v1.4.2

Changelog

• 6229d4e Release 1.4.2
• 61add41 Fix what a sixth full review found
• f295ea1 Fix what a fifth full review found
• 6083e21 Count the oracle's skipped lines on a host without timeout
• 0594f92 Fix what a fourth full review found
• c3dcc44 Fix what a third full review of 1.4.1 found

v1.4.1

Changelog

• 9a4fc3c Release 1.4.1
• fcf928d Fix what a full review of 1.4.0 found

v1.4.0

Changelog

• ae03ae7 Release 1.4.0
• 5a7fa8e Treat bash -lc as conditional in the real-shell oracle
• dde481d Close the launch rough edges: a shell-aware hook, tool-mode guidance, file-watch polling, Linux
• 4a88bd0 Reclaim Claude Code's per-directory scratch for eval repos in clean-evals

v1.3.0

Added

• network.allow_hosts accepts addresses, CIDR blocks (10.0.0.0/8, IPv6 too) and inclusive
  address ranges (10.0.0.10-10.0.0.40), enforced by smolvm as address rules on every port.

Changed

• A wildcard (*.example.com) or a port (host:443) in network.allow_hosts is now an error at
  load. smolvm accepted a wildcard and then allowed nothing, so a sandbox that looked configured
  could reach none of those hosts. A port was refused by smolvm at create.

Fixed

• pkg/boxer Delete also removes the run record, last-used stamp, lock and URLs, as
  boxer rm does. It used to delete only the machine.

Tested before release: release gate on macOS and Ubuntu; smoke on smolvm (101/0), docker, Apple container and podman (90/0/11 each); eval-t1 68/0/1; eval-t2 40/3/14, matching the 1.1.0 record.

Full changelog: https://github.com/BarakChamo/boxer/blob/main/CHANGELOG.md

v1.2.0

Added

• start services are supervised. A service that exits non-zero is restarted after 1 s, then 2, 4
  and up to 30 s. After five quick crashes in a row, boxer stops and the start log says so.
  restart = "never" turns it off. Each restart is a line in /tmp/boxer-start.log.
• boxer restart stops the start services and launches them again without recreating the
  sandbox.
• volumes = ["name:/guest/path"]: named directories kept on the host per scope and mounted
  read-write. They survive rm, --recreate and idle reclaim, and are deleted with their worktree
  by gc, or by boxer rm --volumes. Tested with Postgres on smolvm, including crash recovery
  after a kill -9.
• idle_action = "stop" | "delete" chooses what idle reclaim does to a sandbox whose worktree still
  exists.
• build = "Dockerfile" and build_context. boxer builds the Dockerfile on the host and boots the
  result. docker, podman and Apple container build into their own store. smolvm boots a
  docker save archive built by the host's docker. devcontainer build.dockerfile and dockerFile
  now map to it instead of being refused.
• [network] allow_presets expands npm, yarn, pypi, crates, rust, go, rubygems, maven, gradle,
  debian, alpine and github into the hosts each one needs.
• intercept_also adds programs to the default intercept list without restating it. boxer doctor suggests it for Ruby and JVM projects.
• boxer uninstall <harness>|all|git|conductor [--user] removes what boxer install wrote. Files
  boxer merged into keep everything else.
• pkg/boxer: ListAll lists sandboxes on every installed backend, with the new
  Machine.Backend field. Ports and URLs read a machine's forwarded ports and their URLs.
• Smoke cells for supervision, boxer restart, volumes, build, presets and file watching. File
  watching was measured on each backend. On Apple container and on podman on a Mac, host edits do
  not reach inotify, and the troubleshooting guide gives the polling fix.

Changed

• Idle reclaim now stops a sandbox whose worktree still exists, instead of deleting it. Set
  idle_action = "delete" for the 1.1 behaviour.

Fixed

• The test suite's fake smolvm isolates boxer's state directory itself. A test that used the fake
  without a repository wrote a fake pack into the developer's real pack cache.
• A local image archive on smolvm no longer tries to build a pack at every create. smolvm refuses
  to pack an archive, so each create printed the refusal and paid for the attempt.

Full changelog: https://github.com/BarakChamo/boxer/blob/main/CHANGELOG.md

v1.1.0

Changelog

• a8567ae Give first boots ten minutes in the session-start hook, and close the second-round doc gaps
• 5fa1912 Finish the remaining simulation findings for 1.1.0
• d8dacb2 Re-run setup on every --rebuild, and document where setup must install
• 72eaf8f Fix the four release blockers the setup simulations found
• 562f11b Keep the two config keys 1.0 accepted loading, as the 1.0 contract requires
• e6872f1 Parse pkg/boxer file by file in its docs test; ParseDir is deprecated
• 6f1c382 Test that every CLI flag, config key and Go API is in its reference page
• 7467892 Stamp the test's egress denial during the command, not just before it
• 4f53796 Frame boxer as a sandbox per workstream, as a microVM or a container
• 92c676e Cut copy that says nothing or talks down to the reader
• cf3ddd5 Give every kind of reader a path into the docs
• 4de93ac Merge boxer's hooks into .codex/hooks.json and .dsh/hooks.json instead of overwriting them
• 22d0e32 Make the case for boxer on the homepage, README and intro
• 79f6534 Explain the automatic path: install once, and every worktree gets its own sandbox
• b44fd79 Give the watch test's cleanup a write to fail on
• 725f867 Reorganise the docs around how a developer adopts boxer, and rewrite them plainly
• 4945cfe Test that watch stops in both output forms when every write fails
• b60e268 End boxer watch when its reader goes away
• 96fe049 Raise the internal/vm coverage floor to 65 now that the Apple driver is tested everywhere
• 77c9b7e Stop the container drivers racing on a shared output buffer
• e5f12e0 Build the docs in CI the way Pages does, and cover the Apple driver without its runtime
• 8b1c633 Record that the Pages workflow's action pins were checked against their tags
• ea6f24c Add a motivation section to the README
• 4f85170 Re-measure the benchmarks on the current build, and test the page against the data
• 34ca729 Resolve the contradictions the docs review left open
• b26fd2a Document boxer for release, and fix what reviewing the docs found
• 28d502a Run boxer on every backend on Linux, and fix what that and the open items found
• 936824e Review the docs as a newcomer would, and fix what that found
• 575b4e0 Run boxer on Linux, fix what that found, and trace the inside-cell flake to a real bug
• 7bd6933 Sweep the docs, rebuild the site around four backends, and add runnable examples
• 183f11a Add four backends, portless URLs, a management CLI, and the evidence for them
• ed8def6 Build the docs site in CI
• 7fec247 Give the user documentation one home instead of two
• 83a5ec2 Split what had grown too big, and write the documentation as a site
• 817addb Support fx, and make the scorecard demanding enough to be worth reading
• 4290ecf Score every claim a cell makes, and widen the matrix to every level
• b2ba220 Record the matrix at full coverage, and show the pane when a prompt hangs
• 98b7cd8 Sandbox the shell a launcher starts, and the worktree a launcher makes
• 93625a8 Add an eval tier that varies the integration level, not the task
• 76e1ed0 Report what each agent actually did, not just whether it passed
• 4b423b9 Record a clean sweep: twelve development lifecycles, all passing
• 28eadab Give each worktree its own port, and finish the lifecycle findings
• 93d6c7b Report twelve development lifecycles and what they found
• c60ee36 Explain an out-of-memory kill, and the forwarded-port origin trap
• a0b496f Add an SDLC tier: can somebody actually develop in one of these?
• 490c09d Prove the agent uses a sandboxed MCP server, and fix what stopped it
• 360045e Split what a pack can cache from what it must not (1.1 Stream A, corrected)
• 54c119b Record the 1.1 gate: T1 68/0/1, smoke 53/53
• b27d17e Mention the devcontainer in the README's configuration section
• 001f0d9 Tell the README how to see what is running and what it costs
• f4a407b Copilot's inside mode is run, not merely listed
• 2e536a9 Put the flow tier in the release gate
• 35c4d69 Put [env] where TOML means it, after the scalar keys
• eab707c Repair a stranded comment in the requirements
• ec247e4 List 1.1's configuration keys in the requirements
• 379cb3e Finish Stream D: resources on status, events in the watch stream
• 514c141 Test the environment cache's drop path and the flow tier's own helpers
• 02627c2 Finish Stream A: a cache you can drop, and one that stays bounded
• e026e65 Record the Copilot guest fix in the status report and changelog
• a3f7572 Make the Copilot inside cell actually work
• 386207f Put an agent in the flow session
• 848d4ef Make the Conductor verification a ten-minute procedure
• 5b9c58f Mark the flow tier done: it passes
• b3c3ae9 Close the Stream G items and record what remains
• 1e02b51 Document the MCP server that runs in the sandbox
• b40e035 Record the flow tier's first passing run
• cc75fa3 Run the Copilot inside cell instead of claiming it
• 9527b83 Show what the service printed when readiness times out
• a81b5e2 Add the flow tier: one development session, end to end (1.1 Stream F)
• 0933f5d Read the devcontainer a repository already has (1.1 Stream C)
• 75d233c Make the core answerable by a user interface (1.1 Stream D)
• 2ae85ce Let a project say what it needs to run (1.1 Stream B)
• b6705f8 Cache the environment, not just the image (1.1 Stream A)
• 50a1fad Rewrite the 1.1 plan as the plan of record
• 19b9779 Plan a flow tier: one real development session, end to end
• b079685 Open no registry for an image that is never pulled
• dfa72fa Propose the 1.1 plan: a development environment, not just a command sandbox
• b06aa12 Say which Conductor settings keys are documented and which are a guess
• b2cedc5 Test what a user meets first: installing, and being in the wrong place

v1.0.0

Changelog

• 4c7c367 Keep the release stamp linkable, and prove it stays that way
• 1fdd766 Test the session an agent actually has, and fix what that found
• 77fd27d Prepare 1.0.0: the changelog entry and the evidence behind it
• 9e5bd86 Record the release gate's own numbers
• af96f81 Cover the automatic sweep in smoke, and stop a pipeline from lying
• bfa1a1e Record the adherence run: four models, 96 live cells, one harness verdict
• a3f0c97 Assert the size formatter without a special case
• 1ad00f1 Reclaim storage without being asked
• 68e2a4e Give the adherence target the models its verdict needs
• 7abe876 Never let a killed harness hang the whole suite
• 62d2282 Report the real version after a go install
• 2a1dd29 Name copilot in the per-harness override list
• 464295d Count the ninth harness in the integration model
• 445951f Quote the runs that actually happened
• d4357ef Delete the implementation plan it said to delete when v1 ships
• b8245e8 Tell the install guide how a harness starts using boxer
• 3773b85 Write down the two publishing steps that need an account
• b996748 Say what branch protection enforces
• 15e11e0 Give the repository its issue and pull-request templates
• 654dcbb Record the release-candidate run in the changelog and status report
• 20ecf3e Record the T1 and T2 runs on the merged tree
• f3f811f Mark a candidate tag as a prerelease

v1.0.0-rc.1

Changelog

• 6a0f72d Never fail a release for want of the Homebrew tap's token
• 64359ad Raise the eval and inside floors to what their new tests reach
• 9ebd756 Share one LastLines instead of copying it into the eval package
• fa2c298 Say what the ACP agent printed before it closed
• 9a283d3 Record that every pinned action SHA was verified against its tag
• c21242f Take the linter action that can install golangci-lint v2
• 7d377a8 Pin CI's linter to the version the config is written for
• 2bff368 Make the linter's gate real: 21 findings, three of them bugs
• 88e7664 Let the detached warm-up test wait for a loaded machine
• 6a0a6aa Build on Go 1.26.6, which closes five standard-library vulnerabilities
• 4ff77c2 Raise the command-line coverage floor to what the new tests reach
• eba4087 Test the three commands that write things people then depend on
• f9e9f58 Give the eval drivers one run loop and one answer parser
• 4ade420 Give the truncated-pack failure a troubleshooting entry
• ac91ab2 Document the skill's scripts, Copilot's user-scope hooks and the event package
• bb9ad62 Count the Copilot view in the smoke suite
• 6cb2fd7 Merge branch 'harnesses': GitHub Copilot CLI, a real herdr driver, Conductor
• f6757ea Keep the local openhands venv symlink out of the tree
• a5f26f0 Record the new cells in the status report
• 0d90f78 Include copilot in boxer install all --user
• e99f8c0 Correct the orchestrator record: herdr, Conductor, Multica
• 2dd1a5c Record the content, task, telemetry and pack changes in the changelog
• 7afa6a6 Never build a sandbox from a pack that is not whole
• 81cd5b2 Drive herdr for real, and ship it a plugin
• 6f79356 Document [tasks] and [telemetry] in the configuration guide
• e97d8dc Merge branch 'runtime': the event stream beside static content and named tasks
• 7c585cc Support GitHub Copilot CLI as a harness
• e669086 Let the npm launcher fetch the binary on first use
• c22c554 Keep the coverage profile out of the repository
• b7f171d Write down what the event stream promises
• f781902 Teach the fake smolvm to be more than one machine
• 3c76360 Track the npm launcher the root gitignore was swallowing
• d2b207f Merge branch 'release'
• 6e13b7e Stop tracking the coverage profile
• acc345b Record the release-engineering slice in the changelog
• 11785ac Restructure the documentation around the reader, not the implementation
• 4801ffa Check the published package in, and write down what it may contain
• a483b9b Publish content that is the same for everyone, and resolve config at run time
• 101e960 Declare named tasks, and let an older binary read a newer boxer.toml
• 58a4946 Stop swallowing the errors that cost the most
• 5b71cb2 Write down what 1.0 promises and how a release is proved
• b549a06 Emit events from the places that decide something
• 549cb8e Exercise the install routes in CI and gate the release on them
• 27ee124 Make the release reproducible, signed, and complete
• 4efa03a Give boxer an event stream, off by default
• 90d0fb3 Ship the npm launcher that package.json already promised
• 3d4a0bd Format vm.go after removing the branch API
• bd2b214 Remove dead code, share the test fixture, name the environment in provenance
• b1af147 Make CI a real gate and add the community files
• c1e4ed8 Status for v0.2.0
• 0f4dd27 Keep optional npm packages and verify the ACP entry point before packing
• ecd4a99 Warm the sandbox with the git hook for T3's inside path
• 7171f72 Keep the adherence tier measuring denials
• 51ac726 Record Grok's missing session context as a dialect fact
• 60bf32c Record the determinism and performance checks
• a96849e Merge branch 'orchestrators'
• 4d31e09 Stop tracking the OpenHands venv symlink
• bb2d263 Record the orchestrator runs: what is automated, and what blocked each one
• e2655ed Drive Paperclip and T3 Code headlessly
• b49a4ef Judge the worktree the orchestrator made, not the checkout
• ce1a6ce Take a sandbox down by name
• 370b22a Enforce that the core names no harness
• 1e30477 Merge branch 'dsh'
• 7728c7e Write down what DeepSeek Harness actually does
• bf9384d Make DSH's integration the one that was verified
• 2097a9d Measure cold start, warm run and hook latency in the smoke suite
• a4e762d Document shell substitution as an integration level
• 35cdf3d Stop tracking the stray .venv-openhands symlink
• 13f06dd OpenHands: the terminal's shell is boxer-bash
• 81ec223 Status for v0.1.1: third-pass results from the merged tree
• 5d8d9e3 Wait for a concurrent creator when smolvm says the machine already exists
• 7e0d959 Drop the MCP warm-up wait group; README names the live tiers
• 837fc38 Record the Grok session-context finding
• 99b4fe2 Brief names the run tool the way the harness shows it
• 109e106 Merge branch 'adherence'
• cfed90d Record the adherence runs: four models, six harnesses, findings and a default-model recommendation
• 8069cdc MCP warm-up: detached, and never under session or subagent isolation
• 268ba4a Document the MCP path's scope under session isolation
• 491da40 Merge branch 'timing'
• 8d4a19b Docs: timing matrix results, new config keys, doctor signals, R-GIT and R-SIG verification
• cb7e49d Eval: the scripted model delegates once in the foreground; mid-session worktree nests in the repo
• 8afe239 Merge branch 'packaging'
• 7b0ad44 Document the single Agent Plugins package, the MCP lifecycle signals, and the install retry
• 9d0996f Document the adherence tier in the eval plan and reserve its status table
• 16df89d Retry the harness install once after a dropped exec transport; pace live cells after a refusal
• b7b7827 MCP initialize warms the scope, EOF records last use; map guest cwd back to the host
• ee19569 Render one Agent Plugins package; each harness bundle is a view of it
• 89789a2 Oracle: count only tool-input rewrites, read live answers by kernel name
• 7518657 Oracle: count only tool-input rewrites, read live answers by kernel name
• 24e6692 Eval: session, subagent and timing-matrix cells for Claude Code
• 6fb0e2e Oracle: count only tool-input rewrites, read live answers by kernel name
• 6ae4b39 doctor: per-harness signal report derived from the dialect table
• cbd0f0f boxer install git: post-checkout hook warms the sandbox of every new worktree
• c637320 Add warm_on_session_start and worktree.manage; thread session identity into rewrites
• 1871852 Add the adherence tier: brief, recovery and multistep cells per harness, judged across models
• 01068f5 Install ca-certificates in the Codex guest
• e374476 Oracle: off mode accepts a live model choosing boxer_run; path evidence from one guest probe
• 98341fd Plan the third pass: worktree timing, adherence tier, packaging collapse
• 44ae8ed Oracle: a canary in the guest sat...