chore(release): bump microsandbox to 0.7.7

[appcypher]

TL;DR

Prepare microsandbox 0.7.7 from 0.7.6, including the merged command-tree controls and the other fixes on main.

Description

• Align the Rust workspace, four shared TypeScript packages, Node platform packages, Go version constant, Ruby gem and extension, and TypeScript examples at 0.7.7; Python inherits the workspace version.
• Regenerate Cargo.lock and the active npm workspace lockfiles without changing third-party dependency versions.
• Advance MCP and skills to their signed 0.7.7 companion commits. Skills: chore(microsandbox): bump release reference to 0.7.7 skills#43. MCP: chore(release): bump mcp to 0.7.7 microsandbox-mcp#44.
• The Node lockfile contains updated root and local workspace metadata; npm removes the five old native package entries because 0.7.7 is unpublished. CI already prunes these dependencies and supplies locally built native packages for smoke tests; release.yml refreshes registry tarballs and integrity hashes after publication.
• Preserve the Ruby standalone registry lockfile, legacy nested shared-types lockfile, and example lockfiles according to the release workflow. Ruby's registry graph is refreshed after publication.

Changelog since 0.7.6

• Add command-tree depth limits and commands-only/brief output, with -L, -C, and -b short forms (feat(cli): add command tree depth and display controls #1759).
• Add storage usage reporting, cache cleanup, and CLI improvements (feat(storage): add cache cleanup, usage reports, and CLI polish #1637).
• Add outbound proxy configuration and optional guest clock synchronization (feat(network): add HTTP CONNECT outbound proxy #1508, feat(runtime): add option to disable guest clock sync #1707).
• Fix snapshot archive imports, restored resource reporting, and removal of sandboxes that never started (fix(snapshot): regenerate image VMDK descriptor on archive import #1712, fix(snapshot): accept reordered image metadata when importing an archive #1744, fix(sdk): read restored resource targets while the sandbox is still starting #1741, fix(sdk): allow removing a sandbox that never started #1724).
• Fix secret handling and SDK adapters, report rejected control operations more clearly, and reject symlinked bind-mount roots earlier (fix(sdk): prevent secret leaks and correct adapter behavior #1756, fix(control-client): include the peer's message in rejected operation errors #1757, fix(sdk): report symlinked bind mount roots at create time #1734).
• Reduce paused sandbox host CPU, improve published-port routing and TCP response draining, apply exec limits before switching users, and correct SFTP ownership (perf(runtime): reduce paused sandbox host cpu #1755, fix(network): publish ports without host routes #1754, fix(network): drain TCP responses before closing #1726, fix(agentd): apply exec limits before switching users #1746, fix(ssh): create SFTP files and directories as the session user #1713).
• Update firmware to Linux 6.12.111, parallelize Ruby builds, fix the NAT64 API schema, and refresh dependencies and documentation (fix(runtime): update libkrunfw to Linux 6.12.111 #1740, build(ruby)!: parallelize builds for supported ruby versions #1728, fix(types): give nat64_prefixes a utoipa schema #1729, chore(deps): Bump the "dependencies" group with 2 updates across multiple ecosystems #1718, chore(deps): bump the cargo group across 1 directory with 1 update #1719, chore: refresh lockfiles after v0.7.6 #1723, build: allow deprecated fetch_update for rust 1.99 #1725, chore(deps): bump pageant from 0.2.1 to 0.2.2 in /sdk/ruby/ext/microsandbox in the cargo group across 1 directory #1752).

Test Plan

• Verify all 22 microsandbox Rust packages report 0.7.7, SDK/package references align, Cargo.lock changes only 25 workspace versions, and npm lockfile changes are limited to release metadata/native entries.
• cargo fmt --all -- --check, git diff --check, python3 scripts/ci/test_bump_version.py, and cargo check --workspace --locked --offline.
• cargo clippy --workspace --locked --offline -- -D warnings and cargo run -p microsandbox-types --features ts --bin microsandbox-types-generate --locked --offline -- --check.
• cargo test --workspace --locked --offline -- --test-threads=1 (4,321 passed, 182 ignored).
• Shared packages: npm run build, npm run typecheck, and npm test; Node SDK: CI optional-dependency pruning/install, npm run build:ts, npm run typecheck, and npm run test:unit (335 passed, 1 skipped).
• Python: maturin develop --locked --offline and python -m pytest -q (279 passed, 3 skipped); Go: go test -count=1 .; MCP: npm test against the candidate SDK (21 passed).
• cargo publish -p microsandbox-types-macros --dry-run --allow-dirty --no-verify and Ruby gem/Cargo exact-pin alignment checks.
• Live VM and cross-platform release smoke tests (CI/required fixtures); Ruby native build (local Ruby is 2.6, below the supported ABI range).

Rust validation used an isolated MSB_HOME and existing local runtime artifacts through MSB_EMBED_ARTIFACTS_DIR. The initial parallel SDK test run hit runtime-probe timeouts, so the complete workspace suite was rerun serially. Native registry publication and post-publication lockfile refreshes remain part of the release workflow.

Confidence Score: 5/5

The version bump appears safe to merge based on the checked release paths.

What we checked:

• Node checks without native packages: The checks remove the optional native packages from both Node files before running npm ci. The release regenerates the full lockfile after publication.

_{Reviews (1) · Last reviewed commit: "chore(release): bump microsandbox to 0.7..."}