v0.38.0

Highlights

Kit spec v2. A new schema is available for authoring kits, with a clearer structure for setup, permissions, agent instructions, networking, and credentials. Use schemaVersion: "2" for new kits; existing v1 kits continue to load through the legacy path. See the kit spec reference for migration details.

MCP management is now a first-class feature. Register remote or local MCP servers once with sbx mcp, then reuse them across supported agents and sandboxes through a built-in MCP gateway. OAuth credentials stay on the host, and organizations can govern server registration and tool calls with Cedar policies. See the MCP gateway documentation.

What's new

CLI

• sbx create and sbx run show detailed structured progress during startup, including environment files loaded, resources provisioned, and each kit command's outcome; kit-install progress streams live during sbx create --kit.
• Added sbx daemon restart to stop and restart the sandboxd daemon in the background.
• sbx inspect now displays custom secrets configured for a sandbox.
• DOCKER_SANDBOXES_CLONED_WORKSPACE_SIZE configures the size of the cloned workspace volume.
• sbx setup ssh warns when ssh is missing from PATH, and on Windows when sh (required by Claude Desktop's SSH ProxyCommand) is missing.
• Port publishing failures now identify the affected host port and explain when the OS requires extra daemon privileges.

MCP

• The sbx mcp subcommand is now available for managing MCP servers.
• Includes dynamic MCP tools (mcp-find, mcp-add, mcp-config-set) for attaching registered servers to sandboxes.
• Govern MCP servers and tools for your organization using Cedar policies.

Networking & policy

• --deny-network HOST on sbx run and sbx create records per-sandbox network deny rules at creation time, with layer-aware egress messages.
• sbx policy allow network reports a clear "managed by your organization" error when org governance overrides the local allow, and failed rule removals now explain what went wrong using a single rule identifier.
• Signing in refreshes organization policies in the running daemon immediately instead of waiting for the next polling interval.
• IP-literal destinations denied by a CIDR rule fail fast with a policy message instead of timing out.
• Blocked HTTPS proxy connections appear in sbx policy log even when the client aborts the TLS handshake.

Secrets & credentials

• Service and custom secrets are global by default, with --sandbox for sandbox scope; legacy positional and --global forms are deprecated with warnings.
• Sandbox-scoped GitHub credentials added after creation now work without recreating the sandbox.
• Pressing Ctrl+C while entering a secret cancels the command without saving it.

Agents

• Docker Agent and OpenCode sandboxes can authenticate GitHub Copilot requests with proxy-managed GitHub credentials.
• Codex sandboxes created from the TUI prefer stored OpenAI OAuth credentials over API keys; kit environment variables now reach cloud agents, and git no longer hangs Codex startup prompting for credentials.
• Shared agent skills: directory symlinks under the skills folder are resolved and their contents imported.

Kits & templates

• Kit specs use the new v2 grammar.
• Kits using extends correctly inherit and override the base image or build source of their parent.
• Kit install commands can consume static files from files/home, including binary files.

Packaging

• Homebrew installs from a stapled .dmg artifact rather than a .tar.gz archive, improving Gatekeeper compatibility on macOS.
• Windows: the running sandboxd daemon is stopped during a WinGet/MSI upgrade so client and server end up on the same version.

Security

• Claude Desktop SSH sessions no longer expose Desktop OAuth access tokens inside sandboxes.
• Fixed a destination-escape flaw in sbx cp copy-out (CVE-2026-17106).
• The daemon's loopback egress proxy only serves the daemon's own traffic, preventing other local users on a multi-user host from reaching the configured upstream proxy through it.

Bug fixes

• Fixed a hang where sandboxd stopped answering all endpoints and could not be stopped without SIGKILL after a crash; fatal daemon tracebacks are now included in sbx diagnose --upload bundles.
• Fixed intermittent sandboxd startup failures when a running daemon was slow to answer its health check.
• Fixed sbx daemon stop hanging when an idle SSH session (for example, Claude Desktop) was connected to a sandbox.
• sandboxd automatically repairs a corrupted local image cache by re-pulling the image, and otherwise reports a clear "run sbx daemon reset" error.
• Fixed recreate failures ("base image not found") after daemon restarts when swapping a sandbox's container via sbx kit add; recreates self-heal by recomposing from the sandbox's template.
• Fixed reverse DNS (PTR) lookups from sandboxes returning NXDOMAIN for container-resolved addresses.
• Fixed a goroutine and network-endpoint leak from hijacked HTTP CONNECT tunnels that could eventually stall sandbox creation after many delete/recreate cycles.
• Fixed an intermittent 500 error when deleting a sandbox while its network endpoints were being torn down.
• The daemon restores saved sandboxes' network proxies in parallel on restart, speeding up startup with several sandboxes and fixing a potential crash during first-run policy application.
• Fixed host .git/config corruption when creating a sandbox for repositories using includeIf directives in ~/.gitconfig; the sandbox now writes git identity only to the container's gitconfig.
• sbx skills shows a single usage form and clearer help for importing shared agent skills.
• sbx no longer reports that a stored credential was not injected when the daemon injects it.

Experimental features

Enterprise networking

Settings-driven upstream-proxy configuration with separate sandbox and daemon scopes, integrated NTLM/Kerberos proxy authentication on Windows.

• Configure separate proxy settings for sandbox and daemon traffic using proxy, proxy.sandbox, proxy.daemon, and the matching no_proxy settings. These default to the host operating system's proxy settings. The daemon's own traffic, including image pulls and telemetry, also uses the configured proxy.
• On Windows, sbx can authenticate to upstream proxies that require integrated NTLM or Kerberos/Negotiate authentication. Enable this behavior with the proxy.integratedAuth setting.
• If a TLS-inspecting proxy issues certificates with negative serial numbers, enable compatibility with sbx settings set tls.allowNegativeSerial true, then restart the daemon.

GPU passthrough

Run a sandbox with NVIDIA VFIO GPU passthrough on Linux using sbx run --gpu. Enable this feature with sbx settings set feature.sandbox-gpu true.

Local models

Run Claude Code against a local GGUF model with sbx run --model <name> claude. To use a model from an existing Ollama installation, prefix the model name with ollama/. See Claude Code > Use a local model.