v0.1.0-rc18

Changelog

Features

• 4bc396d: feat(brigd): refuse a connection from another user's uid (@pmoust)
• 2762811: feat(brigd): version the protocol and return stable codes (@pmoust)
• 1d04548: feat(cli): add --json to the read verbs (@pmoust)
• e52b839: feat(cli): add --no-project to run a session without its project (@asapranidis)
• 2ca7497: feat(cli): add brig logs <ref> to read a sandbox's log (@pmoust)
• 352349c: feat(cli): add brig doctor to name the failing prerequisite (@pmoust)
• 79fd7b2: feat(cli): add shell completion for bash, zsh and fish (@asapranidis)
• 2d71bbe: feat(cli): add verbosity levels and the --verbose and -q flags (@asapranidis)
• 9a8abab: feat(cli): collapse the lifecycle verbs onto sh, rm --all and run -d (@asapranidis)
• a62c7ab: feat(cli): collapse the management commands into noun groups (@asapranidis)
• ac63564: feat(cli): give brig's flags a position and read a session ref (@asapranidis)
• ba32eb8: feat(cli): print the session ref in brig ls, and add ls -q (@asapranidis)
• d80a080: feat(cli): read an isolated sandbox's gateway log (@pmoust)
• b90f9e3: feat(cli): read run's project as a positional, and add --home (@asapranidis)
• 6d13bbf: feat(exitcode): add a shared classifier for brig's exit codes (@pmoust)
• 2e3aad8: feat(policy): add CheckCoverage, refuse an unenforceable attach (@marrgko)
• 6ab6d29: feat(policy): add EffectivePolicies, the union of what binds a run (@marrgko)
• 62bea97: feat(policy): add the attach/detach CLI (@marrgko)
• 72a7c14: feat(policy): add the attachments record (@marrgko)
• 9ab8c58: feat(policy): add the brig policy CLI commands (@marrgko)
• d56604e: feat(policy): add the check command (@marrgko)
• db076f7: feat(policy): add the policy document format and directory loading (@marrgko)
• bdaac47: feat(policy): enforce a bound policy at the sandbox's gateway (@ananos)
• 8f39f7a: feat(policy): export CheckName to validate a name before a path exists (@marrgko)
• 44d0b83: feat(policy): hold attach's -n to a session name a run would start (@marrgko)
• edd8a48: feat(policy): name the file when the attachment record will not parse (@marrgko)
• 50b9be8: feat(policy): refuse a policy name the policy directory reserves (@marrgko)
• b222d43: feat(policy): refuse to break a policy binding, unless --force (@marrgko)
• a1ddf88: feat(policy): save an attachment before announcing it (@marrgko)
• e0c98b4: feat(policy): say that a binding is recorded, not enforced (@marrgko)
• 9f20278: feat(policy): show a binding whose policy did not load (@marrgko)
• 3fd2827: feat(policy): show what binds each policy in brig policy ls (@marrgko)
• 1091cef: feat(profile): add an inline policy: field (@marrgko)
• e31a19b: feat(run): run the agent as a child under --json (@pmoust)
• c24622c: feat(runtime): capture the runtime's output and print it on boot failure (@asapranidis)
• b530907: feat(secret): add a Secret Service backend for Linux (@pmoust)
• 73b5233: feat(session): add a session ref that refuses a label it cannot keep (@asapranidis)
• 0cd514a: feat(session): stop shortening a session slug, and drop its cap (@asapranidis)
• bf1a149: feat(wrap): keep verification visible and put the envelope behind --verbose (@asapranidis)
• 5c1d3e1: feat(wrap): key the session index by ref (@asapranidis)
• f3e9e9f: feat(wrap): mount a named project beside the guest home (@asapranidis)

Fixes

• 2d06ec4: Revert "fix(cli): warn about tail flags only on verbs that forward a tail" (@pmoust)
• 1d130fd: fix(agent): refuse a trailing argument in every subcommand (@pmoust)
• 8bacd17: fix(cli): Say brig agent ls in the unknown-profile message (@ananos)
• 5071c81: fix(cli): class a verbless bad ref as a usage error, not failure (@pmoust)
• a3ce070: fix(cli): complete an inline --flag=value in zsh and fish (@asapranidis)
• 85e6ac4: fix(cli): complete at brig's own parsing boundary, not before it (@asapranidis)
• e41207f: fix(cli): diagnose a bare ref as a ref, not an unknown command (@asapranidis)
• c06f9bc: fix(cli): keep reading brig's flags after the project positional (@asapranidis)
• f0f1dd3: fix(cli): make rm and logs exit 3 when the sandbox is absent (@pmoust)
• 6ed914b: fix(cli): read the global flags in the completion test off the table (@pmoust)
• 1fb3036: fix(cli): warn about tail flags only on verbs that forward a tail (@pmoust)
• 4bf5409: fix(cli): warn about tail flags only on verbs that forward a tail (@pmoust)
• 65f92df: fix(completions): survive set -u in bash, and stop caching in fish (@asapranidis)
• 817f3e6: fix(runtime): check BRIG_RUNTIME_BIN before driving it (@pmoust)
• 35275f6: fix(runtime): implement --network isolated on hull (@ananos)
• 01b0e84: fix(runtime): refuse a GUI profile in CanRun so join is covered (@pmoust)
• 8181068: fix(runtime): refuse a GUI profile on the container path (@pmoust)
• 4ef1832: fix(secret): refuse when the keyring has no default collection (@pmoust)
• 7da1279: fix(session): scope the reserved-label refusal to the resolved agent (@pmoust)
• d37b58f: fix(wrap): read an index holding JSON null as empty (@asapranidis)
• b5c20fe: fix(wrap): read the remembered project back like the home (@asapranidis)
• e8761c0: fix(wrap): resolve a project path before ruling out the root (@asapranidis)

Refactors

• 6bf21fd: refactor(brigd): rename the protocol's vm field to sandbox (@asapranidis)
• 14b1005: refactor(policy): pass Bindings its profiles, and reuse the flag helper (@marrgko)

Documentation

• a15712b: docs(brigd): document the protocol version, id, code and peer check (@pmoust)
• 7d47d4f: docs(cli): state intent in comments rather than issue history (@asapranidis)
• 8340bb4: docs(policy): document brig policy in the README and docs/policies.md (@marrgko)
• 340affc: docs(readme): name the session index and what it is for (@asapranidis)
• e2a9543: docs(readme): teach brig agent, and say why secret keeps its verbs (@asapranidis)
• 2ad8a23: docs(readme): teach sh, rm --all and the ref brig ls prints (@asapranidis)
• cabc31b: docs(readme): teach the project positional and --home (@asapranidis)
• 07bc87e: docs(readme): teach the ref form and the flag positions (@asapranidis)
• b98880b: docs(secret): document the Linux Secret Service backend (@pmoust)
• 6f09c5e: docs: Bring the README up to the brig we ship (@ananos)
• 82bc6e6: docs: Fix the claims that no longer hold (@ananos)
• 85c3452: docs: Retire the old profile, env and exec spellings (@ananos)
• 691e2c4: docs: add AI policy (@pmoust)
• bad7110: docs: add a release checklist (@pmoust)
• 731a3cf: docs: add release, CI, coverage, Go and license badges (@pmoust)
• e1e72eb: docs: document shell completion (@asapranidis)
• 7ab68c3: docs: name hull's real build target in the from-source instructions (@pmoust)
• 561b382: docs: say where completion stops, now that it is the parser's boundary (@asapranidis)

v0.1.0-rc17

Changelog

Features

• ad26de5: feat(brig): document and use stable exit codes (@pmoust)
• cf2c70e: feat(cli): print the execution envelope and add brig info (@pmoust)
• 4e31b2d: feat(envelope): report the isolation boundary of the sandbox (@pmoust)
• 4852e1d: feat(runtime): give a Linux sandbox a network of its own (@pmoust)
• b765d12: feat(telemetry): disclose telemetry and gate the boot on consent (@pmoust)
• a8d1c84: feat(telemetry): fix two disclosure claims and read enabled(setting) (@pmoust)
• e19d7c1: feat(verify): verify the digest that boots, not the tag (@pmoust)
• 7b2c0f3: feat(wrap): give a sandbox a network posture, and add an offline mode (@pmoust)
• bd9e76e: feat(wrap): refuse hvi on macOS below 15, and document what brig runs on (@pmoust)

Fixes

• 443f7e2: fix(brigd): arm the signal handler before binding the socket (@pmoust)
• fb8e86a: fix(brigd): make the session daemon safe to leave running (@pmoust)
• b64b8c9: fix(brigd): refuse a socket path the kernel cannot bind (@pmoust)
• 9851000: fix(cli): correct the envelope-skip comment and widen the leak scan (@pmoust)
• 10f52af: fix(cli): let env and ls answer with a broken or absent runtime (@pmoust)
• 754eff2: fix(cli): refuse a BRIG_NAME that drops the brig- prefix (@pmoust)
• 7acd90b: fix(cli): refuse unknown flags and stray arguments (@pmoust)
• 0f66df3: fix(cli): size the ls name column and list profile aliases (@pmoust)
• b50ace2: fix(creds): say which values BRIG_ENV_ARGV puts on the command line (@pmoust)
• f601d12: fix(git): refuse a hosts.yml that is not a regular file (@pmoust)
• 9b4501a: fix(profile): make the export-edit-run recipe work, and guard rm (@pmoust)
• d4f2bdd: fix(runtime): move the sandbox network off 10.87.0.0/24 (@pmoust)
• d3113c9: fix(runtime): tell a stopped sandbox from one that cannot be asked (@pmoust)
• df2303f: fix(script): boot the image check through brig, not the runtime (@pmoust)
• 114ce0b: fix(session): refuse a session-name collision, do not share (@pmoust)
• 504b805: fix(telemetry): gate consent on brig's stdin, not the guest pty (@pmoust)
• f5c901a: fix(verify): refuse an unrecognised BRIG_VERIFY, read BRIG_SKILLS strictly (@pmoust)
• da9bc3a: fix(verify): say whose policy checked the image, and stop advising the check off (@pmoust)
• e31a09a: fix(verify): verify the kernel a sandbox boots, not only its image (@pmoust)
• 9f45769: fix(wrap): echo the value set, trim it, and test the wiring (@pmoust)
• 3b48f49: fix(wrap): name the override when the registry cannot be reached (@pmoust)
• 70a5188: fix(wrap): open the workspace by descending where a guest can reach (@pmoust)
• 2b01aa9: fix(wrap): remember the workspace a sandbox was started with (@pmoust)
• 5e80e19: fix(wrap): require an explicit value for security switches (@pmoust)

Documentation

• 06cfd1e: docs(profiles): document size: on a tmpfs, and the unpublished flag (@ananos)
• a21111a: docs(security): add SECURITY.md and a private report channel (@pmoust)
• ae5303b: docs(security): capture the packets, and say what they show (@pmoust)
• 5f57557: docs(security): say per backend whether a sandbox can reach another (@pmoust)
• e96568e: docs(security): scope the no-host-read claim to credentials (@pmoust)
• f76b2ab: docs: add quickstart and troubleshooting pages (@pmoust)
• db72ad7: docs: describe the runtimes brig delegates to (@pmoust)
• 9ea8218: docs: quote the real image ref, claude-code-stock (@pmoust)
• 1d5918c: docs: scope the absolute safety claims in README and help (@pmoust)
• c639e8d: docs: scope the memory-only claim for ~/.claude (@pmoust)
• cdd605d: docs: write down what a guest image has to provide (@pmoust)
• e3e830e: docs: write down what brig will not do, and why (@pmoust)

v0.1.0-rc16

Changelog

Features

• fe6e42d: feat(creds): resolve only the secrets a run needs (@asapranidis)
• 1e1b741: feat(profile): drop optIn:, which no shipped profile uses (@asapranidis)
• 1179d5f: feat(profile): let a tmpfs say how big it is (@ananos)
• f3117c8: feat: add brig secret import (@asapranidis)
• dca404d: feat: add jsonfind and the stored-secret provenance codec (@asapranidis)
• b345314: feat: add the host-source reader the importer resolves through (@asapranidis)
• d2eafcc: feat: add volumes: and the files: binding it makes safe (@asapranidis)
• 8d551a4: feat: carry a value into the guest on stdin, never in argv (@asapranidis)
• b5bab74: feat: deliver a credential into an ephemeral .claude (@asapranidis)
• 2fe1443: feat: give secrets: an object form and env: a refs: chain (@asapranidis)
• 8bbe87c: feat: point at brig secret import now that the verb answers (@asapranidis)
• c0d7363: feat: rebuild the pre-boot expiry warning from stored provenance (@asapranidis)
• 4c418ff: feat: record where a stored secret came from, in the keychain comment (@asapranidis)
• acb444a: feat: report the imported guest login from stored provenance too (@asapranidis)
• 382a518: feat: rewrite the shipped Claude specs onto the new credential keys (@asapranidis)
• 75da1ef: feat: validate secret sources and ref chains at parse time (@asapranidis)
• eb5f7dd: feat: warn that hostCredential: and BRIG_CREDENTIALS_CMD are going (@asapranidis)

Fixes

• 2e03381: fix(creds): send an expired secret to the import form that can renew it (@ananos)
• 6ee4015: fix(hostsrc): pin the keychain tool, and tell a missing one from a refusal (@ananos)
• 2f32394: fix(profile): keep the user's own config across boots, and size the tmpfs (@ananos)
• b04d243: fix(secret): bound what --from-command reads, and keep its output out of brig's (@ananos)
• ed937fb: fix(secret): keep provenance honest across an update, a locator and a ceiling (@ananos)
• 8398bfb: fix: name the expired secret, and not a verb that does not exist yet (@asapranidis)
• 56e7bc3: fix: stop telling a user a declared secret is not declared (@asapranidis)

Refactors

• 479e0a1: refactor(wrap): mount each tmpfs with its own options (@ananos)

Documentation

• 2bde74c: docs(profile): replace the refresh-token unknowns with measurements (@ananos)
• cec3a17: docs(profile): say why the guest gets the refresh token too (@ananos)
• af24517: docs: correct the tmpfs mode finding in the stdin manual test (@asapranidis)
• f3bb521: docs: document the import verb, files:, volumes: and what they cost (@asapranidis)
• 8d1534d: docs: give import its own usage line, and mark BRIG_CREDENTIALS_CMD (@asapranidis)
• 7cfbfb3: docs: match the house style in prose and comments this change added (@asapranidis)
• 7831dc2: docs: record what claude-code deliberately lets go ephemeral (@asapranidis)
• 686560b: docs: scope the no-host-read promise, and say what an in-sandbox login costs (@ananos)

v0.1.0-rc15

Changelog

• 935c27a: feat: add brig, a sandbox runner for coding agents (Anastassios Nanos ananos@nofire.ai)

v0.1.0-rc14

Changelog

• c51b09f: feat: add brig, a sandbox runner for coding agents (Anastassios Nanos ananos@nofire.ai)

v0.1.0-rc13

Changelog

• 5b5240a: feat: add brig, a sandbox runner for coding agents (Anastassios Nanos ananos@nofire.ai)

v0.1.0-rc12

Changelog

• d0645c3: feat: add brig, a sandbox runner for coding agents (Anastassios Nanos ananos@nofire.ai)

v0.1.0-rc10

Changelog

• d2fa131: feat: add brig, a sandbox runner for coding agents (Anastassios Nanos ananos@nofire.ai)

v0.1.0-rc9

Changelog

• d213a5b: feat: add brig, a sandbox runner for coding agents (Anastassios Nanos ananos@nofire.ai)

v0.1.0-rc8

Changelog

• 6b03535: feat: add brig, a sandbox runner for coding agents (Anastassios Nanos ananos@nofire.ai)