v0.9.0

Add cell start/stop, Windows VM engine, WireGuard tunnels, and declarative packages

Summary

Cells can now run detached (cell start/cell stop), provision Windows VMs end-to-end via cell build --engine=qemu, tunnel outbound traffic through WireGuard peers, declare nixpkgs in devcell.toml, and inject a project-level flake.nix at boot. Internally, Windows/WinPE tooling moved to external repos (go-winkit, go-regedit, go-wimlib, go-nixoci), nixhome moved to devcell-sh/community-home, and all legacy build paths (impure, Dockerfile, pure) were removed in favor of thin-only builds.

Breaking changes

• --impure, --pure, --no-thin, --thick flags removed: every Docker build now runs the thin nix-on-volume flow
• --nixhome, --local-nixhome flags removed: nixhome source is now env-driven (DEVCELL_NIXHOME) or upstream-defaulted
• task nix:validate and image:pure:* tasks removed: use community-home's own validation

Changes

• feat(cmd): cell start/cell stop for detached container lifecycle; cell shell reuses a running container instead of duplicating it
• feat(cmd): cell build --engine=qemu with WinPE bootstrap, DISM offline servicing, Hyper-V/WSL2 transplant, and SSH-wait install pipeline
• feat(cmd): default_command so bare cell launches a configured tool; deterministic session resume per tmux pane
• feat(cfg): [docker] resource limits (mem_limit/cpu_limit/shm_size), [[wireguard]] VPN tunnels, [packages] for declarative nixpkgs, project-level flake.nix injection at boot
• feat(cli): --openrouter extends to codex/opencode; cell telemetry on/off/status with PostHog
• feat(gui): cell-ID wallpaper, HiDPI, D-Bus, SNI tray, swappable WM (IceWM/Fluxbox)
• feat(nix): graynet module (Tor SOCKS proxy); stealth L3 probes (WebGL, codec, timezone, brand)
• fix(cmd): cell -c and agent flags no longer die at root-command parsing
• fix(cfg): [[volumes]] deduplication prevents Docker "Duplicate mount point" errors
• fix(nix): wimlib builds on aarch64; vendorHash sync improved
• refactor: extract 7 internal packages to external Go modules; nixhome to community-home; thin-only builds

What's Changed

• macOS VM engine, persistent PTY sessions, Go-native nix-cache pipeline by @DimmKirr in #44
• Add cell start/stop, Windows VM engine, WireGuard tunnels, and declarative packages by @DimmKirr in #45

Full Changelog: v0.8.2...v1.0.0

v0.8.2

What's Changed

• [CELL-296] [[volumes]] mount accepts a single path, and thin imagesstop losing packages when another stack rebuilds against the shared nix-store volume by @DimmKirr in #43

Full Changelog: v0.8.1...v0.8.2

v0.8.1

What's Changed

• [CELL-296] [[volumes]] mount accepts a single path, and thin images stop losing packages when another stack rebuilds against the shared nix-store volume by @DimmKirr in #42

Full Changelog: v0.8.0...v0.8.1

v0.8.0

What's Changed

• Add Cloudflare Workers configuration by @cloudflare-workers-and-pages[bot] in #39
• Modules 2.0, cell build --thin default, cell-open boot checklist, Stealth L2/L3 verification suite, cell serve --workspace MS RemoteApp feed, cell auth kube, vocabulary rename (session → cell, CellID → Bunk) by @DimmKirr in #38
• [CELL-294, CELL-296] cell chrome/cell login become cell auth chrome, [[volumes]] mount accepts a single path, and thin images stop losing packages when another stack rebuilds against the shared nix-store volume by @DimmKirr in #41

New Contributors

• @cloudflare-workers-and-pages[bot] made their first contribution in #39

Full Changelog: v0.7.0...v0.8.0

v0.7.0

What's Changed

• First-Run Image Pull (minutes → seconds), Serve Background+SSE, Gemini Agent, Patchright Chromium Extensions (CapSolver pinned), Docker Disk Reclaim, Login Cookie Freshness, Claude Code 2.1.158 by @DimmKirr in #37

Full Changelog: v0.6.0...v0.7.0

v0.6.0

What's Changed

• cell serve gains OpenAI Responses API + SSE streaming, configurable system prompts across flags/env/toml, and per-stack user-image tagging that ends per-session image sprawl by @DimmKirr in #36

Full Changelog: v0.5.0...v0.6.0

v0.5.0

Changes

Vagrant engine (no Docker required)

Run cells as native VMs instead of Docker containers — useful for Apple Silicon without Docker Desktop, or when you need full Linux kernel features.

cell claude --macos          # provision Debian ARM64 VM via UTM, then open Claude Code
cell build --macos           # re-apply nixhome flake inside the VM
cell rdp --list              # shows docker + vagrant cells side by side

Set permanently in .devcell.toml:

[cell]
engine = "vagrant"
vagrant_provider = "utm"     # utm (macOS) or libvirt (Linux)
vagrant_box = "utm/bookworm"

On first run: scaffolds a Vagrantfile, starts the VM, installs Nix single-user, and applies the same home-manager configuration used by Docker images. Subsequent runs skip provisioning if already done.

cell models: cloud + local side by side

cell models now shows Anthropic, OpenAI, and Google models (via OpenRouter) alongside local ollama models, ranked by SWE-Bench score and speed.

cell models                  # all models, ranked
cell models --source=local   # ollama only
cell models --source=cloud   # OpenRouter only
cell models --format=json    # machine-readable output

Results are cached on disk (XDG_CACHE_HOME/devcell/) and refreshed in the background — no network wait on repeat invocations.

cell login: bot-detection bypass redesigned

The two-phase login flow now passes Cloudflare, Kasada, and similar systems:

• Phase 1: opens a clean browser on your host — no --remote-debugging-port, no CDP flags, indistinguishable from a normal user session
• Phase 2: after you close the browser, a separate headless CDP instance reads cookies from the same profile and writes storage-state.json

Your fingerprint (User-Agent, platform, browser brands) is read from your real installed Chrome binary and saved alongside the session so Patchright replays with a matching identity.

cell login https://example.com   # clean browser → you log in → cookies sync to container
cell login --force https://...   # wipe saved session and start fresh

cell claude: auto-selects best available model

When use_ollama = true and no model is pinned in config, cell claude now queries running ollama instances and sets ANTHROPIC_MODEL to the top-ranked model by composite SWE-Bench + speed score. No manual model configuration needed.

codex --ollama: local ollama provider

cell codex --ollama          # use ollama as local provider

Or set permanently: use_ollama = true in [codex] section of .devcell.toml. Injects --oss, --local-provider ollama, and CODEX_OSS_BASE_URL automatically.

--format flag for machine-readable output

All listing commands now accept --format=text|json|yaml:

cell models --format=json
cell rdp --list --format=yaml
cell vnc --list --format=json

Prose output is suppressed in non-text modes.

Android module

modules = ["android"]

Adds: ADB + fastboot (all platforms), Android SDK + build-tools + emulator + apktool + jadx (x86_64 only).

docker_privileged config

[cell]
docker_privileged = true

Adds --privileged to docker run. Required for workloads that need /dev/kvm, nested Docker, or full Linux capabilities inside the container.

Build error hints

cell build now parses docker build output for known failure patterns and shows actionable hints — disk space exhaustion, nix eval errors, package collisions — instead of raw build output.

Fixes

• cell rdp --list and cell vnc --list now show vagrant-engine cells alongside Docker containers
• Image registry consolidated to public.ecr.aws/w1l3v2k8/devcell (GHCR mirror removed from docs)
• Codex nixhome config no longer sets stale oss_provider = "lms" entry

What's Changed

• Run cells as native VMs instead of Docker containers — useful for Apple Silicon without Docker Desktop, or when you need full Linux kernel features. by @DimmKirr in #35

Full Changelog: v0.4.2...v0.5.0

v0.4.2

What's Changed

• Remove CompareSection and add FAQ differences for DevCell vs competitors by @DimmKirr in #34

Full Changelog: v0.0.0...v0.4.2

v0.4.1

What's Changed

• Update dependencies versions in go.mod and go.sum by @DimmKirr in #33

Full Changelog: v0.4.0...v0.4.1

v0.4.0

New commands

• cell chrome — open host Chromium with a project-scoped profile, log into sites, press Enter. Cookies export as Playwright storage-state.json with matching UA fingerprint so MCP replays authenticated sessions inside the container.
• cell login <url> — shortcut: opens a URL directly for quick auth and cookie sync.
• cell serve — local ollama-compatible API proxy with Anthropic endpoints. Claude Code and Codex work with local models without per-tool API key setup.
• cell init is now interactive and project-local. Creates .devcell.toml + .devcell/ in the current directory with stack and module selection.

New config sections

• [aws] — read_only = true scopes container credentials to read-only via IAM session policy. AI agents can query CloudWatch and read S3 but cannot modify anything.
• [op] — documents = [...] replaces the old items field. 1Password-resolved env vars are written to tmpfs; secrets never touch disk.
• [ports] — forward = ["3000", "8080:3000"] for container-to-host port forwarding.
• [mise] — forwarded as MISE_* env vars.
• [cell] — new locale field. Container locale matches the host instead of defaulting to POSIX.

New nix modules

• postgresql — PostgreSQL client tools
• project-management — Linear, Notion, and project tracking tools
• qa-tools — testing and quality assurance utilities
• security — Hexstrike AI security scanner and penetration testing tools
• stripe-cli added to financial module

Patchright bot-stealth

Playwright MCP is now nix-packaged with a stealth init-script, runtime TZ/locale injection, and human-like Bezier mouse trajectories. Passes bot detection including mouse-movement analysis.

Composable flake exports

devcell.lib.mkHome, devcell.stacks.*, and devcell.modules.* are now exported from the nixhome flake. Build custom stacks in user wrapper flakes without forking.

Fixes

• cell build auto-rebuilds when build context is newer than the existing image — no more silently running stale containers after a config change or failed build.
• Stack picker shows compressed Docker download sizes (ultimate shows ~7.6 GB, was ~2.9 GB nix-only number).
• Container shared memory increased to 1 GB — drawio-headless and Chromium no longer crash on large renders.
• Hexstrike server working directory redirected to /tmp — hexstrike.log no longer pollutes the project directory.

Infrastructure

• Renamed base stage to core across Dockerfile, bake targets, and CI.
• Images published to ECR Public (public.ecr.aws/w1l3v2k8/devcell) alongside GHCR.
• CI uses nix-cache pre-seeding via skopeo + zstd compression for faster builds.
• Separate deploy-site.yml workflow; dev releases marked as prerelease.
• Replaced pterm with charmbracelet (lipgloss + huh + bubbletea) for brand color palette and adaptive theming.
• Moved codex, opentofu-mcp, playwright, patchright-mcp from npm to nix for reproducible builds.

Full Changelog: v0.3.0...v0.4.0a