0.7.0 — 2026-08-31

First public release. Corral was developed privately through 0.6; this release renames the tool, moves it to https://github.com/corral-sh/corral under the Apache-2.0 licence, and resets the public changelog. Nothing about the sandbox model changed in the rename.

Upgrading: not applicable — this is the first public release. If you ran a pre-release build, note that state now lives in ~/.corral, project config in .corral.toml, and environment variables use the CORRAL_* prefix; boxes and golden images from pre-release builds are not migrated (delete the old state directory and rebuild).

Added

• The tool as shipped: per-project Lima VMs (Apple Virtualization) with golden images (first box 2–4 min, every further project ~15 s), corral claude / shell / run, and a dashboard with live guest and host metrics.
• Egress control: network = "broker" (allow-list proxy on the Mac, DNS closed in the guest, denials audited) and network = "offline"; profile = "strict".
• api_brokers: method+path-scoped API access where the credential stays on the Mac and never enters the box.
• Secret forwarding over SSH SendEnv (CORRAL_FWD_*), keychain_env, env_file, per-host git_tokens; a names-only audit log.
• Source modes mount and clone, box_dirs, hide, protect_git_metadata, readonly_project.
• Toolchains: node, go, python, docker, java, android, flutter — pinned and checksum-verified; toolchain_versions.
• Snapshots (APFS clone) and corral undo; idle GC (idle_stop, gc).
• Unattended-host support: env_file, admission control (max_running, memory_reserve), run --timeout / --result, distinguishable exit codes, read-only list --json with live metrics.
• agent_state = shared | seeded | isolated; corral agents import claude.
• Releases: cross-compiled darwin arm64/amd64 binaries with SHA256SUMS signed by minisign (public key in release/minisign.pub).

Changed

• Renamed from its internal name to Corral: binary corral, state in ~/.corral, repo config .corral.toml, CORRAL_* environment variables, guest paths under /corral and /opt/corral.
• CI moved to GitHub Actions; releases are signed with a freshly generated minisign key (the pre-release key is retired and never shipped here).
• Homebrew: installed from the corral-sh/tap tap; Lima comes from homebrew-core (corral doctor reports a Lima release other than the tested one).

Fixed

Security