Skip to content

Devbox Anywhere v1.2.0

Choose a tag to compare

View all tags
@hubbvee hubbvee released this 13 Aug 21:00
· 81 commits to main since this release
v1.2.0
01cdaa7

Devbox Anywhere v1.2.0

This release adds a secure, agent-oriented operating layer for Devbox Anywhere while keeping scripts/install-devbox as the sole authoritative privileged installer.

New: deterministic agent harness

scripts/devbox-anywhere provides schema-versioned JSON and stable check IDs for terminal-capable assistants:

  • preflight checks Linux, required tools, Compose v2, and local Docker availability.
  • plan validates an exact installer-bearing commit and reports paths, listeners, approvals, and the installer command without changing the server.
  • verify validates trusted installer state, expected ports and writable mounts, helper installation, and HTTP/SSH readiness.
  • diagnose reports failed checks and safe recovery information without mutating the installation.

New: Hermes umbrella skill

skills/devbox-anywhere/ packages the operating workflow for Hermes Agent, with six references covering:

  • installation and upgrades;
  • verification and diagnosis;
  • Telegram project topics;
  • coding-agent handoffs;
  • backups, restoration, and rebuilds;
  • security and approval boundaries.

Install the skill by copying its complete directory from this exact verified stable checkout. Start a new Hermes session afterward so the skill index refreshes.

Security and reliability hardening

  • Privileged installer and harness Docker operations use an isolated Docker configuration and the local built-in default context.
  • Stable-release and exact-commit source validation remain mandatory.
  • The privileged checkout remains fixed at /opt/devbox-anywhere; persistent state remains fixed under /data/devbox.
  • code-server and container SSH remain loopback-only by default.
  • Public container SSH still requires explicit --expose-ssh selection and separate firewall preparation.
  • Human approval remains required before sudo, container build/start, firewall, or public-network effects.
  • Machine-readable parser errors do not reflect arbitrary or secret-shaped arguments.

Documentation and proof

  • README now explains the Hermes skill and harness, their four commands, installation, and security boundaries.
  • Canonical tests cover installer acceptance, exact Compose semantics, lifecycle and source trust, the agent harness, Hermes packaging, runner inventory, and 24 named mutation reds.

Within the independently reviewed and tested scope, there are no known release blockers. A complete real image build/runtime installation was not performed on the review hosts because Docker was unavailable there.

Assets 2
Loading