v0.9.121

Compared HEAD and the working tree with v0.9.120; generated-file churn and test-only changes are excluded.

Breaking Changes

Sandbox project openUrl is now optional. Consumers must handle projects created with route: false.
SshRouteRegistry.handleUpgrade() is now asynchronous; callers must await it.
Removed desktop.desktopScript(). Use the built-in desktop service lifecycle instead.

Features And Fixes

Added route-less Sandbox projects and typed serviceDependencies, with controls in the project manager and a Desktop shortcut in the machine indicator.
Built-in terminal, desktop, and stats services use persisted, machine-owned lifecycle definitions, distributed startup locks, and readiness checks.
Fixed shared-machine route authorization and expiry handling. Expired assignments are cleaned up without deleting machines still assigned to active users; SSH session replacement preserves draining connections.
Reserved built-in service ports to prevent project conflicts, and stopped built-in services before machine shutdown.
CLI fields with helpDefault: false defer configuration loading until parsing. Authentication options retain their CLI metadata.
Demo deployment accepts default environment/configured credentials; --demo-deploy no longer requires --profile. An explicit profile override applies only to that deployment.

Validation

The configured release validation phase completed before this review, as provided. Detailed results and counts were not supplied.
No tests or additional validation commands were run. No files were modified.