Skip to main content
The hiloop CLI ships as prebuilt macOS and Linux binaries with a curl | sh installer — every version is published at github.com/hiloopai/cli. The SDKs ship to PyPI (hiloop) and npm (@hiloopai/sdk), generated from the same API contract. To get started, see the quickstart and Using the SDKs.
hiloop is pre-1.0: a minor version bump (0.x → 0.y) can include breaking changes, and each entry below calls those out. Patch releases never break existing commands.
​
CLI
August 16, 2026
  • hiloop sandbox create --network-access and hiloop sandbox update --network-access select one of the deployment’s closed network profiles: public, gateway-only, or none.
  • Successful updates return the exact sandbox pod, referenced network-policy names, and selected policy-controller object identities. A deployment that cannot prove the requested profile refuses the update instead of silently running with broader access.
​
CLI
August 9, 2026
  • Sandboxes now record explicit entrypoints, buffered exec commands, SSH output, cooperative HTTP, and OTLP into the ambient run returned by sandbox create. Interactive SSH records terminal output but never keystrokes.
  • Running hiloop run -- <command> inside a sandbox joins that ambient capture session without a second run or Hiloop credential. Capture-selection, per-command secret, and egress flags are refused because the sandbox already owns those boundaries.
  • hiloop skills install now installs skills bundle v0.6.2 with the managed-capture source matrix, the correct sandbox receipt shape, and guidance for deliberately exposed sandbox credentials. Provider login, brokered secrets, or short-lived restricted keys remain safer than raw key injection.
​
CLI
August 8, 2026
  • hiloop upgrade now works on installations made with curl -fsSL https://hiloop.ai/install.sh | sh. It previously looked for the install receipt under the wrong name and reported “hiloop can’t find an install receipt” on every such install, so hiloop upgrade and hiloop upgrade --check could never see or install a newer release and installs stayed on the version they were first given.
  • If you are on an older version, reinstall once with the command above; from that install onwards hiloop upgrade keeps you current.
​
CLI
August 8, 2026
  • hiloop sandbox create now provisions a capture-ready ambient run automatically and reports its run ID in both the receipt and JSON output, so you can immediately tail or query the sandbox’s telemetry.
  • Breaking: the --capture switch is gone. Telemetry capture is now part of every sandbox rather than an optional creation mode.
​
CLI
August 7, 2026
  • hiloop skills install now installs the v0.5.0 public skills bundle: nine focused skills with one consolidated sandbox workflow and current CLI guidance.
  • Refreshing an older installation retires superseded skill directories so agents cannot keep loading removed commands. Only byte-for-byte released or previously recorded content is retired; edited and user-created skills are preserved.
  • Sandbox cleanup hints now point to the working hiloop sandbox delete command.
​
CLI
August 4, 2026
  • hiloop sandbox cp copies files between your machine and a running sandbox, in either direction: hiloop sandbox cp ./data my-sandbox:/workspace/data to upload, and the operands reversed to download. Add -r for a directory. Nothing has to be installed inside the sandbox, so this works with any image, including one with no shell.
  • The receipt reports what landed, how long it took, and the transfer rate. --output json returns the same fields plus the resolved sandbox id.
  • A copy of many small files spends most of its time on network round trips rather than moving bytes, so a large source tree can take far longer than its size suggests. To put a repository into a sandbox, cloning it from inside the sandbox is usually much faster than copying it in.
​
CLI
July 30, 2026
  • Names lead everywhere: tables put the name or slug first with the id demoted to a trailing column or a name (id) suffix, receipts report the resolved sandbox name (including deletes addressed by id), and sandbox get shows pinned volumes and snapshot parents by name. --output json payloads are unchanged.
  • Long-running commands print one line per observed state with its elapsed time (for example requested 0.4s, then running 2.0s) instead of a static spinner. On a terminal the current line’s clock ticks in place; piped output gets the same transcript plus a periodic refresh during long silent waits.
  • hiloop sandbox create works with no --image or --from: the platform default image is applied server-side, and the receipt reports the image that was selected.
  • Sandboxes are sized at create with --cpus, --memory-mb, --gpus, and --gpu-model; omitted values resolve to the platform defaults (1 CPU, 2048 MB), and the resolved resources are echoed on the record. GPU requests are not served yet and are refused with a clear error.
  • sandbox list shows each sandbox’s resources (2cpu · 4gb) and who created it; sandbox get renders a compact key-value view with resources, creator, SSH command, metadata, relative times, and a from: row showing the source snapshot for forked sandboxes.
​
CLI
July 28, 2026
Interactive access works end to end. hiloop sandbox ssh <name> opens a shell in a running sandbox with stock OpenSSH: no SSH key to create, no ssh configuration to write, and no credential beyond the organization-scoped API credential you already use.
  • Breaking: the SSH path is rebuilt around a single authenticated connection to the API, which authorizes the caller and connects to the sandbox on their behalf. The jump host and the certificate authority the previous design assumed are gone. An older CLI cannot open a session against a current deployment, so upgrade both together.
  • One-shot remote commands (hiloop sandbox ssh my-sandbox -- 'echo hello') return the remote command’s exit code as the CLI’s exit code, and sftp and scp work over the same path. rsync runs itself on both ends, so it also needs the rsync binary inside your image.
  • The sandbox’s host key is pinned for you on every connect, so there is no trust-on-first-use prompt and nothing lands in your known_hosts.
  • hiloop sandbox exec runs your command in the workload container and returns its buffered output and real exit code on deployments running the current service; it previously reported unsupported_capability.
  • The shell shares the sandbox’s network but not the workload container’s filesystem. Use exec to reach your image’s files. See interactive access.
​
CLI
July 26, 2026
  • Sandbox lifecycle commands finish as soon as the sandbox reaches its target state. A create or delete that the runtime completes in a couple of seconds now reports in a couple of seconds; previously every command waited out a full polling window (about 26 seconds).
  • A sandbox that needs intervention ends the command right away with a clear error and the server’s reason, instead of waiting for the command timeout.
​
CLI
July 26, 2026
The sandbox runtime was rebuilt from the ground up, and this release ships the CLI for it.
  • Breaking: the hiloop sandbox family is rebuilt around name-first commands: create (from an OCI image or a snapshot, waiting until the sandbox is running), list, get, ssh (stock OpenSSH, including one-shot commands), exec, snapshot, stop, start, and delete. Every command accepts a name or an id, create sends an idempotency key so a retried create is safe, and failed or quarantined sandboxes report a stable reason alongside the server detail.
  • Breaking: versioned volumes replace workspaces. hiloop volume create makes a project-scoped volume, volume push publishes a local directory as a new immutable version, and sandboxes mount an exact volume version at create. The hiloop workspace commands are removed.
  • Breaking: commands tied to retired surfaces are removed: tree and branch inspection, leases, egress rules, preview URLs and port forwarding (sandbox expose, unexpose, ports, port-forward), sandbox access lists, and hiloop open.
  • hiloop devbox commands are unavailable while their transport moves to the new runtime; they return a clear error stating that. (They were removed altogether in a later release. A long-lived development sandbox is now built from the ordinary sandbox verbs. See Run a sandbox as a devbox.)
  • Fixed: hiloop sandbox create sends the current API request shape (creates from 0.12.x binaries were rejected), and the CLI’s sandbox types are now pinned to the published API contract by a round-trip test, so this class of drift is caught before a release.
​
CLI
July 23, 2026
  • The Linux shell installer places the bundled pasta network helper next to the hiloop binary, so captured runs work from a fresh install without extra setup.
​
CLI
July 23, 2026
  • New hiloop devbox commands for durable development sandboxes. hiloop devbox create needs zero flags: it provisions a durable sandbox (4 vCPU, 8 GiB memory) on the managed network with open egress, creates or reuses a same-named persistent workspace mounted at /workspace, sets a two-hour idle timeout, waits until the devbox is running, and prints the matching hiloop devbox ssh command. Every default is overridable with the familiar sandbox flags. devbox list shows each devbox’s state, idle-lease expiry, and workspace; devbox ssh, devbox stop, and devbox delete complete the loop.
  • Runs wrapped with hiloop run keep a signed-in session fresh: child processes share a refreshable credential cache instead of a one-shot token, so a long run’s writes no longer fail after the original token expires. Static API keys are passed through unchanged.
  • One-shot SSH commands (sandbox ssh NAME -- cmd) deliver their full output and exact exit status; the stream previously could be torn down before the tail drained.
  • --wait polling paces itself to the operation’s elapsed time, so short lifecycle operations are observed close to their true duration.
  • An unknown secret or workload name is reported as not found, together with the command that lists the ones that exist.
​
CLI
July 22, 2026
The sandbox runtime moved to versioned workspaces, and this release ships the reshaped sandbox surface.
  • Breaking: the hiloop volume and hiloop snapshots command families are removed, along with sandbox fork, sandbox snapshot, sandbox restore, and sandbox cp. Durable state now lives in versioned workspaces: attach an exact workspace revision at create with --workspace-revision and --workspace-target, and manage workspaces with hiloop workspace create and hiloop workspace list.
  • SSH access to sandboxes: sandbox ssh opens a shell, sandbox ssh-config sets up stock ssh and editor access (for example VS Code Remote-SSH), and a stopped sandbox wakes on connect.
  • Sandbox access lists: sandbox access grant, revoke, and list share a sandbox with other principals.
  • Request GPUs at create with --gpus and --gpu-model.
  • Expose guest ports as token-gated preview URLs (sandbox expose, unexpose, ports) or forward them locally with sandbox port-forward.
  • hiloop skills install installs the verified Agent Skills bundle for your agent harness.
  • hiloop open jumps from the terminal to the matching console page.
  • Ambient cloud credentials for workloads: hiloop workload-identity serves workload federation tokens as AWS, GCP, and Azure credential sources, and workloads federation manages the trusted clouds.
  • Usage accounting rolls up per run and per subtree.
  • Live event streams reset their reconnect budget on progress, and a just-refreshed session rides out a stale 401 instead of dying.
  • Exhausted retries report how many attempts were made.
​
SDK
July 17, 2026
Python hiloop 0.4.0 and TypeScript @hiloopai/sdk 0.4.0.
  • Breaking: the /v1 API serves snake_case JSON; regenerated clients follow the wire shape.
  • The sandbox resource contract adds GPU requests.
  • Ergonomic sandbox overlays in both SDKs — higher-level helpers over the generated operations.
  • Typed error responses: the contract models the error body (including quota details on limit rejections), so SDK errors are structured instead of loose JSON.
  • Artifact discovery: list the artifacts a sandbox has produced.
  • Workload identity surface: run attribution to the launching workload, workload delete, and launch ACLs that name principals by kind.
  • Usage accounting includes volume storage bytes; snapshot reads report durability.
​
CLI
July 15, 2026
  • Breaking: the network capture transport is now selectable and composed; capture-related flags changed shape.
  • Breaking: annotation writes move under hiloop annotations add.
  • --profile requests a named runtime profile at sandbox create.
  • Live event streams refresh an expired session on reconnect instead of dying with a 401.
  • sandbox cp and secret-rotation retries are idempotent — a retried request can’t double-apply.
  • JSON output fixes: tenant egress enums and workload launch policies render as their wire values, and a shell-mangled sandbox request now gets an actionable error.
​
CLI
July 12, 2026
  • hiloop snapshots delete — the destructive snapshot verb.
  • Bind stored secrets at snapshot restore with --secret.
  • Volume storage bytes appear in usage accounting and on the volume record.
  • A fork inherits the source sandbox’s image when you don’t pass one.
  • Zero-byte files push cleanly.
​
CLI
July 12, 2026
  • Artifact discovery: list the artifacts a sandbox has produced.
  • An expired login session refreshes mid-command instead of failing long-running operations.
  • Retried and deadline-failed operations report per-attempt failure causes.
​
CLI
July 11, 2026
  • Bind stored secrets at sandbox create and fork with --secret.
  • hiloop runs complete marks a client-owned run finished.
​
CLI
July 11, 2026
  • Launch ACLs name principals by kind, and service accounts can be granted launch access.
​
CLI
July 11, 2026
  • Runs are attributed to the workload that launched them; hiloop workloads delete removes a workload identity.
  • annotations --history JSON carries each row’s supersession status.
​
CLI
July 11, 2026
  • Breaking: the /v1 API serves snake_case JSON; the CLI follows the wire shape.
  • Uniform --output and --project across the sandbox and snapshot verbs; restore --name names the restored sandbox.
  • sandbox get inlines the failure reason when the sandbox’s last operation failed.
​
CLI
July 11, 2026
  • Sandbox create and restore ride out lost responses with bounded keyed retries — a retried create can’t produce a duplicate sandbox.
  • Snapshot durability is acknowledged and readable on the wire.
​
CLI
July 10, 2026
  • Operations carry a typed result and error instead of raw JSON strings.
  • hiloop usage reports your real quota limits.
  • Query results return a rows envelope with column metadata, and queries can project a subset of columns.
  • hiloop tenant switch --set-default persists your default tenant.
  • hiloop projects delete.
​
CLI
July 9, 2026
  • The hiloop volume command family, including volume prefetch (removed in v0.12.0; durable state moved to versioned workspaces).
  • Forked sandboxes inherit the parent’s secrets by default, with merge-by-name overrides.
  • Sandbox and execution wait loops ride out transient poll errors; sandbox cp reports the operation’s terminal state.
  • Flag values accept any casing (signal, severity, surface, HTTP method).
​
CLI
July 8, 2026
  • sandbox cp transfers files to and from a sandbox.
  • Execution timeouts are honored, and a capped timeout is reported loudly.
  • Streamed output carries multi-byte UTF-8 across chunk boundaries.
  • hiloop api passthrough is binary-safe in both directions.
  • hiloop --version reports the build version and commit.
​
CLI
July 8, 2026
  • hiloop feedback sends a bug report or product feedback from the terminal.
  • Under --output json, errors are a JSON envelope on stderr.
  • Egress policy inspection: see the effective egress policy for an identity.
  • Machine identities are now called workloads (renamed from agents).
  • Fixed hiloop run hanging after the child exits when stdin never closes.
​
CLI
July 7, 2026
  • Sandboxes are always named — a Docker-style name is generated when you don’t pass one, and names and slugs work wherever an id is accepted.
  • Breaking: one create-argument grammar — the handle is positional everywhere.
  • One-shot mode: sandbox run executes a command in a fresh sandbox to completion.
  • Snapshots get names and descriptions, snapshots list/get, and restoring a snapshot extends the run lineage.
  • runs show --trace renders a waterfall of the run’s exchanges.
  • Durable sign-in: 30-day sessions that survive concurrent commands, and login enters your default tenant automatically.
  • Workload identity foundation: a registry, launch ACLs, and workload-bound keys.
​
SDK
July 7, 2026
Python hiloop 0.3.0 and TypeScript @hiloopai/sdk 0.3.0.
  • Named sandboxes, one-shot sandbox runs, snapshot names, snapshot list/get, and restore extending the run lineage — the same API surface as CLI v0.3.0.
  • Annotations anchor at the run and support event-pair ranges.
  • Executions report an explicit error and an honest exit-code presence.
​
CLI
July 4, 2026
  • Breaking: command re-home — tail lives under runs, and query and usage are top-level verbs.
  • runs show renders the run’s event transcript, with payload access.
  • data-views manages saved views, with example derivation recipes.
  • User-named API keys, including a service-account kind.
  • whoami reports the resolved principal and tenant.
​
SDK
July 4, 2026
Python hiloop 0.2.0 and TypeScript @hiloopai/sdk 0.2.0.
  • whoami returns the {principal, tenant} identity shape.
  • One canonical event JSON on every read surface.
  • Run trees paginate; sandbox describe, fleet list metadata, and the usage snapshot shape.
  • Digest-first blob upload for payload storage.
  • The OpenAPI contract declares its bearer security scheme, so generated clients authenticate out of the box.
​
CLI
June 30, 2026
  • Named configuration contexts for switching between deployments.
  • Attached sandbox shell.
  • Service endpoints are discovered from the API, so a context only needs one URL.
  • annotate accepts structured nested attributes.
  • Runs get human-readable labels.
  • Fixes: tenant selection during login, macOS terminal support, and TTY passthrough for captured runs.
​
CLI
June 29, 2026
  • Shell completions and man pages ship in the release archive.
  • Unified --output across commands.
  • Runs form a lineage tree.
​
SDK
June 29, 2026
  • TypeScript: the configurable client is exported, so custom base URLs and headers work.
​
CLI
June 29, 2026
  • hiloop secret commands, and run --secret binds a brokered secret to a run.
  • The curl | sh installer points at the public release repository.
  • Sandbox agent output is fully drained before exit.
​
SDK
June 29, 2026
  • Breaking: telemetry queries take SQL directly — the structured query spec is removed.
  • Sandbox secret store and broker endpoints.
​
CLI
June 29, 2026
The first public release of the hiloop CLI.
  • hiloop run wraps any agent command and streams its telemetry to hiloop.
  • Sandbox lifecycle: create, exec, fork, snapshot, and interactive sessions.
  • hiloop login and logout with browser and device flows; tenant switching.
  • Telemetry query, live tail, and branch diff; annotations.
  • Project and API-key management.
  • Prebuilt macOS and Linux binaries (x86_64 and aarch64) with a curl | sh installer.
​
SDK
June 29, 2026
The first public release of the SDKs: Python hiloop on PyPI and TypeScript @hiloopai/sdk on npm — generated from the same API contract as the CLI, covering sandboxes, snapshots, forks, runs, telemetry queries, and annotations.