v1.0.0

Features

• Stacks running a Terraform version (or tool) Spacelift's runner doesn't bundle now migrate as runnable CUSTOM stacks: they're bound to a runner image and a generated workflow-tool context instead of landing unable to run. A new setup key supplies the image, with a matching audit finding and repair that tags it per stack unless you tag it yourself.
• Commands that reach the source or apply to Spacelift now require proof that their guidance was read (a token printed at the end of the relevant help topic) and, for anything that actually changes something, an explicit human approval — an AI assistant driving the CLI cannot supply that approval itself, and the refusal names exactly which command a person needs to run.
• Applying a plan now needs a proof token plus an explicit confirm flag, replacing the old apply-token flow. A plan or apply log that scrolled past — a failed apply is the usual case — can now be replayed straight from Spacelift without re-running anything.
• Policies, policy sets, and run tasks are now discovered and surfaced as informational audit findings, so they aren't missed even though neither translates automatically (policy bodies use a different rule language, and run tasks have no direct equivalent) — you recreate each deliberately.
• Private registry providers are now migrated as real provider definitions; only their published version binaries are left for you to republish, since the source can't hand over those signed artifacts.
• Discovery now reads your Spacelift account before touching the source: it records the account's VCS integrations and worker pools, binds each stack and module to the integration that actually serves its repository (choosing automatically among several candidates, preferring a healthy one), and fails fast on bad Spacelift credentials or an account with nothing to run on. New audit findings catch a repository with no usable integration, one bound to an integration that isn't actually connected to its account, an unreachable integration, and an account with no available worker.
• A new setup key assigns generated stacks to a private worker pool, with matching audit and repair support; without it, stacks default to the public pool, and generation is only blocked when the account has no public pool to fall back on.
• Secret values held by a shared variable set (rather than a single workspace) can now be captured during the capture step, through a disposable workspace that never touches any of your real ones.
• A repair can now target a single entity instead of only a shared setting, so findings that previously had no fix at all — such as a stack with no VCS repository — can be repaired one stack at a time.
• Reviewed warning and informational findings can now be acknowledged to quiet them from later listings, without losing their annotation in the generated code; errors still have to be explicitly accepted at generate time.
• The flags for accepting, acknowledging, and allowing mutations now all accept a comma-separated list as well as repeated flags, so several rules or capabilities can be named in one go.
• The status command now reports capture progress — captured against total, and pushed against captured once finalize has run — for both the staged batch and the whole estate.
• Validating the configuration now also authenticates against Spacelift and names the account, user, and role each set of credentials resolves to, catching a misconfigured destination before anything runs.
• Commands now find the workspace by walking up from the current directory, so they work from a subdirectory without repassing the workspace location.

Fixes

• A repair no longer reports a finding as fixed when it wasn't: anything that could not actually be applied now shows up in a named list with a reason, and the hint printed after later steps now names the correct next command instead of the wrong one.
• Finalizing a batch now refuses to mark it migrated until every captured secret and state value has actually been pushed, closing a gap where a batch could be marked complete while still missing secrets or state; the state step also names each stack it skipped and why.
• Non-sensitive variable and file values in generated code are now marked explicitly readable, instead of inadvertently generating as write-only and becoming unreadable once applied.
• A Terraform version given as a range, rather than an exact version, is now correctly classified as needing the CUSTOM workflow tool when that range could reach a version the runner doesn't support.
• Captured secret values are now matched by variable kind as well as name, fixing a case where a Terraform variable and an environment variable sharing the same name could have their captured values swapped.
• The capture step now always reports how many secret values it captured versus skipped, instead of sometimes omitting that count from the report.
• The capture step now runs its capabilities one at a time instead of concurrently — running two together previously made them compete for the same account-level limits at the source, silently slowing or under-capturing one of them.
• Setting a configuration value no longer writes a resolved secret into the config file on disk — it keeps the original variable reference, so a token doesn't end up persisted in plaintext.
• Repeated discovery runs no longer report an agent pool as changed just because a volatile live counter ticked between runs.
• Accepting the finding for a stack with no VCS repository now renders a stack that can actually plan, instead of one missing a required argument.