Colonizer v0.2.7

Colonizer v0.2.7

Colonies stop failing every turn with UND_ERR_SOCKET

Update, then stop and resume any colony that is failing with UND_ERR_SOCKET.

Some colonies failed on every turn, and on every retry, with
model router: the connection to Anthropic failed (UND_ERR_SOCKET). The cause was the sandbox, not
Anthropic: microsandbox 0.7.3's secret scanner sometimes read the Claude credential's placeholder in
the request header as part of the body, blocked the request as a leak and dropped the connection.
v0.2.7 pins microsandbox 0.7.6, which scans the header and the body separately
(#1096). Your existing sandboxes carry over as they are, with no migration.

Take care: a running colony keeps the microsandbox it booted with. Updating fixes new colonies
only; a colony already failing with UND_ERR_SOCKET needs a stop and a resume to boot on 0.7.6.

The same error is now also handled as what it is, a temporary gateway failure
(#1093, #1099). Socket resets, a
restarted gateway and any 500/502/503/504/529 are retried automatically after 1, 5, then 15 minutes
(the new Watchdog setting provider_retry_schedule_minutes; provider_retry_max_attempts now
defaults to 3). While a retry is pending the card says so ("Stopped on a model gateway error …:
retrying in 4 min") with Retry now, instead of "Waiting on you". A refused sign-in or permission
still holds at once.

Pair a phone with the Colonizer pair code, no GitHub needed

A phone or another browser can now join your remote link with the six-digit Colonizer pair code
alone (#1086). On this machine, open Settings → Remote access → Sign in on another device,
open the one-time link (or scan its QR code) on the phone, and type the code it shows into the
cockpit here. Only devices you paired this way get through; anyone else who finds the link sees a
"Pair this device" page and never reaches the cockpit. Removing a device locks it out on its next
request.

To use it:

1. The relay at my.colonizer.dev has already been redeployed with the new version, so there is
   nothing to do there. (If you run your own relay, redeploy it with its new D1 migration first.)
2. A new remote link pairs by code straight away. An existing link keeps asking for GitHub
   sign-in until you switch off Ask for GitHub sign-in first in Settings → Remote access.

Leave that switch on if you want GitHub sign-in in front of the pair code as well; it works as
before.

Easier to read and tap on a phone

On a phone, or any touch screen, the cockpit now uses bigger text: body text is 16px and nothing is
smaller than 12px (#1084). Text boxes no longer make iPhone Safari zoom in when you tap them.
Buttons, tabs, menu items and icon buttons are at least 44px, so they are easy to hit with a thumb,
and a colony's header scrolls out of the way to leave room for the chat. On a desktop with a mouse
nothing changes.

Update notices for critical fixes

When a release fixes something your colonies may be hitting right now, the cockpit tells you
(#1097). A banner above every view says what the fix is and how many colonies on this machine
it applies to; for this release, it counts the colonies stuck on the UND_ERR_SOCKET sandbox block
described above. After you update, Settings → Updates lists the colonies still running the old
version and offers Restart on the new version for each or all of them. That is the same stop
and resume as a colony's own buttons, so the worktree and the conversation are kept. A source or
development build now says why Update is unavailable and how to switch it to releases.

Burn-down hunts rotate through the red-team focus areas

Burn-down hunt colonies no longer all hunt the same generic bugs (#927). Each new hunt takes
one of the eight red-team focus areas, such as error handling, concurrency, input validation,
resource leaks, auth boundaries or silent failures, and each repository works through them in turn.
Parallel hunts divide the work instead of repeating it, and the colony's title names its area
(Burn-down hunt: input validation and injection). The rotation carries over the weekly reset. A
hunt with your own instructions hunts what you wrote and is titled plain Burn-down hunt.

Take care: at most 5 pull requests per repo per day

Colonies now open at most 5 pull requests per repository per UTC day by default
(#910). A colony that hits the cap is parked with its worktree kept, the cockpit shows the day
it resumes, and the queue picks it up again when the day rolls over. To change the cap for a repo,
set max_prs_per_day under [colonizer] in its .colonizer/config.toml (0 means no cap).

The Inbox: decisions only you can make

• A Decisions section (#1036). Open issues labelled needs-decision, or with an
  "Open decision:" or "Decision needed:" line, become cards with their options; Post decision
  posts your answer on the issue and removes the label. Pull requests that need a person (held by
  policy, needing a redo, conflicted, red CI that is not a known flake, a review requested from you)
  get a card saying why, with Re-run failed jobs, Dispatch redo colony and Open on
  GitHub where they are safe. GitHub is polled gently, at most every five minutes per org.
• Decision cards read the "## Decision needed" format (#1036): the quoted question,
  each labelled option with its description, and the recommended one badged. A pull-request card
  held before it has a pull request always offers Open colony, and Publish anyway when that
  is possible. Both fit a phone screen.
• A new GitHub org is a notification, not a decision: a compact "Added to org" row with
  Add workspace and Not now.
• On a phone, the live-map prompt no longer covers the Inbox; it sits at the top of the list and
  scrolls away.

Models, plans and quota

• Switch models from the top bar (#1051): for the whole install or one org, one model
  per role, with provider health, failure rates and out-of-quota models shown disabled until their
  reset. A switch applies to new colonies, or also restarts the running ones. /model in ⌘K opens
  it.
• Plan bars and saved profiles. The Models popover opens with one row per plan in use: the roles
  on it, a used-against-limit bar, the percent left and the reset time. An exhausted plan is red and
  counts down, and every role on it gets a red badge. Profiles save a set of role → model
  choices, shared across devices, to apply to one org or all.
• The plan-limit banner names the provider that ran out ("BytePlus plan limit reached", not a
  Claude session limit), lists the roles that use it, says colonies on other providers keep running,
  and gives the reset as a local time with a countdown.
• One notification when a provider runs out of quota (#767), not one per colony, with
  a "Provider out of quota" switch per device.
• BytePlus and Volcengine (base URLs ending in /v3) work again (#1018), and a
  provider is now test-called when you save it, so a wrong base URL shows up straight away.

GitHub and the merge train

• GitHub refusing the account pauses the mothership instead of failing every launch
  (#1074). A suspended account, a revoked token or repeated secondary rate limits open a
  breaker: launches, publishes, merges and GitHub writes wait, queued colonies stay queued and
  running ones keep working with their publish held. A banner names the cause and the next step, and
  everything resumes by itself once GitHub answers again.
• The merge train no longer squashes away a late commit (#1075). A pull request merges
  only after its head has been quiet for a while (merge_train_quiet_minutes, default 10) and only
  on checks that ran on that exact head; a branch with commits after the merged head is kept and
  flagged "commits not merged".
• A claimed issue shows which mothership holds it (#919), with a
  colonizer:host:<host> label and one claim comment kept current instead of a new one per colony.
• One rule decides whether a launch duplicates work under way (#832), and a refused
  launch names the colony or pull request that holds it, with Allow duplicate.

Observability: traces and more

• Send logs, metrics and traces to your own backend over OTLP (#839, #843,
  #845). The colonizer-observability add-on exports to Grafana Cloud, Datadog,
  Honeycomb or any OTLP receiver. It is off until you enable it, redacts every string and never
  sends prompts or content.
• Each colony is one trace (#846, #847), with spans per turn, tool call,
  subagent, question (and who answered it), host-chain step and routed model call, kept inside
  Tempo's per-trace limit. See
  Traces.
• A wrong or expired observability API key no longer throws records away (#849): the
  exporter holds them, reports auth_failed and delivers everything once the key is fixed.

Everything else

• iPhone and iPad: only Safari is told to "Add to Home Screen" (#1083). Brave, Chrome,
  Firefox, Edge and Opera now say "Open this page in Safari", with Copy link and Open in Safari.
• The watchdog flags a colony that may have got past one of its controls (#609), from
  new boundary events shown in the chat.
• Colonies can live in an S3-compatible bucket (R2, MinIO, AWS S3), and
  colonizer sessions migrate moves an install to another session store, verified and resumable
  (#610).
• Hand a local agent session to a colony, and a colony's conversation back to your laptop
  (colonizer handoff, #738).
• Colonies can search the operator vault and propose notes back to it for you to accept or
  reject (#777).
• A Prometheus /metrics endpoint (#852): switch prometheus on in the observability
  module and scrape colony, gateway, token, cost and queue metrics with the install's read token.
  No series carries a colony id, a repository name or free text.
• ponytail, an optional skill pack (#958) that pushes an agent to reuse what already exists
  before writing new code. It is off by default; switch it on in Settings → Skillsets.
• The audit page says where each finding stands (#934), and the security-hunter docs point
  at the open issue for the hunter run stage (#933). No finding is marked closed and no release
  checkpoint is cleared by this.
• Org exec policy (#924), layered between the install's and the repository's.
• Hermes colonies run on the stock images (#602), building a hash-pinned hermes-agent
  on first boot; self-paced loops on Pi, Hermes and ACP (#643).
• Start, stream and cancel colonies over UHP (#650).
• Webhooks: a stable event id (#896), optional per-status lifecycle events
  (#897), retries with a dead letter you can replay (#898), and subscriptions for
  scoped API tokens (#899).
• A fleet member refreshes its token instead of stopping on a 401 (#762).
• Colony images carry build provenance (#589), and a weekly code-health report lands
  in one pinned issue (#833).
• Security: remote access closes the remaining review findings R2–R5 (#531; the relay
  at my.colonizer.dev needs a redeploy for its half), every newer write path uses the shared secret
  redactor (#761), and the redactor's identifier exemption now matches whole words, so a
  secret under a key like did or session_cookie_id is no longer let through (#1062).

Every entry is in
CHANGELOG.md.

Install

curl -fsSL https://colonizer.dev/install.sh | sh

Prebuilt bundles are published for Linux x86_64 (with KVM) and Apple Silicon Macs
(darwin-arm64); there is no Intel-Mac or Windows build. What one machine needs:

• Linux: /dev/kvm readable and writable by your user (sudo usermod -aG kvm "$USER", then log
  out and back in) and a native Claude Code install, which colonies run.
• Either platform: git, gh, curl and tar (with xz); on Apple Silicon the installer also
  fetches the Linux build of Claude Code a colony needs.

Run colonizer afterwards; it prints a sign-in link and opens it. The full walkthrough — install
options, first run, where things live, how to update — is in
docs/install.md.

Security status

Colonizer is alpha and not ready for unattended work on sensitive repositories, real credentials
included. An external audit of v0.1.3 (commit d89ce76, 17 September 2026) found four ways a
colony could cross into the host; they are filed as draft advisories (F01–F04) and are not fixed
yet, and its four release checkpoints (G1–G4) are all uncleared. Controls added since — scoped
tokens, remote-access fencing, sensitivity-aware routing, gateway audit lines, log and secret
redaction, path policy, egress and exec policies — do not close those findings, so attended work is
what the harness is good for today. The live status is
docs/audit.md and its tracking
issue (#91); report vulnerabilities privately
through SECURITY.md.

Prebuilt Colonizer for Linux x86_64 (with KVM) and Apple Silicon Macs, built from b3f2358.

curl -fsSL https://colonizer.dev/install.sh | sh

The installer checks the archive against SHA256SUMS. It fetches the Claude Agent SDK from the npm registry, and on a Mac the Linux build of Claude Code, from Anthropic's own channels: neither is in the release. Guide: https://colonizer.dev/docs/install

Each artifact, SHA256SUMS included, also carries a build-provenance attestation recording the commit that built it. Verify one with:

gh attestation verify colonizer-<platform>.tar.gz --repo Colonizer-dev/harness

Here is linux-x86_64 or darwin-arm64.

c0c26bdaaa230aede6447aab0e58b3fdfa3fb944cd4a3c35e757368020a373fc  colonizer-darwin-arm64.tar.gz
3e7c828359c9addd26d37aa8d825b7777738816a9195e4e6ed4493e1e9cae65f  colonizer-linux-x86_64.tar.gz
12eeacb0c7248f4074b6343a1d787182a9ab18590837173dae19306ff33e85aa  install.sh