v1.6.0: rebuild safety — upgrade-safe drop-ins, verify invariants, supervised daemons

Devbox Anywhere v1.6.0 — rebuild safety: upgrade-safe customization, honest verify, supervised daemons

Your customizations now survive an upgrade, verify checks the things that actually break after a rebuild, and long-running agent gateways come back on their own.

What's new

• Upgrade-safe relink drop-ins. Add your own persistent links as ~/.local/share/devbox-relink.d/*.conf files: one literal <target> <link> pair per line, absolute paths, no $HOME. They load after the shipped links in LC_ALL=C order, and a later file wins. A missing source, malformed line or unreadable directory is reported and skipped, never linked wrong.
• Upgrades preserve your edits. If an upgrade would overwrite a helper you changed, the installer first copies it to <helper>.pre-upgrade.<utc>.bak and prints a machine-readable PRESERVED notice. For devbox-relink it also lists any custom relink lines (CUSTOM_RELINK_LINE …) so you can re-add them as drop-ins. They aren't migrated automatically. Unchanged helpers are left alone.
• verify checks the hands-off invariants (warn-only, schema v2).
  • relink.targets warns when a managed link is broken: a shipped default that's missing or replaced by a real file/dir, or a drop-in whose source is gone.
  • daemon.<name> warns when a declared daemon isn't running.
  • Both are warn-only, so they never flip ok and never block an install that was fine before.
• devbox-daemon — declare a long-running process in ~/.local/share/devbox-daemons.d/<name>.conf (name, command, optional tmux_session). It starts last at every boot, idempotently, and comes back after a container rebuild with no human action. verify delegates liveness to it. docs/10 describes the rebuild-safe path for messaging gateways (hermes gateway install isn't usable in this image because systemd isn't PID 1).

Fixed

• gh auth login couldn't persist on a fresh install (present since v1.0). ~/.config/gh was a dangling link until the store existed, and gh's directory-create fails against a dangling link (mkdir …/.config/gh: file exists). devbox-relink now pre-creates the directory sources (gh-config, terminfo). File sources (gitconfig) still write through as before. docs/09 explains which is which.

Upgrading from v1.5.x

Run the installer from the new release as usual. If you hand-edited ~/.local/bin/devbox-relink, read the PRESERVED / CUSTOM_RELINK_LINE output and move those lines into a drop-in. Your backup stays next to the helper.

Known issue (pre-existing, fix planned for v1.6.1)

verify's service.ssh check probes sshd with an unauthenticated ssh-keyscan from inside the container. OpenSSH 10's default PerSourcePenalties blocks 127.0.0.1 after about 15 rapid probes, so running verify many times in a row can return a false ok: false that heals by itself a few minutes later. This has been present since v1.2.0. If you script retries, space them out.

Testing

• Full canonical suite green, 51/51 named mutation reds. New tests run the real verify probe against the real shipped devbox-relink in a clean HOME, not canned output.
• Real-upgrade container smoke PASS on Ubuntu 24.04 / Docker 29.1.3 / Compose v2.40.3: a v1.5.0 install with an in-file custom relink, upgraded to this release. It covered preservation notices and backup, drop-in re-add, an idempotent re-run, verify pass/warn behavior on healthy, dangling and absent links, gh and git write-through on a fresh box, and a daemon plus drop-in link restored after compose down/up. The only failure was the known service.ssh issue above, root-caused and reproduced on its own.

Base: v1.5.0 (9190eba).