# Changelog

All notable changes to firecrab are documented in this file.
Sections are **Added**, **Changed**, **Deprecated**, **Fixed**, and **Improved**; version headings match the Cargo workspace version.

## Releases

| Version | Date | Work |
| --- | --- | --- |
| [Unreleased](#unreleased) | — | — |
| [0.4.3](#043---2026-11-02) | 2026-11-02 | AI Sandbox, CODE workspaces, registry kernels and inactive VM network changes |
| [0.4.2](#042---2026-11-01) | 2026-11-01 | React dashboard and MicroVM agent workspaces |
| [0.4.1](#041---2026-10-30) | 2026-10-30 | Latest managed installations and cross-platform updates |
| [0.4.0](#040---2026-10-30) | 2026-10-30 | [Changes since v0.3.1](https://github.com/SteelCrab/firecrab/compare/v0.3.1...v0.4.0) |
| [0.3.1](#031---2026-10-06) | 2026-10-06 | [#123], [#314], [#315], [#318], [#324], [#330], [#331], [#332], [#333], [#343], [#351], [#358], [#359], [#360], [#368], [#378] |
| [0.3.0](#030---2026-09-29) | 2026-09-29 | [#210], [#266], [#287], [#290], [#294], [#295], [#297], [#312] |
| [0.2.2](#022---2026-09-15) | 2026-09-15 | [#269], [#270], [#272], [88ba35d], [729bb47] |
| [0.2.1](#021---2026-09-14) | 2026-09-14 | [#262], [#263], [#264], [#265] |
| [0.2.0](#020---2026-09-03) | 2026-09-03 | [#146], [#178], [#183], [#184], [#186], [#176], [#190], [#198], [#131], [#188], [#194], [#208], [#232], [#254], [45790c3], [1ffba72], [1a44619], [73d5fe1], [76f6ef3] |
| [0.1.2](#012---2026-08-21) | 2026-08-21 | [#145], [#147], [#151], [#152], [#158], [#163], [#165], [#171], [#174], [#175] |
| [0.1.1](#011---2026-08-17) | 2026-08-17 | [#141], [#142], [#143] |
| [0.1.0](#010---2026-08-16) | 2026-08-16 | First public release |

## [Unreleased]

Entries land here as work merges, and move under the next version heading when that release is cut.

### Added

- AI Sandbox **Workspace** has **Rename**. It opens an inline field (Enter
  saves, Esc cancels) and renames the workspace and its VM together, so AI
  Sandbox, the MicroVM list and the CODE › VS Code project card show the new
  name. `PATCH /api/workspace-setups/{id}` with `{ "name": "..." }` writes both
  names in one SQLite transaction; a failure keeps both old names. Names follow
  the VM rule: 1–64 ASCII letters, numbers, `.`, `_` or `-`, starting with a
  letter or number. A running VM can be renamed. Its hostname, SSH keys, files
  and AI sessions depend on the VM ID, not the name, so they do not change.
  Firecrab refuses the rename while the workspace is still preparing, while the
  VM starts, stops or pauses, and for VMs that pools, builders, queues, sandbox
  environments, cluster workers, MicroServices or stacks manage.
- AI Sandbox **App address** has **View locally**. It opens the VM's running
  app at `http://127.0.0.1:<port>/` on the computer that runs Firecrab,
  through one SSH loopback forward to the VM. It needs no token and publishes
  nothing to the internet. Firecrab uses the app's own port when that port is
  free on the computer, else a free port, and checks the address once. The
  address only opens in a browser on that computer. **Stop local access**,
  **Stop app**, an app port change, a VM stop and a Firecrab service exit end
  the forward. It does not count as the HTTPS check for a public address.
  See [#576](https://github.com/SteelCrab/firecrab/issues/576).
- AI Sandbox asks for GitHub's `workflow` permission when it connects a VM's
  GitHub account, so agents can push GitHub Actions workflow files such as the
  one **Create workflow** makes. An account connected without it shows
  **Add workflow permission** on **Connect accounts**. It adds the permission
  with the same one-time code, through `gh auth refresh --scopes workflow` in
  the VM, and keeps the account's other permissions. App run shows the same
  hint next to **Create workflow**.
- AI Sandbox can install and use xAI's official Grok Build CLI (`grok`). It
  signs in inside the VM with `grok login --device-auth`; Firecrab does not
  collect or store keys. A task can pick a Grok model by name. Grok Build keeps
  its own reasoning effort, starts a new conversation after a VM restart, and
  shows no board preview. It needs an xAI subscription that includes Grok Build.
  See [#576](https://github.com/SteelCrab/firecrab/issues/576).

### Changed

- The CODE menu now opens **VS Code**, a read-only list of projects linked in
  AI Sandbox. Each open agent session has one link to its AI Sandbox editor.
  macOS and Windows hosts show their own service commands when the main server
  dashboard at `127.0.0.1:5523` cannot reach the host. Linux hosts show that
  AI Sandbox editors are not supported there yet.
- CODE workspaces, their runtime, editor, agent execution and verification
  routes under `/api/code/` are removed. Their MicroVMs stay as regular
  MicroVMs, and their saved records are no longer read.
- A macOS microManager without a saved allocation gets 8 vCPU, but never more
  than the Mac's CPU count, and 16 GiB RAM, reduced so that macOS keeps 8 GiB,
  but at least 4 GiB. Unsaved controller (Sleepy) settings use the same CPU and
  RAM defaults, and the resource status in controller mode shows the CPU and
  RAM its daemon boots with. Saved allocations and settings keep their values. New AI Sandbox workspaces default to 4 vCPU,
  8 GiB RAM and a 16 GiB disk.
  See [#576](https://github.com/SteelCrab/firecrab/issues/576).
- AI Sandbox's App run no longer has a security scan. It runs tests, the build
  and the app. The first scan downloaded Trivy's 132 MB vulnerability database
  and wrote about 1 GB into the VM, which could overload a small VM until SSH
  and terminals stopped responding. A new GitHub Actions workflow from
  **Create workflow** runs only the tests and the build. Saved App run settings
  still load, and a run that an older build stopped on scan findings shows as
  failed. A VM that already ran a scan keeps Trivy and its cache (about 1 GB)
  until you remove them in the VM:
  `rm -rf /root/.cache/trivy /root/.local/bin/trivy`. An existing
  `.github/workflows/firecrab-checks.yml` keeps its Trivy step until you edit it.

### Fixed

- AI Sandbox sessions work again after their MicroVM stops and starts. The next
  status refresh starts the VM's Herdr runtime and reconnects each open session
  in its folder. Claude Code and Codex continue their saved conversation; a
  session without a recorded conversation starts a new one and says so. Waiting
  tasks are never sent twice, and sign-in or closed sessions are not started again.
- AI Sandbox keeps Claude Code conversations across a VM restart when Claude Code
  moves to another conversation in the same process, for example when it starts
  itself again in auto mode or after `/clear`. Status refreshes record the id
  that the pane's own Claude Code process registers, at most every 10 seconds.
  A resumed session keeps the permission mode its transcript last recorded
  (`acceptEdits`, `auto`, `dontAsk` or `plan`).
- AI Sandbox starts Codex with `--no-daemon`, so each session's own process holds
  its conversation. Codex board cards show their latest messages, and a chosen
  reasoning effort no longer prints the shared background server warning.
- The App run log no longer shows a `curl: (7) Failed to connect` line while it
  waits for the test app to start, which made a passed run look failed. When the
  app answers, the log ends with `Test application is ready at http://127.0.0.1:<port>`.
- AI Sandbox's public HTTPS check for App preview no longer fails right after
  a temporary address starts. A new `trycloudflare.com` name can be missing
  from DNS at first, and the computer's resolver keeps that answer for up to
  60 seconds. Firecrab now shows the address only after the tunnel registers
  its connection, and the HTTPS check retries connect, DNS and timeout errors
  for about 90 seconds while App preview shows **Preparing the address**. Any
  HTTP response ends the wait. The check of a connected Firecrab address
  retries the same way. See [#576](https://github.com/SteelCrab/firecrab/issues/576).
- AI Sandbox keeps the temporary public address when the app restarts.
  **Stop app** and a new **Verify and run** with the same app port leave the
  tunnel and its address on, so a connected Firecrab address keeps working; a
  new run still needs a new HTTPS check. While the app is stopped, visitors
  see an error page and App run says so. A new app port, **Stop public
  access** and a VM restart stop the tunnel. A tunnel that an older build
  started keeps running and is used the same way.

## [0.4.3] - 2026-11-02

AI Sandbox quick start and release validation updates for the React dashboard and guest workflows.
See [#572](https://github.com/SteelCrab/firecrab/pull/572),
[#573](https://github.com/SteelCrab/firecrab/pull/573) and
[#577](https://github.com/SteelCrab/firecrab/pull/577).

### Added

- Change an inactive MicroVM's MicroNetwork from its Overview or Network tab.
  Save the VM settings and replacement IP lease together, then use the selected
  network on the next start. See [#137](https://github.com/SteelCrab/firecrab/issues/137).
- AI Sandbox quick start prepares Ubuntu 26.04 LTS with 2 vCPU, 4 GiB RAM,
  a 32 GiB disk and the selected coding tools. The right-side navigation connects
  workspace preparation, accounts, AI tasks, app verification and preview.
- Connect a fixed Firecrab app address to the guest-owned preview tunnel and
  explicitly verify its public HTTPS response before opening the app preview.
- CODE workspaces connect GitHub checkouts, retained MicroVMs, Web VS Code,
  terminals and assigned AI AUTH agents through the React dashboard.
- Repository defaults and existing AI AUTH accounts keep setup short.
  Interrupted operations and agent requests recover without automatic replay.

### Changed

- Align Rust, dashboard and E2E package versions and lockfiles on 0.4.3.
- Install prebuilt kernels from registry.firecrab.dev after checking package
  checksums, architecture and required VM drivers, including Vsock.

### Deprecated

- None.

### Fixed

- Match live OCI image inspection, image deletion and SSH browser checks to
  the current React dashboard controls. Allow guest actions up to 30 seconds.
- Prevent dashboard isolation test fixtures from selecting the same free port
  by starting each server before allocating the next fixture's port.
- Use clearer Korean prompts, status messages and action descriptions throughout
  the dashboard.

### Improved

- Show kernel installation stages, publication dates and the actual download
  source in a responsive detail panel. Resume progress after reload and support
  cancellation with safe cleanup. See [#586](https://github.com/SteelCrab/firecrab/pull/586).
- Resume journaled workspace preparation after browser or controller restarts.
  Idempotent retries preserve the reserved VM and avoid duplicate creation.
- Verify that creating and removing an SSH port forward preserves existing
  forwards in the console's SSH tab.

## [0.4.2] - 2026-11-01

React dashboard migration and MicroVM workspace recovery. See [#554](https://github.com/SteelCrab/firecrab/pull/554).

### Added

- MicroVM agent workspaces provide Codex and Claude Code sessions, a task board,
  GitHub authentication and a web editor for the VM's working directory.

### Changed

- Replace the Rust/WASM dashboard with React and xterm.js. Resource, Pipe,
  deployment and Sandbox workflows use responsive React forms and recover
  ongoing image and kernel jobs after reload.
- Preserve the established navigation symbols, flat lists and full-width page
  headers after the React migration. Restore Shell and volume creation drawers
  and separate physical host information from management VM usage.
- Add dashboard-only development connections to an existing private instance.
  UI changes reload without deploying guest binaries or restarting its VMs.


### Deprecated

- None.

### Fixed

- Resume kernel installations and OCI image imports after reload and show compact
  progress without starting duplicate jobs.
- Restore terminal size negotiation, shared viewer dimensions and resize signals
  for interactive guest programs.
- Align Secrets connection settings with the API's supported providers.

### Improved

- Keep fixture browser tests separate from real guest tests and run both against
  built React bundles. Update live browser workflows to the current forms.
- Extend native recovery and terminal transport coverage without lowering the
  patch coverage requirement.

## [0.4.1] - 2026-10-30

Hotfix for macOS and Windows managed installations and updates.

### Added

- macOS and Windows CLI support `firecrab update --check` and `--apply` for
  the managed Debian guest.

### Changed

- Explicit `service install` and `service reinstall` select the latest stable
  Firecrab release at installation time and verify its published SHA-256 sums.
  Installed manifests retain the exact selected tag for validation and repair.
- Primary and private development installs share this selection. The default
  manifest contains no Firecrab release pin, and the separate development
  release overlay has been removed.

### Deprecated

- None.

### Fixed

- Managed installations no longer install the legacy v0.2.2 Firecrab snapshot.
- Managed updates install matching API, CLI, helper and service units together,
  without starting an old API against data created by development builds or
  sending an old CLI protocol to a newer helper.

### Improved

- Update failures restore development service settings and preserve diagnostics.
- Rust, frontend and E2E package versions and lockfiles agree on 0.4.1, with a
  release check that rejects mismatched versions or fixed managed-install pins.

## [0.4.0] - 2026-10-30

This release adds AI Sandbox, declarative stacks, MicroService deployment and
recovery, database and queue integrations, security groups, and a refreshed dashboard.

### Added

- Pipe Database connects to MySQL and PostgreSQL with verified TLS. The
  dashboard can browse and edit rows, manage backups and restore, and apply
  versioned schema changes. Services can use private database accounts and
  managed RabbitMQ change delivery. Tracked in [#412](https://github.com/SteelCrab/firecrab/issues/412).

- Queue resources use a persistent RabbitMQ MicroVM for durable messaging.
  Dashboard, REST and CLI manage the engine, queues and connection credentials.
  MicroServices can bind separate publisher and consumer credentials. Messages
  survive receiver disconnects; the initial engine runs on one VM. Tracked in
  [#479](https://github.com/SteelCrab/firecrab/issues/479).

- PipeStorage connects AWS S3 buckets for object browsing, uploads and downloads.
  MicroServices can use a saved connection, with credentials kept out of public
  VM and deployment records. Tracked in [#439](https://github.com/SteelCrab/firecrab/issues/439).

- Security groups apply IPv4 TCP and UDP ingress and egress rules to MicroVMs.
  MicroService replicas inherit their configured group. Rules can be managed in
  the dashboard and REST API. Upgrade the API and helper together for the new
  helper protocol. Tracked in [#59](https://github.com/SteelCrab/firecrab/issues/59).

- MicroVM schedules support one-time and recurring start and stop operations
  through the dashboard, CLI and REST API. Recurring schedules use cron with
  an explicit time zone. Run history and interrupted-operation recovery survive
  API restarts. Tracked in [#436](https://github.com/SteelCrab/firecrab/issues/436).

- Cloudflare Quick Tunnels provide temporary public URLs for VM apps or saved
  Nginx routes. Firecrab Tunnel can connect fixed `firecrab.dev` addresses to
  Quick Tunnels or Nginx routes. The fixed-address service requires its operator
  deployment. See [Firecrab Tunnel](public-docs/guides/firecrab-tunnel.md).

- MicroService observability exposes application logs, lifecycle events and
  health alerts. Locally managed services can opt into OTLP export. App metrics
  and traces require an existing OpenTelemetry SDK. Tracked in
  [#527](https://github.com/SteelCrab/firecrab/issues/527).

- AI Sandbox gains pinned, role-based environments, separate readiness checks,
  scoped service discovery, Docker/nspawn execution and retained Workspaces.
  Projects accept local Git refs, selected skills and reference files. Assigned
  agents share dependency results through the existing task engine with bounded
  explicit retries. Command-backed tests and downloadable artifacts retain their
  task/attempt identities. Dashboard, CLI and local stdio MCP share these REST
  contracts. Tracked in [#414](https://github.com/SteelCrab/firecrab/issues/414).

- Saved Sandbox preview bindings retain fixed addresses and immutable execution
  references. Explicit successor bindings retarget the same URL. Helper health,
  public HTTPS/WebSocket verification, local removal and remote retirement are
  reported separately. Bounded commands do not provide interactive PTY.
  Explicit shutdown checks require a fresh inactive connector observation and
  verify the saved HTTPS address without following redirects. Dashboard, CLI
  and MCP retain the result separately from remote retirement.

- Service-scoped CI Deploy tokens, image-only Nginx endpoints, CLI and GitHub Action
  preserve exact operation outcomes, with expiry/revocation and one-time Dashboard controls.

- Opt-in registry tag automation submits pinned images through Deploy, with durable rollback/failure pauses, Dashboard controls and YAML/Git image ownership.

- The Deploy queue prioritizes waiting rollbacks and supports cancelling an exact
  queued operation. Cancellation retains the active release and its VMs and routes.
  Saved ordering and cancelled outcomes survive API restart. Dashboard actions
  use the existing icon controls. Tracked in [#521](https://github.com/SteelCrab/firecrab/issues/521).

- MicroServices periodically check replica health and restart or replace failed
  VMs through Deploy. Pinned inputs, encrypted environments, healthy replicas,
  bounded retries, and recovery ownership survive API restart. An all-unready
  service keeps its hostname with HTTP 503. Tracked in [#516](https://github.com/SteelCrab/firecrab/issues/516).
  VM teardown resets only its gateway-to-guest TCP connections, allowing ingress
  to retry stalled requests without shortening healthy response timeouts.

- MicroServices publish private `<name>.internal` DNS and network-scoped ingress
  after app health succeeds. Internal-only deployments need no host ports.
  DNS and routes retain deployment ownership through restart and cleanup retries.
  Private listeners support HTTP/1.1, HTTP/2 and WebSockets, preserve source and
  destination security-group rules, and stay outside public tunnel configuration.
  The bundled ingress gains HTTP/2 and the port-binding capability.

- An opt-in Sandbox recovery gate verifies real-model command timeouts,
  cancellation, disconnected admission, controller crashes, explicit retries and
  guest reboots on a disposable API host. Ownership and socket checks protect
  other controllers; retained data and borrowed resources survive task cleanup.
  Tracked in [#414](https://github.com/SteelCrab/firecrab/issues/414).

- Replicated controller services declare stateless or shared external application
  state and distribute version-pinned PipeSecrets through encrypted deployment
  snapshots. Invalid state, credential references and exclusive work fail before
  dispatch. Tracked in [#457](https://github.com/SteelCrab/firecrab/issues/457).

- Changed PipeSecret values automatically rotate running domain services through
  Deploy. Rotation keeps the current image and encrypted per-attempt values,
  shares queue/capacity limits, and retains bounded retries across API restarts.
  Tracked in [#503](https://github.com/SteelCrab/firecrab/issues/503).

- Stack manifests can opt into dependency-ordered replacement and pruning with
  exact UUID ownership checks and durable replacement reservations. Standalone
  VM disk artifacts remain retained by default; `deleteVmDisks` requires an
  additional explicit manifest flag. External dependencies block destruction (#437).

- One controller registers authenticated workload hosts and places VMs using
  deterministic image/resource filtering and durable capacity reservations.
  Idempotent operations reconcile with the recorded owner after timeouts and
  restarts. REST, `firecrab cluster`, and the dashboard expose inventory, VM
  lifecycle, and host drain. Tracked in [#455](https://github.com/SteelCrab/firecrab/issues/455).

- AI Sandbox reuses Pipe AI accounts for verified model selection, persistent
  conversations, isolated project edits, and bounded commands in a selected
  MicroVM. Dashboard, CLI, and local stdio MCP share durable attempts, cancellation,
  recovery, actual tool results, and selected-file apply with source conflict checks.
  Tracked in [#414](https://github.com/SteelCrab/firecrab/issues/414).

- AI Sandbox persists caller and runtime references, authorizes project and
  resource operations, and checks current grants before model/file/guest actions.
  Operators manage delegated host policies through REST, CLI, and stdio MCP.
  Scoped hosts cannot bypass grants through other controller APIs.
  Tracked in [#414](https://github.com/SteelCrab/firecrab/issues/414).

- An opt-in Sandbox QA command connects real model calls to MicroVM commands,
  validates project defaults and task overrides, rejects denied/disconnected
  selections, and retains private attempt and guest-result evidence (#414).

- Named MicroBlockStorage data volumes persist after VM deletion. REST, CLI, and
  Dashboard support creation and exclusive attachment to inactive user VMs.
  Guest mounts use filesystem UUIDs and gate managed application startup.
  Data disks honor guest flush requests, and API restarts retain reservations.
  Tracked in [#247](https://github.com/SteelCrab/firecrab/issues/247).

- `firecrab service dev --port PORT` selects the development dashboard port on
  macOS and Windows. Development controls retain the selected port, and older
  dashboard sessions default to 8080. Tracked in [#488](https://github.com/SteelCrab/firecrab/issues/488).

- Git-linked worktrees have independent `service dev --port PORT` environments.
  macOS uses a separate management VM; Windows and Linux use a private Docker
  runtime with separate data, caches, ownership, and network state. Backend
  API/resource ports are assigned and saved; dashboard ports remain manual.
  Primary macOS/Windows development remains separate, and Linux primary-checkout
  development uses Docker without changing production systemd services.
  Tracked in [#495](https://github.com/SteelCrab/firecrab/issues/495).

- Secrets imports selected values from the Firecrab account linked in Auth.
  The Rust/WASM dashboard previews names without values, requires explicit
  selection for replacements, and records Firecrab Console as the source (#411).

- Pipe Auth links a Firecrab account with an account integration token issued
  by `console.firecrab.dev`. It displays the verified account ID, email, and
  token expiry. Address-scoped Tunnel tokens remain separate. Existing Tunnel
  connection requests also declare the service's required client protocol (#440).

- GitHub stack sources resolve exact commits and verified regular-file blobs, then
  detect configuration drift without changing resources. Periodic and manual
  checks share durable admission, generation guards, pause/resume, bounded
  backoff and fifty redacted observations. `stack source`, REST and the dashboard
  expose status and history; the dashboard also shows recovery guidance.
  Private sources use the existing GitHub Auth connection. Opt-in automatic synchronization and `stack source sync` reuse
  native apply, retain desired/attempted/successful revisions, and stop after
  failed or interrupted applies until explicit operation-ID recovery (#437).

- Stack plan approval includes exact VM template versions and boot artifact hashes.
  Git VM manifests require `templatePin`; apply journals retain template and OCI
  digest identities. Changed content blocks apply and later owned VM starts.
  Git sources reject independent apply and service mutation requests, including
  while polling is paused, to prevent competing image controllers (#437).

- Browser console dimensions reach the guest serial terminal through a private
  vsock resize helper. Connected viewers share the smallest available grid.
  The console reports whether the guest applied the size and keeps working
  when guest resize support is unavailable. Host-built stable guest kernels
  include vsock support on x86_64 and ARM64. Tracked in [#471](https://github.com/SteelCrab/firecrab/issues/471).

- The browser console uses Ghostty WebAssembly for VT parsing, Unicode cells,
  terminal modes and history. It supports mobile editing, composition,
  bracketed paste, application mouse/focus reports and native grapheme export.
  Session memory stays isolated; output and resize work are scheduled in frames.
  The xterm dependency is removed. Tracked in [#453](https://github.com/SteelCrab/firecrab/issues/453).

- MicroServices inject PipeSecrets into every replica using an encrypted
  deployment snapshot that survives API and VM restarts. Missing or invalid
  references fail before VM creation. Values stay out of public VM/deployment
  records and SQLite; guest environment files are root-only. Stop and failed
  deployment cleanup remove snapshots after deleting owned replicas.

- Remote API listeners require mutual TLS with a private CA and UUID host
  identities. `firecrab ca` generates the CA and host certificates offline.
  HTTPS API and WSS console clients share certificate configuration, and Linux
  `doctor` checks validity and upcoming expiration. Boolean TLS/authentication
  flags cannot enable plaintext remote access. Tracked in [#157](https://github.com/SteelCrab/firecrab/issues/157).

- MicroService domains connect healthy replicas to PipeIngress automatically,
  without host ports or manual routes. The dashboard shows the domain and DNS
  setup guidance, and the CLI accepts domain deployments without `--host-port`.
  Deployment ownership protects routes from stale Pipe saves and retains cleanup
  state across API restarts. Stop withdraws the domain before deleting instances.

- MicroVM pause/resume retains guest memory and execution state in the same
  Firecracker process through REST, `firecrab vm pause/resume`, and bilingual
  Dashboard actions. API restart recovery checks the actual VMM state. Paused
  guests keep their allocations and block Sleepy shutdown. Failed confirmation
  exposes retry/stop actions; service-owned and builder VMs reject manual pause.
  Disk-backed suspension is separate. Tracked in [#442].

- `firecrab stack validate --file YAML [--json]` validates an experimental
  declarative stack offline. The shared schema checks local network references,
  resource limits, overlapping subnets and service ports, and pinned service
  image syntax. Validation reports omit configuration values and remain offline.

- Native `stack apply` creates and updates owned resources, deploys services and
  records redacted progress by retry UUID. Plan fingerprints reject stale input;
  running VM changes and service replica replacement require explicit stop
  permission. Interrupted work keeps its exact ownership for explicit recovery.
  Opt-in replacement and pruning use the lifecycle policies described above (#437).

- Host-local stack registration and UUID ownership bindings survive API restarts.
  `firecrab stack register/list/status/bind/unbind` manages metadata without
  changing resources. `firecrab stack plan --file YAML [--json]` reports a
  read-only configuration diff, blocks implicit adoption and conflicting ownership,
  and retains removed declarations. Plans expose immutable input identities
  without environment values.
  Empty registrations can be removed with `stack delete NAME --id STACK_UUID`;
  bound resources and newer registrations with the same name are protected.

- An experimental Terraform REST example provisions a network, stopped VM and
  saved service configuration through the public API. It includes a provider
  lock file and explicit response-field exclusions that preserve drift detection.

- Warm MicroVM pools keep booted, never-used VMs ready to lease. A pool pins an
  image version and VM spec, keeps `minReady` members booted within `maxSize`,
  and deletes and replaces every released or expired member instead of reusing
  its disk. Acquire is atomic and idempotent through `Idempotency-Key`, pool
  members refuse direct VM mutations, and pools are available over REST
  (`/api/pools`), `firecrab pool`, and the dashboard ([#291]). Pools protect
  their pinned images from deletion and kernel replacement, including while
  empty. CLI failures print the acquire retry key, and the dashboard keeps
  pending keys across reloads. Surviving members and leases reconnect after an
  API restart; guest QA verifies unchanged VM processes and lease replay.
  The dashboard starts with name and image inputs, keeps advanced settings
  optional, and exposes Use VM and End session as its main actions.

- Updating from the dashboard opens a dialog that shows what the new release
  changes, then a gauge with the overall percent and the stage (check,
  download, verify, apply, restart) until the API is back on the new version.
  A run that fails says why in the dialog instead of leaving it waiting for ten
  minutes. `firecrab update --apply` shows the same stages with a gauge and the
  percent. `GET /api/update` carries the release's `notes` and `releaseUrl`,
  and `GET /api/update/progress` reports the run, which the updater records in
  `$DATADIR/updates/progress.json` so it survives the restart that ends an
  update.

- The installed MicroManager `micromanager.toml` accepts runtime policy settings.
  macOS and Windows can disable automatic host-job relaunch. macOS also supports
  SSH connection reuse, keepalives, configurable tunnel retries, and retaining
  the VM while SSH reconnects. Runtime edits preserve installation fingerprints
  and survive explicit install/reinstall; existing TOML files keep working.

- `firecrab pipe install/render/apply/status/disable` manages independent Nginx
  PipeIngress and cloudflared PipeTunnel systemd units. Nginx routes domains and
  path prefixes, distributes requests across app addresses, and gracefully reloads
  while keeping in-flight requests. Failed application restores the previous config.
  The dashboard's Pipe page edits routes, applies configuration, shows live service
  states, stops the pipe, and accepts optional tunnel credentials without returning
  saved secrets. API controls run through the authenticated helper. Native CLI
  commands forward to the managed Linux guest. `install.sh --with-pipe` adds the
  OS Nginx package and verified cloudflared binary. See [Service data plane](public-docs/guides/pipe.md).

- The dashboard's Host tab has a Firecrab panel with the version and what
  `firecrab info` prints: the install prefix, data, config and unit
  directories, and the address the API listens on. `GET /api/info` serves the
  same installation fields, plus the configured Firecracker version and live
  API/helper service states. The panel refreshes every ten seconds and clears
  stale states when the API becomes unavailable. CLI `firecrab info --json`
  retains its six-field report.

- macOS and Windows `firecrab service dev start`, `stop`, and `restart` control
  the guest API and helper without rebuilding sources or stopping microManager.
  They preserve the current development overrides and require a running management VM.
- macOS `firecrab service repair` rebuilds the resident service registration and
  restarts the existing management VM without downloading or reinstalling assets.
  It preserves installed binaries, the data disk, and SSH credentials, and checks
  the local API and current-boot guest report before reporting success.
  Service startup, SSH, and API failures suggest the repair command; unhealthy
  status and debug reports include the same recovery advice.
  An idle-runtime macOS E2E phase checks recovery, injected SSH/API failures,
  preserved assets, and restoration, retaining logs and JSON QA evidence.

- The dashboard's Pipe Registry card saves Docker Hub, GHCR and Amazon ECR
  logins, lists repository tags, pulls OCI images to this host, and imports a pulled image as
  an M2Image. Logins are write-only in API responses. See
  [Pipe Registry](public-docs/guides/pipe-registry.md).

- Deploy updates running domain services through the existing Nginx ingress.
  Rolling and blue-green updates, immutable release history, selected rollback,
  verified worker drain, and restart/retry recovery share one REST/CLI/YAML
  executor. The Rust/WASM dashboard exposes update and rollback actions (#335).
  Deploy-owned rootfs caches are pruned after VM, pool, operation, and retained-release references are released.

### Changed

- Remove the Infisical connector, its dashboard fields, and its account QA requirement (#411).
  Existing imported values and source history remain available. Older vaults discard
  retired connections and pending previews on their next successful write.

- Guest kernel installation and OCI import build kernel.org's current stable
  source on the Linux host instead of downloading MicroRegistry kernel packages.
  Source and image digests are verified, and existing image kernel assignments
  remain explicit. `FIRECRAB_KERNEL_RELEASES_URL` and `FIRECRAB_KERNEL_BUILD_JOBS`
  control source discovery and compiler parallelism.

- The dashboard has refreshed navigation, tables, status indicators and detail
  panels. Pipe uses sub-navigation and overview rows for its services. MicroVM
  creation has a dedicated form, and MicroService management groups overview,
  instances, releases and settings into tabs.
- The dashboard's VM list shows only a VM's own state: the API label next to it
  is gone, and the API's reconciliation result for a VM stays in its detail view.

### Deprecated

- None.

### Fixed

- Alpine Sandbox cleanup accepts the owned user's explicit primary-group
  membership after verifying its durable account records. Foreign or shared
  membership still blocks cleanup and preserves the attempt for reconciliation.

- Private Sandbox VM names follow IPAM allocations instead of expiring DHCP
  leases. A separate DNS hosts file preserves existing VM names through private
  resolver restart, network changes and service-record refresh. Tracked in
  [#414](https://github.com/SteelCrab/firecrab/issues/414).

- Sandbox CLI and MCP artifact downloads reject a task response whose ID differs
  from the requested task. Artifact ownership and download URLs remain bound to
  that task and its attempt. Existing output files retain their original bytes.

- Gateway MAC addresses remain stable when MicroVM TAP ports join or leave.
  Stopping a service no longer strands surviving guests' cached gateway
  neighbors or delays their internal DNS requests.

- Worktree development cleanup retains the selected dashboard checkout and port.
  Private start/restart requires that saved selection before changing the backend.
  macOS VM port relays protect primary and all registered backend ports, including
  instances registered after relay startup. New backend ports use 20000–32767,
  excluding the host's current IPv4 TCP ephemeral range; existing saved ports
  remain valid. Tracked in #495.

- PipeSecrets rejects AWS name prefixes containing filter operators or other
  non-name characters, preventing a negated prefix from listing secrets outside
  the configured scope. Tracked in [#411](https://github.com/SteelCrab/firecrab/issues/411).

- Dashboard WASM builds reuse a version-checked `wasm-bindgen` Cargo installation
  from the wasm-pack cache. The matching tool is exposed only to the build child,
  avoiding an unnecessary installer pass while preserving normal discovery when
  the cache is missing or stale.

- The development API proxy preserves the dashboard's Host header so browser
  requests from custom ports such as 8098 pass the API's same-origin checks.
  Vite's default host checks and the API's origin checks reject untrusted requests.
  This fixes the `--port` behavior from [#488](https://github.com/SteelCrab/firecrab/issues/488).

- ChatGPT login callbacks follow trusted loopback development ports. Dashboard
  proxies keep callbacks on their selected API, including private worktrees.
- Source development bundles preserve the embedded host-kernel build script,
  allowing current API sources to compile in the management VM.
- Sandbox live QA checks API-visible source paths before model usage and accepts
  successful task responses with nullable or textual task-error fields (#414).

- Sandbox reconciliation restores interrupted command output and confirmed exit
  status before guest cleanup. Unknown exits remain unknown. A failed checkpoint
  retains guest evidence, and successful reconciliation clears stale restart errors.
  Tracked in [#414](https://github.com/SteelCrab/firecrab/issues/414).

- OCI guests recreate image-declared `/run` directories with `systemd-tmpfiles`
  before app services on every boot. MariaDB can restart after tmpfs clears
  `/run/mysqld`, without a manual guest startup hook.

- macOS and Windows `service dev clean` and `service dev --restore` stop
  workload MicroVM units before switching back to installed services. Older
  installed APIs no longer start a second Firecracker against a TAP or disk
  held by a development VM. Failed unit listing or stopping preserves the
  development deployment and cache. VM disks and application data are kept.

- macOS and Windows `service dev` starts the source dashboard on
  `http://localhost:8080`, checks its API proxy, and keeps it running after the
  command exits. Development start/stop/restart commands control the dashboard
  with the guest services. Port conflicts and frontend startup failures fail
  the command instead of reporting an API-only success.

- macOS service repair prints all six stages. Service start and repair report
  VM/API readiness and elapsed time every ten seconds while waiting. Shutdown
  waits also report launchd/VM state. Local VM/API startup uses a ten-second
  readiness deadline; health checks stay unchanged.
- macOS repair backs up the OS image and fixes filesystem errors on a detached
  copy before installing a verified result. It preserves the data disk and SSH
  assets, cleans up matching stale helpers, and locks each home against concurrent
  management VMs. Forced VZ stop completion now allows the helper to exit.
- macOS repair also restores missing packaged Debian OS files and package
  manifests from the verified local image cache or checksum-matched lost+found
  files. It preserves existing files and verifies the repaired copy before commit.

- macOS SSH connections quote known-host paths inside OpenSSH options, so the
  default `Application Support` directory remains one path. Repair completes
  using the guest's fresh virtiofs boot report and live API instead of SSH commands.

- Browser console E2E reloads initial dashboard modules once when Chromium
  reports `ERR_NETWORK_CHANGED` after a guest bridge is created. Other failures
  and repeated network errors remain test failures.

### Improved

- The helper logs failed host firewall commands with their arguments, exit
  status, and stderr. Warnings also identify failed nftables and firewall-state
  queries that keep their existing empty or disabled fallback ([#305]).

- MicroService setup guides users through a five-step wizard with field
  explanations and a configuration summary. App selection
  uses only Pipe Auth-connected GitHub or AWS accounts and their repository/tag
  lists, rechecks the connection before saving, and directs unconnected users
  to Auth. The API also checks image ownership when saving, updating, and
  deploying; queued work rechecks Auth and pulls only with its credentials.
  Deployment controls recheck Auth in the background and before submitting,
  disable deployment after disconnection or a failed check, and link to Auth
  reconnection while keeping service stop available. Reconnecting the matching
  account returns to the same deployment panel with the selected network and
  host port, ready for an explicit deploy action. Placement checks verify that
  the restored network still exists and all replica TCP ports are available;
  invalid choices block deployment with field errors and direct editing. The
  deploy API rechecks placement before queueing, including VM forwards and host
  listeners.
  Saving opens deployment management with image/start/health progress, an app
  link after a successful health check, and guidance for failed deployments.

## [0.3.1] - 2026-10-06

firecrab runs every MicroVM in its own systemd unit with host resource ceilings and startup
recovery, adds `service shell` and `service dev`, and fixes console replay, OCI import issues, and
the files, processes, and firewall rules an uninstall used to leave behind.

### Added

- Each MicroVM's systemd unit runs under host-side ceilings derived from its RAM
  and vCPUs: `MemoryMax` is the guest RAM plus the larger of 256 MiB and an
  eighth of it, and `CPUQuota` is one core per vCPU plus one. They apply from a
  VM's next start, so a runaway Firecracker or shim cannot starve the host
  ([#123]).
- `POST /api/network/reconcile` retries networking for running VMs without
  restarting their API/shim/Firecracker processes and refreshes per-VM
  recovery diagnostics ([#123]).
- VM list and detail responses expose per-VM API startup reconciliation outcomes,
  timestamps, and diagnostics. The Dashboard displays them in English and Korean
  alongside the VM lifecycle state, with hover/focus information panels for the
  VM and API status labels ([#123]).
- `firecrab service shell` opens a root shell in the managed Debian guest on
  macOS and Windows, and `firecrab service shell -- <command>` runs one command
  there. On Windows, `service run` remains an alias ([#343]).
- `firecrab service dev` builds the checkout's API and helper inside the managed
  Debian guest on macOS and WSL2 and switches both services to the new binaries;
  a failed build leaves the running services untouched, and `--restore` returns
  to the installed ones. It replaces the macOS foreground `service run`
  ([#332], [#351]).
- `DELETE /api/microregistry/local/{alias}` releases a host-local image
  registration while protecting active jobs, other architectures, installed
  images, and staged packages ([#333]).
- On Windows, TCP port forwards of MicroVMs are relayed to `localhost`
  ([#358], [#359], [#360]).
- `install.sh` records, on the first install, whether it granted the `kvm` group an ACL on
  `/dev/kvm` and whether IPv4/IPv6 forwarding was off, in `/etc/firecrab/host-baseline.env`,
  so an uninstall can put back exactly that ([#378]).

### Changed

- Rename the privileged daemon and unit to `firecrab-helper`. Installer
  reruns migrate the legacy service into an alias; old executable paths,
  release installers, update bundles, socket settings, and status JSON remain
  compatible. CLI status/doctor and macOS/Windows guest control accept either
  installed service name; lifetime QA checks migration with a running VM ([#123]).
- Each MicroVM now runs under a per-VM `firecrab-vm` shim (`firecrab-api vm-shim`)
  that owns Firecracker, writes `console.log`, and records the exit status in
  `exit.json`. The API controls the VM through the shim's socket.
- API startup settles VMs left active by the previous run from evidence
  (live shim, `exit.json`) instead of marking them all `stopped`, and
  re-applies their networking ([#123]).
- Each VM's shim runs in its own `firecrab-vm-<id>.service` unit started by
  the network helper, so VMs survive API restarts and upgrades ([#123]). The
  child-process launcher and `FIRECRAB_VM_LAUNCHER` are gone; a leftover value
  is logged and ignored. Running the API from a checkout on Linux now goes
  through `scripts/dev-net-helper.sh`, which stages both binaries as root.
- A VM stopped from outside the API (`systemctl stop` of its unit, a host
  shutdown) is recorded `stopped` rather than `error`; a start right after a
  stop no longer fails on the previous unit's name; a VM left `stopping` by an
  API restart is killed if it ignores SIGTERM; and `$` in a VM's paths reaches
  its unit unexpanded ([#123]).
- `tower-http` is updated to 0.7.1 ([#318]).

### Deprecated

- None.

### Fixed

- The API systemd unit starts even when a stopped/failed helper has removed
  `/run/firecrab`, allowing network diagnostics and recovery retries. This unit
  change requires existing installations to rerun `install.sh` once ([#123]).
- API startup detects and repairs owned nft rule drift even with an unchanged
  helper cache, DHCP file/process drift at the same lease revision, and TAP/
  bridge/forwarding drift. Recovery makes three attempts; lifetime QA checks
  guest ping, SSH and forwarded HTTP across restart and injected failures ([#123]).
- `exit` or `logout` in a reattached serial console no longer receives replayed
  terminal queries: replay omits complete queries and starts after the last guest
  session boundary, while the full transcript stays in the log API ([#368]).
- A custom image registered in the host-local MicroRegistry can be installed
  again after its template is deleted ([#333]).
- On macOS, `service stop` waits for the management VM to exit, force-stops it
  after 20 seconds, and reports a timeout after 40; the management VM keeps a
  stable MAC address across boots ([#330], [#331]).
- Guest SSH initialization uses explicit utility paths, so OCI guests start
  key-only root SSH with a minimal `PATH` ([#324]).
- OCI imports read RPM headers from Fedora SQLite databases, retry registry
  connection failures within the inspection deadline, bound guest package
  installation retries, and keep dual-stack DHCP ([#358], [#359], [#360]).
- `firecrab service uninstall` and `install.sh --uninstall` stop running MicroVMs before they
  remove the services. A VM's unit outlives the API on purpose, so its shim and Firecracker
  process used to keep running after an uninstall, and after `--purge` they ran on with their
  disks deleted ([#378]).
- Uninstall removes `extract-vmlinux` and `extract-arm64-image`, so `/usr/local/lib/firecrab`
  goes with the rest of the install instead of staying behind holding those two scripts
  ([#378]).
- Deleting a MicroNetwork, and uninstalling, remove the iptables NAT MASQUERADE rules for its
  subnet. They used to stay on the host until a reboot ([#378]).
- `firecrab-helper --teardown`, and so uninstall, also deletes the UFW rules that name a
  Firecrab bridge, including the route rule that carries the uplink and was never deleted
  ([#378]).
- Uninstall restores what the installer recorded: the `/dev/kvm` ACL it added, and IPv4/IPv6
  forwarding on a host that had it off. Forwarding stays on while another bridge or container
  network exists, and a host installed before the record existed keeps both until a reboot
  ([#378]).

### Improved

- The `firecrab-helper` service logs through `tracing`. A connection from an
  unauthorized UID, an unreadable peer credential, a request read timeout, and a
  failed response write now appear in `journalctl -u firecrab-helper`.
  `RUST_LOG=firecrab_helper=debug` raises the level; the default is
  `firecrab_helper=info` ([#305]).
- Contributor guide, READMEs, architecture diagrams, and PR-body guidance are
  simplified and updated for the per-VM shim and VM lifetime ([#314], [#315]).

## [0.3.0] - 2026-09-29

firecrab adds microManager on macOS and Windows, SPDX SBOMs for OCI imports,
native init support for imported guests, and host platform diagnostics.

microManager still provisions verified Firecrab v0.2.2 guest artifacts. On WSL2,
that pinned guest cannot yet start MicroVMs; the net-helper fixes below will
reach it when a newer guest bundle is pinned.

### Added

- Apple silicon macOS releases include an entitlement-signed `microManager`
  helper exposed through `firecrab service`. Install pins and verifies Debian 13,
  Firecracker v1.17.0, and Firecrab v0.2.2 artifacts; provisions separate OS and
  persistent data disks; requires usable nested KVM and a real Firecracker workload
  boot; and starts a launchd-resident VM with a key-only localhost API tunnel.
  Reinstall and ordinary uninstall preserve managed data, while explicit
  `uninstall --purge` removes it. The complete path is validated on Apple M5 with
  macOS 26.6.2; other M3-or-later hosts remain runtime and E2E gated ([#266]).
- Public documentation lists the shared Linux, macOS, and Windows QA work
  list ([#266]).
- On macOS, the microManager daemon also serves running VMs' TCP port
  forwards on `127.0.0.1:<hostPort>` over the management SSH connection;
  UDP forwards stay reachable at the management VM address ([#266]).
- `firecrab service install` and `reinstall` list each pending download's
  mirror, digest, and size on a terminal and ask first (`--yes` skips it),
  then draw a progress gauge; an interrupted download resumes on the next
  run ([#266]).
- Windows x86_64 and ARM64 CLIs can manage a Debian WSL2 distribution with a
  per-user scheduled task, localhost API, and the same install, doctor, and
  service commands. The x86_64 path has been validated in a Windows 11 lab;
  ARM64 installation remains unverified on native hardware ([#295]).
- `firecrab service debug` reports host capability, service, guest, API,
  provisioning, and log state without starting a stopped guest. It supports
  JSON output and bounded log excerpts on macOS and Windows ([#312]).
- OCI imports generate SPDX SBOMs from guest package databases ([#210]).
- The host API exposes platform information for Linux, macOS, and Windows
  hosts ([#297]).

### Changed

- OCI imports preserve supported native init systems and use the BusyBox
  fallback only when no supported native init is available ([#290]).

### Deprecated

- None.

### Fixed

- `exit` in the web terminal or `firecrab vm console` ends the session instead of
  silently logging root back in. The guest marks the ended session on its serial
  console, the API closes the console socket with code `4000` (`session_ended`),
  the CLI prints `guest session ended` and exits `0`, and the dashboard offers a
  new session instead of reconnecting ([#303]).
- Catalog Alpine VMs start again after a stop. VM start no longer mistakes the
  `/etc/firecrab` directory the SSH service creates for an OCI import and
  overwrites the template's inittab; VMs already hit by this must be recreated
  ([#306]).
- The macOS management guest installs `fakeroot`, and a missing binary is
  reported as such, so OCI import can pack ext4 without a false missing-tree
  error ([#266]).
- On macOS, a dropped API tunnel reconnects instead of restarting the
  management VM and every microVM in it; an `uninstall --purge` refused for an
  unsafe path no longer stops the service first; `install` no longer hangs when
  the provisioning guest never powers off; the management guest no longer boots
  degraded by the packaged `dnsmasq.service`; and status output no longer
  panics when stdout is non-blocking ([#266]).
- The net-helper keeps per-VM L2 rules in `netdev` tables and binds dnsmasq
  only to MicroNetwork bridges, avoiding WSL2's missing nftables `bridge`
  family and loopback DNS listener collision ([#294]).
- Host disk usage is measured on the filesystem containing the VM directory
  ([34193f5]).

### Improved

- The dashboard Host view identifies the reported host OS with its platform
  icon ([#297]).

## [0.2.2] - 2026-09-15

firecrab adds standalone CLI cleanup, improves OCI package portability and
release documentation, and hardens network teardown testing.

### Added

- The standalone CLI installer supports `--uninstall`. Adding `--purge` also
  removes saved host profiles and the configuration file ([#272]).

### Changed

- Standalone CLI host profiles now default to `~/.firecrab/config.toml`, avoiding
  collisions with a source checkout ([#272]).

### Deprecated

- None.

### Fixed

- The CLI documentation's Mermaid edge label now renders correctly on GitHub
  ([#272]).
- OCI imports no longer time out halfway through guest package configuration
  when an apt mirror is slow or unreachable; the guest setup timeout now
  covers the full package-manager operation ([#269]).
- OCI-cached kernels are packaged under a portable kernel/ archive member
  instead of exposing the internal .oci/kernel/ cache path ([88ba35d]).

### Improved

- Installation and CLI documentation now cover the new configuration path and
  uninstall commands ([#272]).
- Network bridge teardown control flow is easier to exercise with deterministic
  tests ([#270]).
- README test instructions now include formatting, Clippy, coverage, frontend,
  documentation-link, and changelog checks ([729bb47]).

## [0.2.1] - 2026-09-14

firecrab hardens OCI import against slow mirrors and hardened base images, and
stabilizes release and coverage CI.

### Added

- None.

### Changed

- None.

### Deprecated

- None.

### Fixed

- OCI imports no longer freeze the guest console on an unreachable apt mirror;
  `apt-get update`/`install` inside guest `sysinit` is bounded by a hard
  wall-clock timeout ([#262]).
- OCI import no longer wedges after importing a hardened image (e.g.
  `fedora:46`) with non-writable directories or unreadable files; scratch
  cleanup chmods before removal, and merged files guarantee owner-read so
  `mkfs.ext4` can copy them ([#263]).
- Release smoke tests retry Unpack tools package-manager installs to absorb
  transient mirror hiccups ([#264]).
- VM start tests no longer flake under coverage instrumentation; `wait_for_state`'s
  real-time budget is widened ([#265]).

### Improved

- None.

## [0.2.0] - 2026-09-03

firecrab adds optional IPv6 networking, managed SSH access, a cross-platform remote
CLI, expanded host operations, and kernel lifecycle management, while hardening guest
provisioning, compliance artifacts, and release validation.

### Added

- MicroNetworks accept an optional IPv6 `/64` at create time (`ipv6Cidr`,
  `ipv6AddressMode` SLAAC or DHCPv6). Unique-local prefixes use NAT66, global
  prefixes are forwarded untranslated, and existing IPv4-only networks stay
  IPv4-only ([#146], [#178]).
- The dashboard Networks create form has an IPv6 select, list column, and
  detail panel ([#178]).
- The serial console inspect rail is four equal cards with a bottom toggle,
  and the network card shows the guest IPv6 address ([#183], [#184]).
- OCI imports install OpenSSH and drop a minimal sshd service that generates
  host keys on first boot ([#186]).
- Every guest provisions an ed25519 operator key pair in its storage directory
  and authorizes its public key inside the rootfs ([#186]).
- `GET /api/vms/:id/ssh-key` exposes the operator private key, and `GET
  /api/vms/:id/ssh-host-key` verifies the guest host-key fingerprint via
  SHA-256 against authorized runtime state ([#186]).
- The dashboard introduces an SSH connect panel (accessible via the VM actions
  menu, VM detail modal, and serial console tabs) with masked private key
  preview, clipboard copy commands, and host fingerprint verification ([#186]).
- VM table row actions are reorganized into a kebab dropdown menu with direct
  SSH connect ([#186]).
- [`public-docs/guides/dashboard.md`](public-docs/guides/dashboard.md),
  [`public-docs/reference/api.md`](public-docs/reference/api.md), and
  [`public-docs/guides/oci.md`](public-docs/guides/oci.md) document the SSH connect panel,
  endpoints, and guest sshd service ([#186]).
- Host release archives include `LICENSE`, `THIRD_PARTY_NOTICES.txt`, the
  license inventory, and the GPL-2.0 text required by `extract-vmlinux`;
  `install.sh` installs them under `$PREFIX/share/firecrab` ([#176], [#190]).
- M2Image packages ship SPDX 2.3 SBOMs and matching corresponding-source
  archives, and catalog publication refuses a binary without its source
  sibling ([#176], [#190]).
- Host API VM, network, image, and console operations in `firecrab-cli`, plus CLI
  service-management helpers ([1ffba72], [8bcc2af]).
- Standalone Linux, macOS, and Windows clients manage saved API or SSH host profiles
  under `~/firecrab/config.toml` and run remote VM, network, image, and console
  operations ([#254]).
- Digest-pinned kernel catalog management and per-image kernel updates in the API and
  dashboard ([37075bf], [1a44619], [664d446]).

### Changed

- CI fails on any new Clippy warning instead of maintaining a warning baseline
  ([76f6ef3]).
- A GitHub Release is titled `firecrab v<tag>`, and its body no longer repeats that title
  ([45790c3]).
- The pinned Rust toolchain is 1.97.1 (`rust-toolchain.toml`) ([#131], [#188]).
- `install.sh` rejects a prepared payload that is missing the compliance artifacts
  ([#190]).
- CLI releases include native Linux, macOS, and Windows archives with checksum-verified
  user-level POSIX and PowerShell installers ([#254]).

### Deprecated

- None.

### Fixed

- Existing and newly provisioned guests recover missing network-ready units through
  repaired symlinks and distro-specific fallbacks ([73d5fe1], [a8152a4]).
- OCI imports install `udev` on apt-based and zypper-based images that need it for
  systemd-based guests ([3bc13d0]).
- Dashboard field errors use the same styling outside form fields ([3b910c9]).
- Serial consoles print a session-ended banner before respawning a guest shell after
  `exit`, making the new session boundary visible for both agetty and BusyBox fallback
  consoles ([#232]).
- Release notes credit the commits between the previous release and this tag ([45790c3]).
- Shorthand references resolve, and in-repo document links point at the released tag
  ([45790c3]).
- IPv6 prefixes are allowlisted to `/64` unique-local or global, and the host
  uplink keeps RA so the default route is not dropped ([#178]).
- Reassigning VM storage preserves the existing operator key pair instead of
  regenerating a mismatched key ([#186]).
- OCI SSH daemon starts and verifies connectivity on dual-stack IPv4/IPv6 networks
  ([#186]).
- Fake Firecracker spawns in test suites retry on transient `ETXTBSY` ([#186]).
- Host and M2Image packaging fail closed on missing, incompatible, or tampered
  license and source material ([#190]).
- `firecrab-cli` builds cleanly with zero Clippy warnings ([#194]).
- Microboot test startup eliminates timing flakes ([#208]).
- CLI installers reject non-HTTPS release sources; local `file://` fixtures require an
  explicit test-only opt-in ([#254]).

### Improved

- README architecture guidance is condensed into a layered diagram and a shorter
  first-time-reader flow ([677cbef], [77e7347], [4360419]).
- CLI-only installation is documented alongside the prepared host payload flow
  ([c27e516]).
- CLI-only installation verifies the separately published checksum before executing a
  downloaded POSIX or PowerShell installer ([#254]).
- Networking, API, and dashboard docs cover IPv6 create-time choice, NAT66 vs
  direct egress, and guest sysctl ([#178]).
- [`public-docs/development/ci.md`](public-docs/development/ci.md) documents the Clippy gate ([#198]).

## [0.1.2] - 2026-08-21

firecrab gains a CLI (`doctor`/`info`/`status`/`update`) that can update the host in
place, and OCI import provisions its own kernel instead of borrowing a guest image's.

### Added

- OCI import pairs a digest-pinned MicroRegistry kernel, cached at `.oci/kernel/<arch>/` ([#145]).
- `FIRECRAB_OCI_KERNEL_PATH` names a host copy of that kernel ([#145]).
- [`public-docs/guides/oci.md`](public-docs/guides/oci.md) gains a contents table and an import architecture diagram ([#145]).
- `firecrab-cli` workspace crate ships `firecrab doctor`/`info`/`status` ([#152], [#152-comment]).
- [`public-docs/reference/cli.md`](public-docs/reference/cli.md) documents the CLI's architecture and all three subcommands ([#152]).
- Left nav rail gets solid SVG icons matched to each feature (MicroVM, Networks, Storage, Images, Host), replacing Unicode glyphs ([#165]).
- `firecrab update --check` compares the installed version with the newest GitHub Release, with human-readable and JSON output ([#163], [#171]).
- `firecrab update --apply` verifies the matching host bundle and delegates an atomic privileged swap to `firecrab-net-helper` ([#163], [#171]).
- `GET` and `POST /api/update` expose cached update checks and detached update application to the dashboard ([#171]).
- The dashboard navigation reports available updates, restart progress, completion, and stalled update guidance ([#171]).

### Changed

- An unreachable MicroRegistry falls back to an installed catalog kernel ([#145]).
- Published pages may run to 300 lines, up from 170 ([#145]).
- Default `FIRECRAB_BIND_ADDR` moves from `127.0.0.1:3000` to `127.0.0.1:5523` — a dedicated
  4-digit port instead of a common dev port ([#147], [#147-comment]).
- README (all locales) and `CONTRIBUTING.md` point at port `5523`, not `3000` ([#147]).
- `public-docs/` API examples and check lists reference port `5523`, not `3000` ([#147]).
- `install.sh` no longer preinstalls a guest image — `--no-images`, `--with-images`,
  `--with-ubuntu-image`, and `--with-rocky-image` are removed along with everything only
  reachable through them; a guest image now comes from OCI import or the dashboard Images
  page, and guest-image handling moves to a future `firecrab` CLI instead of `install.sh`
  ([#151], [#151-comment]).
- CI's `vm-boot`/`vm-boot-self-hosted` import Ubuntu/Rocky via OCI import instead of the
  removed `install.sh` flags ([#151]).
- `scripts/firecrab-doctor.sh` and the `firecrab-doctor` binary alias are removed; use `firecrab doctor` ([#152]).
- OCI import and MicroBoot session logs auto-scroll to the latest line, matching `VmDetailModal` ([#165]).
- OCI import log box height is unified to `40vh`, up from the `28vh` cap ([#165]).
- Both `x86_64` and `aarch64` OCI imports pin the latest published stable Linux 7.1.9 kernel with immutable package and image digests ([#174], [#175]).
- Systemd units expose the validated install layout and only the update paths required by the privileged helper ([#171]).

### Deprecated

- None.

### Fixed

- A kernel download from a registry that stops answering times out ([#145]).
- `install.sh`'s API-readiness poll no longer prints a `curl: (7) Failed to
  connect` line on every retry before `firecrab-api` finishes binding its
  listener ([#158]).
- `aarch64` OCI imports use the dedicated MicroRegistry kernel instead of requiring the Ubuntu M2Image kernel ([#174], [#175]).
- Self-update stages replacements beside each target, avoiding cross-mount `rename(2)` failures under systemd `ReadWritePaths` ([#171]).
- The update helper derives its own install layout, rejects archive symlinks and special entries, and rolls back failed swaps accurately ([#171]).
- Timed-out update checks terminate their child process, and a stalled dashboard restart wait now surfaces recovery guidance ([#171]).
- Local installation guides now match the three binaries built by the prepared payload.

### Improved

- Update documentation covers CLI checks, application, service restarts, and when the installer must still be rerun ([#171]).
- Installation documentation separates the prepared payload script from manual Cargo and npm builds, including the required frontend output ([322e95c]).

## [0.1.1] - 2026-08-17

One `./install.sh` leaves a working host on SELinux, and image downloads work again.

### Added

- `firecrab-doctor` fails on a service confined to `init_t`, and prints the relabel command ([#142]).
- `firecrab-doctor` tests registry egress as the API service account ([#141]).
- `semanage` is installed on SELinux hosts, so the recorded file context applies ([2493c7d]).

### Changed

- `install.sh` labels binaries `bin_t` and relabels `$PREFIX/lib/firecrab`; uninstall removes the rule ([#142]).
- A package download takes its object key from the published catalog ([#143]).

### Deprecated

- None.

### Fixed

- Image downloads no longer answer `404` ([#143]).
- Both services stay out of `init_t`, where connect is denied and `nft` cannot exec ([#142]).
- `--doctor` survives a data directory private to the service account ([7eb6740]).
- A connect refused by local policy names SELinux, the unit sandbox, and firewall rules ([#141]).

### Improved

- Troubleshooting covers the SELinux failure end to end ([#142]).
- Transport errors carry their whole source chain ([#141]).

## [0.1.0] - 2026-08-16

First public release of firecrab: a single-host Firecracker microVM manager
with an unprivileged API, a browser dashboard, and a capability-bounded
network helper.

### Added

- REST API and systemd-installable `firecrab-api` for creating, inspecting,
  editing stopped guests, starting, stopping, and deleting MicroVMs.
- Browser dashboard (English and Korean) with VM list, create flow, detail
  editing, serial console, logs, and host status.
- Browser serial console, including CJK IME composition.
- `firecrab-net-helper` over a versioned Unix-socket protocol so only the
  helper holds host network capabilities.
- Explicit MicroNetworks: isolated bridges, persistent IPv4, MAC, and
  hostname per VM, internet or isolated egress, and optional NAT uplink.
- MicroStorage pools plus the default host disk layout for VM artifacts.
- M2Image catalog install for Alpine, Ubuntu, and Rocky templates, each
  with that distro's own official kernel.
- OCI inspect and import: pull a registry image, merge layers, and register
  a bootable ext4 rootfs.
- MicroRegistry register of an already-installed local image into the
  in-memory catalog.
- Docker Hub login for OCI pulls (`GET`/`PUT`/`DELETE
  /api/microregistry/docker-hub`): one stored account per host, used by
  inspect, import, and the guest toolbox pull, so a shared egress IP no
  longer runs into the anonymous rate limit. The secret is write-only and
  is offered to Docker Hub alone.
- Runtime environment variables on stopped VMs, written into the guest
  service wrapper on the next start.
- Host and guest port forwards on the API and dashboard.
- `install.sh` host installer and `firecrab-doctor` health checks.
- Host install from a GitHub Release:
  `curl -fsSL https://github.com/SteelCrab/firecrab/releases/latest/download/install.sh | bash`
- Host bundles for Linux `x86_64` and `aarch64` in both `gnu` (glibc) and
  `musl`: `firecrab-host-<arch>-<gnu|musl>.tar.gz`. `install.sh` detects
  the host libc (`--libc gnu|musl` to override).
- `install.sh --bin-dir` replaces installed binaries from a local directory
  without compiling on the host.
- Release-profile and cross-target GitHub Actions builds for
  `x86_64`/`aarch64` GNU and musl, plus `firecrab-host-*.tar.gz` bundles.

### Changed

- GitHub Releases publish only host bundles and `install.sh`. Release notes
  have no Binaries section and no API-only tarballs.
- `install.sh` downloads musl release binaries instead of building with
  rustup and npm on the host.
- Workspace version is `0.1.0` across the Rust crates.
- Dashboard package version is `0.1.0`.
- The pinned Rust toolchain is 1.96.0 (`rust-toolchain.toml`, workspace
  `rust-version`, and CI).
- Test assertions use stable `assert_matches!` so failures print `Debug`.

### Deprecated

- None.

### Fixed

- Piped `install.sh` (`curl | bash`) no longer crashes on unset
  `BASH_SOURCE`, and downloads the Firecracker installer when there is
  no git checkout.
- Piped `install.sh` asks for the sudo password on `/dev/tty` instead of
  telling the operator to run `sudo -v` first.
- Default `install.sh` does not install a guest image. Use the dashboard
  Images page, or pass `--with-images`.
- DHCP and DNS are allowed on each MicroNetwork bridge and through the
  common guest firewall profiles so guests can obtain a lease.
- Saving a running VM applies port-forward edits instead of dropping them.
- NAT uplink fallback in the dashboard is parenthesized so Vite accepts it.
- Image catalog architecture must be stated explicitly, including on
  arm64 installer doctor paths.
- Release smoke no longer waits for `firecrab-api` to exit, so a binary
  that actually starts cannot stall Publish GitHub Release for six hours.

### Improved

- README architecture diagrams cover the host, MicroNetwork, OCI import,
  and MicroVM boot path, including how to inspect guest PID 1.
- Public English docs under `public-docs/` describe install, networking,
  storage, images, OCI import, the API, and operations.
- CI runs fmt, clippy, workspace tests with Codecov, rustdoc, installer
  smoke (including Debian/Fedora/Arch/openSUSE deps), and the frontend
  lint/build on every pull request.
- Changelog validation is part of the documentation CI job so a release
  cannot drop a required section.

[Unreleased]: https://github.com/SteelCrab/firecrab/compare/v0.4.3...main
[0.4.3]: https://github.com/SteelCrab/firecrab/releases/tag/v0.4.3
[0.4.2]: https://github.com/SteelCrab/firecrab/releases/tag/v0.4.2
[0.4.1]: https://github.com/SteelCrab/firecrab/releases/tag/v0.4.1
[0.4.0]: https://github.com/SteelCrab/firecrab/releases/tag/v0.4.0
[0.3.1]: https://github.com/SteelCrab/firecrab/releases/tag/v0.3.1
[0.3.0]: https://github.com/SteelCrab/firecrab/releases/tag/v0.3.0
[0.2.2]: https://github.com/SteelCrab/firecrab/releases/tag/v0.2.2
[0.2.1]: https://github.com/SteelCrab/firecrab/releases/tag/v0.2.1
[0.2.0]: https://github.com/SteelCrab/firecrab/releases/tag/v0.2.0
[0.1.2]: https://github.com/SteelCrab/firecrab/releases/tag/v0.1.2
[0.1.1]: https://github.com/SteelCrab/firecrab/releases/tag/v0.1.1
[0.1.0]: https://github.com/SteelCrab/firecrab/releases/tag/v0.1.0
[#131]: https://github.com/SteelCrab/firecrab/issues/131
[#140]: https://github.com/SteelCrab/firecrab/issues/140
[#141]: https://github.com/SteelCrab/firecrab/issues/141
[#142]: https://github.com/SteelCrab/firecrab/issues/142
[#143]: https://github.com/SteelCrab/firecrab/issues/143
[#145]: https://github.com/SteelCrab/firecrab/pull/145
[#146]: https://github.com/SteelCrab/firecrab/issues/146
[#147]: https://github.com/SteelCrab/firecrab/issues/147
[#147-comment]: https://github.com/SteelCrab/firecrab/issues/147#issuecomment-5327667852
[#151]: https://github.com/SteelCrab/firecrab/pull/153
[#151-comment]: https://github.com/SteelCrab/firecrab/issues/151#issuecomment-5327863284
[#152]: https://github.com/SteelCrab/firecrab/issues/152
[#152-comment]: https://github.com/SteelCrab/firecrab/issues/152#issuecomment-5328210931
[#158]: https://github.com/SteelCrab/firecrab/issues/158
[#163]: https://github.com/SteelCrab/firecrab/issues/163
[#165]: https://github.com/SteelCrab/firecrab/pull/165
[#171]: https://github.com/SteelCrab/firecrab/pull/171
[#174]: https://github.com/SteelCrab/firecrab/issues/174
[#175]: https://github.com/SteelCrab/firecrab/pull/175
[#176]: https://github.com/SteelCrab/firecrab/issues/176
[#178]: https://github.com/SteelCrab/firecrab/pull/178
[#183]: https://github.com/SteelCrab/firecrab/issues/183
[#184]: https://github.com/SteelCrab/firecrab/pull/184
[#186]: https://github.com/SteelCrab/firecrab/pull/186
[#188]: https://github.com/SteelCrab/firecrab/pull/188
[#189]: https://github.com/SteelCrab/firecrab/pull/189
[#190]: https://github.com/SteelCrab/firecrab/pull/190
[#194]: https://github.com/SteelCrab/firecrab/pull/194
[#198]: https://github.com/SteelCrab/firecrab/pull/198
[#208]: https://github.com/SteelCrab/firecrab/pull/208
[#210]: https://github.com/SteelCrab/firecrab/pull/210
[#232]: https://github.com/SteelCrab/firecrab/pull/232
[#254]: https://github.com/SteelCrab/firecrab/pull/254
[#262]: https://github.com/SteelCrab/firecrab/pull/262
[#263]: https://github.com/SteelCrab/firecrab/pull/263
[#264]: https://github.com/SteelCrab/firecrab/pull/264
[#265]: https://github.com/SteelCrab/firecrab/pull/265
[#266]: https://github.com/SteelCrab/firecrab/issues/266
[#269]: https://github.com/SteelCrab/firecrab/pull/269
[#270]: https://github.com/SteelCrab/firecrab/pull/270
[#272]: https://github.com/SteelCrab/firecrab/pull/272
[#291]: https://github.com/SteelCrab/firecrab/issues/291
[#287]: https://github.com/SteelCrab/firecrab/pull/287
[#290]: https://github.com/SteelCrab/firecrab/pull/290
[#294]: https://github.com/SteelCrab/firecrab/pull/294
[#295]: https://github.com/SteelCrab/firecrab/pull/295
[#297]: https://github.com/SteelCrab/firecrab/pull/297
[#303]: https://github.com/SteelCrab/firecrab/issues/303
[#305]: https://github.com/SteelCrab/firecrab/issues/305
[#306]: https://github.com/SteelCrab/firecrab/issues/306
[#312]: https://github.com/SteelCrab/firecrab/pull/312
[#314]: https://github.com/SteelCrab/firecrab/pull/314
[#315]: https://github.com/SteelCrab/firecrab/pull/315
[#318]: https://github.com/SteelCrab/firecrab/pull/318
[#324]: https://github.com/SteelCrab/firecrab/pull/324
[#330]: https://github.com/SteelCrab/firecrab/pull/330
[#331]: https://github.com/SteelCrab/firecrab/pull/331
[#332]: https://github.com/SteelCrab/firecrab/pull/332
[#333]: https://github.com/SteelCrab/firecrab/pull/333
[#343]: https://github.com/SteelCrab/firecrab/pull/343
[#351]: https://github.com/SteelCrab/firecrab/pull/351
[#358]: https://github.com/SteelCrab/firecrab/pull/358
[#359]: https://github.com/SteelCrab/firecrab/pull/359
[#360]: https://github.com/SteelCrab/firecrab/pull/360
[#368]: https://github.com/SteelCrab/firecrab/pull/368
[#378]: https://github.com/SteelCrab/firecrab/pull/378
[#123]: https://github.com/SteelCrab/firecrab/issues/123
[88ba35d]: https://github.com/SteelCrab/firecrab/commit/88ba35d
[34193f5]: https://github.com/SteelCrab/firecrab/commit/34193f5
[729bb47]: https://github.com/SteelCrab/firecrab/commit/729bb47
[1ffba72]: https://github.com/SteelCrab/firecrab/commit/1ffba72
[8bcc2af]: https://github.com/SteelCrab/firecrab/commit/8bcc2af
[37075bf]: https://github.com/SteelCrab/firecrab/commit/37075bf
[1a44619]: https://github.com/SteelCrab/firecrab/commit/1a44619
[664d446]: https://github.com/SteelCrab/firecrab/commit/664d446
[73d5fe1]: https://github.com/SteelCrab/firecrab/commit/73d5fe1
[a8152a4]: https://github.com/SteelCrab/firecrab/commit/a8152a4
[3bc13d0]: https://github.com/SteelCrab/firecrab/commit/3bc13d0
[3b910c9]: https://github.com/SteelCrab/firecrab/commit/3b910c9
[76f6ef3]: https://github.com/SteelCrab/firecrab/commit/76f6ef3
[c27e516]: https://github.com/SteelCrab/firecrab/commit/c27e516
[677cbef]: https://github.com/SteelCrab/firecrab/commit/677cbef
[77e7347]: https://github.com/SteelCrab/firecrab/commit/77e7347
[4360419]: https://github.com/SteelCrab/firecrab/commit/4360419
[2493c7d]: https://github.com/SteelCrab/firecrab/commit/2493c7d
[7eb6740]: https://github.com/SteelCrab/firecrab/commit/7eb6740
[322e95c]: https://github.com/SteelCrab/firecrab/commit/322e95c
[45790c3]: https://github.com/SteelCrab/firecrab/commit/45790c3

[#442]: https://github.com/SteelCrab/firecrab/issues/442