Get Pinegrove

Download progress main row now shows only the percentage badge; per-asset byte counts are shown on sub-rows with a · prefix for cleaner hierarchy

Project configs (runtimes, services, setup commands) now load correctly in step 2 of the create workspace dialog — repo IDs containing colons (e.g. `gitlab:12345`) were not URL-encoded in API calls, causing silent 404s

Opening Git & SSH settings panel no longer throws a Zod validation error — the `git-ssh` value was missing from the route search schema enum

Project configs (runtimes, services, setup commands) now load correctly in step 2 of the create workspace dialog — repo IDs containing colons (e.g. `gitlab:12345`) were not URL-encoded in API calls, causing silent 404s

File operations use workspaceId instead of host path translation for simpler, more reliable file tree loading

File tree sidebar not showing workspace files

Platform toggle in workspace creation Step 2 with iOS runtime option

Device filtering in Step 3 with automatic VM size selection for macOS workspaces

Connected devices store with WebSocket subscription for real-time device state

Device panel UI with phone icon and badge indicator in sidebar

Platform and ConnectedDevice types added to shared protocol package

Daemon download now extracts and installs sidecar directory (adb binary) alongside the daemon binary

macOS 26 (Tahoe) DMG bundling workaround for Tauri's AppleScript template

Device forwarding gaps: WebSocket handlers, workspace lifecycle hooks, progress events

Device shape and selectDevice requirements in workspace creation flow

VM config form inputs stacked vertically with sliders instead of number inputs

Default badge now uses solid accent background for better contrast

Check for updates button uses proper UI Button component

Daemon download progress uses circular spinner instead of linear shimmer bar

Release script now creates DMG fallback when Tauri bundler fails

Release script changelog parser recognizes Added/Changed headings

R2 pruning keeps only current + previous version for both desktop and daemon

VM config profiles now sync from daemon to API and arrive via WebSocket broadcast

Device entries include VM configs and host info inline — no separate fetch needed

Replaced useVmConfigsStore with device-level VM config data from useDevicesStore

Create workspace flow reads VM configs synchronously from device entries

Pass Firebase auth token to mesh proxy as query param instead of WebSocket frame — fixes remote daemon connection auth

Route remote daemon connections through the local daemon's mesh proxy instead of connecting directly to tsnet IPs (which are unreachable from the WebView)

Invite link always generates regardless of team capacity

Capacity warning shown when team is at or near member limit

Errors display inline with a copy button

Copy button embedded inside invite link input with "Copied" feedback

File tree no longer collapses after creating, renaming, or deleting files

Right-clicking empty space in the files panel shows the custom context menu instead of the native Tauri menu

File tree context menu (New File, New Folder, Rename, Delete, Copy Path)

Header buttons for creating new files and folders

Tooltips on file and folder names

Long file names truncate with ellipsis (VS Code style)

Rename input in folders no longer triggers folder toggle on click

Inline input no longer double-submits on Enter followed by blur

Crash during workspace setup: `TypeError: null is not an object (evaluating 'i.changes')` — null-coalesce on git changes from daemon

Setup screen now shows cloning and setup steps as already completed on entry (Phase 1 finishes before navigation)

Diff tab no longer crashes when git project has null changes

Source maps uploaded to Sentry on release builds for readable stack traces in error reports

Full-screen workspace setup screen with vertical stepper showing clone, devbox, and Claude CLI progress in real time

WorkspaceTopBar status override for reconnecting and setting-up states

Disconnected overlay replaces the old banner — translucent overlay over workspace content

VerticalStepper, VerticalStepperItem, and PinegroveMark components extracted to shared UI package

Setup status hydrated from API on page refresh — no longer shows half-built workspace as ready

Setup screen shows for both in-progress and failed states with error details

1.5-second completion view with all stepper checkmarks before transitioning to workspace

Creation dialog shows dynamic subtitle ("Cloning repositories on <device>...")

Disconnected overlay uses relative positioning instead of magic pixel offset

Page refresh during workspace setup no longer shows workspace as ready

Failed setup state now properly shows error screen instead of empty workspace

Protocol dist rebuilt to include workspace setup message type declarations

Drizzle migration made idempotent with IF NOT EXISTS

Daemon is now downloaded from the update server during onboarding instead of being bundled in the app

New "Downloading daemon" step in device setup with download-specific error messaging

Daemon and desktop releases are now fully independent — daemon updates no longer require a desktop rebuild

Comprehensive git status parsing rewrite: null-terminated output, rename/copy detection, conflict handling

Deep nested files now surface correctly in the git changes list

Filesystem watcher picks up newly created directories

Git push auto-retries with --set-upstream when no upstream is configured

Post-commit UI refresh in source control panel

Fix Claude auth on macOS: stop writing incomplete .credentials.json that corrupts Keychain-based authentication

Add comprehensive PTY token extraction tests to prevent future setup-token regressions

Fix Claude auth on macOS: stop writing incomplete .credentials.json that corrupts Keychain-based authentication

Add comprehensive PTY token extraction tests to prevent future setup-token regressions

Back buttons now navigate to the correct previous step instead of relying on browser history (fixes broken back after refresh)

All onboarding navigation is now fully frontend-driven — API's nextStep field is no longer used

Removed dead ConnectDeviceCard component

Onboarding step navigation now follows the API's nextStep instead of skipping ahead

Refreshing during device setup shows env tools instead of dead ConnectDeviceCard

Device stats panel moved from daemon setup to environment setup step

Error alert moved to bottom of env tools list for cleaner layout

Removed redundant retry button from environment tools section

3-step daemon install progress UI showing installing, starting, and detecting phases

Manual install fallback commands with copy-to-clipboard for git, nix, and devbox

Environment tools phase after device registration with auto-repair and faster error polling

Device onboarding flow uses a reducer-driven state machine (provision, setup, env phases)

ToolRow component extracted and shared between ConnectDeviceCard and EnvToolsSection

Poll interval reduced to 5s when environment tools have errors for faster manual install detection

Redesigned onboarding device step with styled tool status badges, error alerts, and daemon error reasons

Redesigned onboarding Claude step with 3-step progress flow, browser sign-in callout, and model selector

Redesigned onboarding git step with per-provider SSH key cards, inline OAuth, and key generation

Redesigned onboarding complete step with dynamic summary based on actual completed steps

Update badge minimum width set to 250px

AddProjectDialog refactored to use @pinegrove/ui primitives

Complete step now hydrates all stores on mount, fixing empty summaries on cold start or page refresh

Tool error reasons from daemon now pass through API to the frontend

SSH-first git onboarding: detects SSH keys, tests connectivity, generates keys if needed

Git & SSH settings tab in Settings dialog: manage SSH keys, OAuth connections, git identity

Cmd+N shortcut to add projects manually via SSH URL

Tauri SSH commands: scan_ssh_keys, test_ssh_connection, generate_ssh_key, read_ssh_key_pair

Separate Claude onboarding step (split from environment step)

Onboarding git step redesigned with parallel SSH connectivity testing

Add Project dialog auto-matches SSH connections by host

Removed impersonation UI: IdentityChoiceModal, identity mode toggles, impersonation store logic

Removed stale identity mode references from workspace and activity stores

Manual daemon update flow — shows an Update button when a new daemon version is available, downloads on click

Device settings dialog rebuilt with Radix Dialog for better accessibility and UX

Daemon update banner integrated into device settings dialog

Device list refreshes automatically on tab view, dialog open, and window focus

Updated Cargo.lock dependencies

Auto-updater relaunch after install (add `process:allow-restart` ACL permission)

Auto-updater install failure caused by macOS resource forks (`._Pinegrove.app`) in update archive

Update re-downloading on window focus when already downloaded and ready to install

Update badge moved next to daemon status badge (bottom-right) with matching visual weight

Structured logger with `[namespace]` prefix and timestamps across all app subsystems

Boot sequence logging: startup phases, auth hydration, daemon store init

Auth logging: sign-in/out events, user hydration

Deep link logging: incoming URLs, OAuth callbacks, invite handling

Onboarding logging: step satisfaction state, fingerprint, repair

Claude setup logging: token flow, API sync

Daemon pool logging: device connect/disconnect events

Session logging: load, create, errors

Git, login, provisioning error logging migrated to structured logger

Updater logging migrated to logger service for consistent format

Auto-updater: check for updates when window regains focus

Cmd+R refresh hotkey in Cmd+K search dialog and create workspace repo picker

Active session count on repo tiles in Cmd+K dialog now matches correctly (keyed by repoId instead of fullName)

Starred/favourite repos now sort to the front of the Projects list in Cmd+K dialog

Auto-updater: show download progress banner with spinner and linear progress bar

Auto-updater: check for updates on WebSocket reconnect and window focus

Auto-updater: added debug logging for update check/download state transitions

Daemon badge: show version in brackets alongside device name

Workspaces on local device use local daemon status, never grayed out when daemon is running

Refresh device online status on WebSocket reconnect to avoid stale grayed-out state

Preferences: offline devices now visible and selectable in device dropdown

Account panel: profile save and delete routed through store actions

Preferences: offline devices now appear in the device selector instead of showing "No devices online"

Account panel: profile save and delete routed through store actions for consistency

Duplicate workspace: pre-populates create dialog with source workspace's repos, runtimes, setup commands, and env vars

Runtime reconfigure: changing runtimes in workspace settings triggers devbox regeneration on the daemon

Workspace settings cog menu fully wired: rename, duplicate, settings, delete

Removed unused "Push branches to remote" menu item

Rename action focuses and selects the workspace name for inline editing

Delete action shows confirmation dialog before removing workspace

Fix Claude token extraction stripping PTY garbage suffix

Push updated Claude credentials to daemons after re-auth

Show re-auth button when current user's Claude token expired

Connect daemon pool on login and add join loading spinner

Resolve TS errors in sessionsSlice and workspaces store test

Daemon error formatting, provision error message, and stale tests

Correct API contracts in workspace view store

Align @tauri-apps/plugin-updater npm version with Rust crate

Resolve bundled resource paths for Tauri's nested layout

Release script ignores untracked files in dirty check

Context-scoped WorkspaceViewStore with slices

Workspace join flow in workspaces store

Guard workspace creation on environment prerequisites

EnvRepairDialog for post-onboarding env degradation

Handle device:env-health WS push, remove prereqs HTTP polling

Rewrite onboarding store as API-only single source of truth

Migrate workspace view to WorkspaceViewProvider

Extract useDaemonPoolStore from useWorkspaceSessionsStore

Rewrite environment step to use API for tools and repair

Simplify onboarding derivation, remove prereqs polling

macOS builds are now code-signed, notarized, and stapled (no more "damaged app" Gatekeeper warning)

Sidecar binaries (daemon, cloudflared, ripgrep) signed with Developer ID, hardened runtime, and secure timestamp

Writes install manifest on daemon install marking desktop-managed mode

Prerequisite installation delegated to daemon's `prereqs install` subcommand

Provisioning tokens for headless device registration via API

Environment onboarding screen delegates to daemon for prerequisite management

Daemon version detection via `--version` flag (replaces "unknown" in manifest)

UTC timestamp generation uses native Rust instead of shelling out to `date`

Provisioning token handler generates Headscale preauth key (devices now join the mesh)

Provisioning token double-spend prevented via atomic database transaction

Nix tool row in environment onboarding step

Open Terminal.app for Nix install (requires sudo/TTY)

ReprovisionDialog with detailed error messages

Single confirm dialog on session delete (remove double-confirm)

Confirm only shown when session is actively busy

Improved daemon status reporting with Nix prerequisite

Dashboard shows daemon update status with version and restart button

daemon:update-status WebSocket event integration for real-time updates

Separate release-daemon.sh and bundle-daemon.sh scripts

Desktop and daemon update independently via separate release channels

Daemon provisioning simplified: copy bundled binary + shell out to install

Desktop update artifacts moved to desktop/ prefix in R2 bucket

Removed plist.rs, launchctl.rs — service management moved to Go daemon

Removed daemon_upgrade, daemon_check_upgrade Tauri commands

Native Windows support with ConPTY terminal integration

PowerShell and cmd.exe shell detection

Cross-platform PTY abstraction layer (PtyHost/PtyHandle)

Build pipeline support for Windows cross-compilation

Job Object-based process tree management on Windows

Process suspend/resume for session throttling on Windows

Correct process liveness detection on Windows

Workspace management with Git worktree isolation

Integrated terminal with PTY support

Claude CLI session management

Monaco code editor with file tree navigation

Team collaboration with real-time device status and activity feed

Tailscale mesh networking via bundled daemon

Firebase authentication with OAuth (GitHub, Google)

Automatic OTA updates every 5 minutes

Firecracker binary resolution on Linux now checks `<stateDir>/bin/` when the binary is not in `$PATH`, matching how the install script deploys it — fixes "executable file not found in $PATH" on fresh Linux installations

Centralized binary lookup (`paths.FindBinary`) for firecracker and cloudflared — both now use the same $PATH → stateDir/bin fallback pattern

VM asset downloads (kernel, base image, runtimes, services) now run in parallel and complete before the boot phase begins, preventing the setup UI from flickering between download and boot steps

Private repository cloning on Linux no longer fails with exit 128 — SSH credentials are now passed through to the data-volume population step

SSH agent socket no longer leaks on early-exit error paths during workspace setup

Workspace recovery after daemon restart now includes Platform and Services in the recovery config — darwin workspaces are recovered by the correct provider and pg-agent receives the right services list

File operations API simplified to use workspaceId + relative paths instead of host path translation

Vsock read loop now starts immediately after VM creation and recovery, so file operations and port queries work without requiring a PTY session first

File tree showing empty despite files existing in the VM

VM recovery failing with CPUCount below minimum when vm_config was not loaded from SQLite

**Initramfs boot chain** — custom initramfs loads kernel modules (ext4, virtio_blk, virtio_net, vsock, virtiofs) before mounting rootfs; enables reliable boot on macOS Virtualization.framework

**Repo staging into VM** — repos cloned on the host are now copied from the virtio-fs read-only mount into the writable data volume at VM boot

**Host-to-guest path translation** — daemon proxy translates host-side file paths to guest-side paths for all file operations (list, read, write, search, rename, mkdir, delete)

**Claude CLI onboarding bypass** — writes `~/.claude.json` with `hasCompletedOnboarding` so Claude CLI skips the first-run wizard when `CLAUDE_CODE_OAUTH_TOKEN` is set

**Initramfs includes virtio_net dependencies** — `net_failover` and `failover` modules added so networking works reliably

**VM sessions run as dev user (UID 1000)** — PTY sessions set `Credential{Uid:1000, Gid:1000}` and `HOME=/home/dev` to satisfy Claude CLI's root/sudo check

**Network interface detection** — `ensureNetworking` enumerates interfaces dynamically instead of hardcoding `eth0`

**Rootfs increased to 2 GB** — prevents "no space left on device" during runtime extraction

**musl added to Debian rootfs** — Claude CLI binary is musl-linked; `musl` package in debootstrap resolves the dynamic linker

Removed local file fallbacks — all file operations now require a running VM; no more stale host-side reads

`exec.LookPath` PATH resolution — process PATH updated via `os.Setenv` so `exec.Command("claude")` resolves correctly

**Node.js version detection from package.json** — reads `engines.node` from workspace projects and installs the matching major version via NodeSource; falls back to LTS (22) when not determinable

NAT networking for VMs — virtio-net with VZ NAT attachment for internet access

Debian rootfs build scripts (`scripts/build-debian-rootfs.sh`, `scripts/vm-init`)

**VM base image switched from Alpine to Debian 12 (bookworm)** — eliminates all musl/glibc binary incompatibilities; upstream Node.js, Bun, and Claude CLI binaries now work natively

Runtime provisioning rewritten from apk to apt-get

DHCP client switched from udhcpc (busybox) to dhclient (Debian)

User creation switched from busybox adduser to Debian useradd

Removed `runtimeWorks` glibc smoke test (no longer needed on Debian)

`PINEGROVE_NODE_VERSION` env var now set via both `a.env` and `os.Setenv` so installRuntime reads it correctly in-process

VM boot failure on macOS 15+ (VZErrorDomain Code=1) — migrated from LaunchAgent to LaunchDaemon to bypass TCC silently denying Virtualization.framework Local Network access

IPSW download corruption — fixed race condition where progress polling read from the same stream as the library's internal io.Copy goroutine

Install/uninstall now use osascript for admin privilege escalation (standard macOS auth dialog)

Automatic migration: existing LaunchAgent is detected and removed on install

Crash on startup (nil pointer dereference) when recovering workspaces — cache SHA validation accessed manifest before it was fetched; Ensure* methods now fall back to file-exists check when no manifest is loaded

Pre-existing cached assets without SHA sidecars no longer deleted on first run after upgrade — missing sidecar is treated as fresh

Terminal sessions showing only a blinking cursor — `TERM` was never set in the VM environment

Runtime fallback installer used `apt-get` on Alpine Linux VMs (now uses `apk`)

Runtime/service installation ran unconditionally even when pre-extracted by the init script — now skips if `/opt/runtimes/<name>/bin` exists

Build script kernel extraction quoting bug (single quotes in Python code broke outer `sh -c`)

Graceful VM shutdown before updater binary swap (sessions flushed, VMs stopped with 10s deadline)

HTTP server now starts before workspace recovery — desktop app connects instantly instead of waiting for all VMs to boot

Recovery runs in background goroutine with per-workspace retry cap (3 attempts, then marked `recovery_failed`)

Darwin VM stop uses 5s ACPI timeout with force-kill fallback (matches Firecracker behavior)

StopAll now blocks until all VMs are actually stopped (WaitGroup)

Daemon no longer crash-loops when a workspace fails recovery — retries are capped and the workspace is skipped after 3 failures

Updater no longer orphans VMs on update — CleanupAll and StopAll run before os.Exit(0)

Firecracker orphan detection on Linux — checks for running process before recovery boot to prevent dual-access to data.img

Fix PTY output never reaching desktop: pg-agent was generating its own session ID instead of using the one assigned by the daemon, causing all output frames to be silently dropped

Replace hand-rolled AF_VSOCK with mdlayher/vsock library for proper Go runtime poller integration

Workspace setup progress events now fire granularly (cloning, downloading, booting phases visible to clients)

Workspace DELETE now removes the SQLite DB record and VM state (previously only killed the VM)

Activity event posting no longer races with workspace sync (workspace:created moved to async phase)

Add missing activity event types (claude:sub:switched, workspace:setup:ready, workspace:setup:failed) to protocol schema

Remove unused virtio_net kernel module from initramfs (eliminates net_failover errors in VM boot logs)

macOS 26 VM boot failure (VZErrorDomain Code=1): decompress gzip-compressed PE/EFI stub kernels to raw ARM64 Image format, which Virtualization.framework on Tahoe requires

Auto-install Rosetta for Linux if missing before VM boot

macOS 26 crash: use /dev/null for serial port read handle instead of nil (NSInvalidArgumentException on Tahoe)

Skip VM recovery for non-ready workspaces (prevents boot attempts on failed setups)

Reject session creation for any non-ready workspace across all paths (HTTP, WebSocket relay, direct)

Android device detection on Linux via ADB sidecar binary

Event-driven device tracking using `adb track-devices` (replaces polling)

Replaced IOKit/ObjC USB detection with pure Go implementations

Android detection is now cross-platform (macOS + Linux)

iOS detection uses usbmuxd ListDevices + lockdownd (pure Go, no CGo)

Removed all CGo dependencies from the devices package

Restored Intel Mac (darwin-amd64) daemon builds — ARM-only VZ code now gated behind build tags

Stale IOKit comment in release script

Android device detection on Linux via ADB sidecar binary

Event-driven device tracking using `adb track-devices` (replaces polling)

Replaced IOKit/ObjC USB detection with pure Go implementations

Android detection is now cross-platform (macOS + Linux)

iOS detection uses usbmuxd ListDevices + lockdownd (pure Go, no CGo)

Removed all CGo dependencies from the devices package

Stale IOKit comment in release script

macOS platform workspaces: DarwinProvider for macOS guest VMs using Virtualization.framework

Golden image infrastructure: IPSW download, macOS install, SSH provisioning with Homebrew-based tool installation

Native device forwarding: replaced all external tool dependencies (socat, libimobiledevice, pymobiledevice3, usbfluxd) with native implementations

IOKit-based USB device detection on macOS via CGo/ObjC with event-driven attach/detach notifications

Native usbmuxd protocol for iOS device enumeration and lockdownd protocol for metadata enrichment (DeviceName, ProductVersion, ProductType)

Bidirectional TCP↔Unix socket relay (SocketRelay + ReverseSocketRelay) replacing socat

Typed vsock control messages for device:connect/device:disconnect in pg-agent

Bundled adb sidecar binary shipped in daemon tarball — no external adb dependency

Device mesh announcement and WebSocket events for connected devices

CGo bridge for VZMacGuestProvisioningOptions (macOS 27+)

Cross-compiled pg-agent for macOS with Homebrew-based provisioning

Platform field propagated through workspace creation flow

Granular progress reporting for IPSW download and macOS install phases

Release script reordered to download adb sidecar before building daemon tarballs

Thread-safe global detector using atomic.Pointer for IOKit callback

Removed adb $PATH fallback — sidecar-only resolution per spec

Fixed usbmuxd response length underflow on malformed responses

Fixed pg-agent HandleDisconnect returning error on bad JSON instead of silently disconnecting all

Fixed connectiOS mutex gap — disconnect→setup→register now atomic

Fixed `repos/` path segment in MCP tools (workspace, exec, envsets), file watcher, and session working directory

Fixed step numbering in workspace provisioning flow (sequential 1-4)

Removed stale sidecar references from build and release scripts

VM boot failure no longer marks workspace setup as failed — falls back to bare-metal mode gracefully

Setup failures now emit phase-specific `workspace:setup:failed` with the failing phase, so the desktop UI can highlight the exact step that failed

SQLite migration crash on startup (`ADD COLUMN IF NOT EXISTS` not supported by SQLite)

Release script now signs darwin binaries with Virtualization.framework entitlement

x86_64 kernel extraction from bzImage using boot protocol header fields instead of fragile od+grep approach

Standalone (CLI) installs: daemon no longer self-destructs after 10 minutes on headless servers. The `install` command now accepts `--standalone` to write `mode: "standalone"` to the install manifest, which disables the desktop app existence watcher.

Workspace creation: detailed timing logs for every phase (clone, setup commands, devbox install, Claude CLI install) with elapsed milliseconds

Setup progress: granular sub-step updates during devbox install (config detection, lock restore, package install) and step counters for setup commands (1/3, 2/3, etc.)

Prerequisites: check git via well-known paths (`/usr/bin/git`, homebrew) before falling back to login shell — prevents false "git not installed" alerts after wake-from-sleep when shell init is slow

File delete: treat already-deleted files as success (delete is idempotent) instead of returning 500

Mesh proxy: strip CORS headers from proxied responses — the local daemon's CORS middleware already sets them, and duplicate `Access-Control-Allow-Origin` headers caused browsers to reject every mesh-proxied response

Added verbose debug logging across mesh proxy (HTTP and WS), file listing, workspace listing, active sessions, and proxy:request handler to diagnose remote workspace connectivity issues

Client mode (`--client`) — lightweight mesh-only daemon that skips PTY, workspaces, toolchain, and resource management; starts only mesh proxy, HTTP server, updater, and identity subsystems

`proxy:request` relay handler — serves HTTP requests forwarded by the API over the upstream WebSocket via `router.ServeHTTP` and `httptest.ResponseRecorder`

Client-mode WS handler — thin event-only WebSocket handler that subscribes to EventBus without requiring ptyMgr

`--client` flag on `install` command — writes client mode into the launchd/systemd/SCM service definition

Status endpoint reports `"mode": "client"` or `"mode": "full"`

Router refactored to `NewRouterFromOpts(RouterOpts)` — conditional route registration based on client mode

Internal routes split into common (status, mesh/status) and full-mode-only (provision, prerequisites/install) to prevent nil ptyMgr panics in client mode

SessionChecker interface passed to updater with explicit nil guard instead of nil-wrapping *pty.Manager

Auto-install Claude CLI via `npm install -g @anthropic-ai/claude-code` during prereqs install

Auto-install bubblewrap (bwrap) on Linux via system package manager (apt-get, dnf, pacman, apk)

Google device-code auth: pass `client_secret` in token exchange for OAuth clients that require it (fixes `invalid_request` error during CLI setup)

Use system-level systemd unit (`/etc/systemd/system/`) when running as root on headless Linux servers where `systemctl --user` is unavailable (no D-Bus session bus)

Add `network-online.target` dependency and `HOME` env var to system-level unit for reliable headless operation

Linux x86_64 build now included in release manifest

Add `/mesh/status` diagnostic endpoint — returns mesh state, tailscale IP, node ID, server readiness, and optional connectivity test via `?target=<ip>`

Add `MESH_DEBUG_TOKEN` env var support — when set, mesh listener accepts this token in place of Firebase auth for debugging

Fix mesh listener race condition — listener no longer skips startup when the mesh bootstrap goroutine hasn't transitioned from idle yet

Always fetch Headscale controlURL from API on mesh bootstrap — fixes tsnet defaulting to tailscale.com when reusing persisted state

Auto-clear stale tsnet state on mesh join failure — daemon now self-heals when Headscale nodes are deleted, keys expire, or the server is rebuilt, instead of getting stuck in a login loop

Fix mesh WebSocket proxy authentication — pass Firebase token as HTTP Authorization header during WS upgrade so remote daemon's auth middleware accepts the connection

Add mesh proxy — local daemon proxies HTTP and WebSocket connections through tsnet to remote daemons, enabling cross-device access from the desktop app

Fix SHA256 verification in daemon self-updater — was hashing the extracted binary instead of the archive, causing update failures

Increase mesh bootstrap timeout from 30s to 90s — tsnet needs more time for initial auth and DERP relay handshake on first join

`POST /files/delete` endpoint for file and folder deletion with path sandboxing

Git status watcher no longer sends null changes for clean repos — Go nil slice now coerced to empty array before JSON serialization

Async workspace creation — git clone returns immediately, devbox and Claude CLI install in the background with real-time progress streaming

Bare-repo cache for git clones (`--reference --dissociate`) — second workspace on the same repo clones near-instantly

Devbox lock file cache by package-set hash — skips Nix evaluation on warm installs

Shared Claude CLI install with symlink into workspaces — eliminates per-workspace npm install

Session gating during workspace setup — terminals and Claude sessions blocked until environment is ready

Per-repo mutex on bare cache to prevent concurrent clone/fetch corruption

Panic recovery in background setup goroutine — a crash in devbox/npm no longer kills the daemon

Startup recovery for stuck `setting_up` workspaces from prior crashes

Graceful shutdown checks between background setup phases

5-minute timeout on setup commands to prevent indefinite hangs

Atomic devbox lock file cache writes (tmp + rename)

Prerequisites and runtime guards moved before SQLite insert to prevent ghost workspace entries

TOML-backed identity and config system — device identity, provisioning state, and non-relational config moved from SQLite to `identity.toml` and `config.toml`

WebSocket liveness detection across daemon, relay, and desktop layers

Per-session SSH agent for git operations (carried over from 0.8.0 infrastructure)

Git status parsing rewritten with null-terminated output (`--porcelain -z`) for safe filename handling

Individual files in untracked directories now surface correctly (`-uall` flag)

Rename and copy detection with `--find-renames` flag

Full conflict status support (UU, AA, DD, AU, UA, DU, UD) — emitted as single unstaged entry

Filesystem watcher now picks up newly created directories on the next tick

`--no-optional-locks` flag prevents lock contention during status queries

`--no-ext-diff` flag on diff operations prevents unexpected external tool output

Git log separator switched from `|` to null byte to handle pipes in commit messages

Push auto-retries with `--set-upstream` when no upstream is configured

Stop writing incomplete `.credentials.json` that corrupts Keychain-based Claude authentication on macOS

Rename revert now properly restores original file and removes renamed copy

Staged file deletion no longer errors on diff

Background onboarding revalidation no longer triggers spurious daemon auto-repair on boot

Per-session SSH agent for git operations — replaces GIT_ASKPASS with `ssh-agent` per workspace session

SSH credential types in workspace credential storage (SQLite)

Credential message flow now uses `sshKeys` (host → PEM) instead of per-repo `gitToken`

Warnings logged when ssh-agent or ssh-add fails (previously silent)

Deduplicated credential deserialization in relay workspace:create handler

Removed impersonation system: askpass log watcher, identity mode env vars, impersonation-related structs

Removed PINEGROVE_IDENTITY_MODE from git hook scripts

Prerequisite checks (git, nix, devbox, claude) now run through the user's login shell, matching exactly what the terminal sees

Each failed check reports a reason with the actual error output for easier debugging

Failed prerequisites are reported to Sentry with full context (login shell PATH, OS, per-tool diagnostics)

MCP subprocess now receives `PINEGROVE_STATE_DIR` env var, fixing "workspace not found" errors in Claude sessions when the DB path was not resolvable

Workspace sync uses API as source of truth — orphaned local workspaces are pruned, missing workspaces are created

MCP config key renamed from `grove-daemon` to `pinegrove-daemon` for brand consistency

MCP subprocess now opens the correct database file (`daemon.db`) instead of a stale `db.sqlite3`, fixing "no such table: workspaces" errors in Claude sessions

Workspace repos are now full clones inside the workspace directory instead of git worktrees pointing to an external bare repo, fixing "Operation not permitted" errors when running git commands from sandboxed sessions

Added `db.OpenAndMigrate()` — single entry point for production DB access that guarantees correct path and migrated schema

Workspace deletion simplified — no more git worktree cleanup needed

Heartbeat suspends after 3 consecutive 401 errors instead of retrying indefinitely

`/status` endpoint now returns the real daemon version from buildinfo instead of hardcoded "0.2.0"

Heartbeat signals auth failure via callback so desktop can detect and prompt re-provisioning

Include nodejs@22 in default devbox packages so npm is available for Claude CLI installation

Claude sessions no longer fail with "command not found" in workspaces without an explicit node runtime

Set `core.bare=false` in worktree config when enabling per-worktree hooks — fixes git operations failing with "not a git repository" in workspace sessions

MCP server mode (`pinegrove-daemon mcp`) exposing 10 tools to Claude via stdio

`pinegrove:exec` — run shell commands in project devbox environments with configurable timeouts

`pinegrove:workspace-info` — inspect workspace state including projects, runtimes, and active env sets

`pinegrove:add-project` — add git repositories to workspace with setup commands and env set selection

`pinegrove:list-runtimes` / `pinegrove:add-runtime` / `pinegrove:remove-runtime` — manage devbox packages

`pinegrove:list-env-sets` / `pinegrove:get-env` / `pinegrove:update-env` / `pinegrove:switch-env` — manage per-project environment variables across local/dev/prod sets

SIGUSR1 IPC for MCP subprocess to trigger daemon workspace sync

CLAUDE.md generation now includes MCP tool usage instructions

Devbox package management: new AddPackage/RemovePackage functions with JSON-preserving read-modify-write

Upstream client: new env set API endpoints (list, get, update) for daemon-scoped routes

SQLite migration 010: active_env_set_id column on workspace_projects

Boot guard: auto-rollback to previous binary if daemon crashes 3+ times consecutively

Session recovery: fetch credentials before process start so OAuth token, git identity, and MCP config are available at spawn

Updater: publish error and minDesktopVersion in WS status messages

Tarball extraction: validate filename contains "pinegrove-daemon" before extracting

Install: always copy bundled daemon binary (removes stale guard that skipped copy if file existed)

POST /workspaces/{workspaceId}/reconfigure endpoint — regenerate devbox.json and reinstall when runtimes change

Write `.credentials.json` for cross-platform Claude auth (no Keychain dependency)

Show re-auth button when current user's Claude token expires

Strip ANSI escapes before classifying PTY output

Add DEVBOX_PROJECT_DIR to recovery session env maps

Detect 401 auth rejection in Claude PTY output

Quote hook script path in claude settings.json

Set DEVBOX_PROJECT_DIR so init_hook resolves claude PATH

Use bare `claude` command instead of absolute path

Replace env vars in sandbox instead of appending

Restore XDG_CACHE_HOME fix and pin devbox 0.18.0

Patch devbox launcher to handle spaces in paths

Use provisioned API URL for relay WebSocket connection

Auto-repair on boot and handle prerequisites:repair command

POST /internal/prerequisites/install endpoint

Send device:env-health on auth:result reconnect

Emit device:env-health from guard loop with messageId

HasAnyClaudeToken credential query

Claude credential check verifies CLI installed + user token, not workspace credentials

Standalone installation via `curl -fsSL https://pinegrove.dev/install.sh | sh`

Install manifest (`install-manifest.json`) tracks install mode and prerequisite ownership

`prereqs status` and `prereqs install` subcommands for managing prerequisites (git, nix, devbox)

`setup` subcommand for interactive device provisioning (email/password + Google device-code OAuth)

`setup --token --name` for scripted non-interactive provisioning

`uninstall --all` removes prerequisites that Pinegrove installed

`version` / `--version` command prints daemon version

App-existence watcher skipped in standalone mode (no desktop app to watch for)

Soft uninstall now always removes the state directory per spec

Password input uses golang.org/x/term for proper terminal echo restoration on signals

Firebase and Google auth endpoints check HTTP status before JSON parsing

Google ID token properly URL-encoded in Firebase signInWithIdp call

Network error messages match spec format

Provisioning token race condition: token claim is now atomic via database transaction

`prereqs install` no longer claims "All prerequisites ready" when tools are missing or installs failed

Automatic cleanup when the desktop app is uninstalled

Daemon detects missing app every 10 minutes and removes all data

Windows NSIS uninstaller hook for immediate cleanup

--purge flag on uninstall command for full data wipe

Dev mode (PINEGROVE_STATE_DIR) protected from cleanup watcher

Per-workspace Claude CLI installation for version isolation

Just-in-time install for workspaces created before this change

Nix prerequisite check with version detection

Terminal busy/idle tracking via OSC 133 markers (preexec/precmd hooks)

session:busy and session:idle WebSocket events for terminal sessions

Sandbox hardening: restricted file reads to whitelisted system paths

macOS: add root literal, Xcode/CLT, git/shell dotfile reads

Linux: prepend Nix bin to PATH inside bwrap sandbox

Windows: grant restricted write access to temp and Nix paths

MCP config written into per-workspace tmp dir inside sandbox boundary

Hide .claude and .pinegrove dirs from UI file tree

Claude CLI hooks format updated to new matcher/hooks schema

Workspace name DB migration

Daemon self-update: hourly manifest check + API WebSocket push trigger

Update state machine (idle, checking, downloading, ready, applying)

Hybrid restart: auto-restart when idle, prompt when sessions active

Binary swap with backup, rollback, and minisign signature verification

Daemon owns service registration on all platforms (install/uninstall subcommands)

X-API-Version header on every HTTP response for version compatibility

GET /update-status and POST /update/restart endpoints

daemon:update-status WebSocket event for real-time UI updates

macOS: launchd plist with KeepAlive + ThrottleInterval

Linux: systemd user service with Restart=always

Windows: SCM registration with recovery actions

Native Windows support with ConPTY terminal integration

PowerShell and cmd.exe shell detection

Cross-platform PTY abstraction layer

Job Object-based process tree management on Windows

Process suspend/resume for session throttling on Windows

Initial release — workspaces, Claude sessions, and terminal

GitHub and GitLab repository import

File editor with syntax highlighting

Team management with roles and permissions

Device sharing via Headscale mesh