Agentic Sandbox v2026.6.35

Released: 2026-06-29 Tag: `v2026.6.35` Previous: `v2026.6.34` Compare: `v2026.6.34...v2026.6.35`

What this release is

v2026.6.35 is the live terminal reliability cut for Observe/Drive. It keeps the v2026.6.34 QEMU/vsock baseline, then fixes the pty-ws paths that could leave existing sessions unobservable or undriveable after bridge handoff, idle tabs, or half-open WebSocket drops.

The release also adds the first HTTP credential-proxy backend for ADR-028: managed sessions can call approved upstream HTTP/API targets through a scoped lease while the secret is injected only on the outbound management-side hop.

Highlights

Live pty-ws output stays attached (#594): VM sessions continue delivering

bridge output through the canonical event stream after the controller joins, so observers and controllers keep seeing terminal output during real Observe/Drive sessions.

Stale controller sockets are reaped (#598): the executor sends standard

WebSocket heartbeat Pings and releases controller state when a client stops answering Pong frames, allowing the next authorized attach to become controller and send input.

HTTP credential proxy backend: `POST /api/v2/credential-proxy/http`

validates an active credential lease, checks host/path/method/header policy, injects the credential upstream, and redacts the credential from the returned response body.

vsock cleanup hardening: QEMU vsock CID ownership and VM cleanup paths

were tightened to prevent stale registry state during teardown and E2E VM reaping.

Release matrix alignment: Darwin/macOS artifacts are deferred from the

required release-publication gate; Linux packages, installer assets, and GHCR images remain the active publication surface.

Upgrade matrix

Audience	Action
Live terminal operators	Upgrade management and executor together so the pty-ws bridge-output and stale-controller cleanup fixes are both active.
Credential/API integrators	Use the new credential proxy only with leases that include `proxy_policy`; missing or mismatched policy fails closed.
QEMU/vsock operators	Keep the v2026.6.34 vsock setup, then upgrade to pick up the cleanup hardening.
Release consumers	Expect Linux packages, installer assets, and GHCR images; do not wait on Darwin/macOS artifacts for this release.

Install / upgrade

Linux packages and the checksum-verifying installer are published by the tag release workflow:

curl -fsSL https://github.com/jmagly/agentic-sandbox/releases/download/v2026.6.35/agentic-sandbox-install.sh \
  | bash -s -- --version v2026.6.35

Direct package installs:

sudo apt-get install ./agentic-sandbox_2026.6.35-1_amd64.deb
sudo dnf install ./agentic-sandbox-2026.6.35-1.x86_64.rpm

Verification

After upgrading, confirm the installed CLI and management binary report the new version:

sandboxctl --version
agentic-sandbox --version

For live terminal validation:

1. Open a VM or container session through `pty-ws/v1`. 2. Attach one controller and one observer. 3. Confirm both receive live output while the controller drives the shell. 4. Drop or background the controller connection long enough for heartbeat reap, then reattach and confirm the new controller can send input.

For credential proxy validation, create a credential lease with `allowed_use: "proxy.http"` and a matching `proxy_policy`, then call:

POST /api/v2/credential-proxy/http

The proxy should deny host/path/method/header mismatches and should never return the raw injected credential in the response body.

Quality

Release code-to-docs sync recorded in

`.aiwg/reports/doc-sync-audit-2026-06-29-release.md`.

Local release gates include script syntax checks, pin linting, Rust format

checks across all crates, and crate test suites before the tag is published.