Changelog

​

Updates

• Polished installer and upgrade output. The install and upgrade flows now use a branded theme with phase dividers (for example, separate Configuration and Reconfiguration sections during malbox daemon upgrade --reconfigure) so it’s easier to see where you are in the run. See Automatic install.
• Structured non-TTY install logs. When the installer isn’t attached to a terminal (CI, curl | bash, log files), each line is now prefixed with a timestamp and a [step/total] counter so progress is easy to follow and grep.
• Recovery hints on failed steps. If an install, upgrade, or rollback step fails, the renderer now prints a short hint with the exact command to retry (for example, malbox daemon upgrade --rollback or systemctl --user start malbox) directly under the failure.

​

New features

• Unified malbox CLI with daemon subcommands. Administration has moved under malbox daemon, alongside the everyday submission commands. Use malbox daemon install, malbox daemon upgrade, malbox daemon start, malbox daemon plugin, malbox daemon provider, and malbox daemon config — one binary covers user and admin workflows. See the malbox reference.
• Standalone malboxd daemon. A new malboxd binary runs the daemon on its own (for example, under systemd) without going through the CLI wrapper.
• Plugin registry and management commands. A new plugin registry lets you install, update, search, list, remove, and inspect host plugins from a configured registry. Configure sources under the new [plugins.registry] section in daemon.toml — see Plugin configuration — and drive it from malbox daemon plugin install|update|list|search|remove|info.
• Provider install / uninstall / rebuild. Manage machinery providers from the CLI with malbox daemon provider install, uninstall, and rebuild, including non-interactive flows for automation.
• Installer overhaul. The installer now provisions the PostgreSQL database for you at install time, supports install resume after a failure, same-version rebuilds, and upgrade reconfiguration. The install wizard also gained release channels (stable / beta / nightly), URL validation, and a PostgreSQL preflight check. See Automatic install.
• Same-origin front-end. The daemon now serves the front-end SPA from the same origin as the API, controlled by the new web_dir config — no separate static host required.
• Sample pages with multi-run aggregation. The web UI now has dedicated sample pages that aggregate results across every analysis run for a given hash, with a sample-aware sidebar, deferred report loading, and a section that surfaces failed plugins.
• Hash lookup, rescan, and workbench. Look up a sample by hash from the dashboard, trigger a rescan, and use the new workbench for ad-hoc inspection. Settings have been reorganized to match.
• Context menu, transforms, and inline editor. Right-click any value in a report to copy it, preview it, pipe it through transforms, or open it in the new CodeMirror-based editor.
• Paginated tasks and submissions. The dashboard and submissions views now use cursor-based pagination, so large task lists stay responsive.
• Richer report viewer. The report view has a faster hex viewer, syntax-highlighted code blocks, and modular components that load only what you scroll to. A top-of-page navigation progress bar shows route transitions.
• Persistent plugin reports and verdicts. The scheduler now records plugin reports and a sample-level verdict after each run, and the HTTP API exposes aggregated task and sample reports.

​

Updates

• malboxctl renamed to malboxd. The administration binary introduced in the May 15 release has been renamed: the standalone daemon is now malboxd, and admin commands have moved into malbox daemon .... Update any scripts that call malboxctl directly.
• Database configuration uses discrete fields. daemon.toml now takes host, port, user, and password for the database instead of a single URL. The database name is no longer required in the URL, and the default development database has been renamed from malbox_db to malbox.
• Typed config defaults and MALBOX_CONFIG override. Default values are now strongly typed, and you can point the daemon at any config file via the MALBOX_CONFIG environment variable.
• Non-interactive installs. The install script now supports curl | bash–style runs cleanly, pins the gum dependency, and treats checksum verification failures as fatal.
• More resilient daemon startup. The daemon cleans up stale iceoryx2 IPC resources at startup to prevent corruption across restarts, restores SIGTERM handling, and loads its config lazily so first-run commands work before the config exists.
• Standalone Images and Machines pages removed. Those views have been folded into the new settings and sample flows; file uploads now redirect to the existing sample page when a file has already been submitted.
• Deprecated native provisioner removed. The native provisioner and the in-development provider-xen feature have been dropped from the default configuration.

​

Bug fixes

• Fixed a duplicate header and a stuck systemd step in the installer’s progress renderer.
• Fixed install and upgrade flows on fresh machines so a clean host reaches a working install reliably.
• Fixed the install script leaving temp directories behind on some exit paths.
• Fixed the CodeMirror editor being recreated on every keystroke, which caused input lag in the workbench and recipe editors.
• Fixed an SSR build failure caused by eager zlibjs loading.
• Fixed hash digests being rendered without leading zeros in some views.
• Fixed first-run CLI commands failing because the daemon config was loaded eagerly.

​

Bug fixes

• Release artifact packaging. Fixed the release pipeline so the new malbox and malboxctl binaries are correctly bundled in published release archives. If you grabbed a release build earlier this week, re-download to pick up the fix.

​

Updates

• Front-end cleanup. Removed an unused, deprecated score bar component left over from the report UI redesign. No visible changes — the new report layout introduced last week remains the default.

​

New features

• Python plugin SDK. You can now write host plugins in Python using the new SDK with PyO3 bindings, alongside the existing Rust and C++ options. See the Python plugin guide.
• Automatic installer. A new install script (powered by amber) plus a bare-metal installer crate make it easier to get Malbox running on a fresh host. See Automatic install.
• New CLI binaries. The old malbox-cli has been replaced by two focused binaries: malbox for everyday use and malboxctl for administration.
• Redesigned report UI. Reports now feature score cards, a threat overview, artifact previews, and richer visualization blocks for faster triage.
• Submission configuration modal. Configure analysis options directly from a new submission modal in the web UI, and cancel running tasks from the task view.
• Snapshots API coverage. The front-end now exposes snapshot management end-to-end.
• New plugin event handlers. Host plugins can subscribe to events and results and react with an on_result handler. See Event hooks.
• More example plugins. The plugin examples have been refreshed for the new SDK API, with additional samples to learn from.
• Release checksums. Release binaries now ship with SHA256 checksums for verification.

​

Updates

• C++ SDK refresh. The C++ plugin SDK has been updated to match the latest native SDK surface. See Creating a C++ plugin.
• Polished CLI output. Tables auto-fit your terminal width, branded colors are applied across commands, and selection prompts are now interactive.
• More reliable scheduler. Plugin execution failures are tracked explicitly, and sample paths are resolved more reliably so tasks fail loudly instead of silently.
• Faster, more reliable plugin runtime. The host plugin runtime has been rewritten around an event-driven loop, and the guest plugin lifecycle and IPC layer have been reworked for better stability under load.
• Stricter configuration. Configuration files now reject unknown fields, so typos surface immediately instead of being silently ignored. See Plugin configuration.
• Improved logging. Plugin runtime logs are more informative when things go wrong.

​

Bug fixes

• Fixed plugin launch failures not being surfaced clearly; report score values are now clamped to valid ranges.
• Fixed several plugin transport issues: event mapping, chunked-payload flags, and payload encoding.
• Fixed Python plugin SDK error handling and added a context validity guard.
• Fixed C++ plugin SDK health check defaults and FFI error propagation.
• Fixed a potential deadlock when spawning guest plugins.
• Fixed missing created_at / updated_at fields on sample records.
• Renamed the CLI --format flag to --image-format to avoid a conflict — update your scripts accordingly.
• Fixed C++ codegen producing invalid empty vector initializers.
• Fixed the result content proxy path in the front-end.