> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hiloop.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Changelog

> What's new in the hiloop CLI and SDKs — the release history for every published version.

The `hiloop` CLI ships as prebuilt macOS and Linux binaries with a `curl | sh` installer — every
version is published at [github.com/hiloopai/cli](https://github.com/hiloopai/cli/releases). The
SDKs ship to [PyPI (`hiloop`)](https://pypi.org/project/hiloop/) and
[npm (`@hiloopai/sdk`)](https://www.npmjs.com/package/@hiloopai/sdk), generated from the same API
contract. To get started, see the [quickstart](/guides/quickstart) and
[Using the SDKs](/guides/using-the-sdks).

<Note>
  hiloop is pre-1.0: a minor version bump (`0.x` → `0.y`) can include breaking changes, and each
  entry below calls those out. Patch releases never break existing commands.
</Note>

<Update label="CLI v0.18.1" description="August 16, 2026" tags={["CLI"]}>
  * `hiloop sandbox create --network-access` and `hiloop sandbox update --network-access` select
    one of the deployment's closed network profiles: `public`, `gateway-only`, or `none`.
  * Successful updates return the exact sandbox pod, referenced network-policy names, and selected
    policy-controller object identities. A deployment that cannot prove the requested profile
    refuses the update instead of silently running with broader access.
</Update>

<Update label="CLI v0.18.0" description="August 9, 2026" tags={["CLI"]}>
  * Sandboxes now record explicit entrypoints, buffered exec commands, SSH output, cooperative HTTP,
    and OTLP into the ambient run returned by `sandbox create`. Interactive SSH records terminal
    output but never keystrokes.
  * Running `hiloop run -- <command>` inside a sandbox joins that ambient capture session without a
    second run or Hiloop credential. Capture-selection, per-command secret, and egress flags are
    refused because the sandbox already owns those boundaries.
  * `hiloop skills install` now installs skills bundle v0.6.2 with the managed-capture source matrix,
    the correct sandbox receipt shape, and guidance for deliberately exposed sandbox credentials.
    Provider login, brokered secrets, or short-lived restricted keys remain safer than raw key
    injection.
</Update>

<Update label="CLI v0.17.1" description="August 8, 2026" tags={["CLI"]}>
  * `hiloop upgrade` now works on installations made with `curl -fsSL https://hiloop.ai/install.sh | sh`.
    It previously looked for the install receipt under the wrong name and reported "hiloop can't find
    an install receipt" on every such install, so `hiloop upgrade` and `hiloop upgrade --check` could
    never see or install a newer release and installs stayed on the version they were first given.
  * If you are on an older version, reinstall once with the command above; from that install
    onwards `hiloop upgrade` keeps you current.
</Update>

<Update label="CLI v0.17.0" description="August 8, 2026" tags={["CLI"]}>
  * `hiloop sandbox create` now provisions a capture-ready ambient run automatically and reports
    its run ID in both the receipt and JSON output, so you can immediately tail or query the
    sandbox's telemetry.
  * **Breaking:** the `--capture` switch is gone. Telemetry capture is now part of every sandbox
    rather than an optional creation mode.
</Update>

<Update label="CLI v0.16.1" description="August 7, 2026" tags={["CLI"]}>
  * `hiloop skills install` now installs the v0.5.0 public skills bundle: nine focused skills with
    one consolidated sandbox workflow and current CLI guidance.
  * Refreshing an older installation retires superseded skill directories so agents cannot keep
    loading removed commands. Only byte-for-byte released or previously recorded content is
    retired; edited and user-created skills are preserved.
  * Sandbox cleanup hints now point to the working `hiloop sandbox delete` command.
</Update>

<Update label="CLI v0.16.0" description="August 4, 2026" tags={["CLI"]}>
  * `hiloop sandbox cp` copies files between your machine and a running sandbox, in either
    direction: `hiloop sandbox cp ./data my-sandbox:/workspace/data` to upload, and the
    operands reversed to download. Add `-r` for a directory. Nothing has to be installed
    inside the sandbox, so this works with any image, including one with no shell.
  * The receipt reports what landed, how long it took, and the transfer rate.
    `--output json` returns the same fields plus the resolved sandbox id.
  * A copy of many small files spends most of its time on network round trips rather than
    moving bytes, so a large source tree can take far longer than its size suggests. To
    put a repository into a sandbox, cloning it from inside the sandbox is usually much
    faster than copying it in.
</Update>

<Update label="CLI v0.15.0" description="July 30, 2026" tags={["CLI"]}>
  * Names lead everywhere: tables put the name or slug first with the id demoted to a
    trailing column or a `name (id)` suffix, receipts report the resolved sandbox name
    (including deletes addressed by id), and `sandbox get` shows pinned volumes and
    snapshot parents by name. `--output json` payloads are unchanged.
  * Long-running commands print one line per observed state with its elapsed time (for
    example `requested 0.4s`, then `running 2.0s`) instead of a static spinner. On a
    terminal the current line's clock ticks in place; piped output gets the same
    transcript plus a periodic refresh during long silent waits.
  * `hiloop sandbox create` works with no `--image` or `--from`: the platform default
    image is applied server-side, and the receipt reports the image that was selected.
  * Sandboxes are sized at create with `--cpus`, `--memory-mb`, `--gpus`, and
    `--gpu-model`; omitted values resolve to the platform defaults (1 CPU, 2048 MB), and
    the resolved resources are echoed on the record. GPU requests are not served yet and
    are refused with a clear error.
  * `sandbox list` shows each sandbox's resources (`2cpu · 4gb`) and who created it;
    `sandbox get` renders a compact key-value view with resources, creator, SSH command,
    metadata, relative times, and a `from:` row showing the source snapshot for forked
    sandboxes.
</Update>

<Update label="CLI v0.14.0" description="July 28, 2026" tags={["CLI"]}>
  Interactive access works end to end. `hiloop sandbox ssh <name>` opens a shell in a running
  sandbox with stock OpenSSH: no SSH key to create, no `ssh` configuration to write, and no
  credential beyond the organization-scoped API credential you already use.

  * **Breaking:** the SSH path is rebuilt around a single authenticated connection to the API,
    which authorizes the caller and connects to the sandbox on their behalf. The jump host and the
    certificate authority the previous design assumed are gone. An older CLI cannot open a session
    against a current deployment, so upgrade both together.
  * One-shot remote commands (`hiloop sandbox ssh my-sandbox -- 'echo hello'`) return the remote
    command's exit code as the CLI's exit code, and `sftp` and `scp` work over the same path.
    `rsync` runs itself on both ends, so it also needs the `rsync` binary inside your image.
  * The sandbox's host key is pinned for you on every connect, so there is no
    trust-on-first-use prompt and nothing lands in your `known_hosts`.
  * `hiloop sandbox exec` runs your command in the workload container and returns its buffered
    output and real exit code on deployments running the current service; it previously reported
    `unsupported_capability`.
  * The shell shares the sandbox's network but not the workload container's filesystem. Use `exec`
    to reach your image's files. See
    [interactive access](/sandboxes/commands-executions#interactive-access).
</Update>

<Update label="CLI v0.13.1" description="July 26, 2026" tags={["CLI"]}>
  * Sandbox lifecycle commands finish as soon as the sandbox reaches its target state. A create
    or delete that the runtime completes in a couple of seconds now reports in a couple of
    seconds; previously every command waited out a full polling window (about 26 seconds).
  * A sandbox that needs intervention ends the command right away with a clear error and the
    server's reason, instead of waiting for the command timeout.
</Update>

<Update label="CLI v0.13.0" description="July 26, 2026" tags={["CLI"]}>
  The sandbox runtime was rebuilt from the ground up, and this release ships the CLI for it.

  * **Breaking:** the `hiloop sandbox` family is rebuilt around name-first commands: `create`
    (from an OCI image or a snapshot, waiting until the sandbox is running), `list`, `get`,
    `ssh` (stock OpenSSH, including one-shot commands), `exec`, `snapshot`, `stop`, `start`,
    and `delete`. Every command accepts a name or an id, `create` sends an idempotency key so
    a retried create is safe, and failed or quarantined sandboxes report a stable reason
    alongside the server detail.
  * **Breaking:** versioned volumes replace workspaces. `hiloop volume create` makes a
    project-scoped volume, `volume push` publishes a local directory as a new immutable
    version, and sandboxes mount an exact volume version at create. The `hiloop workspace`
    commands are removed.
  * **Breaking:** commands tied to retired surfaces are removed: tree and branch inspection,
    leases, egress rules, preview URLs and port forwarding (`sandbox expose`, `unexpose`,
    `ports`, `port-forward`), sandbox access lists, and `hiloop open`.
  * `hiloop devbox` commands are unavailable while their transport moves to the new runtime;
    they return a clear error stating that. (They were removed altogether in a later release.
    A long-lived development sandbox is now built from the ordinary sandbox verbs. See
    [Run a sandbox as a devbox](/guides/personal-devbox).)
  * Fixed: `hiloop sandbox create` sends the current API request shape (creates from 0.12.x
    binaries were rejected), and the CLI's sandbox types are now pinned to the published API
    contract by a round-trip test, so this class of drift is caught before a release.
</Update>

<Update label="CLI v0.12.2" description="July 23, 2026" tags={["CLI"]}>
  * The Linux shell installer places the bundled `pasta` network helper next to the `hiloop`
    binary, so captured runs work from a fresh install without extra setup.
</Update>

<Update label="CLI v0.12.1" description="July 23, 2026" tags={["CLI"]}>
  * New `hiloop devbox` commands for durable development sandboxes. `hiloop devbox create` needs
    zero flags: it provisions a durable sandbox (4 vCPU, 8 GiB memory) on the managed network
    with open egress, creates or reuses a same-named persistent workspace mounted at
    `/workspace`, sets a two-hour idle timeout, waits until the devbox is running, and prints
    the matching `hiloop devbox ssh` command. Every default is overridable with the familiar
    sandbox flags. `devbox list` shows each devbox's state, idle-lease expiry, and workspace;
    `devbox ssh`, `devbox stop`, and `devbox delete` complete the loop.
  * Runs wrapped with `hiloop run` keep a signed-in session fresh: child processes share a
    refreshable credential cache instead of a one-shot token, so a long run's writes no longer
    fail after the original token expires. Static API keys are passed through unchanged.
  * One-shot SSH commands (`sandbox ssh NAME -- cmd`) deliver their full output and exact exit
    status; the stream previously could be torn down before the tail drained.
  * `--wait` polling paces itself to the operation's elapsed time, so short lifecycle
    operations are observed close to their true duration.
  * An unknown secret or workload name is reported as not found, together with the command that
    lists the ones that exist.
</Update>

<Update label="CLI v0.12.0" description="July 22, 2026" tags={["CLI"]}>
  The sandbox runtime moved to versioned workspaces, and this release ships the reshaped
  sandbox surface.

  * **Breaking:** the `hiloop volume` and `hiloop snapshots` command families are removed, along
    with `sandbox fork`, `sandbox snapshot`, `sandbox restore`, and `sandbox cp`. Durable state
    now lives in versioned workspaces: attach an exact workspace revision at create with
    `--workspace-revision` and `--workspace-target`, and manage workspaces with
    `hiloop workspace create` and `hiloop workspace list`.
  * SSH access to sandboxes: `sandbox ssh` opens a shell, `sandbox ssh-config` sets up stock
    `ssh` and editor access (for example VS Code Remote-SSH), and a stopped sandbox wakes on
    connect.
  * Sandbox access lists: `sandbox access grant`, `revoke`, and `list` share a sandbox with
    other principals.
  * Request GPUs at create with `--gpus` and `--gpu-model`.
  * Expose guest ports as token-gated preview URLs (`sandbox expose`, `unexpose`, `ports`) or
    forward them locally with `sandbox port-forward`.
  * `hiloop skills install` installs the verified Agent Skills bundle for your agent harness.
  * `hiloop open` jumps from the terminal to the matching console page.
  * Ambient cloud credentials for workloads: `hiloop workload-identity` serves workload
    federation tokens as AWS, GCP, and Azure credential sources, and `workloads federation`
    manages the trusted clouds.
  * Usage accounting rolls up per run and per subtree.
  * Live event streams reset their reconnect budget on progress, and a just-refreshed session
    rides out a stale 401 instead of dying.
  * Exhausted retries report how many attempts were made.
</Update>

<Update label="SDK 0.4.0" description="July 17, 2026" tags={["SDK"]}>
  Python `hiloop` 0.4.0 and TypeScript `@hiloopai/sdk` 0.4.0.

  * **Breaking:** the `/v1` API serves snake\_case JSON; regenerated clients follow the wire shape.
  * The sandbox resource contract adds GPU requests.
  * Ergonomic sandbox overlays in both SDKs — higher-level helpers over the generated operations.
  * Typed error responses: the contract models the error body (including quota details on limit
    rejections), so SDK errors are structured instead of loose JSON.
  * Artifact discovery: list the artifacts a sandbox has produced.
  * Workload identity surface: run attribution to the launching workload, workload delete, and
    launch ACLs that name principals by kind.
  * Usage accounting includes volume storage bytes; snapshot reads report durability.
</Update>

<Update label="CLI v0.11.0" description="July 15, 2026" tags={["CLI"]}>
  * **Breaking:** the network capture transport is now selectable and composed; capture-related
    flags changed shape.
  * **Breaking:** annotation writes move under `hiloop annotations add`.
  * `--profile` requests a named runtime profile at sandbox create.
  * Live event streams refresh an expired session on reconnect instead of dying with a 401.
  * `sandbox cp` and secret-rotation retries are idempotent — a retried request can't double-apply.
  * JSON output fixes: tenant egress enums and workload launch policies render as their wire
    values, and a shell-mangled sandbox request now gets an actionable error.
</Update>

<Update label="CLI v0.10.0" description="July 12, 2026" tags={["CLI"]}>
  * `hiloop snapshots delete` — the destructive snapshot verb.
  * Bind stored secrets at snapshot restore with `--secret`.
  * Volume storage bytes appear in usage accounting and on the volume record.
  * A fork inherits the source sandbox's image when you don't pass one.
  * Zero-byte files push cleanly.
</Update>

<Update label="CLI v0.9.0" description="July 12, 2026" tags={["CLI"]}>
  * Artifact discovery: list the artifacts a sandbox has produced.
  * An expired login session refreshes mid-command instead of failing long-running operations.
  * Retried and deadline-failed operations report per-attempt failure causes.
</Update>

<Update label="CLI v0.8.0" description="July 11, 2026" tags={["CLI"]}>
  * Bind stored secrets at `sandbox create` and fork with `--secret`.
  * `hiloop runs complete` marks a client-owned run finished.
</Update>

<Update label="CLI v0.7.2" description="July 11, 2026" tags={["CLI"]}>
  * Launch ACLs name principals by kind, and service accounts can be granted launch access.
</Update>

<Update label="CLI v0.7.1" description="July 11, 2026" tags={["CLI"]}>
  * Runs are attributed to the workload that launched them; `hiloop workloads delete` removes a
    workload identity.
  * `annotations --history` JSON carries each row's supersession status.
</Update>

<Update label="CLI v0.7.0" description="July 11, 2026" tags={["CLI"]}>
  * **Breaking:** the `/v1` API serves snake\_case JSON; the CLI follows the wire shape.
  * Uniform `--output` and `--project` across the sandbox and snapshot verbs; `restore --name`
    names the restored sandbox.
  * `sandbox get` inlines the failure reason when the sandbox's last operation failed.
</Update>

<Update label="CLI v0.6.0" description="July 11, 2026" tags={["CLI"]}>
  * Sandbox create and restore ride out lost responses with bounded keyed retries — a retried
    create can't produce a duplicate sandbox.
  * Snapshot durability is acknowledged and readable on the wire.
</Update>

<Update label="CLI v0.5.0" description="July 10, 2026" tags={["CLI"]}>
  * Operations carry a typed result and error instead of raw JSON strings.
  * `hiloop usage` reports your real quota limits.
  * Query results return a rows envelope with column metadata, and queries can project a subset of
    columns.
  * `hiloop tenant switch --set-default` persists your default tenant.
  * `hiloop projects delete`.
</Update>

<Update label="CLI v0.4.0" description="July 9, 2026" tags={["CLI"]}>
  * The `hiloop volume` command family, including `volume prefetch` (removed in v0.12.0;
    durable state moved to versioned workspaces).
  * Forked sandboxes inherit the parent's secrets by default, with merge-by-name overrides.
  * Sandbox and execution wait loops ride out transient poll errors; `sandbox cp` reports the
    operation's terminal state.
  * Flag values accept any casing (signal, severity, surface, HTTP method).
</Update>

<Update label="CLI v0.3.2" description="July 8, 2026" tags={["CLI"]}>
  * `sandbox cp` transfers files to and from a sandbox.
  * Execution timeouts are honored, and a capped timeout is reported loudly.
  * Streamed output carries multi-byte UTF-8 across chunk boundaries.
  * `hiloop api` passthrough is binary-safe in both directions.
  * `hiloop --version` reports the build version and commit.
</Update>

<Update label="CLI v0.3.1" description="July 8, 2026" tags={["CLI"]}>
  * `hiloop feedback` sends a bug report or product feedback from the terminal.
  * Under `--output json`, errors are a JSON envelope on stderr.
  * Egress policy inspection: see the effective egress policy for an identity.
  * Machine identities are now called **workloads** (renamed from agents).
  * Fixed `hiloop run` hanging after the child exits when stdin never closes.
</Update>

<Update label="CLI v0.3.0" description="July 7, 2026" tags={["CLI"]}>
  * Sandboxes are always named — a Docker-style name is generated when you don't pass one, and
    names and slugs work wherever an id is accepted.
  * **Breaking:** one create-argument grammar — the handle is positional everywhere.
  * One-shot mode: `sandbox run` executes a command in a fresh sandbox to completion.
  * Snapshots get names and descriptions, `snapshots list`/`get`, and restoring a snapshot extends
    the run lineage.
  * `runs show --trace` renders a waterfall of the run's exchanges.
  * Durable sign-in: 30-day sessions that survive concurrent commands, and login enters your
    default tenant automatically.
  * Workload identity foundation: a registry, launch ACLs, and workload-bound keys.
</Update>

<Update label="SDK 0.3.0" description="July 7, 2026" tags={["SDK"]}>
  Python `hiloop` 0.3.0 and TypeScript `@hiloopai/sdk` 0.3.0.

  * Named sandboxes, one-shot sandbox runs, snapshot names, snapshot list/get, and restore
    extending the run lineage — the same API surface as CLI v0.3.0.
  * Annotations anchor at the run and support event-pair ranges.
  * Executions report an explicit error and an honest exit-code presence.
</Update>

<Update label="CLI v0.2.0" description="July 4, 2026" tags={["CLI"]}>
  * **Breaking:** command re-home — `tail` lives under `runs`, and `query` and `usage` are
    top-level verbs.
  * `runs show` renders the run's event transcript, with payload access.
  * `data-views` manages saved views, with example derivation recipes.
  * User-named API keys, including a service-account kind.
  * `whoami` reports the resolved principal and tenant.
</Update>

<Update label="SDK 0.2.0" description="July 4, 2026" tags={["SDK"]}>
  Python `hiloop` 0.2.0 and TypeScript `@hiloopai/sdk` 0.2.0.

  * `whoami` returns the `{principal, tenant}` identity shape.
  * One canonical event JSON on every read surface.
  * Run trees paginate; sandbox describe, fleet list metadata, and the usage snapshot shape.
  * Digest-first blob upload for payload storage.
  * The OpenAPI contract declares its bearer security scheme, so generated clients authenticate
    out of the box.
</Update>

<Update label="CLI v0.1.3" description="June 30, 2026" tags={["CLI"]}>
  * Named configuration contexts for switching between deployments.
  * Attached sandbox shell.
  * Service endpoints are discovered from the API, so a context only needs one URL.
  * `annotate` accepts structured nested attributes.
  * Runs get human-readable labels.
  * Fixes: tenant selection during login, macOS terminal support, and TTY passthrough for
    captured runs.
</Update>

<Update label="CLI v0.1.2" description="June 29, 2026" tags={["CLI"]}>
  * Shell completions and man pages ship in the release archive.
  * Unified `--output` across commands.
  * Runs form a lineage tree.
</Update>

<Update label="SDK 0.1.2" description="June 29, 2026" tags={["SDK"]}>
  * TypeScript: the configurable client is exported, so custom base URLs and headers work.
</Update>

<Update label="CLI v0.1.1" description="June 29, 2026" tags={["CLI"]}>
  * `hiloop secret` commands, and `run --secret` binds a brokered secret to a run.
  * The `curl | sh` installer points at the public release repository.
  * Sandbox agent output is fully drained before exit.
</Update>

<Update label="SDK 0.1.1" description="June 29, 2026" tags={["SDK"]}>
  * **Breaking:** telemetry queries take SQL directly — the structured query spec is removed.
  * Sandbox secret store and broker endpoints.
</Update>

<Update label="CLI v0.1.0" description="June 29, 2026" tags={["CLI"]}>
  The first public release of the `hiloop` CLI.

  * `hiloop run` wraps any agent command and streams its telemetry to hiloop.
  * Sandbox lifecycle: create, exec, fork, snapshot, and interactive sessions.
  * `hiloop login` and `logout` with browser and device flows; tenant switching.
  * Telemetry query, live tail, and branch diff; annotations.
  * Project and API-key management.
  * Prebuilt macOS and Linux binaries (x86\_64 and aarch64) with a `curl | sh` installer.
</Update>

<Update label="SDK 0.1.0" description="June 29, 2026" tags={["SDK"]}>
  The first public release of the SDKs: Python
  [`hiloop`](https://pypi.org/project/hiloop/) on PyPI and TypeScript
  [`@hiloopai/sdk`](https://www.npmjs.com/package/@hiloopai/sdk) on npm — generated from the same
  API contract as the CLI, covering sandboxes, snapshots, forks, runs, telemetry queries, and
  annotations.
</Update>