v0.7.0

This release shows which domains and IP addresses an agent contacts, so you can
see which fbk network allow rules a task needs and spot hosts it shouldn't
reach.

Features

• fbkd records the domains and IP addresses each sandbox contacts, including
  attempts the network rules deny. A logger in the firebrick-base image
  reports each DNS lookup and outgoing TCP and UDP destination. Sandboxes
  created by an older version have no record until you remove and start them
  again; custom images need to run the logger. (#156)
• fbk network log shows the record of the project's sandbox, newest first,
  with whether its current rules allow each destination. (#157)

What's Changed

• Add a social card for link previews of the website by @wmeints in #153
• Record the domains and IPs a sandbox contacts through a guest logger on vsock by @wmeints in #156
• Show a sandbox's network activity with fbk network log by @wmeints in #157
• chore: release v0.7.0 by @wmeints in #158

Full Changelog: v0.6.0...v0.7.0

v0.6.0

This release makes .NET tools such as the Aspire CLI work in a sandbox out of
the box, and the docs now explain how to run firebrick on Windows through WSL 2.

Features

• The firebrick-base image includes the ICU library (libicu78), so the
  Aspire CLI and other .NET apps run in a sandbox without installing it first.
  (#151)
• The documentation explains how to run firebrick on Windows through WSL 2,
  including where fbkd writes the SSH config. (#145)

What's Changed

• docs(readme): point users to the website and focus the README on contributors by @wmeints in #144
• Document running Firebrick on Windows through WSL 2 by @wmeints in #145
• docs(crates): add a README to every crate by @ArthurJosephLawson in #148
• chore(ci): update the GitHub Actions to their latest major versions by @wmeints in #149
• feat(image): install libicu78 in the firebrick-base image for Aspire by @wmeints in #151
• chore: release v0.6.0 by @wmeints in #152

New Contributors

• @ArthurJosephLawson made their first contribution in #148

Full Changelog: v0.5.0...v0.6.0

v0.5.0

This release hardens firebrick against an agent that edits its own workspace:
fbk asks before it applies mounts or network changes from .firebrick.yml,
and several paths that trusted agent-controlled input are closed. Browser logins
from inside a sandbox now complete, git can push to GitHub with a GH_TOKEN
secret, and the crates are published to crates.io.

Breaking changes

• fbk start, fbk run and fbk network ask before they apply mounts or
  network settings from .firebrick.yml that you haven't approved, and show
  the changes. Approvals are stored per workspace in
  ~/.config/firebrick/approved.yml. Without a terminal the command fails; pass
  --yes (fbk run --yes <command>) in scripts to approve without asking.
  (#140)
• fbkd no longer falls back to /tmp/firebrick for its secrets, SSH keys and
  logs. When HOME and the XDG variables aren't absolute paths it refuses to
  start, and fbk reports why. (#139)
• fbk secret set --allow-host rejects single-label wildcards such as *.com,
  following the same rules as the network rules in .firebrick.yml. (#141)

Features

• OAuth browser logins in a sandbox, such as gh auth login --web or Claude
  Code, complete: fbkd forwards the callback port into the sandbox before it
  opens the URL in the host browser. (#118)
• The firebrick-base image configures a git credential helper, so git clone,
  pull and push over HTTPS to github.com work once fbk secret set GH_TOKEN
  is set. (#123)
• Install firebrick from crates.io with cargo install firebrick-cli firebrick-daemon. (#120)
• The user documentation moved to https://firebrick-sandbox.dev. (#122, #123)

Fixes

• fbk only talks to a daemon socket served by your own user or root, so
  another local user can't intercept requests such as fbk secret set. (#139)
• fbk stop, fbk rm, fbk network, fbk port and fbk secret --scope sandbox without a name refuse to act on a sandbox that belongs to another
  workspace, like fbk start already did. (#138)
• Terminal control characters in guest output, for example from mise when a
  sandbox starts, are stripped before they reach your terminal or the daemon
  log. (#137)

What's Changed

• Forward localhost OAuth callback ports into the sandbox by @wmeints in #118
• feat(release): publish the crates to crates.io in the release workflow by @wmeints in #120
• docs(website): add the user documentation and deploy it to GitHub Pages by @wmeints in #122
• Configure a git credential helper for GitHub tokens in firebrick-base by @wmeints in #123
• Update dependencies to microsandbox 0.7.8 and russh 0.64.1 by @wmeints in #124
• Build the landing page and docs theme from the product design by @wmeints in #126
• chore: add a Fable security-reviewer agent by @wmeints in #127
• ci: run each workflow only for the changes it checks, and stop recompiling microsandbox between steps by @wmeints in #135
• docs(website): explain what the agent can change in the workspace by @wmeints in #136
• Stop falling back to the temp dir for fbkd's data and logs, and check the socket owner in fbk by @wmeints in #139
• fix(cli): refuse name-less commands on a sandbox that belongs to another workspace by @wmeints in #138
• fix(daemon): strip terminal control characters from guest output by @wmeints in #137
• fix(daemon): reject single-label wildcards such as *.com in secret allowed hosts by @wmeints in #141
• Ask before applying unapproved mounts and network changes from .firebrick.yml by @wmeints in #140
• chore: release v0.5.0 by @wmeints in #142

Full Changelog: v0.4.0...v0.5.0

v0.4.0

This release gives you control over what a sandbox can reach and see: network
allow/deny rules, extra mounts, port forwards and per-sandbox secrets, all
configurable from .firebrick.yml or the new fbk subcommands. Sandboxes also
come up ready to work, with Docker and the project's mise tools installed.

Breaking changes

• fbkd keeps its microsandbox runtime, images, database and sandboxes in
  $XDG_STATE_HOME/firebrick/msb (~/.local/state/firebrick/msb) instead of
  ~/.microsandbox, so a separately installed msb can no longer break it.
  Sandboxes created by earlier versions stay in ~/.microsandbox and no longer
  show up in fbk ls; recreate them after upgrading. Images are pulled again on
  first start. A non-empty MSB_HOME still takes precedence. (#101)

Features

• fbk init writes a default .firebrick.yml for the current directory. (#89)
• Restrict a sandbox's outgoing traffic with a network section in
  .firebrick.yml: with enforce: true, only hosts, domains, IPs and CIDR
  ranges in allow are reachable, and deny rules win. Blocked HTTP and HTTPS
  requests get a page that names the host. (#92)
• fbk network allow, fbk network deny and fbk network policy enable|disable change the rules of an existing sandbox and update
  .firebrick.yml. (#97)
• fbk network disable removes a sandbox's network device entirely; fbk network enable restores it. (#103)
• Mount extra host directories into the sandbox with a mounts section in
  .firebrick.yml, optionally read-only. Host paths may start with ~ or
  ~user. (#95)
• Forward host ports to servers in the sandbox with a ports section in
  .firebrick.yml, or live with fbk port forward <host>:<guest> and fbk port rm. (#96, #99)
• Secrets can be scoped to one sandbox with fbk secret set --scope sandbox; a
  sandbox-scoped secret overrides the global one with the same name in that
  sandbox only. (#100)
• xdg-open and $BROWSER inside the sandbox open http and https URLs in the
  host browser, for example for device login flows. Local addresses are refused,
  and enforced network rules apply. (#104)
• fbk shows a progress bar while it pulls the sandbox image. (#102)
• The firebrick-base image includes Docker, and every sandbox gets a dedicated
  disk for /var/lib/docker, sized with volumes.docker in .firebrick.yml.
  (#83, #84)
• fbkd trusts the workspace's mise config and runs mise install when a
  sandbox starts, so the project's tools are ready. Set mise: false in
  .firebrick.yml to turn it off. (#85)

Fixes

• fbk start and fbk run refuse to reuse a sandbox that mounts a different
  working directory, instead of silently giving the agent access to another
  project's files when two directories hash to the same name. (#87)

What's Changed

• feat(daemon): give every sandbox a dedicated ext4 disk for /var/lib/docker by @wmeints in #83
• feat(images): install Docker from Docker's apt repository in firebrick-base by @wmeints in #84
• Install the workspace's mise tools when a sandbox starts by @wmeints in #85
• test(daemon): show the daemon's logs in the vm-tests output by @wmeints in #86
• feat(cli): refuse to reuse a sandbox that mounts another directory by @wmeints in #87
• feat(cli): add fbk init to write a default .firebrick.yml by @wmeints in #89
• Enforce network allow/deny rules from .firebrick.yml by @wmeints in #92
• Forward host ports to the sandbox from .firebrick.yml by @wmeints in #96
• feat(spec): mount extra host directories into the sandbox from .firebrick.yml by @wmeints in #95
• Add fbk network commands to change an existing sandbox's egress rules by @wmeints in #97
• Add herdr skill for controlling Herdr panes and agents by @wmeints in #98
• Add fbk port forward and fbk port rm that apply live and update .firebrick.yml by @wmeints in #99
• Add a per-sandbox scope for secrets by @wmeints in #100
• feat(daemon): keep the microsandbox home in firebrick's XDG state directory by @wmeints in #101
• Show image pull progress when fbk creates a sandbox by @wmeints in #102
• Add fbk network enable/disable to turn a sandbox's network off by @wmeints in #103
• test(daemon): let vm-tests runs share the microsandbox home safely by @wmeints in #106
• feat(daemon): open http/https URLs from the sandbox in the host browser by @wmeints in #104
• feat(agents): add a test-reviewer agent for test quality and test gaming by @wmeints in #108
• Install protoc through mise by @wmeints in #110
• feat(agents): add an implementation-reviewer agent and a review-branch workflow by @wmeints in #111
• Add gh and Claude Code to the mise toolset and pin all tool versions by @wmeints in #112
• docs: add the website design mockups by @wmeints in #113
• Add a create-release skill that releases through a version bump PR by @wmeints in #114
• Set up the Astro website with its checks and reviewers by @wmeints in #115
• chore: release v0.4.0 by @wmeints in #116

Full Changelog: v0.3.0...v0.4.0

v0.3.0

What's Changed

• Overhaul the agent harness and isolate the vm-tests by @wmeints in #47
• Use xterm-256color as the terminal type in sandboxes by @wmeints in #48
• Register sandbox hosts in VS Code's Remote-SSH settings and print an open-folder command by @wmeints in #60
• Register sandboxes as Zed remote projects and print an open command by @wmeints in #62
• fix(daemon): refuse to remove a running sandbox unless anvil rm --force is passed by @wmeints in #63
• Log the original error behind generic daemon errors by @wmeints in #64
• feat(images): add build-essential, pkg-config and libssl-dev to the anvil-base image by @wmeints in #71
• refactor: rename anvil to firebrick (fbk/fbkd) by @wmeints in #73
• Make the crates publishable with a firebrick-proto crate by @wmeints in #74
• Add a --version flag to fbk by @wmeints in #75
• feat(daemon): restrict the daemon socket to its owner by @wmeints in #78
• Name new sandboxes after a hash of the working directory by @wmeints in #79

Full Changelog: v0.2.1...v0.3.0

v0.2.1

What's Changed

• Fix release job artifact download and bump to 0.2.1 by @wmeints in #46

Full Changelog: v0.2.0...v0.2.1