> ## Documentation Index
> Fetch the complete documentation index at: https://docs.malbox.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Changelog

> Release notes for Malbox covering new features, plugin SDK updates, CLI changes, UI improvements, and bug fixes shipped each week.

<Update label="June 19, 2026" tags={["maintenance"]}>
  ## Updates

  * **Polished installer and upgrade output.** The install and upgrade flows now use a branded theme with phase dividers (for example, separate **Configuration** and **Reconfiguration** sections during `malbox daemon upgrade --reconfigure`) so it's easier to see where you are in the run. See [Automatic install](/installation/automatic).
  * **Structured non-TTY install logs.** When the installer isn't attached to a terminal (CI, `curl | bash`, log files), each line is now prefixed with a timestamp and a `[step/total]` counter so progress is easy to follow and grep.
  * **Recovery hints on failed steps.** If an install, upgrade, or rollback step fails, the renderer now prints a short hint with the exact command to retry (for example, `malbox daemon upgrade --rollback` or `systemctl --user start malbox`) directly under the failure.

  A quiet week of installer UX polish on top of the [June 18 release](/changelog#june-18-2026).
</Update>

<Update label="June 18, 2026" tags={["release"]}>
  ## New features

  * **Unified `malbox` CLI with daemon subcommands.** Administration has moved under `malbox daemon`, alongside the everyday submission commands. Use `malbox daemon install`, `malbox daemon upgrade`, `malbox daemon start`, `malbox daemon plugin`, `malbox daemon provider`, and `malbox daemon config` — one binary covers user and admin workflows. See the [`malbox` reference](/reference/cli/malbox).
  * **Standalone `malboxd` daemon.** A new `malboxd` binary runs the daemon on its own (for example, under systemd) without going through the CLI wrapper.
  * **Plugin registry and management commands.** A new plugin registry lets you install, update, search, list, remove, and inspect host plugins from a configured registry. Configure sources under the new `[plugins.registry]` section in `daemon.toml` — see [Plugin configuration](/reference/configuration/plugins) — and drive it from `malbox daemon plugin install|update|list|search|remove|info`.
  * **Provider install / uninstall / rebuild.** Manage machinery providers from the CLI with `malbox daemon provider install`, `uninstall`, and `rebuild`, including non-interactive flows for automation.
  * **Installer overhaul.** The installer now provisions the PostgreSQL database for you at install time, supports install resume after a failure, same-version rebuilds, and upgrade reconfiguration. The install wizard also gained release channels (stable / beta / nightly), URL validation, and a PostgreSQL preflight check. See [Automatic install](/installation/automatic).
  * **Same-origin front-end.** The daemon now serves the front-end SPA from the same origin as the API, controlled by the new `web_dir` config — no separate static host required.
  * **Sample pages with multi-run aggregation.** The web UI now has dedicated sample pages that aggregate results across every analysis run for a given hash, with a sample-aware sidebar, deferred report loading, and a section that surfaces failed plugins.
  * **Hash lookup, rescan, and workbench.** Look up a sample by hash from the dashboard, trigger a rescan, and use the new workbench for ad-hoc inspection. Settings have been reorganized to match.
  * **Context menu, transforms, and inline editor.** Right-click any value in a report to copy it, preview it, pipe it through transforms, or open it in the new CodeMirror-based editor.
  * **Paginated tasks and submissions.** The dashboard and submissions views now use cursor-based pagination, so large task lists stay responsive.
  * **Richer report viewer.** The report view has a faster hex viewer, syntax-highlighted code blocks, and modular components that load only what you scroll to. A top-of-page navigation progress bar shows route transitions.
  * **Persistent plugin reports and verdicts.** The scheduler now records plugin reports and a sample-level verdict after each run, and the HTTP API exposes aggregated task and sample reports.

  ## Updates

  * **`malboxctl` renamed to `malboxd`.** The administration binary introduced in the [May 15 release](/changelog#may-15-2026) has been renamed: the standalone daemon is now `malboxd`, and admin commands have moved into `malbox daemon ...`. Update any scripts that call `malboxctl` directly.
  * **Database configuration uses discrete fields.** `daemon.toml` now takes `host`, `port`, `user`, and `password` for the database instead of a single URL. The database name is no longer required in the URL, and the default development database has been renamed from `malbox_db` to `malbox`.
  * **Typed config defaults and `MALBOX_CONFIG` override.** Default values are now strongly typed, and you can point the daemon at any config file via the `MALBOX_CONFIG` environment variable.
  * **Non-interactive installs.** The install script now supports `curl | bash`–style runs cleanly, pins the `gum` dependency, and treats checksum verification failures as fatal.
  * **More resilient daemon startup.** The daemon cleans up stale iceoryx2 IPC resources at startup to prevent corruption across restarts, restores SIGTERM handling, and loads its config lazily so first-run commands work before the config exists.
  * **Standalone Images and Machines pages removed.** Those views have been folded into the new settings and sample flows; file uploads now redirect to the existing sample page when a file has already been submitted.
  * **Deprecated `native` provisioner removed.** The `native` provisioner and the in-development `provider-xen` feature have been dropped from the default configuration.

  ## Bug fixes

  * Fixed a duplicate header and a stuck systemd step in the installer's progress renderer.
  * Fixed install and upgrade flows on fresh machines so a clean host reaches a working install reliably.
  * Fixed the install script leaving temp directories behind on some exit paths.
  * Fixed the CodeMirror editor being recreated on every keystroke, which caused input lag in the workbench and recipe editors.
  * Fixed an SSR build failure caused by eager `zlibjs` loading.
  * Fixed hash digests being rendered without leading zeros in some views.
  * Fixed first-run CLI commands failing because the daemon config was loaded eagerly.
</Update>

<Update label="May 17, 2026" tags={["maintenance"]}>
  ## Bug fixes

  * **Release artifact packaging.** Fixed the release pipeline so the new `malbox` and `malboxctl` [binaries](/changelog#may-15-2026) are correctly bundled in published release archives. If you grabbed a release build earlier this week, re-download to pick up the fix.

  ## Updates

  * **Front-end cleanup.** Removed an unused, deprecated score bar component left over from the [report UI redesign](/changelog#may-15-2026). No visible changes — the new report layout introduced last week remains the default.

  A quiet week otherwise, focused on internal cleanup and documentation polish following the May 15 release. Larger product changes resume next week.
</Update>

<Update label="May 15, 2026" tags={["release"]}>
  ## New features

  * **Python plugin SDK.** You can now write host plugins in Python using the new SDK with PyO3 bindings, alongside the existing Rust and C++ options. See the [Python plugin guide](/plugin-guides/creating-a-python-plugin).
  * **Automatic installer.** A new install script (powered by amber) plus a bare-metal installer crate make it easier to get Malbox running on a fresh host. See [Automatic install](/installation/automatic).
  * **New CLI binaries.** The old `malbox-cli` has been replaced by two focused binaries: `malbox` for everyday use and `malboxctl` for administration.
  * **Redesigned report UI.** Reports now feature score cards, a threat overview, artifact previews, and richer visualization blocks for faster triage.
  * **Submission configuration modal.** Configure analysis options directly from a new submission modal in the web UI, and cancel running tasks from the task view.
  * **Snapshots API coverage.** The front-end now exposes snapshot management end-to-end.
  * **New plugin event handlers.** Host plugins can subscribe to events and results and react with an `on_result` handler. See [Event hooks](/plugin-system/event-hooks).
  * **More example plugins.** The plugin examples have been refreshed for the new SDK API, with additional samples to learn from.
  * **Release checksums.** Release binaries now ship with SHA256 checksums for verification.

  ## Updates

  * **C++ SDK refresh.** The C++ plugin SDK has been updated to match the latest native SDK surface. See [Creating a C++ plugin](/plugin-guides/creating-a-cpp-plugin).
  * **Polished CLI output.** Tables auto-fit your terminal width, branded colors are applied across commands, and selection prompts are now interactive.
  * **More reliable scheduler.** Plugin execution failures are tracked explicitly, and sample paths are resolved more reliably so tasks fail loudly instead of silently.
  * **Faster, more reliable plugin runtime.** The host plugin runtime has been rewritten around an event-driven loop, and the guest plugin lifecycle and IPC layer have been reworked for better stability under load.
  * **Stricter configuration.** Configuration files now reject unknown fields, so typos surface immediately instead of being silently ignored. See [Plugin configuration](/reference/configuration/plugins).
  * **Improved logging.** Plugin runtime logs are more informative when things go wrong.

  ## Bug fixes

  * Fixed plugin launch failures not being surfaced clearly; report score values are now clamped to valid ranges.
  * Fixed several plugin transport issues: event mapping, chunked-payload flags, and payload encoding.
  * Fixed Python plugin SDK error handling and added a context validity guard.
  * Fixed C++ plugin SDK health check defaults and FFI error propagation.
  * Fixed a potential deadlock when spawning guest plugins.
  * Fixed missing `created_at` / `updated_at` fields on sample records.
  * Renamed the CLI `--format` flag to `--image-format` to avoid a conflict — update your scripts accordingly.
  * Fixed C++ codegen producing invalid empty vector initializers.
  * Fixed the result content proxy path in the front-end.
</Update>