## [not yet released]

## 0.11.0

### Enhancements

- exec: gains `--assume-role` option to call `sts:AssumeRole` using vended credentials from remote server. This allows to use the first-hop credential as a jump role for a final IAM role. [#44](https://github.com/sorah/mairu/pull/44), [#42](https://github.com/sorah/mairu/pull/42)

### Bug fixes

- aws-sso: was always re-registering OAuth 2.0 dynamic client when logging in. Now consent prompt is only shown at the first login. [#43](https://github.com/sorah/mairu/pull/43)
- aws-sso: was failing on a machine using a hostname with non-ASCII characters. [#45](https://github.com/sorah/mairu/pull/45)

## 0.10.0

### Enhancements

- exec: Recognises `$MAIRU_SERVER` environment variable in addition to `--server` CLI argument  [#38](https://github.com/sorah/mairu/pull/38)

### Miscellaneous

- Rust edition upgraded to 2024 [#34](https://github.com/sorah/mairu/pull/34)
- Rolled Rust dependencies to latest versions (16 Dec 2025) [#35](https://github.com/sorah/mairu/pull/35)
- `daemonize` crate used for daemonizing agent process was replaced with `daemonix` due to [RUSTSEC-2025-0069](https://rustsec.org/advisories/RUSTSEC-2025-0069) [#37](https://github.com/sorah/mairu/pull/37)
- https://crates.io/crates/mairu now published via GitHub Actions and Trusted Publishing [#40](https://github.com/sorah/mairu/pull/40)

## 0.9.0

### Enhancements

- kill-agent: New subcommand `mairu kill-agent` stops the running agent process. This is useful when upgrading mairu. [#31](https://github.com/sorah/mairu/pull/31)
- oauth_code: OAuth 2.0 callback page gained a dark mode and enabled when a browser configured to prefer dark mode. [#32](https://github.com/sorah/mairu/pull/32)

### Miscellaneous

- readme: Installation methods are reorganized.
- Rolled Rust dependencies to latest versions (21 Aug 2025) [#33](https://github.com/sorah/mairu/pull/33)


## 0.8.0

- login: during OAuth 2.0 Authorization Code flow, mairu now shows localhost URL that redirects to an actual authorize url. This allows to show shorter URLs, which ease opening URLs by avoiding line wrapping.

## 0.7.0

- redirect_uri endpoint returns fancier HTML page during OAuth 2.0 Authorization Code flow.
- New subcomand `mairu list-roles` lists possible `role` parameter for a server. Corresponding HTTP API is added to the spec.
- `mairu` command now suggets user to restart agent when a connected agent reports different version.

## 0.6.0

- New subcomand `mairu show` dumps informations about 'auto' role.

## 0.5.1

- debian: Debian package was missing `setcap` call on post installation, which results into mlockall failure on `mairu agent`.

## 0.5.0

- `mairu login` uses `$MAIRU_LOCAL_PORT` environment variable for a port number when listening to callback. Takes precedence over a server configuration.

## 0.4.0

- Support OAuth 2.0 Authorization Code Grant without client secret; It's safe because we always use PKCE, and expects your authorization server to enforce PKCE.
- `.oauth.code_grant` server configuration gains `use_localhost` flag, which forces redirect_uri to be `http://localhost:.../oauth2callback` instead of `http://127.0.0.1:.../oauth2callback`. This is required for some authorization servers, e.g. Microsoft + Mairu as a public client.
- `mairu list-sessions` command now indicates sessions with an OAuth refresh token.
- `mairu list-sessions` command now shows expiry in a local time by default. It also gains `--utc` to revert to the previous behaviour which shows expiry in UTC.

## 0.3.1

- AWS SSO: fix failure on device code flow. This requires re-registration of OAuth 2.0 dynamic client (which is performed automatically).

## 0.3.0

- agent: Ensure runtime_dir (to create a socket) is only writable by owner (0700) https://github.com/sorah/mairu/pull/19

### Breaking changes

- Agent socket location is changed to state_dir `~/.local/state/mairu/run` on platforms without XDG_RUNTIME_DIR (e.g. macOS)

## 0.2.0

- Fix crash on macOS https://github.com/sorah/mairu/pull/14
- Support generic OAuth 2.0 Device Authorization Grant (RFC 8628)  https://github.com/sorah/mairu/pull/15
- Support generic token refresh using refresh_token grant type https://github.com/sorah/mairu/pull/16
- AWS SSO: Support OAuth 2.0 Authorization Code Grant  https://github.com/sorah/mairu/pull/17  https://github.com/sorah/mairu/pull/18

## 0.1.0

- Initial release
