Changelog

• 81cef80 harness-runtime: opt into manage_model_access_key across the config/session create commands (#2114)
• a4e5efe MARSOHS-2084: --region on harness-runtime selects the regional API host (#2065)
• 594c5e8 Add doctl insights dashboard commands (#2102)
• 963718f agents: accept egress deny-all (none / empty allowlist) in manifest validation (#2031)

Changelog

• 7e22058 microvm: access-token create, list, and revoke (MDROP-630) (#2092)

Changelog

• ce33fbc auth: point sign-in hints at doctl auth login (#2098)
• 783d252 auth: print the agent setup prompt after login (PDOCS-4939) (#2087)
• a5b98dd fix(MARSOHS-1935): require --force to delete a workspace without a terminal, list the workspace id (#2103)
• 4e5e5c5 Updating images for oauth screens (#2101)
• 63bac20 feat(MARSOHS-1935): add persistent workspace commands to harness-runtime (#2018)
• e190c73 agents: add connections reconnect (AR-3404, MARSOHS-2177) (#2086)
• df15a9b agents: revoke a connection by actor (MARSOHS-2183) (#2094)
• a5fc66c Updating OAuth success page (#2090)
• c34b17c Document AMD and DigitalOcean token checks in auth init (#2091)

Changelog

• 4e5e5c5 Updating images for oauth screens (#2101)
• 63bac20 feat(MARSOHS-1935): add persistent workspace commands to harness-runtime (#2018)
• e190c73 agents: add connections reconnect (AR-3404, MARSOHS-2177) (#2086)
• df15a9b agents: revoke a connection by actor (MARSOHS-2183) (#2094)
• a5fc66c Updating OAuth success page (#2090)
• c34b17c Document AMD and DigitalOcean token checks in auth init (#2091)

Changelog

• a4bc101 agents: add the hermes harness (Hermes gateway) (MARSOHS-2451) (#2083)
• 95b204d agents: canvas <session> serves the session's Agent Canvas UI through a local token-adding proxy (#2082)
• 9379c12 FI-688: --environment-id flag and EnvironmentID column (#2066)
• 92ad7fe microvm: add --egress-allow and --egress-default-action to create (MDROP-608) (#2078)
• 17b4bb2 agents: show connection deletion protection (MARSOHS-2173) (#2059)

Changelog

• 39b6921 Built with Go 1.26.10 to address CVE-2026-111943 (eMudhra intermediate CA trust mitigation) (#2080)
• Add microvm upload/download commands- #2079

Changelog

• a17e669 pin godo to v1.232.0-beta.1
• d966540 harness-runtime: add hr as a short alias (#2070)
• cb0b82e agents: accept the harness key and agent: sandbox for bare sandboxes (#2046)
• 10ba27c deviceid: stamp X-Device-UUID under /v2/harness-runtime as well as /v2/agents (#2071)
• fa4632a fix(FI-649): update for string dialogue ID from signals-api (#2069)
• 813301f Add Insights CLI commands (#2067)
• d0db360 microvm: ingress URL add/remove/list + create opt-out (MDROP-596) (#2060)
• 07bd33c Update godo to v1.229.0 (#2062)
• ad0d6d6 MARSOHS-2171: stream MARS Exec output over SSE (#2042)
• d74d475 agents: give --harness openhands a DigitalOcean Inference key and a DO model by default (#2058)
• 9f8bce1 agents: explain why connections list omits revoked (MARSOHS-2175) (#2055)
• 81c92a8 agents: stop waiting on expired or revoked connections (MARSOHS-2174) (#2054)
• 8582c39 agents: add the openhands harness (OpenHands Agent Server) (#2048)
• 247c89f Update godo to v1.227.0 (#2052)
• 64ae746 add support for gpu-operator-ready flag on k8s clusters (#2051)

Changelog

• 902ac13 Merge branch 'prao/MARSOHS-1935/fix.agent-kind-display-names' into prao/MARSOHS-1935/feat.workspaces
• b5df53c fix(MARSOHS-1935): show Hermes, LangGraph and CrewAI as agent names
• 813301f Add Insights CLI commands (#2067)

Changelog

• cb30ccf Merge remote-tracking branch 'origin/main' into prao/MARSOHS-1935/feat.workspaces
• d0db360 microvm: ingress URL add/remove/list + create opt-out (MDROP-596) (#2060)
• 07bd33c Update godo to v1.229.0 (#2062)
• 432a54b feat(MARSOHS-2336): rename the workspace size flag to --size-limit-gib
• 7a6f00b Merge remote-tracking branch 'origin/main' into prao/MARSOHS-1935/feat.workspaces
• ad0d6d6 MARSOHS-2171: stream MARS Exec output over SSE (#2042)
• d74d475 agents: give --harness openhands a DigitalOcean Inference key and a DO model by default (#2058)
• 9f8bce1 agents: explain why connections list omits revoked (MARSOHS-2175) (#2055)
• 81c92a8 agents: stop waiting on expired or revoked connections (MARSOHS-2174) (#2054)
• 8582c39 agents: add the openhands harness (OpenHands Agent Server) (#2048)
• 247c89f Update godo to v1.227.0 (#2052)
• 64ae746 add support for gpu-operator-ready flag on k8s clusters (#2051)
• ef740e1 Merge remote-tracking branch 'origin/main' into prao/MARSOHS-1935/feat.workspaces
• 759a88c feat(MARSOHS-1935): workspace delete goes ahead without --force when there is no terminal
• cb11bba build(MARSOHS-1935): bump godo to v1.220.0
• a31fd00 Merge remote-tracking branch 'origin/main' into prao/MARSOHS-1935/feat.workspaces
• 59e0739 feat(MARSOHS-1935): list DELETING as a workspace state in the help text
• 9f63146 feat(MARSOHS-1935): add --state to harness-runtime workspace list
• c3688d8 fix(MARSOHS-1935): show the server's message for a workspace conflict
• fa8ffc4 refactor(MARSOHS-1935): attach a workspace only when creating from a config
• d3b6d6c feat(MARSOHS-1935): add persistent workspace commands to harness-runtime

What's Changed:

Cleaner terminal experience

• doctl now understands your terminal better — colour, width, and plain text when you’re piping or running in CI — so output stays readable whether you’re in a terminal or a script.

Clearer flag errors

• Missing or invalid flags are caught before the API is called, with plain-language messages and hints on what to fix.

Better waiting on long operations

• Commands that use --wait share one consistent progress style. There’s a timeout (default 30 minutes) so a wait can’t hang forever, and failed operations are reported as failures. Progress goes to stderr so piping still works.

Welcome when you run doctl

• Running doctl with no arguments shows a short welcome: version, account, team, context, and a few next steps — plus a note if a newer version is available. Use doctl --help for the full command list.

Safer auth config

• auth switch and auth remove no longer rewrite your whole config file. Environment tokens are no longer accidentally saved to disk.
  If you’ve used doctl in CI with DIGITALOCEAN_ACCESS_TOKEN set, check your config file and rotate the token if it was saved there.

Masked secrets by default

• Secret values and database passwords (including those inside connection strings) are masked in terminal output. Pass --show to reveal them. In CI, values are still returned unmasked so scripts keep working without the flag.

Clearer errors

• Failures now show a short title, why it failed, status when relevant, and a next step when one helps. Request IDs are included when the API provides them. Typos in nested commands (for example under compute) now exit with an error instead of looking like success.

Styled help

• --help uses a consistent, easier-to-scan layout across commands, with examples highlighted.