minimal

No entries match these filters. Clear filters

1. release-6a01d5ae Nov 7, 2026 · issue 134

   minimal adds a Box Egress Proxy, secret management, OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. tracing, and a vulnerability reporting flag across CLI and daemon components⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch release-6a01d5ae https://github.com/gominimal/minimal.git
   # already have the repo? check out this version:
   $ git checkout release-6a01d5ae

   └──▷ TRY IT
   Manage a secret token inside a box — store it once, then list to confirm it is registered.
   copy

   $ min secret set MY_API_TOKEN
   min secret list

   Inspect a box's proxy-enforced audit trail and merge its parent chain for a full history.
   copy

   $ min box audit --parent mybox

   Submit a suspected vulnerability report from the local telemetry spool.
   copy

   $ min bug --security

   • Adds min box audit to read a box's audit trail, min box audit --parent to merge parent chains, min doctor to report an edited audit chain, and min box spec to list each store reference with its authorities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Report a suspected vulnerability to the project with --security on the diag command.
   • Sign in to GitHub and finish the OAuth flow on a real page with min login, with repository choice offered during sign-in.
   • Adds the bep crate implementing a Box Egress Proxy that issues leaf certificates under a name-constrained root and signing CA, holds proxy keys in the host Secure Enclave, maintains a hash-chained audit log per proxy decision, rotates the signing CA through a control socket, starts beside gvproxy so git and gh reach GitHub from inside VM boxes, and wires a client-key bound into bep serve via --max-client-keys to cap the registry size.
   • Name the QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving cyber tools low-latency encrypted transport without head-of-line blocking. block helper in min finalize-install for post-install network configuration.

   +4 more show less

   • Add opt-in OpenTelemetry export with local spooling across mlog, min, minimald, and minvmd, carrying one trace per request through CLI, daemon, and VM guest.
   • Give a project with no session entry an implicit default in mfile.
   • Keep box names answering across a reboot and a second VM.
   • Proxy runtime-published ports like a direct connection in minimald.
   • Adds min box audit to read a box's audit trail, min box audit --parent to merge parent chains, min doctor to report an edited audit chain, and min box spec to list each store reference with its authorities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Report a suspected vulnerability to the project with --security on the diag command.
   • Sign in to GitHub and finish the OAuth flow on a real page with min login, with repository choice offered during sign-in.
   • Adds the bep crate implementing a Box Egress Proxy that issues leaf certificates under a name-constrained root and signing CA, holds proxy keys in the host Secure Enclave, maintains a hash-chained audit log per proxy decision, rotates the signing CA through a control socket, starts beside gvproxy so git and gh reach GitHub from inside VM boxes, and wires a client-key bound into bep serve via --max-client-keys to cap the registry size.
   • Add opt-in OpenTelemetry export with local spooling across mlog, min, minimald, and minvmd, carrying one trace per request through CLI, daemon, and VM guest.

   +2 more show less

   • Give a project with no session entry an implicit default in mfile.
   • Proxy runtime-published ports like a direct connection in minimald.

   2 more in Everything

2. release-1e236070 Nov 6, 2026 · issue 134

   minimal: Store, list, and remove secrets inside a box with min secret (subcommands: set, list, remove).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch release-1e236070 https://github.com/gominimal/minimal.git
   # already have the repo? check out this version:
   $ git checkout release-1e236070

   └──▷ TRY IT
   Store a GitHub token as a named secret so a box can retrieve it at runtime without it ever appearing in the toml.
   copy

   $ min secret set GH_TOKEN

   Inspect the full hash-chained audit trail for a box, merging in its parent chain, to verify no decisions were tampered with.
   copy

   $ min box audit --parent mybox

   Limit how many client keys the Box Egress Proxy will register before refusing new ones, to bound the registry surface.
   copy

   $ bep serve --max-client-keys 50

   • Carry an edited-audit-chain warning into min doctor.
   • Carry telemetry spool and redact telemetry settings automatically when running min bug.

   2 more in Everything

3. release-47eba5d3 Nov 5, 2026 · issue 134

   minimal: Ship minzoned in a signed macOS app bundle with the app icon, and ship a signed, notarized bep binary beside minvmd on macOS.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch release-47eba5d3 https://github.com/gominimal/minimal.git
   # already have the repo? check out this version:
   $ git checkout release-47eba5d3

   └──▷ TRY IT
   Store a secret scoped to a box so the agent can access it without it appearing in the environment directly.
   copy

   $ min secret set MY_API_KEY

   Inspect a box's full audit trail, merging parent chains, to verify no proxy decisions were tampered with.
   copy

   $ min box audit --parent mybox

   Review all store references and their declared authorities for a box before granting additional egress.
   copy

   $ min box spec mybox

4. release-3c2b2a73 Nov 5, 2026 · issue 134

   minimal: Control the client-key registry limit in bep serve with --max-client-keys.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch release-3c2b2a73 https://github.com/gominimal/minimal.git
   # already have the repo? check out this version:
   $ git checkout release-3c2b2a73

   └──▷ TRY IT
   Store a secret in a box so an agent can access it without a manually pasted credential.
   copy

   $ min secret set MY_API_KEY

   Inspect a box's full audit trail, merging in its parent chain, to verify no decisions were tampered with.
   copy

   $ min box audit --parent

   Review every store reference a box declares along with the authorities bound to each, to audit egress policy before activating a session.
   copy

   $ min box spec

   • Bundle the telemetry spool and redacted telemetry settings in min bug reports.
   • Sign in to GitHub through the published App and manage credentials with min login; logout deletes the sign-in and refuses every reference to it.
   • Ship a git credential helper inside grant boxes so agents can reach GitHub without a manually pasted PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it..
   • Block UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. port 443 for boxes whose QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving cyber tools low-latency encrypted transport without head-of-line blocking. stance is blocked, enforced both at the host and from a blocked cohort's own leaves.
   • Sign in to GitHub through the published App and manage credentials with min login; logout deletes the sign-in and refuses every reference to it.
   • Ship a git credential helper inside grant boxes so agents can reach GitHub without a manually pasted PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it..
   • Block UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. port 443 for boxes whose QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving cyber tools low-latency encrypted transport without head-of-line blocking. stance is blocked, enforced both at the host and from a blocked cohort's own leaves.

   1 more in Everything

5. release-46d9e530 Nov 5, 2026 · issue 134

   minimal: Introduces the new bep crate shipping the GitHub module and sealed-envelope proxy, with bep serve as the runtime entry point for egress control in the Box

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch release-46d9e530 https://github.com/gominimal/minimal.git
   # already have the repo? check out this version:
   $ git checkout release-46d9e530

   └──▷ TRY IT
   Store a GitHub token as a named secret in a box so agents can use it without it being pasted into the session environment.
   copy

   $ min secret set GH_TOKEN

   Review the tamper-evident audit trail for a box, merging its parent's history, to verify every proxy egress decision made during an agent session.
   copy

   $ min box audit --parent <box-name>

   • Issue leaf certificates under a name-constrained root and signing CA; rotate the signing CA under an unchanged root, including rotation through the control socket.
   • Report non-Rust dependency pins and bump the locked_commit for packages in scripts.
   • Issue leaf certificates under a name-constrained root and signing CA; rotate the signing CA under an unchanged root, including rotation through the control socket.

   1 more in Everything

6. release-f6fcbab7 Nov 3, 2026 · issue 134
   └──▷ GET THIS VERSION

   copy

   $ git clone --branch release-f6fcbab7 https://github.com/gominimal/minimal.git
   # already have the repo? check out this version:
   $ git checkout release-f6fcbab7

   └──▷ TRY IT
   Store a secret token that a box can retrieve at runtime without the agent seeing the raw value.
   copy

   $ min secret set MY_API_TOKEN

   Review every proxy decision recorded for a box, merging its parent chain, to audit egress activity.
   copy

   $ min box audit --parent mybox

   Sign in to GitHub so grant boxes can reach GitHub through the Box Egress Proxy without a PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. in the environment.
   copy

   $ min login

7. release-2d06816e Nov 2, 2026 · issue 134
   └──▷ GET THIS VERSION

   copy

   $ git clone --branch release-2d06816e https://github.com/gominimal/minimal.git
   # already have the repo? check out this version:
   $ git checkout release-2d06816e

   └──▷ TRY IT
   Store a secret token for a box so the agent can retrieve it without it ever appearing in the box spec.
   copy

   $ min secret set MY_API_TOKEN

   Inspect the full hash-chained audit trail for a box, merging its parent chain, to verify no decisions were tampered with.
   copy

   $ min box audit --parent mybox

   Review every store reference a box declares, with the authorities each one carries, before activating a session.
   copy

   $ min box spec mybox

8. release-e0fb6403 Oct 31, 2026 · issue 134

   minimal: minimald now ships a git credential helper inside grant boxes so agents can reach GitHub without a manual PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it., delivers each GitHub grant's sealed value into its

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch release-e0fb6403 https://github.com/gominimal/minimal.git
   # already have the repo? check out this version:
   $ git checkout release-e0fb6403

   └──▷ TRY IT
   Store a GitHub token as a secret so it is available inside a box without being passed as an environment variable.
   copy

   $ min secret set GH_TOKEN

   Inspect the full audit trail for a box — including merged parent chains — to verify no egress decisions were tampered with.
   copy

   $ min box audit --parent mybox

   Review every store reference a box declares, with its permitted authorities, before activating a session.
   copy

   $ min box spec mybox

9. release-79c50305 Oct 31, 2026 · issue 134
   └──▷ GET THIS VERSION

   copy

   $ git clone --branch release-79c50305 https://github.com/gominimal/minimal.git
   # already have the repo? check out this version:
   $ git checkout release-79c50305

   └──▷ TRY IT
   Store a GitHub token as a named secret so a box can retrieve it without a manually pasted PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it..
   copy

   $ min secret set github-token

   Review the tamper-evident audit trail for a box, merging its parent chain, to verify every proxy decision recorded since creation.
   copy

   $ min box audit --parent mybox

   Sign in to GitHub once so the daemon can mint sealed credentials for grant boxes without prompting again.
   copy

   $ min login

10. release-0be7561f Oct 30, 2026 · issue 134
    └──▷ GET THIS VERSION

    copy

    $ git clone --branch release-0be7561f https://github.com/gominimal/minimal.git
    # already have the repo? check out this version:
    $ git checkout release-0be7561f

    └──▷ TRY IT
    Store a secret token for a box so the agent can use it without a manually pasted credential.
    copy

    $ min secret set MY_API_TOKEN

    Review the tamper-evident audit trail of proxy decisions for a specific box.
    copy

    $ min box audit my-box-name

    Sign in to GitHub once so grant boxes receive credentials through the proxy rather than via a pasted PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it..
    copy

    $ min login

11. release-de32bd3d Oct 29, 2026 · issue 134
    └──▷ GET THIS VERSION

    copy

    $ git clone --branch release-de32bd3d https://github.com/gominimal/minimal.git
    # already have the repo? check out this version:
    $ git checkout release-de32bd3d

    └──▷ TRY IT
    Store a GitHub token as a secret in a box so an agent can reach GitHub without an exported PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it..
    copy

    $ min secret set GH_TOKEN

    Inspect a box's proxy-decision history to verify no audit records have been tampered with.
    copy

    $ min box audit

    Sign in to GitHub under the published app so grant boxes can reach GitHub through the Box Egress Proxy.
    copy

    $ min login

    └──▷ BREAKING ON UPGRADE

    • !min login now replaces the previous GitHub sign-in cert surfaces; retired cert surfaces are removed.
12. release-fad7c721 Oct 27, 2026 · issue 134

    minimal: Refuse Minimal's own infrastructure domains in the box CA and store rules.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch release-fad7c721 https://github.com/gominimal/minimal.git
    # already have the repo? check out this version:
    $ git checkout release-fad7c721

    └──▷ TRY IT
    Store a secret token for a box so the agent can retrieve it without a manual paste.
    copy

    $ min secret set MY_API_KEY

    Inspect the tamper-evident audit trail for a specific box after a session ends.
    copy

    $ min box audit <box-name>

    List all store references and their declared authorities for a box to review egress policy.
    copy

    $ min box spec <box-name>

    • Record a revocation when a live box is destroyed, and check minted box IDs against retained revocations.

    1 detail in Everything

13. release-5a93a07a Oct 26, 2026 · issue 134
    └──▷ GET THIS VERSION

    copy

    $ git clone --branch release-5a93a07a https://github.com/gominimal/minimal.git
    # already have the repo? check out this version:
    $ git checkout release-5a93a07a

    └──▷ TRY IT
    Store a secret into a box and confirm it appears in the secret list — useful for injecting API keys or tokens without exposing them in the box definition.
    copy

    $ min secret set MY_API_KEY
    min secret list

    Review the hash-chained audit trail for a specific box to verify every proxy decision made on its behalf.
    copy

    $ min box audit <box-name>

14. release-dd753658 Oct 25, 2026 · issue 134

    minimal: Adds the bep crate with a GitHub module that signs in to GitHub under a published App with credentials kept in the host keychain, plus sealed envelope support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch release-dd753658 https://github.com/gominimal/minimal.git
    # already have the repo? check out this version:
    $ git checkout release-dd753658

    └──▷ TRY IT
    Inspect the tamper-evident audit log for a specific box after a proxy session to verify every egress decision.
    copy

    $ min box audit

15. release-608ab9c9 Oct 23, 2026 · issue 134

    minimal adds a bound-proxy layer (bep), per-request OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. tracing, audit trails, and GitHub keychain sign-in across the CLI and daemon⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch release-608ab9c9 https://github.com/gominimal/minimal.git
    # already have the repo? check out this version:
    $ git checkout release-608ab9c9

    └──▷ TRY IT
    Inspect the tamper-evident proxy decision history for a specific box to verify what egress was allowed or denied.
    copy

    $ min box audit <box-name>

16. release-5378e56c Oct 22, 2026 · issue 134

    minimal adds opt-in OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. tracing across the CLI, daemon, and VM host, plus a new bep proxy subsystem with certificate issuance, audit chaining, and egress enforcem⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch release-5378e56c https://github.com/gominimal/minimal.git
    # already have the repo? check out this version:
    $ git checkout release-5378e56c

    └──▷ TRY IT
    Inspect the full proxy decision history for a specific box to verify egress enforcement.
    copy

    $ min box audit

    • Adds the bep crate for proxied access control, including a GitHub module and sealed-envelope support, storing and publishing proxy key identities from the host keychain, hash-chained audit records for every proxy decision, leaf certificate issuance under a name-constrained root and signing CA, wiring redemption decisions and each box's declared egress into bep serve, refusing undeclared egress, host mismatches, off-port, off-set authorities, and expired values, and accepting only box connections while terminating TLS for module hosts over HTTP/1.1.

    1 detail in Everything

17. release-248b259c Oct 21, 2026 · issue 134

    minimal adds opt-in OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. tracing, a new BEP proxy layer with certificate issuance, and a min box audit command for reading a box's audit trail⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch release-248b259c https://github.com/gominimal/minimal.git
    # already have the repo? check out this version:
    $ git checkout release-248b259c

    └──▷ TRY IT
    Inspect the full audit trail for a named box to review every proxy decision recorded in the hash-chained log.
    copy

    $ min box audit

18. release-d67d78ee Oct 19, 2026 · issue 134

    minimal adds opt-in OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. tracing across the CLI, daemon, and VM host, plus a signed macOS app bundle for minzoned⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch release-d67d78ee https://github.com/gominimal/minimal.git
    # already have the repo? check out this version:
    $ git checkout release-d67d78ee

    └──▷ HOW TO FIND IT
    Opt out of OpenTelemetry telemetry export by setting the DO_NOT_TRACK environment variable before running any min command.
    📍DO_NOT_TRACK=1 min session activate --attach .
    • minimal now exports OpenTelemetry spans from mlog with opt-in switches and a local spool, grounded in DO_NOT_TRACK opt-out support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • minimal now traces each request end-to-end with one trace per request across both min and minimald.

    2 details in Everything

19. release-6c6c39ae Oct 16, 2026 · issue 134

    minimal adds opt-in OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. export, min diag upload, min finalize-install, and staged-version installs via --version⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch release-6c6c39ae https://github.com/gominimal/minimal.git
    # already have the repo? check out this version:
    $ git checkout release-6c6c39ae

    └──▷ TRY IT
    Install a specific staged release of minimal rather than the current stable channel.
    copy

    $ curl --proto "=https" --tlsv1.2 -fsSL 'https://go.minimal.dev/stable' | sh -s -- --version <version>

    Run the new network finalisation step after install, reviewing the script before it applies.
    copy

    $ min finalize-install --show --script

    • Install a specific staged version of minimal with --version on the installer.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Upload diagnostic bundles directly to the portal for analysis with min diag upload.
    • Replace min net setup with min finalize-install for host DNS and network setup; --show --script replaces --print.
    • Warn within a minute when the switch datapath is lost.
    • End a task run's box daemon-side.

    +1 more show less

    • Give an absent egress destination list no network reach once layers merge.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The [harness] table in minimal.toml no longer loads a stack and now fails to load; rename it to [stack].
    • !--token is removed from min bug, min diag collect, and min diag upload; passing it is now a parse error. The Status: line is no longer printed after an upload.
    • !min net setup is removed with no alias; run min finalize-install instead (--show --script replaces --print).
    • !The own-ip deny-all egress default is now enforced for sessions and minvmd.
20. release-a3f2fa97 Oct 15, 2026 · issue 134

    minimal: Collect and redact telemetry spool in min bug reports as part of the OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. tracing integration.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch release-a3f2fa97 https://github.com/gominimal/minimal.git
    # already have the repo? check out this version:
    $ git checkout release-a3f2fa97

    └──▷ TRY IT
    Run the host network setup script interactively so you can review it before it executes, replacing the old min net setup workflow.
    copy

    $ min finalize-install --show --script

    └──▷ BREAKING ON UPGRADE

    • !min net setup is removed with no alias; use min finalize-install instead (--show and --script replace --print).
    • !--token is removed from min bug, min diag collect, and min diag upload; passing it is now a parse error. The Status: line is no longer printed after an upload.
    • !A minimal.toml that spells the stack table [harness] now fails to load; rename the table to [stack].
    • !The own-ip deny-all egress default is now enforced in sessions and minvmd.
21. v0.7.0 Oct 15, 2026 · issue 134

    minimal adds per-session network isolation with egress rules, named addresses, port publishing, a root-setup command, multi-VM support, and CLI bug reporting⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.7.0 https://github.com/gominimal/minimal.git
    # already have the repo? check out this version:
    $ git checkout v0.7.0

    └──▷ TRY IT
    Activate a session that can only reach github.com and nothing else — useful for an agent that must pull code but must not exfiltrate data.
    copy

    $ min session activate --network own_ip --allow-dns-hosts github.com --attach

    Forward port 8080 from a running session to localhost:8080 so you can open a dev server in your browser without installing anything in the session.
    copy

    $ min net forward mysession 8080:8080

    Upload a diagnostic bundle immediately after a hang so the team can investigate without manual log collection.
    copy

    $ min bug --upload

    • Adds session network control: min session activate --network <none|host_ip|own_ip> sets the network mode (host_ip shares the host network, own_ip gives the session its own IP, none removes all network access), --allow-dns-hosts <host>, --allow-subnets <cidr>, --deny-subnets <cidr>, --allow-protocols <tcp|udp|icmp>, and --deny-all-egress flags restrict what an own_ip session can reach, and min session policy <session> (also shown in the detail pane of min dash) inspects the effective network policy for a running session.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds session port management: --ingress <external>:<internal> publishes ports when a session starts, --dynamic-ingress <allow|ask|deny> and --dynamic-range <lo-hi> control runtime port requests, min net expose <port> requests a port from inside a session, and min net forward <session> <local>:<port> forwards a session port to localhost from outside.
    • Every session gets a <name>.min.internal hostname reachable via a local HTTP proxy, and via full DNS resolution after min finalize-install.
    • Collect and upload a diagnostic bundle in one step with min bug --upload, which prints a shareable report link and a delete command; upload a previously collected bundle with min diag upload <path>, and remove it later with min diag delete <id> <token> (bundles auto-expire after 7 days).
    • Collect all root-requiring setup into one reviewable sudo call with min finalize-install; preview what is missing with --show, print the exact script with --show --script, and undo the installation with --undo.

    +1 more show less

    • Run multiple named VMs alongside the default with --vm <name> on min session activate.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • ![harness] in minimal.toml no longer loads — rename the table to [stack].
    • !min ssh-forward is removed — use min net forward <session> <local>:<port> instead.
    • !The daemon's HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. reverse proxy and client certificates are removed, and min login no longer issues a certificate — reach sessions via <session>.min.internal or min net forward.
    • !Session names must now be valid hostnames (letters, digits, hyphens only; case-insensitive; host, local, localhost, and minimald are reserved; names shaped like a session id are refused) — rename non-conforming sessions with min session rename.
22. release-f5bb38c2 Oct 14, 2026 · issue 134

    minimal: Deny all egress by default for sessions with no declared egress destination list.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch release-f5bb38c2 https://github.com/gominimal/minimal.git
    # already have the repo? check out this version:
    $ git checkout release-f5bb38c2

    └──▷ TRY IT
    Pin the sandbox environment to a specific staged release during install rather than taking the current stable channel.
    copy

    $ curl --proto "=https" --tlsv1.2 -fsSL 'https://go.minimal.dev/stable' | sh -s -- --version <version>

    Upload a diagnostic bundle to the portal for automated analysis — no token needed.
    copy

    $ min diag collect && min diag upload

    Review and run the host DNS/network setup script after installation, replacing the removed min net setup command.
    copy

    $ min finalize-install --show --script

    └──▷ BREAKING ON UPGRADE

    • !min net setup is removed with no alias; run min finalize-install instead (--show and --script replace --print).
    • !A minimal.toml that spells the stack table [harness] now fails to load; rename it to [stack].
    • !--token is removed from min bug, min diag collect, and min diag upload; passing it is now a parse error. The Status: line is no longer printed after an upload.
    • !Sessions now enforce a deny-all egress default for own-IP traffic once network layers merge.
23. release-1e32c2b0 Oct 12, 2026 · issue 134

    minimal: Deliver each accepted box connection to the proxy with the box identity attached.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch release-1e32c2b0 https://github.com/gominimal/minimal.git
    # already have the repo? check out this version:
    $ git checkout release-1e32c2b0

    └──▷ TRY IT
    Install a specific staged release of minimal rather than the current stable channel.
    copy

    $ curl --proto 'https' --tlsv1.2 -fsSL 'https://go.minimal.dev/stable' | sh -s -- --version 0.8.0

    Run the new post-install network setup step, printing the script for review before applying it.
    copy

    $ min finalize-install --show --script

    Upload a diagnostic bundle to the portal for analysis, then remove it when done.
    copy

    $ min diag upload && min diag delete

    └──▷ BREAKING ON UPGRADE

    • ![harness] in minimal.toml no longer loads a stack and now fails to load; rename it to [stack].
    • !--token is removed from min bug, min diag collect, and min diag upload; passing it is now a parse error. The Status: line is no longer printed after an upload.
    • !min net setup is removed with no alias; use min finalize-install instead (--show --script replaces --print).
    • !The own-ip deny-all egress default is now enforced for sessions and minvmd.
24. release-5cd498c2 Oct 11, 2026 · issue 134

    minimal: Make host DNS setup opt-in with a reviewable min net setup script and --undo support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch release-5cd498c2 https://github.com/gominimal/minimal.git
    # already have the repo? check out this version:
    $ git checkout release-5cd498c2

    └──▷ TRY IT
    Upload a diagnostic bundle to the portal for analysis without supplying a token, then remove it when done.
    copy

    $ min diag collect && min diag upload && min diag delete

    Finish host network setup on a new install using the replacement for min net setup.
    copy

    $ min finalize-install --show --script

    └──▷ BREAKING ON UPGRADE

    • ![harness] table in minimal.toml no longer loads a stack and now fails to load; rename it to [stack].
    • !--token is removed from min bug, min diag collect, and min diag upload; passing it is now a parse error. The Status: line is no longer printed after an upload.
    • !min net setup is removed with no alias; run min finalize-install instead. --show and --script replace --print.
    • !Own-ip deny-all egress default is now in force for sessions and minvmd.
25. release-4732e714 Oct 11, 2026 · issue 134
    └──▷ GET THIS VERSION

    copy

    $ git clone --branch release-4732e714 https://github.com/gominimal/minimal.git
    # already have the repo? check out this version:
    $ git checkout release-4732e714

    └──▷ TRY IT
    Install a specific staged release of minimal rather than the latest stable channel.
    copy

    $ curl --proto "=https" --tlsv1.2 -fsSL 'https://go.minimal.dev/stable' | sh -s -- --version <version>

    Upload a diagnostic bundle to the portal for analysis after a session problem, without needing an auth token.
    copy

    $ min diag collect && min diag upload

    └──▷ BREAKING ON UPGRADE

    • ![harness] table in minimal.toml no longer loads a stack and now fails to load; rename it to [stack].
    • !--token is removed from min bug, min diag collect, and min diag upload; passing it is now a parse error. The Status: line is no longer printed after an upload.
    • !min net setup is removed with no alias; use min finalize-install instead (--show and --script replace the former --print flag).
    • !Own-ip deny-all egress default is now enforced for sessions and minvmd.
26. release-f90c2617 Oct 10, 2026 · issue 134

    minimal: Add the macOS app icon built from the minimal mark.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch release-f90c2617 https://github.com/gominimal/minimal.git
    # already have the repo? check out this version:
    $ git checkout release-f90c2617

    └──▷ TRY IT
    Pin a specific staged release during install rather than taking the current stable channel.
    copy

    $ curl --proto 'https' --tlsv1.2 -fsSL 'https://go.minimal.dev/stable' | sh -s -- --version <version>

    Upload a diagnostic bundle to the portal for analysis after a session problem — no token needed.
    copy

    $ min diag collect && min diag upload

    └──▷ BREAKING ON UPGRADE

    • !minimal.toml files using [harness] to name the stack table no longer load a stack; rename the table to [stack].
    • !--token is removed from min bug, min diag collect, and min diag upload; passing it is now a parse error. The Status: line is no longer printed after an upload.
    • !min net setup is removed with no alias; use min finalize-install instead (--show and --script replace --print).
    • !Sessions and minvmd now enforce a deny-all egress default for the own-IP by default.
27. release-ea1b0154 Oct 9, 2026 · issue 134

    minimal: Bind declared ports before name resolution and refuse unpublished ports at startup in minimald.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch release-ea1b0154 https://github.com/gominimal/minimal.git
    # already have the repo? check out this version:
    $ git checkout release-ea1b0154

    └──▷ TRY IT
    Install a specific staged release instead of the latest stable, e.g. to pin a known-good version in CI.
    copy

    $ curl --proto "=https" --tlsv1.2 -fsSL 'https://go.minimal.dev/stable' | sh -s -- --version 0.7.0

    Upload a diagnostics bundle when debugging a session problem, so the portal can analyse it automatically.
    copy

    $ min diag upload

    Review and apply host DNS configuration changes, or roll them back, without editing system files by hand.
    copy

    $ min net setup --undo

    └──▷ BREAKING ON UPGRADE

    • !The [harness] table in minimal.toml no longer loads a stack; rename it to [stack] or the file will not load.
    • !The own-ip deny-all egress default is now enforced in sessions and minvmd.
28. release-5ec43856 Oct 9, 2026 · issue 134
    └──▷ GET THIS VERSION

    copy

    $ git clone --branch release-5ec43856 https://github.com/gominimal/minimal.git
    # already have the repo? check out this version:
    $ git checkout release-5ec43856

    └──▷ TRY IT
    Pin a CI environment to a specific staged release instead of always pulling the latest stable build.
    copy

    $ curl --proto "=https" --tlsv1.2 -fsSL 'https://go.minimal.dev/stable' | sh -s -- --version <version>

    Review and apply host DNS configuration, then undo it cleanly if something goes wrong.
    copy

    $ min net setup
    # review the script, then apply; to revert:
    min net setup --undo

    Send a diagnostic bundle to the portal when troubleshooting a broken session or daemon issue.
    copy

    $ min diag upload

    └──▷ BREAKING ON UPGRADE

    • !The [harness] table in minimal.toml no longer loads a stack and will be refused if a task has two actions — rename it to [stack].