Skip to content

v0.2.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 05 Sep 21:58
· 85 commits to main since this release
v0.2.0
8d67295

devbox 0.2.0 — the sandbox that shows you what your coding agent did

One command runs an agent inside an isolated Linux VM and hands back a report of that run: the files it wrote, the hosts it reached with TLS names and bytes, the processes it spawned, the credentials it used, and how much of that the collector actually saw.

$ devbox run -- claude
run 01M1S4M245XA0DBDZKR6CV8YGF · 1.5s · exit 0 · finished
  files    1 changed (1 added, 0 modified, 0 deleted) · scope: run
  network  1 peers · 1 DNS · ↑1.9KB ↓6.3KB
  process  23 in the tree
  coverage full (ebpf+packet+netfilter) · 42 events · 0 dropped
  report   ~/.devbox/runs/<box>/01M1S4M245XA0DBDZKR6CV8YGF/report.html

New

  • Runs and reports. devbox run -- <cmd> records a run (cgroup-scoped, with process-tree and time-window fallbacks), brackets it with overlay checkpoints, and renders a self-contained HTML/Markdown/JSON report. devbox runs, devbox report, and a Runs tab in the console. exec and shell are recorded as runs too.
  • Credentials stay on the host. devbox secret set <provider> keeps API keys and tokens in the OS keychain; a host-side broker injects them per request within a declared scope and records every use as a credential event. The v4 code that copied ~/.claude/.credentials.json and ~/.codex/auth.json into the box is gone. Secret-looking values in command lines are redacted before they are recorded.
  • Overlay checkpoints. devbox layer checkpoint, checkpoints, diff --from/--to, restore, checkpoint-rm. The walk now recognises whiteouts and opaque directories, which v4's diff did not.
  • MCP servers in a box. devbox mcp add <name> -- <cmd> registers a stdio MCP server to run inside a box; devbox mcp run <name> is what Claude Code or Codex launch, and each session is a run with a report. devbox mcp self exposes runs, reports, and behaviour summaries to the agent as MCP tools.
  • Export. devbox export --format ocsf|otlp-json|jsonl, per run or per time window. Every OCSF class validated against the schema server; brokered credential use is API Activity 6003.
  • The eBPF agent ships in source builds. Per-architecture CO-RE objects are committed, so cargo build embeds the kernel-level agent; connections carry pids, TLS names are read even when the ClientHello spans two TCP segments, and bytes are settled at tcp_close. devbox doctor says which capture sources are live and what the file-event scope is.
  • Agents and the collector replace themselves by content hash, not by version string.

Changed

  • The network lab and the ZTP fabric are removed; their code is archived outside this repository.
  • Box names are positional everywhere (devbox policy show mybox); --name still works as a hidden alias.
  • File events are scoped to /workspace and the user's home, filtered in the agent.
  • origin/main's Incus and image-caching fixes since March are merged in.

Known limits

  • Incus and Docker paths for the new features are implemented but were verified only on Lima.
  • gh cannot be brokered (it insists on HTTPS to its host); git over HTTPS is.
  • devbox code (Remote SSH) does not yet receive the broker variables.
  • Events recorded before 0.2.0 keep any secret that was in an argv at the time; they are redacted when read, not rewritten in the store.

Design: docs/plans/2026-09-05-devbox-v5-design.md. Decisions: ADR-0056 through ADR-0067 in DECISIONS.md.

Full Changelog: v0.1.6...v0.2.0

Assets 4
Loading