Colonizer v0.2.1

Colonizer v0.2.1

About this release

v0.2.1 is the first published 0.2 release. v0.2.0 was tagged but never published: its macOS build
failed because two web UI files, fleetColonies.ts and FleetColonies.tsx, differ only in letter
case, which a case-insensitive filesystem cannot tell apart. v0.2.1 renames one of them and adds a
CI check that fails any pull request reintroducing a case-only path collision
(#915). Everything below, including what the
changelog lists under v0.2.0, ships for the first time in v0.2.1.

What it is

Colonizer runs coding agents on your own machine. Every task gets its own colony: a KVM microVM
with a fresh git worktree and an agent inside, so it works without permission prompts. When it needs
you it asks with choices, and when the work is done the mothership — your machine — commits it
and opens the pull request, your credentials never leaving the host.

Install

curl -fsSL https://colonizer.dev/install.sh | sh

Prebuilt bundles are published for Linux x86_64 (with KVM) and Apple Silicon Macs
(darwin-arm64); there is no Intel-Mac or Windows build. What one machine needs:

• Linux: /dev/kvm readable and writable by your user (sudo usermod -aG kvm "$USER", then log
  out and back in) and a native Claude Code install, which colonies run.
• Either platform: git, gh, curl and tar (with xz); on Apple Silicon the installer also
  fetches the Linux build of Claude Code a colony needs.

Run colonizer afterwards; it prints a sign-in link and opens it. The full walkthrough — install
options, first run, where things live, how to update — is in
docs/install.md.

What's new since v0.1.0

The v0.1.x releases in the open. The themes a newcomer is most likely to care about, each backed by
entries in CHANGELOG.md:

• A family of agents behind one protocol. Besides Claude Code, colonies run OpenAI's Codex, Pi,
  xAI's Grok Build and OpenCode, plus any Agent Client Protocol agent (verified with Gemini CLI);
  each asks questions as choice cards and resumes its conversation when suspended, and Codex, Grok
  Build and the Gemini preset fetch their pinned CLI on first boot (v0.1.9–v0.2.0).
• A CLI, an MCP server, and scoped API tokens. The colonizer binary is also a client —
  launch, list, status, logs, ask, answer, stop, resume, pr — with shell
  completions, a man page, colonizer mcp, and named least-privilege API tokens (v0.1.10).
• Loops, and a merge train. loops run recurring work, and built-in loops keep the machine tidy
  (Disk cleanup, Docs & README, Dependencies & supply chain, TypeScript: remove any, Merge train).
  The merge train squash-merges a colony pull request once it is clean and every check is green —
  never force-merged — and holds back the open colonies a merge overlaps (v0.1.9, v0.1.11).
• The cockpit on your phone. Web Push (answer a simple question from the notification), a phone
  paired from a QR code, and remote access that serves the cockpit through a relay with no open
  port (v0.1.9–v0.1.11).
• A harder colony fence. Masked and protected worktree paths (credential files hidden, .git
  and agent config read-only), an egress policy whose deny set no setting can reopen, in-guest
  hardening, a programmable exec policy, and secrets redacted from the logs (v0.1.10, v0.1.11).
• Providers, budgets and quotas. A gateway that holds the keys, per-colony budget_usd and
  budget_tokens budgets, a quota probe, trusted/vetted marks so sensitive paths reach only
  approved providers, and a "Provider out of quota" card instead of hanging colonies (v0.1.0–v0.1.11).
• Fleets. Two motherships pair with an invite and a confirmation code, share one fleet view, and
  — once a member opts in — sync finished-colony history to the owner. Placement picks a member with
  room and records why, a launch can pin a member, and the Overview lists every colony the fleet
  knows about (v0.1.11, v0.2.0).

Security status

Colonizer is alpha and not ready for unattended work on sensitive repositories, real credentials
included. An external audit of v0.1.3 (commit d89ce76, 17 September 2026) found four ways a
colony could cross into the host; they are filed as draft advisories (F01–F04) and are not fixed
yet, and its four release checkpoints (G1–G4) are all uncleared. Controls added since — scoped
tokens, remote-access fencing, sensitivity-aware routing, gateway audit lines, log and secret
redaction, path policy, egress and exec policies — do not close those findings, so attended work is
what the harness is good for today. The live status is
docs/audit.md and its tracking
issue (#91); report vulnerabilities privately
through SECURITY.md.

Prebuilt Colonizer for Linux x86_64 (with KVM) and Apple Silicon Macs, built from b1b1b75.

curl -fsSL https://colonizer.dev/install.sh | sh

The installer checks the archive against SHA256SUMS. It fetches the Claude Agent SDK from the npm registry, and on a Mac the Linux build of Claude Code, from Anthropic's own channels: neither is in the release. Guide: https://colonizer.dev/docs/install

Each artifact, SHA256SUMS included, also carries a build-provenance attestation recording the commit that built it. Verify one with:

gh attestation verify colonizer-<platform>.tar.gz --repo Colonizer-dev/harness

Here is linux-x86_64 or darwin-arm64.

b1c6c1dbe9cbd59919ce5ace08efd516c5c1d93f7a7a309b96a1be25c1f77518  colonizer-darwin-arm64.tar.gz
c8ea6fcb5c71165679ac3bd4c49918e0821d9d7b88a0ead796187866480a3abe  colonizer-linux-x86_64.tar.gz
c331a0e754d4a0a809801996ebc1d41e013407ff14969dfe0bd2b0b1e8569028  install.sh