devvm 0.1.1-rc.2

A release candidate for 0.1.1, adding to 0.1.1-rc.1. Install it with devvm upgrade --to 0.1.1-rc.2, the install script's --version 0.1.1-rc.2, or brew install devvmhq/tap/devvm-rc. Homebrew's devvm stays on 0.1.0.

After you upgrade

• Base and every image built on it are built again once, for transparent mode's programs.
• Run devvm update in an existing VM's folder to give it transparent mode, which new VMs get by default: its image predates the programs it needs.
• On a Linux host, run devvm mount-cache none for each existing VM, to stop the 9p cache bug below. Each launch reminds you until you do.
• If you used devvm git-protect strict, use devvm clone on for code you don't trust: strict is gone.
• Make new API keys for any VM you don't trust that had keys passed to it as they were.

New

• Transparent mode (#35), on by default: on every tier but open, tools that ignore the proxy settings, such as wrangler dev, static Go binaries and containers, reach the VM's proxy and its allowlist anyway. A VM made before needs devvm update first, and devvm network transparent off turns it off for a VM (what it covers).
• Folders of repos with --clone (#3): one VM gets a clone of each repo you pick, at the same paths. devvm clone fetch brings back every repo's work, and devvm clone add PATH adds one (folders of repos).
• Rules by HTTP method and path: --method and --path on devvm network allow, deny and rm, such as devvm network deny api.github.com --method POST,PUT,PATCH,DELETE.
• Your own secrets: devvm secret set NAME --host HOST --env VARIABLE, then devvm secret use NAME. The VM only ever sees a placeholder, and --method and --path limit where the real value goes.
• Learning a VM's hosts (#17): --network learn, then devvm network lock to keep the hosts you choose.
• .git protection on Linux (#4, #20): .git is locked read-only around QEMU, without root. Where a host can't, such as Ubuntu with AppArmor, devvm watches .git, warns at each launch, and names what changed.
• Nested repos (#3): a VM protects the .git of each repo up to 4 folders down. devvm doctor suggests safe.bareRepository explicit.
• pi and more providers (#23, #31, #32): pi is a fourth agent, and Gemini, Groq, Mistral, xAI and DeepSeek keys stay on this machine.
• Prereleases on Homebrew (#19): brew install devvmhq/tap/devvm-rc.

Changed

• The 9p cache on Linux (#36): Lima's default cache could write files to this machine empty or cut short, and made SQLite and Gradle fail. New Linux VMs use none, and devvm mount-cache none switches existing ones. Under none, keep SQLite WAL databases and other files that programs map for writing on the VM's own disk, or use --clone. macOS doesn't change.
• A --clone VM in a folder another VM mounts is refused, and devvm rm asks before deleting one made earlier.
• Logins: a VM's copy of Codex's and Claude Code's login files keeps only the fields devvm knows. opencode, like pi, gets no key devvm doesn't bind, unless you list the provider in config.toml's [pass-keys] (#30).
• Warnings print once per command.
• Nix is 2.35.5.

Removed

• devvm git-protect strict (#37): it couldn't keep git on this machine out of submodules the VM adds, so it's a usage error now. Strict VMs become on, and devvm takes out the diff.ignoreSubmodules = all it set, keeping a value of your own (VMs that were strict).

Fixed

• opencode's history copy with SQLite 3.54 (#26), a NUL byte in an ssh socket's path (#25), a build VM reusing its clone's ssh port, a login saved for an agent the VM lacks (#27), and .git protection locking a folder that only looks like a git folder (#28).