v1.8.0: named instances, read-only status gate, bot guide

Devbox Anywhere v1.8.0: named instances, read-only status gate, bot guide

v1.8.0 lets a hosted bot (or any script) watch a devbox without getting a shell, and lets you run a second, separate devbox on the same server for it. Everything is opt-in. An existing install behaves as before, with one new helper that does nothing until you configure it.

What's new

• Named instances: install-devbox --instance NAME --web-port P --ssh-port P [--with-browser --browser-port P] creates a second devbox with its own data root (/data/devbox-NAME), container, Compose project (devbox-NAME) and loopback ports.
  • The name is validated strictly. Reserved names and the default ports are refused, and so is a port that is already in use (it fails closed when ss is missing).
  • It refuses to adopt a container it didn't create, and never takes a path (--data-root is still rejected).
  • devbox-anywhere plan|verify|diagnose|preflight accept --instance.
• devbox-status-gate: a read-only forced command for an SSH key (restrict,command="/home/coder/.local/bin/devbox-status-gate" ssh-ed25519 ...).
  • It allows exactly version, list and status <project> [--json]. Anything else is denied with exit 126.
  • It runs the status tool in a clean environment and keeps an owner-only audit log, rotated once at 256 KiB.
  • It is installed and checked by verify like the other helpers, and does nothing until you add a key line.
• Status board fix: status now proves an agent's tmux window exists before it reads activity. It matches the exact name, then addresses the window by id. An agent with no window reads unknown, not another window's activity. An ambiguous or forged window is never reapable.
• Status hardening:
  • Every pane of a split window counts toward activity.
  • Turn output is parsed fail-closed, and the turn lock's timestamp is validated.
  • JSON escapes control bytes and invalid UTF-8, and the table prints only printable ASCII.
  • status no longer takes git's index lock.
  • An unreadable worktree marks only that agent as error.
  • Registry rows are read byte-wise in every locale.
• New guide: docs/14: Let a bot manage your devbox. It covers a separate instance for the bot, the gate, a forwarding-only tunnel account and compromise recovery. It states the trust model plainly: the gate protects the instance from the bot's key, not the reverse.
• docs/03 gains "Running a second instance", and docs/13 corrects the reapable rules.

Upgrading from v1.7.x

1. Move your approved checkout to the v1.8.0 commit.
2. Re-run the installer with the same flags you first installed with (--expose-ssh, --with-browser). A bare re-run moves SSH back to loopback and leaves the browser out.
3. Until you re-run, verify reports the new helper.devbox-status-gate check as failing. That is expected.

status --json objects gain an additive error field. schema_version stays 1. If a consumer checks the exact set of keys, allow the new one.

Testing

• Test suites: the full suite passes on macOS (bash 3.2) and Linux (bash 5.2 with real tmux), with 156/156 named mutation reds.
• Container smoke on a disposable Ubuntu 24.04 Docker-in-Docker host: 65/65 checks pass.
  • The default install is unchanged.
  • Refusals happen before anything is built.
  • A second instance runs beside the default without recreating it, and each instance's re-run leaves the other alone.
  • Through real sshd, the gate allows its three commands and denies injection, shells, login and port forwarding.
  • Removing the instance leaves the default running.
• Review: the whole branch was reviewed independently across installer security, gate security, docs vs code, test quality and release hygiene, and the fixes were reviewed again. All 28 confirmed findings were fixed.

Base: v1.7.0.