chriswritescode-dev/opencode-manager v0.17.2 on GitHub

What's Changed

feat(settings): add manager logs viewer (#344) — Settings gains a manager logs viewer backed by backend log capture, with a layout that works on mobile and renders full-height output.
feat(sandbox): boot the shared microVM at startup when sandboxing is enabled — Startup and the enforcement toggle now run the same ensureWorkspaceSandbox path a command triggers, so the image pull, microVM boot, attestation, and exec-user provisioning are done before the first command instead of on it. One microVM serves every repo and schedule worktree.
feat(sandbox): cache the guest image at startup instead of on first command — The configured guest image is pulled in the background at Manager boot and when enforcement is switched on, so a sandboxed command no longer pays the multi-gigabyte download. msb pull is a no-op once cached, startup is never blocked by it, and a command racing the pull joins the same in-flight boot.
feat(sandbox-image): align guest toolchain with Manager image
feat(source-control): add branch search filter

fix(sandbox): wait for guest agent, verify exec user provisioning, pin rebuilt image (#343) — Exec-user provisioning now gates on guest-agent readiness bounded by SANDBOX_START_TIMEOUT_MS instead of racing boot, the canonical shell spec is derived from the create args so msb 0.6.15 recordings match attestation, spawned commands close stdin so msb exec no longer hangs waiting for EOF, provisioning attempts are serialized and background retries cancelled on stop, and the rebuilt guest image digest is pinned.
fix(sandbox): pin the guest image by digest so rebuilds are adopted — msb caches images by reference and pull without --force never contacts the registry, while attestation compares the reference string, so a floating tag kept a stale guest image forever while still passing attestation. The default is now pinned to the published index digest, making IfMissing pull the new image and forcing the running microVM to be recreated on deploy.
fix(sandbox): make the guest toolchain and sudo usable by the exec user — Writable guest HOME and shared COREPACK_HOME, bunx exposed, npm/pnpm global installs redirected to a PATH dir, Debian's externally-managed pip guard lifted, and the toolchain verified as an unprivileged uid at build time. passwd/group/shadow entries are provisioned for the numeric exec uid at sandbox create, start, and Manager boot so passwordless sudo works in the guest.

Full Changelog: v0.17.1...v0.17.2