Alien v3.3.32

Bug Fixes

• preserve EC2 launch template version overrides (#921)(2c74eef)
• read OPERATOR_OPERATIONS written as a plugin map without the plugins key (ALIEN-1358) (#968) (operator)(7b9a370)
• resume setup-required failures when setup reruns (#962)(234f938)
• complete provisioning after removed resources finish deletion (#925)(abdbe6a)
• report a worker's URL from its first declared public endpoint (#967)(20617ea)
• export Lambda application logs before the environment freezes (#970)(1e050a2)
• restore cross-account AWS impersonation and registry access (#969)(85fb246)
• keep an installed pool's failure-domain spread on later releases (#971)(99dea1b)
• build generated compute pools from the pools containers name (#973)(840fbe6)
• don't let a slow log endpoint hold every Lambda invocation (#977)(45c9fe3)
• drain the local manager when dev server exits (#974)(6d08333)
• recover abandoned local deployment claims on restart (#975)(7033378)
• decode event states as an enum (ALIEN-1384) (#980) (platform-sdk)(4c1ef40)
• surface the manager's own error for every failed manager request (#976)(82f6f46)
• make local builds and supervised shutdown reliable (#984)(1f67d49)
• don't duplicate stack-level AWS grants as per-resource inline policies (#983)(07bd981)
• revoke registry access before handing a deletion to setup teardown (#985)(8ac320e)
• bump lognorm to 0.2.0 so buffered JSON decimals decode again (#986)(38851c1)
• keep an installed pool's machine when no compute choice is stored (#989)(b802f0a)
• let container and daemon roles find ACM certificates by their import tag (#972)(502c0ad)
• adopt the worker's own Lambda function after a lost create response (#988) (infra)(302b010)
• finish a confirmed deletion when the lease release is refused as unauthenticated (#987)(0171fc9)
• accept null defaultManagers in alien managers defaults (#990)(e8f2828)

Features

• normalize captured application logs with lognorm (#978)(c47c528)
• select deployment resources and manage machine sizing (#979)(21000b2)

Miscellaneous

• sync published platform API clients (#982)(29ccb78)
• release v3.3.32 (#991)(bbde04b)

Alien v3.3.31

Bug Fixes

• keep cloud resource IDs in controller state across failures (#912)(500f481)
• worker custom domains and persisted create tokens across crashes (#926)(284e146)
• reconcile AWS vault grants during setup updates (#924)(36f66d9)
• apply config changes that arrive while a resource is being created or updated (#933)(2841cb1)
• resolve alien destroy by ID or group/name against the right project (#934)(a3d79f0)
• prevent SQS connection churn and blocking DNS (#929)(bb9018a)
• bump turso to 0.8.2 so encrypted WALs checkpoint (ALIEN-1311) (#931) (operator)(1820ca0)
• decode nullable open strings as scalars (ALIEN-1310) (#930) (platform-sdk)(ec68b70)
• lost ACM imports, denied deletes of gone network objects, worker log groups (#935)(6f44ca0)
• leave settled deployments alone on setup and finish clean destroys (#936)(649d6b9)
• check GCP registry consumers without decoding whole deployment records (#937)(e08730d)
• reconcile vault grants across cloud updates (#932)(f8ee218)
• grant ec2:DetachVolume to container provision (#944)(7ec44d3)
• exclude service-managed addresses from EIP quota usage (#938)(64047ea)
• preserve setup failures and release checkpointed terminal claims (#918)(2fca1cf)
• align workload trust with compute node identities (#939)(365eaf0)
• revoke vault grants after permission profile removal (#942)(6d537d3)
• explain unavailable deployment acquisition (#699)(e2e2e63)
• recover interrupted volumes and network deletion (#950)(bd656e5)
• make deployment setup commands safely resumable (#940)(dd15aaa)
• sync hosted acquisition and operations SDK contracts (#951)(0a680b9)
• distinguish saved runtime failures during setup retry (#945)(f47dc4e)
• preserve reconcile validation errors in SDK contracts (#952)(2801921)
• validate installation before deployment creation (#946)(9dc1a0e)
• retain stored inputs during standalone setup (#953)(0810d1d)
• accept the onboard setup item names and pick a link's only item (#955)(51d712e)
• name the setup token when a saved key is refused for setup (#956)(622c13f)
• let a failed preflight take corrected compute and stop pinning generated pools (#957)(2e13387)
• grant and decode EBS volume modification checks (#954)(c4cac8b)
• show S3's reason when it rejects a request (#958)(0b4866b)
• reject invalid storage lifecycle rules before deploying (#959)(91afb3c)
• fail fast on denied network deletes and report the teardown cause (#960)(828bc90)
• send storage lifecycle rule prefixes to gcs (#961)(c55b4a3)
• keep public endpoint environment stable during reconciliation (#928)(0fbd707)

CI

• require fresh automated code reviews (#947)(78fa58c)

Features

• add c8g Graviton4 machines to the AWS instance catalog (ALIEN-1302) (#923) (compute)(1dce1cb)
• add deployment group move command and SDK (#943)(093d0b5)
• create releases without promoting a channel (#948)(918c7dc)
• support operations on push deployments without an Operator (#821)(d860dd1)
• add standalone canary updates (#964) (cli)(d2fb873)
• simplify Speakeasy TypeScript SDK arguments (#965) BREAKING(72c6ab6)

Miscellaneous

• release v3.3.31 (#966)(beacc9d)

Alien v3.3.30

Bug Fixes

• keep the error chain when a binding error reaches TypeScript (ALIEN-1249) (#910) (bindings)(23933ab)
• delete local storage through its owning services (#908)(16b1afe)
• wait for frozen resource convergence before setup handoff(a9f97e4)
• accept unchanged legacy service-account grant metadata (#914)(4eb2b55)
• honor selected Docker context for local API clients (#915)(ab2651e)
• preserve unchanged imported bucket setup on refresh (#917)(02eb56a)
• run commands on kernels without ambient capabilities (ALIEN-1288) (#911) (sandbox-agent)(6476d6c)
• grant Azure workload identities their sandbox roles on the sandbox group (ALIEN-1248) (#916) (terraform)(0ffe67d)
• preserve setup-owned storage grants when retrying updates (#919)(e50ee4c)

Features

• support deploy token files and installed setup recovery(7bf486a)
• add rollout-unconfirmed error for accepted workload updates (#913)(6dd5ae7)

Miscellaneous

• release v3.3.30 (#920)(c7ce7dd)

Alien v3.3.29

Bug Fixes

• install the cached @alienplatform/core atomically (#897) (cli)(9fa8cb9)
• let a Live sandbox register through a setup package and link from a Worker (ALIEN-1236) (#890) (sandbox)(ffaad19)
• resume exact setup updates with scoped storage permissions (#843)(92d391c)
• resolve destroy targets without local tracking (#899)(b344c16)
• preserve shared local image identity (#901)(3964dbb)
• release follow-ups for domain preflight, secret rotation, re-setup, logs and deletes (#895)(501ef42)
• preserve persistent local development (#900)(1ef1265)
• persist tracked deployments in release builds (#903) (cli)(435b05f)
• a capability-only onboard link allows only what its package registers (ALIEN-1241) (#904) (cli)(cd03a2b)

CI

• build and test only the Rust packages a pull request can affect (#896)(fadeb42)
• build the TypeScript job's Rust addon and CLIs in one invocation (#898)(8c8bdef)

Features

• backups for container persistent volumes (#885)(0c64c9f)
• add a Terraform state bucket for end-to-end test runs (ALIEN-1138) (#902) (infra)(5c5d645)

Miscellaneous

• release v3.3.29 (#905)(721bee0)

Testing

• run the container_app tests against a prebuilt alien-test-app (#894)(64694b3)

Alien v3.3.28

Bug Fixes

• publish Lambda workers as ARM64 gzip images (#889)(4dd23f8)

CI

• stop publishing the alien CLI distribution from this repo (#883)(9921c89)
• serve Terraform providers from a read-only mirror in the Rust job (#887)(43edeef)

Miscellaneous

• release v3.3.28 (#892)(b330ea1)

Performance

• build the filtered Platform API client in workspace builds (#880)(401e7be)

Testing

• record controller polling delays instead of sleeping them (#886)(8a2eee5)
• run the worker integration tests in their own job, as two real tests (#891)(8ced1f2)

Alien v3.3.27

Bug Fixes

• update all non-major dependencies (#795) (deps)(d941adc)
• isolate collector pod selectors (ALIEN-1082) (#785) (helm)(91f98fc)
• keep waiting on transient deployment read errors (#783)(2906ebe)
• check the release channel before building (#786)(918143a)
• list failed preflight checks in CLI errors (#788)(f6e7484)
• retry a deployment checkpoint after a transient manager error (#801)(60ec149)
• honor telemetry off in the manager's log config (#802)(cd0ad7b)
• show what the server accepted when deleting a deployment (#804)(67d43b5)
• accept vault --deployment after the subcommand (#807)(76bc4d4)
• accept reasoning effort none when translating to Messages (#806)(8c0d831)
• track partial Azure creates without sweeping retained resources (ALIEN-1128) (#809) (terraform)(ba986a4)
• tie Remote Operator RBAC to runtime needs and enabled operations (ALIEN-1132) (#811) (helm)(52b6c7f)
• run the sandbox image as root after the base image (#781)(60f5032)
• scope the AWS sandbox roll token to the deployment's image (#782)(00d3ab4)
• regenerate the manager TypeScript SDK with speakeasy run (#814)(ba7d35a)
• restrict standalone Operator RBAC and retain product cleanup (ALIEN-1155) (#818) (helm)(2bc1781)
• name each failed resource in CLI deployment errors (#805)(871c472)
• resolve a deployment group by name in the manager's list filter (#812)(4be7004)
• pass alien dev deploy inputs to the local deployment (#815)(3d27610)
• destroy local deployments by name in alien dev destroy (#813)(374b82d)
• don't repeat a stack-wide grant for a linked resource (#803)(eb0bcb1)
• close idle inbound connections (#822) (manager)(122514e)
• read stack state stored before the lifecycle rename (ALIEN-1184) (#828) (sandbox)(16cce6b)
• keep the API's error on a 503 from command operations (ALIEN-1183) (#827) (platform-sdk)(2df2ed6)
• finish AWS worker delete after GetFunction is denied (ALIEN-1190) (#830) (infra)(403b9af)
• only the Operator may hold a deployment's tunnel (#832) (manager)(0ced619)
• reuse custom role IDs through every deleted state (ALIEN-1202) (#838) (gcp)(3e86acd)
• wait for exact redeploy operation (#689)(d08ffa6)
• delete only a deployment's own custom roles (ALIEN-1203) (#839) (gcp)(f2f2a80)
• depend on zod by range in the published packages (#816)(23c0d0a)
• enable ABAC on AWS buckets (ALIEN-1205) (#842) (storage)(c9fe488)
• revert bucket ABAC enablement (ALIEN-1205) (#846) (storage)(4a60145)
• create the python-bindings sandbox without a tenant key (ALIEN-1215) (#849) (examples)(ee35854)
• honor env and cwd in sandbox commands (ALIEN-1214) (#848) (local)(410d789)
• support AWS setup role trusts and custom domains (#854)(310ea0e)
• repair local releases and runtime lifecycle (#861)(8a744cf)
• staging validation fixes for remote bindings and setup (#865)(ab22b8c)
• acknowledge completed pull execution receipts (#873)(a8e8b20)
• accept manager version bumps and render the new release's changelog (#876) (release)(5b5250f)
• resolve loaded images by their manifest digest on the containerd image store (#871) (local)(2fe3f20)
• refuse new stacks with shared endpoint hostnames, add deployments delete --forget (#875)(a295ea6)
• apply a release that supersedes an in-flight update (#878)(844ed11)
• keep deployer secrets working for stored values and pre-vault deployments (#872)(1c8baef)
• place compute pools in offered zones and refuse setup re-registration that changes management permissions (#877)(d79abb9)
• restore completed receipt release API mode (#881)(3d430de)

CI

• generate Renovate lockfiles in Renovate's commit (#784)(e85d1c3)
• keep GitHub Actions out of the Renovate batch (#792)(9b5f47e)
• share development and CI tool version pins (ALIEN-1211) (#845)(43d439e)
• cut Rust CI compile time with unwind, no debug info and mold (#868)(dc2c5a4)
• run the Kind lifecycle tests after merge, and report failures on main (#869)(1107170)
• run the Rust and TypeScript jobs on 8-vCPU runners (#870)(db6036c)

Features

• add a typed custom plugin example (ALIEN-1111) (#787) (operations)(6755ccf)
• ship a general agent toolchain in the default sandbox base (#780) (sandbox)(76bda4e)
• share offline operation permission compiler (ALIEN-1112) (#791) (permissions)(ba059dc)
• enable remote-sandbox sends one custom image for every matching cloud (#767) (cli)(7ff7d92)
• require generated plugin metadata (ALIEN-1134) (#810) (operations)(0866130)
• expose sandbox preview in the Python and Node SDKs (#797)(01a324f)
• create Remote Sandbox keys, print Remote Sandbox requests, search their logs (#819) (cli)(372e228)
• add access-requests revoke and the revoked grant state (ALIEN-1135) (#820) (cli)(47ec725)
• allow same-architecture AWS machine changes at runtime (#823) (preflights)(dc3cb25)
• run software in customer Kubernetes clusters and air-gapped sites from a self-hosted manager (#774)(301cffe)
• add alien projects delete (#817)(9a2573b)
• let Alien generate secret stack input values (#825)(9401b2d)
• enforce egress with a privileged agent (ALIEN-1188) (#840) (sandbox)(f69f757)
• change an AWS machine type within one architecture at runtime (#833)(caa6947)
• send queue batches with per-message outcomes (#835)(121b657)
• add remote KV and Queue bindings with batch send (#834)(33f3a3a)
• vault-native deployer secrets (ALIEN-1192) (#837)(a82cd38)
• let cloud Containers and Daemons read their deployer secrets (#859)(fffface)
• support setup-only private endpoint access (#844)(684ffd9)
• expose command retry keys in Platform SDK (ALIEN-1222) (#874)(bbee474)

Miscellaneous

• update rust crate aegis to v0.9.20 (#742) (deps)(9573131)
• update rust crate tower-http to v0.7.1 (#553) (deps)(2787a2d)
• refresh the platform API spec for pending prepared releases (#879)(aa4f7be)
• build the official CLI from the current platform revision (#882)(9839365)
• release v3.3.27 (#884)(74ee4aa)

Testing

• give the lease-expiry submission test room on a loaded runner (#808)(fe34b31)

Revert

• revert the untested Renovate batch (#796)(4208809)
• undo the Renovate session and pause automation (#800)(2b35aed)

Alien v3.3.26

Bug Fixes

• publish PyPI wheels from stable release workflow (#719)(7484168)
• read and delete an AWS MicroVM image by ARN, not by name (#712) (sandbox)(41d867e)
• let the MicroVM image build apply its own boundary tags (#715) (sandbox)(3dd3030)
• accept the management role guards in either direction (#718) (preflights)(0fe8b19)
• derive the AWS build inputs instead of reading them back (#713) (sandbox)(1e08397)
• delete an AWS MicroVM image without sweeping its versions (#714) (sandbox)(67afba2)
• sync worker clients with ts-proto update (#741)(9079ee9)
• add scoped queue publisher and consumer grants (#722)(9d95f4d)
• sign endpoint overrides with destination host (#749) (aws-clients)(8274f26)
• allow filtered Aurora instance reads for frozen Postgres (#729)(3507398)
• scope Azure storage lifecycle rules to their container (#707)(fb73f2a)
• preserve wildcard hosts in Kubernetes endpoint routes (#755)(a224add)

Documentation

• say that AWS egress deny still resolves DNS (#736) (sandbox)(8ff42cb)

Features

• route operation names to the operations CLI and check typed plugin metadata (ALIEN-970) (#708) (commands)(324926c)
• report observed application identity (#709) (operator)(681ca4b)
• deploy AWS sandboxes through direct deployment (#716) (sandbox)(f32aef2)
• allow removing Remote Operator from a product release (#710) (helm)(477bc67)
• add optional release titles (#743)(30b58df)
• build a remote sandbox base image from a Dockerfile and save it by digest (#750) (cli)(f2909b7)
• support Kubernetes product deployments (#744)(c3c0cc6)
• add per-plugin operations sync status to the Platform API spec (ALIEN-1047) (#751) (platform-sdk)(ba4501a)
• support dynamic containers in existing deployments (#747)(0a5c250)
• offer Kubernetes Pod API and node log collectors (#752)(ba29337)
• allow machines join to advertise an endpoint IP (#732)(5cdfd06)

Miscellaneous

• amend the hk 2.1.0 config package (ALIEN-370) (#720)(ee8697f)
• update dependency @azure/identity to v4.13.3 (#725) (deps)(c6cd1ee)
• update dependency @biomejs/biome to v2.5.14 (#727) (deps)(b426772)
• update dependency @biomejs/biome to v2.5.14 (#730) (deps)(b2b803c)
• update dependency @grpc/grpc-js to v1.14.5 (#731) (deps)(a7a1390)
• update dependency @types/node to v24.13.6 (#733) (deps)(d750c20)
• update dependency @types/node to v24.13.6 (#734) (deps)(584675c)
• update dependency bun to v1.4.2 (#735) (deps)(519a4d2)
• refresh pnpm-lock.yaml for the @types/node bump in the e2e test app (#737) (deps)(62c3327)
• update dependency ts-proto to v2.12.4 (#738) (deps)(75fe421)
• update docker.io/oven/bun docker tag to v1.4.2 (#740) (deps)(168510a)
• release v3.3.25 (#756)(ee5d708)

Alien v3.3.25

Bug Fixes

• heap-allocate deployment step futures (#679)(0d3d7ee)
• redact deployment inputs from diagnostics (#698)(ed32b66)
• reserve the deployment secrets resource id (#693)(c9aa2b0)
• reject incompatible worker architectures (#686)(dbf1e06)
• preserve controller state across refresh retry (#701)(e8b332b)
• preserve explicit resource permissions on links (#705)(18140c6)
• report SQS delivery attempts in queue bindings (#706)(93e93a6)
• enforce local container health checks (#694)(f2e0e01)
• validate local release artifacts before deploy (#682)(5e80421)
• show blocked deployment update failures (#692)(3146fc7)
• normalize CloudFormation registration outputs (#687)(fab0c1b)
• allow runtime workloads to link live sandboxes (#695)(f5bd7bc)
• render EKS Kubernetes exec authentication as a provider block (#711)(336d0cb)

Documentation

• clarify sandbox provider identity (#697)(afdf08e)

Features

• support remote debugging access requests (ALIEN-831) (#645) (cli)(3ab3253)
• add first-class Python resource bindings (#677)(b462624)
• add Vault secret deletion (#703)(100e6a7)
• add secure secret sources to alien dev (#681)(198312d)
• accept inputs during stack registration (#691)(2969ede)
• encrypt standalone manager state (#702)(36cd8d9)
• load project config from packaged images (#704) (operator)(675987b)
• build and release a sandbox base image like every other compute type (#700) (build)(7356a49)

Miscellaneous

• release v3.3.24 (#717)(2309e97)

Alien v3.3.24

Bug Fixes

• retry transient OTLP log delivery failures (ALIEN-850) (#632)(e930057)
• sanitize git release metadata (#639)(58f2604)
• preserve first-party deployment context (#636)(9475b70)
• plan configurable cloud storage (#637)(c6508c6)
• preserve semantic deployment failures through finalization (#643)(fd8f9f0)
• preserve compute selections in public deploy (#658)(c4c4bef)
• surface safe JSON command failures on stderr (#659)(0d48f43)
• recover direct teardown without a local tracker (#660)(49fb40e)
• preflight AWS Elastic IP quota before network creation (#662)(7fd232a)
• validate cloud config before deployment creation (#638)(37b4b46)
• preserve command polling in filtered Platform client (#667)(98dc665)
• bind official CLI qualification to exact sources (#673)(9e8cf0f)
• resolve manager installers through stable channel (#674)(1344792)
• prepare composed CLI release dependencies (#680)(2bcdce5)
• publish reviewed release commit (#683)(09f9f8e)
• pin valid composed CLI setup action (#684)(fd03232)
• isolate multi-platform image smoke pulls (#685)(15a1317)

CI

• compile feature tests in one workspace graph (#665)(3e7f821)
• build the package gateway in the unified CLI graph (#666)(e5da9b4)
• increase Rust build concurrency (#668)(fceacc0)
• publish the Platform-composed Alien CLI (#672)(f6b41a6)

Features

• sync SDK baseline and enforce canonical contracts (ALIEN-845, ALIEN-818) (#629) (operations)(bc7aadb)
• require explicit permission decisions (#630) (operations)(9bdcc76)
• publish the GCP sandbox agent image (#651) (sandbox)(0a734b8)
• validate deploy configs without side effects (#661)(2724ab7)
• support composed CLI render registries (#671)(13e75bf)
• list machines for every deployment (#670)(63ba435)
• build a Live sandbox from a project's private base image (#675) (sandbox)(8d72939)
• add product remote operator lifecycle (ALIEN-823) (#633) (helm)(b13cd12)
• grant a GCP sandbox read on the registry it pulls from (#663) (sandbox)(23318e3)
• report exact image identity (ALIEN-826) (#634) (operator)(ad81ae1)

Miscellaneous

• release v3.3.23 (#678)(05a60b1)

Performance

• keep test utilities out of production builds (#640)(e0b560a)
• trim Lambda event features (#641)(a97c9cf)
• isolate local worker runtime features (#648)(b79c33a)
• use ring for embedded PostgreSQL TLS (#650)(f7c9f56)
• generate only used Azure models (#646)(a309e25)
• isolate permission types from core (#647)(1ad705c)
• default to reachable Azure models (#664)(8910570)
• generate only used Platform API operations (#644)(d653999)
• deduplicate Platform client schemas (#649)(4e64bc1)
• compile Azure models in parallel (#652)(b5682e0)

Revert

• restore previous OTLP exporter behavior (#635)(87dc10a)

Alien v3.3.23

Bug Fixes

• remediate dashboard dependency alerts (#611)(198f824)
• refresh platform TypeScript SDK for credential rotation (ALIEN-750) (#597)(cf00ab2)
• re-register setup with deployment-scoped credentials (#609)(164dcee)
• retry transient registry uploads (#616)(8373794)
• reconcile partially provisioned resources in place (#618)(7407644)
• classify RDS not-found responses (#619)(1483aea)
• thread operations-plugin sync reports through the sync loop (#612) (manager)(615881b)
• send uploadId on operations plugin publish (#622) (cli)(9c3e3b7)
• retry failed generated CLI teardown (#620)(743504d)
• report completed deployment cleanup (#624)(420f1e3)
• return reserved deployment credential (#617)(8e0911e)

Documentation

• contain unrelated Platform regeneration (#551) (sdk)(534d664)

Features

• expose cloud load balancer health (#610)(38507b4)
• scoped Kubernetes operation declarations (ALIEN-726) (#592)(ed91682)
• rotate persisted Operator credentials (ALIEN-750) (#596)(b0eb8b8)
• support setup Postgres in the default VPC (#613)(731456e)
• align the sandbox API with industry conventions (#615) (sandbox)(c45b4ea)
• add a built-in Azure sandbox controller and importer (#623) (sandbox)(959b524)

Miscellaneous

• release v3.3.22 (#626)(0279993)

Testing

• use resource-scoped operations permission (#625)(08adb57)