v0.6.1

Changelog

Features

• dcf9f31: feat(cli): inline grant prompting for missing credentials (#389) (@dpup)

Bug Fixes

• a73c090: fix(daemon): scope OAuth token refresh to the run's credential profile (#392) (@dpup)

Others

• 68a82d8: chore(ci): add review-prevention guardrails (#390) (@dpup)
• 9b0628c: chore(release): v0.6.1 (#393) (@dpup)
• d87a863: docs(mcp): frame host-local MCP credential isolation; add example (#391) (@dpup)

Full Changelog: v0.6.0...v0.6.1

v0.6.0

Changelog

Features

• 7cc343d: feat(mcp): add Langfuse regional MCP shortcuts (#384) (@dpup)
• 5ba011c: feat(mcp): adopt mcp: grant naming (mcp- still accepted) (#386) (@dpup)
• e80c600: feat(oauth): add posthog OAuth/MCP auto-discovery shortcut (#382) (@dpup)
• 61d205c: feat(proxy): add 'moat proxy restart' with version-aware daemon adoption (#385) (@dpup)
• c14cd24: feat: declarative MCP shorthand for well-known servers (#383) (@dpup)
• 9316faf: feat: moat join — run a second agent in a running container (#379) (@dpup)

Bug Fixes

• e1fb7ed: fix(claude): install python by default for the Claude agent (#371) (@dpup)
• 02b212f: fix(container): harden Apple async container ops (network delete + service IP) (#367) (@abezzub-dr)
• 3348e5e: fix(container): report pre_run hook failures clearly (#377) (@dpup)
• 4add020: fix(github): stop proactively refreshing env-sourced tokens so re-grant takes effect (#373) (#381) (@dpup)
• 5b48a97: fix(github): surface re-grant hint when an injected credential is rejected (#380) (@dpup)
• 80036aa: fix(github): use Basic auth for github.com git smart-HTTP over HTTPS (#376) (@dpup)
• ce12113: fix(mcp): address proxy relay via moat-proxy so the token is stripped (#387) (@dpup)
• 6e20317: fix(run): default service version to registry default; add ministack (#366) (@abezzub-dr)

Others

• ebcc7f6: chore(release): v0.6.0 (#388) (@dpup)
• 0f6183c: test(daemon): regression test for MCP relay token-path routing (#348) (#378) (@dpup)

Full Changelog: v0.5.4...v0.6.0

v0.5.4

Changelog

Bug Fixes

• 7e287bc: fix(claude): match Claude Code's project-dir slug rule (#364) (@abezzub-dr)
• 4c689f3: fix(claude): preserve source file mode in marketplace tar (#363) (@abezzub-dr)
• 7674d46: fix(tui): drain vt emulator reply pipe to prevent compositor deadlock (#362) (@abezzub-dr)

Full Changelog: v0.5.3...v0.5.4

v0.5.3

Changelog

Bug Fixes

• 33b7afb: fix(claude): don't scrape claude setup-token output (#353) (@natehardison)
• a3eea8e: fix(claude): write subscriptionType and scopes to container credentials (#358) (@dpup)
• 65f06f6: fix(container): set tmpfs mode to 1777 for non-root container users (#355) (@abezzub-dr)
• 66bc44f: fix(deps): install the pinned claude-code version (#357) (@dpup)

Full Changelog: v0.5.2...v0.5.3

v0.5.2

Changelog

Bug Fixes

• 4568fc8: fix(claude): preserve marketplace source shape for allowlist matching (#345) (@abezzub-dr)
• 223bce5: fix(claude): use far-future expiry for setup-token credentials (#352) (@abezzub-dr)
• 3ecc34a: fix(claude): use sk-ant-oat01 placeholder, drop CLAUDE_CODE_OAUTH_TOKEN env (#351) (@abezzub-dr)
• 66febdb: fix(tui): keep footer pinned when child resets scroll region (#349) (@dpup)

Full Changelog: v0.5.1...v0.5.2

v0.5.1

Changelog

Features

• 7af31ca: feat(config): honor MOAT_HOME to relocate moat state directory (#323) (@dpup)
• 7331bf9: feat(deps): add Python 3.13/3.14 and bump uv to 0.11.6 (#316) (@ternarybits)
• fb8a324: feat(tui): add ctrl+/ d (dump) and r (reset) shortcuts (#343) (@dpup)
• 13ca67e: feat: multi-runtime manager for cross-engine CLI commands (#311) (@dpup)

Bug Fixes

• 9fdb9a3: fix(ci): pre-compile E2E test binary and capture output on timeout (#329) (@dpup)
• 7c3393b: fix(ci): prevent E2E test hang on CI runners (#328) (@dpup)
• 0d6c955: fix(deps): handle multi-line YAML block scalars in build hooks (#339) (@dpup)
• 616f1b3: fix(e2e): skip host traffic tests that freeze CI runner (#332) (@dpup)
• 27566bb: fix(proxy): close loopback bypass in NO_PROXY under Docker host networking (#327) (@dpup)
• be55720: fix(proxy): install ip6tables rules to block IPv6 egress bypass (#324) (@dpup)
• d707c86: fix(proxy): prevent host traffic from bypassing proxy (#321) (@dpup)
• a60349f: fix(proxy): prevent ip6tables hang on hosts without IPv6 kernel module (#325) (@dpup)
• 4c57090: fix(proxy): reach host from custom networks on Docker Desktop (#337) (@abezzub-dr)
• cfc5f2e: fix(run): auto-include MCP auth grants in credential loading (#338) (@dpup)
• 3cbb241: fix(run): bound network create and reap orphan moat networks (#342) (@dpup)
• 2c3f51e: fix(run): stop reconciliation from corrupting persisted run state (#309) (@dpup)
• c9ee1be: fix(test): use fake runtime type in unavailable cache test (#312) (@dpup)
• 9fc790d: fix: correct error message to suggest command that actually exists (#336) (@abezzub-dr)

Refactoring

• 9d8a460: refactor: extract gatekeeper and proxy to standalone repo (#333) (@andybons)

Others

• 521e5a7: ci(e2e): add step-level timeout so artifact upload runs (#330) (@dpup)
• d0c2397: ci(e2e): use shell timeout to guarantee process kill (#331) (@dpup)
• c45b5d9: ci(release): add workflow_dispatch for manual gatekeeper builds (#314) (@andybons)
• aa82623: ci(release): publish gatekeeper image to GHCR (#313) (@andybons)
• b8afc8e: test(deps): skip transient failures in github URL reachability test (#344) (@dpup)
• 142ff79: test(proxy): close coverage gaps for host-traffic proxy path (#326) (@dpup)

Full Changelog: v0.5.0...v0.5.1

v0.5.0

Changelog

Features

• 9d837f4: feat(aws): propagate AWS_PROFILE from grant time to proxy daemon (#296) (@dpup)
• 2f0ce0d: feat(claude): add support for managed settings (#306) (@abezzub-dr)
• 472f27e: feat(claude): host-side marketplace cloning for private plugin repos (#240) (@abezzub-dr)
• 3897be2: feat(claude): settings passthrough for ~/.moat/claude/settings.json (#281) (@dpup)
• 9123ae3: feat(config): global mounts in ~/.moat/config.yaml (#282) (@dpup)
• 4ba384b: feat(deps): add protobuf compiler and plugin dependencies (#276) (@dpup)
• fb27ec6: feat(deps): update default Node.js version from 20 to 22 (#304) (@dpup)
• 8e6936b: feat(gatekeeper): standalone credential-injecting proxy (#299) (@dpup)
• f2d5b78: feat(grant): add moat grant show for credential inspection (#297) (@dpup)
• 621fd81: feat(mcp): support sandbox-local MCP servers (#184) (@dpup)
• 1f9a065: feat(oauth): add OAuth grant provider for MCP servers (#278) (@dpup)
• cfff686: feat(proxy): support multiple credentials per host (#295) (@dpup)
• 130e0d1: feat: Keep policy integration (#288) (@dpup)
• 450026e: feat: block host traffic by default, add network.host for per-port opt-in (#303) (@dpup)
• 29b1fc2: feat: support configuring a custom base image (#292) (@joonas)

Bug Fixes

• 8eb83e3: fix(aws): surface actionable errors and rename legacy agentops references (#290) (@dpup)
• b5ab1e3: fix(claude): SSH fallback for marketplace clone and clearer error output (#285) (@dpup)
• 8936389: fix(claude): SSH known_hosts ordering and clone fallback visibility (#283) (@dpup)
• b3f3d55: fix(claude): disable git credential prompt during host-side marketplace clone (#280) (@dpup)
• 0d68907: fix(claude): skip plugin install when claude CLI is absent (#291) (@dpup)
• 66777de: fix(daemon): use ConfigureProxy for token refresh propagation (#289) (@dpup)
• 909e690: fix(e2e): add curl retry for Apple container network startup delays (#284) (@dpup)
• f4d880a: fix: add Anthropic and Gemini token placeholders (#293) (@daveworth)
• 8dc9acf: fix: install Rust toolchain to shared location for non-root access (#305) (@joonas)

Refactoring

• ed95459: refactor(proxy): remove all moat-internal imports (#301) (@dpup)

Others

• 17485bf: test(claude): add assertion for plugin script guard (#294) (@dpup)
• 8dd6377: test(gatekeeper): add integration tests for credential injection and network policy (#302) (@dpup)

Full Changelog: v0.4.0...v0.5.0

v0.4.0

Changelog

Features

• 8556105: feat(clipboard): host clipboard bridging for interactive session (#219) (@mme)
• 8668427: feat(container): add Rancher Desktop support (#239) (@abezzub-dr)
• 30a03ca: feat(deps): add Ollama service dependency with provisioning and cache support (#238) (@dpup)
• ff51ec7: feat(exec): add moat exec command (#232) (@mme)
• 04fe592: feat(mounts): Use tmpfs to implement excludable directories from filesystem mounts (#233) (@dpup)
• 24f754b: feat(provider): add Meta Graph API credential provider (#226) (@dmitriy-northbeam)
• 78a918c: feat(runctx): add documentation URLs to agent runtime context (#228) (@dpup)
• e573d13: feat(runctx): surface per-path network rules in agent runtime context (#266) (@dpup)
• b166d61: feat(secrets): add env:// resolver for host environment variable forwarding (#236) (@dpup)
• ff737f0: feat: HTTP request rules for network firewall (#230) (@dpup)

Bug Fixes

• 62c791b: fix(claude): suppress startup prompts in container runs (#253) (@dpup)
• bd473b4: fix(claude): warn that imported credentials are short-lived (#251) (@dpup)
• 7f42a0e: fix(daemon): complete run setup before registry insertion to prevent proxy race (#250) (@dpup)
• 970b0b9: fix(daemon): per-container runtime cache in liveness checker (#221) (@dpup)
• e2fb4ab: fix(deps): generate legacy-compatible Dockerfiles when BuildKit unavailable (#235) (@dpup)
• d49a2a8: fix(deps): resolve default runtime versions to prevent broken tarball URLs (#227) (@dpup)
• e7cf702: fix(deps): suppress interactive prompts for corepack and playwright (#223) (@dpup)
• 06d2be9: fix(e2e): isolate tests from host Claude plugin settings (#271) (@dpup)
• 2a4366d: fix(github): configure git to use SSH for GitHub when SSH grant is active (#252) (@dpup)
• db93fea: fix(github): strip nil values from gh config to prevent YAML null round-trip (#241) (@abezzub-dr)
• 68f4fbf: fix(langserver): use uv tool install for pyright instead of pip (#259) (@dpup)
• b7e36ba: fix(plugins): add Claude CLI path so plugins can be baked into image (#261) (@dpup)
• 1fc62da: fix(plugins): make plugin/marketplace install errors fail Docker build (#260) (@dpup)
• d36cc09: fix(provider): use init-files for gh config to fix .config ownership (#224) (@dpup)
• 653f3ed: fix(routing): auto-clean stale routes on agent name collision (#237) (@dpup)

Refactoring

• 17b5582: refactor(deps): unify image pipeline structs and fix OpenAI grant detection (#220) (@dpup)

Others

• 9617851: Add support for Node 24 (#269) (@abezzub-dr)
• 23d50e9: Update documentation examples from my-agent to my-project (#242) (@dpup)
• 1e5b1bf: docs(guides): add workspace sharing guide for host/container dependency conflicts (#264) (@dpup)
• 349c42d: docs(guides): specify moat claude as the parent command for --rebuild (#262) (@dpup)
• 098c056: docs(reference): add troubleshooting page with error-to-fix lookup table (#265) (@dpup)
• d3144f1: docs(worktrees): add multi-repo workspace guidance (#268) (@dpup)

Full Changelog: v0.3.3...v0.4.0

v0.3.3

Changelog

Features

• 028c7d3: feat(provider): add Graphite CLI credential provider (#218) (@dpup)

Bug Fixes

• 63cd756: fix(image): include firewall flag in image tag hash (#214) (@dpup)
• aef5a1b: fix(proxy): rewrite proxy host for custom network gateways (#217) (@dpup)
• c0b747a: fix(proxy): separate credential proxy port from routing proxy (#213) (@dpup)
• c677adf: fix(snapshot): consider current file size in total-size guard (#208) (@joonas)
• 3cb863f: fix(snapshot): prevent silent truncation of large files (#209) (@joonas)
• fc17245: fix(trace): fix network tracing bugs and improve test coverage (#216) (@dpup)

Full Changelog: v0.3.2...v0.3.3

v0.3.2

Changelog

Features

• b1f5aaf: feat(container): add ulimits configuration (#211) (@dpup)
• 9404ef9: feat(mcp): support host-local MCP servers (#183) (@dpup)

Bug Fixes

• 06bdbe4: fix(container): Apple port bindings + daemon run persistence (#210) (@dpup)

Full Changelog: v0.3.1...v0.3.2