Skip to content

Colonizer v0.2.11

Choose a tag to compare

View all tags
@github-actions github-actions released this 07 Oct 13:11
Immutable release. Only release title and notes can be modified.
v0.2.11
c723105
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Colonizer v0.2.11

Settings are easier to find

Settings is now one vertical menu with search, and every view in the cockpit has its own address you
can bookmark and share (#1180).

  • Press / to search any page or field by name, help text or a plain word like "key" or "token".
  • A dot on a group shows when something needs you (amber) or is broken (red).
  • On a phone, the menu is a list that opens each page with a back arrow.

Fixes

  • Auto mode no longer takes on more colonies than the host can hold (#1158). Running colonies are never stopped; over the limit, nothing new starts.
  • A quota error is blamed on the right provider (#1168), so one provider running out no longer pauses the whole queue as a Claude problem.
  • Providers show their own logo (#1166), even when they were saved as custom at a known vendor's URL.
  • No more false alarms for placeholder dotfiles (#1169). The empty .env and similar files the harness mounts no longer look like a control bypass.
  • Documented example keys and redacted PR descriptions no longer block publishing (#1175). A colony that is stuck on the same cause now fails fast instead of looping.
  • Helper agents work with model aliases (#1176), and a finished colony is no longer held over an unrecognized model.
  • The Nest shows every colony (#1177), however busy the host is.

Smaller changes

  • The log archive's Clean up now takes hours as well as days.
  • The Jev key can be set on the Secrets page, without a restart (#1179).

Security status

Colonizer is alpha and not ready for unattended work on sensitive repositories, real credentials
included. An external audit of v0.1.3 (commit d89ce76, 17 September 2026) found four ways a
colony could cross into the host; they are filed as draft advisories (F01–F04) and are not fixed
yet, and its four release checkpoints (G1–G4) are all uncleared. Controls added since — scoped
tokens, remote-access fencing, sensitivity-aware routing, gateway audit lines, log and secret
redaction, path policy, egress and exec policies — do not close those findings, so attended work is
what the harness is good for today. The live status is
docs/audit.md and its tracking
issue (#91); report vulnerabilities privately
through SECURITY.md.

Prebuilt Colonizer for Linux x86_64 (with KVM) and Apple Silicon Macs, built from c723105.

curl -fsSL https://colonizer.dev/install.sh | sh

The installer checks the archive against SHA256SUMS. It fetches the Claude Agent SDK from the npm registry, and on a Mac the Linux build of Claude Code, from Anthropic's own channels: neither is in the release. Guide: https://colonizer.dev/docs/install

Each artifact, SHA256SUMS included, also carries a build-provenance attestation recording the commit that built it. Verify one with:

gh attestation verify colonizer-<platform>.tar.gz --repo Colonizer-dev/harness

Here is linux-x86_64 or darwin-arm64.

Apple Silicon Macs can also use Colonizer-arm64.dmg: an unsigned app, so macOS asks you to approve it once (System Settings > Privacy & Security > Open Anyway). The curl installer above is the recommended path.

e55079f7847b5b798bd6aab25eb89c4d205db904b525668bdd2bbb4c2bcc133a  colonizer-darwin-arm64.tar.gz
d6605c84649c5f48de1bae7e3e6063ab5d591ea886ec9007b0fcf997c070ff8c  colonizer-linux-x86_64.tar.gz
77ec4eb4414d4aa347ffd4573a919df4b5d869214e5480b4eeb092b1294624cf  Colonizer-arm64.dmg
4293bed20d991fb79164e457163a058fb362f10e480c0588e0edac4d3ffd7b4b  install.sh
Assets 8
Loading