Colonizer v0.2.18

Colonizer v0.2.18

What's new

• **Observability: a file provider that writes the export stream to disk, a disk guard, a status
• Models served by several providers are ranked by price, and a colony can start on the cheapest host. GET /api/model-hosts lists every canonical model two or more connections serve, each host with its input/output $/1M and when the price feed last verified the price, ranked cheapest first by a blended rate (three parts input to one output, cache-aware when a cache-read rate is known); the cockpit's model picker and the routing settings show the same table. A new prefer_cheapest_host module setting (off by default) re-pins a colony's open-weight models to the cheapest healthy connected host at boot: it skips degraded, out-of-quota or tools-disabled hosts, never moves closed models, and never moves a model the operator marked host-sensitive via host_sensitive_models on a provider connection — the model itself is kept, only the host serving it changes. (#1039)
• Releases now ship the observability add-on. colonizer-observability-linux-x86_64.tar.gz and
• Stacked colonies no longer cascade into failure when their parent fails; they now wait for recovery. Colonies stacked on a parent that entered a failed state used to immediately fail themselves, killing entire dependency chains with a single failed parent. Now, when a parent enters a failed state, its children transition to a waiting state instead, pausing their work until the parent recovers. When the parent recovers, waiting children automatically resume from where they left off, allowing the full stack to continue working together. This prevents the loss of work in multi-level colony stacks and enables recovery scenarios where a transient parent failure can be resolved without restarting all dependent colonies. (#1066)
• A provider outage no longer ends a colony. A turn that dies on a model gateway error is retried
• Retry a colony that failed before it had a worktree. A colony that dies at boot or sync has
• Claude's exhausted quota no longer holds colonies that never spend it. The Claude account's
• Colonies park when the Claude account and its fallback's provider are both out of quota. Where before a running colony kept its microVM and had its agent re-ask every minute, each request coming back quota_exhausted, the queue's 5 s tick now parks a colony whose whole provider chain — the Claude account and every provider its allowed_providers list can reach — is out, releases the slot and, under the usual discard_vm, removes the microVM. The park names the exhausted provider and the earliest reset in the chain, so the colony rejoins the queue on its own when either plan refills. The account fallback's route answer matches: a fallback whose own provider is out is now parked with a reason rather than "go ask Claude", which could only produce another 429. (#1160)
• Skill pack MCP hosts join the egress allowlist. A skill pack's mcp.json declares remote tool servers and the hosts they live on. In allowlist mode, those hosts now join the colony's allow list, recorded in egress.json as each pack's contribution alongside the module's, so the agent reaches the tool servers the packs' skills call without the operator restating them. The hosts are clamped by the fleet floor like module hosts. In open mode they are not a fence (the public profile covers them); a per-pack fence in open mode is future work. (#1165)
• secret-paths exec policy now detects secrets in git refs and flag-value pairs. The words() tokenizer was modified to split on : and = characters in addition to whitespace, enabling proper detection of secret paths in contexts like git object refs (e.g., HEAD:.env) and command-line flag-value pairs (e.g., --flag=.env). (#1174)
• Setup flow now optional for Claude login when other model providers are configured. The "GitHub & Claude" page has been renamed to "GitHub & models" to reflect the broader scope of model providers. The Setup checklist now displays "A model colonies can use" instead of requiring a Claude login, making the Claude login step optional when other model providers (like Anthropic API keys, OpenAI, or other LLM services) are already configured. The needs-you indicator clears as soon as any working model provider is available, reducing setup friction for users who bring their own models. (#1211)
• Resumed colonies keep their place in queue: When a stopped colony is resumed, it now gets a
• Cross-member launch references consolidated to issue #1252. The closed outposts design gate
• Autonomy judge model test call now accepts extended thinking. The test call's token budget
• Autopilot no longer publishes, or releases the issue as "no changes", while the agent's background subagents are still running. When a lead agent launches background subagents with the Agent or Task tools, autopilot waits for them to settle before publishing the PR, even if the PR description is already written. This prevents premature releases while the subagents are still making changes. Errors are not blocked by subagents: a turn that ends with an error is held or retried immediately. An empty branch whose PR description names changed files is now held as contradicted, rather than published as "no changes" (#1268).
• context-mode, an opt-in third-party module, with the exec policy enforced on its tools. Organisation settings take a context_mode of off (the default), shadow or on, passed to the colony as COLONIZER_CONTEXT_MODE. In on, the Claude Code runner registers the context-mode MCP server only from an operator-installed copy whose package.json matches the pin in modules/agents/claude-code/context-mode.json (1.0.169, sha256 and npm integrity, ELv2 — never bundled), with its data kept in the colony guest's ~/.colonizer/context-mode rather than the shared ~/.claude. shadow is accepted but does nothing yet. Whatever the mode, the exec-policy hook now also covers ctx_execute, ctx_execute_file and ctx_batch_execute: shell code is judged exactly as the same Bash command, other languages as an inline script, every batch command separately with the strictest decision winning, and malformed input, .. paths and ctx_upgrade are refused. (#1273)
• Org dashboard: Cost per merged PR now reads the same window as the Spend tile, not the all-time session rollup. When the live-session rollup was close to zero but the spend history showed measured activity, the Cost per merged PR tile could contradict the Spend tile or round to "$0.00". The tile now divides the period spend (from /api/spend/history, the same value the Spend tile shows) by the number of PRs merged in that same date range (not all-time), so the two tiles always cover the same window and can never contradict each other. The sub-line now says "N merged in range" instead of "N merged", and the tile shows "—" with an explanatory note when nothing merged in the period but spend was measured (or when spend is unmeasured). (#1275)
• Input screening detects hidden text in GitHub issues and comments at launch. The promptdecode org setting (off by default) runs a local scanner for zero-width characters, tag runs, bidi controls, HTML comments, and base64 payloads: off skips scanning; shadow records findings in the session log and ledger without mutating the issue; on removes hidden text and appends a visible note. The screening runs before the prompt is built, using a local decoder until the promptdecode CLI ships; PR comments, fetched pages, diffs, and the cockpit card are future slices. (#1277)
• Red-team: detects repository artifacts that would change the colony's PATH (executable shims, direnv, version managers, Makefiles). The colony ledger now flags repositories with committed bin/cargo, .envrc, Makefile with PATH assignments, and similar artifacts that hostile repos use to fool agents. Verification gates are unaffected: they trust the VM's reported exit code, not fabricated output. PATH stays pinned by the image. (#1278)
• Provider catalog adds quota probe presets for DeepSeek and Z.AI, with clearer UI messaging for providers without balance APIs. The provider catalog now includes quota probe presets for DeepSeek and Zhipu GLM (Z.AI), so colonies connecting to these models can set up quota monitoring out of the box. The providers page UI now clearly distinguishes providers without quota probe support by showing "no balance API" instead of the generic "balance unknown", making it easier for operators to understand which providers support balance queries and which do not. (#1281)
• Placement verdict is no longer shown on running colonies. A placement verdict — a message like "archlinux: no free slot; no member has room" — appeared on every colony's detail page, whether it was queued, blocked, or actively running. This made operators think running colonies couldn't actually run because they seemed to be blocked on placement. The verdict now only shows on colonies that are queued or blocked waiting for a slot; running and working colonies no longer display a placement message. (#1282)
• Fixed: Guest Claude Code auto-memory writes to /root/.claude/projects/ — disabling session-resume in the claude-code module prevents the directory from being mounted, eliminating exec-policy prompts and control-defeat holds from denied writes. Agents also get clearer guidance about not accessing .git/ internals when testing commit capability (#1283)
• The orgs list no longer shows case-duplicate orgs such as cratefield next to Cratefield. A launch now stores the repository under GitHub's own casing (the full_name from the repository lookup the push-access check already makes, falling back to the casing of existing colonies or a saved org), and a one-off migration at startup moves existing colonies onto one casing per org and repository. The orgs list, the per-org and per-repo colony limits, duplicate-claim checks and API-token scopes now compare owner and repository names case-insensitively. (#1284)
• Remote claims now auto-clear when stale (no branch or PR for 24h), and the cockpit offers a take-over action. A label-only claim (no branch or open/merged pull request) on an issue from another mothership is now marked as potentially stale. Launches automatically clear claims older than 24 hours and proceed. For younger label-only claims, the cockpit shows a "No branch or pull request" notice with the claimant's GitHub account and claim age, alongside a "Take over" button to proceed with the launch. The refusal now names the claimant GitHub account and when the claim was created, so operators can tell whose work is blocking the issue (#1286)
• An operator note to a colony that isn't running now waits for it instead of being lost. POST /api/sessions/{id}/messages used to answer a bare 409 for a queued, stopped, parked, blocked or failed colony and the note was gone; it now keeps the note on the session (once per client id) and hands it to the agent with the first turn when the colony (re)starts, and the cockpit shows "1 note waiting" above the composer until then. A pr_opened, merged, closed or no_changes colony still answers 409, now saying why ("colony finished (merged): the note would go nowhere"), and the cockpit shows that reason instead of its generic text. (#1287)
• Colonies on security hold no longer waste microVM slots. When a control-defeat signature is flagged on a colony (issue #609), the colony is now immediately parked with its microVM slot freed, keeping its worktree and transcript intact. The operator can see the colony in the holds list with its evidence and resume it once they have investigated. The park does not auto-resume: only an explicit operator resume brings the colony back into the queue at front priority (#1288).
• Settings → Secrets keeps the settings sidebar. Secrets is a settings page at /settings/connections/secrets, shown inside the settings layout with its item highlighted, instead of a cockpit page of its own that dropped the sidebar. /secrets and /settings/secrets open it there, as do the header's Secrets button and the "Set key" links. It leaves the rail and the phone's More sheet; settings search still finds it. (#1290)
• Verify retries with larger resources when the guest disk or memory fills. On large Rust
• Prevent infinite retries on corrupted git repository mirrors; automatically repair with reclone and set attention on unrecoverable corruption. When a git mirror became corrupted due to disk errors mid-write, every colony booting against it would retry infinitely, burning through the retry budget without progress. Now, sync_repo climbs a three-rung repair ladder: first, corrupt loose objects are cleaned locally and a fetch is retried; second, if still failing, the entire mirror is re-cloned from GitHub and the fetch retried; finally, if the re-clone's fetch fails, the operator is notified via mirror_needs_attention and the colony enters an attention state to free its microVM slot. The corruption detection now covers additional git error messages (did not send all necessary objects, nonexistent object, missing object, broken ref) to catch corrupted refs in addition to corrupted objects. When mirror corruption is unrecoverable, the session's attention field is set with reason repo_cache_corruption_unrecoverable so it doesn't silently hold a slot. (#1319)
• The agent prompt explains why a nested clone's .git/config and hooks are read-only, and how to clone without defeating the mount. A git clone into the workspace (e.g. a build cloning a data repo into a gitignored dir) failed on the path policy's read-only binds; an agent that didn't know why tried to umount them and was held as control_defeat. The prompt now says why these binds exist, names the supported route (git clone --separate-git-dir=/tmp/<name>.git to keep the git dir outside the workspace, or clone outside it entirely), and forbids trying to unmount. The hold itself is unchanged — a protection mount is real and trying to defeat it is real control_defeat — and nested clones in gitignored dirs stay protected. (#1320)

Prebuilt Colonizer for Linux x86_64 (with KVM) and Apple Silicon Macs, built from f4c9b80.

curl -fsSL https://colonizer.dev/install.sh | sh

The installer checks the archive against SHA256SUMS. It fetches the Claude Agent SDK from the npm registry, and on a Mac the Linux build of Claude Code, from Anthropic's own channels: neither is in the release. Guide: https://colonizer.dev/docs/install

Each artifact, SHA256SUMS included, also carries a build-provenance attestation recording the commit that built it. Verify one with:

gh attestation verify colonizer-<platform>.tar.gz --repo Colonizer-dev/harness

Here is linux-x86_64 or darwin-arm64.

The observability add-on rides along as colonizer-observability-.tar.gz for the same platforms; the installer puts it beside the colonizer binary, and the checksums and the attestation above cover it too.

Apple Silicon Macs can also use Colonizer-arm64.dmg: an unsigned app, so macOS asks you to approve it once (System Settings > Privacy & Security > Open Anyway). The curl installer above is the recommended path.

b2c3215c53b471f3b5651eb9de7c4b3c63f7504416211029195ffd72b82b8296  colonizer-darwin-arm64.tar.gz
37488c2e28fcf036296588e6c18b89740376c64e6f0bb44538cbc152a479e14c  colonizer-linux-x86_64.tar.gz
0e5dc98700f3044345d38b68b85c226d98389c27f536d739a3263e776e015844  colonizer-observability-darwin-arm64.tar.gz
50625100559a77f6e0818d5c90cd102b37e6844f9152b5a9d2a9783fdad8d315  colonizer-observability-linux-x86_64.tar.gz
c82a03be3a727e10b22e8c0e3ae804be7ed5cb24403d8697b47beedef1c3ff86  Colonizer-arm64.dmg
a65be2043bbd94aa8d5e1e122113ae3d3945120bf4b2771fc300298a06e60f4e  install.sh