks are now discovered and surfaced as an audit-only finding naming each one and how many workspaces use it, since the external callout has to be reconnected by hand.
• Policies and policy sets are now discovered and surfaced as audit-only findings, since there's no reliable automatic translation of the underlying rules.
• Added a publish last command that re-fetches and replays the admin stack's most recent plan or apply log, so a scrolled-past run can be reviewed again without re-running or re-planning.
• Applying a plan now requires proof the latest plan was actually read and a person's explicit approval; an agent acting alone can no longer trigger an apply, and the flags involved have changed accordingly.
• Mutating a staged batch now requires a person's prior, explicit approval of exactly which capabilities will run; an agent cannot grant that approval on its own, and approval is invalidated automatically if the staged batch changes before it runs.
• An AI agent driving discover or mutate is now required to first read the relevant guidance and prove it did so; a human at an interactive terminal is unaffected.
• Stacks whose source Terraform version is newer than what the runner supports are now generated in a runnable state on a custom workflow, with a scaffolded runner image and init/plan/apply/destroy commands, instead of landing broken.

Fixes

• A stack or module with no VCS repository, generated with the corresponding finding ignored, now renders a placeholder that actually plans instead of an empty required value that fails validation outright.
• A Terraform workflow-tool version expressed as a range (rather than an exact version) is now classified correctly, fixing cases where a bounded range was incorrectly treated as requiring the custom workflow.
• A captured secret is now matched by its kind as well as its key, fixing a case where a Terraform variable and an environment variable sharing the same name could have their captured values cross over.
• When more than one mutation capability is requested in a single run, they now execute one at a time rather than concurrently, avoiding the risk of two capabilities colliding while writing to the local store at the same time.
• Discover no longer captures an agent pool's live agent count, which changes as agents connect and disconnect and was making repeated discover runs against an unchanged estate report differently each time.
• Finalizing a staged batch now refuses to proceed while it still holds captured secret values or state that haven't been pushed to Spacelift yet, naming what's outstanding and which command to run first; the suggested next step after mutating now points through the right order of finalize steps; and a finalize report now names each skipped item and the specific reason it was skipped, rather than just a count.
• Fixed capitalization of vendor acronyms (VCS, API, ID, JSON, SHA, URL) in human-readable table headers.
• Output written for piping (agent use) is no longer vulnerable to control characters or escape sequences leaking through from source data and corrupting the encoded result.

Security Updates

• Fixed a flaw where setting any single configuration value, even an unrelated one, could rewrite the whole configuration file with previously-referenced secrets (source tokens, the Spacelift key secret, VCS tokens) expanded to their literal plaintext on disk, instead of preserving the original reference.

v1.0.0-rc.2

Features

• Source-mutating steps (starting with mutate) now refuse to run until a person has explicitly approved them, using a new liftoff approve <key> command — an assistant driving the CLI is detected and can't grant this approval itself. The approval covers only the exact operation shown and is spent on first use, so it can't be reused or replayed against a batch that has since changed.
• Several steps (including discover and mutate) now also require proof that their guidance was actually read: liftoff skills <topic> prints a proof token at the end of the page, and the gated command accepts it via a new --proof-token flag. A refusal always names the exact command to run next.
• Publishing changes has moved onto the same model: the old --apply-token flag is gone. Applying a plan now takes --confirm together with --proof-token (proof the plan was read) and, like other mutating steps, requires a person's approval before it proceeds.
• A source can now put its own extra approval or read-proof requirement in front of specific commands, so a vendor-specific risky operation can be protected without changes to the generic CLI.
• Discover and audit now surface a source's policies and policy sets (informational findings only). Since policy rule bodies can't be mechanically translated to Spacelift's policy language, nothing is auto-generated — each finding names the policy's kind and enforcement level, or the policy set's scope and coverage, with guidance on recreating it by hand.
• Stacks whose Terraform/OpenTofu version isn't one of Spacelift's built-in runner versions can now generate onto a custom workflow tool backed by your own runner image, instead of failing to generate a runnable stack. A new custom_runner_image setting controls the image reference, and audit --repair fills it in (tagging it per-stack by version unless you've pinned your own tag). Audit also gained findings that flag a stack missing its runner image, or an unsupported/unparseable version string, before generation would produce something that can't run.

Fixes

• Configuring settings with configure --set no longer writes already-resolved secret values into the saved configuration file — a ${VAR}-style secret reference is now preserved as a reference on every save, instead of being replaced by the plaintext value it resolves to.
• Discover no longer records an agent pool's live connected-agent count, which fluctuates independently of the estate and was making repeated discovers register spurious changes. Discover is idempotent again for accounts using agent pools.

v1.0.0-rc.1

No user-visible changes in this release.

v0.0.2

Features

• Discover now also captures agent pools from your Terraform Cloud/Enterprise organization. Since a Spacelift worker pool is the equivalent but has to be stood up separately (install workers, register the pool), each agent pool is surfaced as an informational audit finding — naming the pool, how many agents it has, and how many workspaces use it — rather than being generated for you. It can be dismissed once you've provisioned the matching worker pools.
• Release candidates are now published to their own Homebrew cask alongside the regular one, so you can opt in to try an upcoming version before it becomes the default install; installing the regular package is unaffected and always gets the latest final release.

Fixes

• Corrected the install instructions: VERSION and INSTALL_DIR need to be set right before sh in the install command, not before curl — placing them before curl had no effect on the install.