v0.5.0

This release hardens firebrick against an agent that edits its own workspace:
fbk asks before it applies mounts or network changes from .firebrick.yml,
and several paths that trusted agent-controlled input are closed. Browser logins
from inside a sandbox now complete, git can push to GitHub with a GH_TOKEN
secret, and the crates are published to crates.io.

Breaking changes

• fbk start, fbk run and fbk network ask before they apply mounts or
  network settings from .firebrick.yml that you haven't approved, and show
  the changes. Approvals are stored per workspace in
  ~/.config/firebrick/approved.yml. Without a terminal the command fails; pass
  --yes (fbk run --yes <command>) in scripts to approve without asking.
  (#140)
• fbkd no longer falls back to /tmp/firebrick for its secrets, SSH keys and
  logs. When HOME and the XDG variables aren't absolute paths it refuses to
  start, and fbk reports why. (#139)
• fbk secret set --allow-host rejects single-label wildcards such as *.com,
  following the same rules as the network rules in .firebrick.yml. (#141)

Features

• OAuth browser logins in a sandbox, such as gh auth login --web or Claude
  Code, complete: fbkd forwards the callback port into the sandbox before it
  opens the URL in the host browser. (#118)
• The firebrick-base image configures a git credential helper, so git clone,
  pull and push over HTTPS to github.com work once fbk secret set GH_TOKEN
  is set. (#123)
• Install firebrick from crates.io with cargo install firebrick-cli firebrick-daemon. (#120)
• The user documentation moved to https://firebrick-sandbox.dev. (#122, #123)

Fixes

• fbk only talks to a daemon socket served by your own user or root, so
  another local user can't intercept requests such as fbk secret set. (#139)
• fbk stop, fbk rm, fbk network, fbk port and fbk secret --scope sandbox without a name refuse to act on a sandbox that belongs to another
  workspace, like fbk start already did. (#138)
• Terminal control characters in guest output, for example from mise when a
  sandbox starts, are stripped before they reach your terminal or the daemon
  log. (#137)

What's Changed

• Forward localhost OAuth callback ports into the sandbox by @wmeints in #118
• feat(release): publish the crates to crates.io in the release workflow by @wmeints in #120
• docs(website): add the user documentation and deploy it to GitHub Pages by @wmeints in #122
• Configure a git credential helper for GitHub tokens in firebrick-base by @wmeints in #123
• Update dependencies to microsandbox 0.7.8 and russh 0.64.1 by @wmeints in #124
• Build the landing page and docs theme from the product design by @wmeints in #126
• chore: add a Fable security-reviewer agent by @wmeints in #127
• ci: run each workflow only for the changes it checks, and stop recompiling microsandbox between steps by @wmeints in #135
• docs(website): explain what the agent can change in the workspace by @wmeints in #136
• Stop falling back to the temp dir for fbkd's data and logs, and check the socket owner in fbk by @wmeints in #139
• fix(cli): refuse name-less commands on a sandbox that belongs to another workspace by @wmeints in #138
• fix(daemon): strip terminal control characters from guest output by @wmeints in #137
• fix(daemon): reject single-label wildcards such as *.com in secret allowed hosts by @wmeints in #141
• Ask before applying unapproved mounts and network changes from .firebrick.yml by @wmeints in #140
• chore: release v0.5.0 by @wmeints in #142

Full Changelog: v0.4.0...v0.5.0