Skip to content

mgit v0.4.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 06 Aug 06:19
· 82 commits to main since this release
v0.4.0
4c5a62d

mgit — a sandboxed, checkpointed working substrate for LLM coding agents

mgit gives a coding agent two things together: containment — its untrusted code (npm/pip installs, builds, tests) runs in a disposable per-task microVM, not on your machine — and a checkpointed working substrate — every step is a task-tagged micro-commit in an isolated .mgit store that never touches your real .git, so you review and land only the squashed result.

Beta. The microVM sandbox is the differentiator; it is live-validated on Linux (firecracker/KVM) and macOS (Apple Virtualization.framework, arm64). Windows runs core mgit without the sandbox. See Known limitations in the CHANGELOG.

Highlights

  • Per-task microVM containment — installs/builds/tests run in a disposable, hardware-isolated VM; a poisoned dependency burns the VM, not your host. Default-deny per-task egress allowlist; verified land (dual-hash + task binding + host-anchored attestation) through an airlock.
  • mgit work — one command starts an agent on a task: a task-bound worktree with the agent's shell wired through mgit run into the sandbox.
  • Runs over your existing git repo — a self-contained .mgit store; your project's .git is provably never mutated, and the base stays in sync with your local working state automatically (no manual sync).
  • Checkpointed, reviewable history — task-tagged micro-commits; backtrack / fork / cherry-pick to course-correct; squash --to-git | git apply lands a byte-for-byte patch.
  • Multi-agent worktree isolation, REST + MCP integration surfaces, dual-hash integrity, append-only audit.
  • Pure Go, zero CGO — single static binary (Linux, macOS, Windows; amd64 + arm64).

Quality

  • 530+ automated tests, race-detector clean under -race, zero lint warnings.

Install

Each archive below ships two host binaries: mgit and, where a
sandbox backend exists (Linux and macOS arm64), the mgit-sandboxd
daemon next to it. Homebrew installs both.

# Homebrew (installs mgit + mgit-sandboxd)
brew install hyper-swe/tap/mgit

# Go — core mgit
go install github.com/hyper-swe/mgit/cmd/mgit@latest

# Go — the sandbox daemon (Linux works out of the box; on macOS the
# go-installed binary is unsigned and needs the virtualization
# entitlement — prefer brew or the release archive there)
go install github.com/hyper-swe/mgit/cmd/mgit-sandboxd@latest

# Binary — download the archive below for your platform (contains both)

The microVM sandbox also needs a guest image; see
docs/INSTALL-SANDBOX.md.

Pairs with mtix

mgit + mtix form a closed loop for enterprise AI-driven development: mtix tracks what to build, mgit tracks what was built. Task IDs flow between both systems. The unit of failure is a task, not a session.

Changelog

  • 94b68ed build(sandbox): reproducible, SOUP-pinned guest-image build (MGIT-30)
  • e191bfa chore(mtix): capture libkrun/netstack decisions and follow-up tasks
  • 84727f3 chore(mtix): reconcile the backlog with the single-backend decision
  • 161d3cf chore(mtix): record libkrun lifecycle, litmus and coverage findings
  • 20e5f2e chore(mtix): record the GA-readiness decisions and follow-up tickets
  • 3c80887 chore(mtix): record the Linux/KVM parity findings and status
  • e766321 chore(mtix): record the capability gate, litmus completion and guest-userspace options
  • 1474284 chore(mtix): record the default flip, guest-base contract and gateway logging
  • 5954c4c chore(mtix): record the release-blocker findings from the clean-Mac run
  • b7abdfb chore(mtix): record the tree-pinning design and the BYO base path
  • d03374b chore(mtix): sequence the guest-image publish decision (MGIT-61.12)
  • 80a069e chore(release): one source of truth for the Homebrew formula (#3)
  • 9209d92 docs(build): clarify make lint already inherits PKG_CONFIG_PATH
  • 5d351de docs(changelog): note the brew sandbox-activation caveat (MGIT-61.3)
  • 12717cf docs(changelog): promote the unreleased section to 0.4.0
  • 369a0fe docs(changelog): record the OCI guest base and the five boot defects
  • dd08f7e docs(changelog): record the attested base digest and the clean-install fixes
  • af87152 docs(e2e): rebuild E2E-MATRIX as a full-product audit, not a sandbox-only map
  • 5c4e454 docs(e2e): record claude-hook's new real-process coverage
  • 86fea52 docs(e2e): record the SEC-09 real-VM proof and correct a pass-count miscount
  • 7ff1850 docs(e2e): reflect the new cmd-level coverage, correct earlier severity
  • fa3c433 docs(guestboot): record the backend-specific precedence rule and firecracker re-verification
  • 095563f docs(install-sandbox): stop claiming published guest-image bundles ship with the release
  • 57faeba docs(release): hold the guest-image publish pending the libkrun path (MGIT-61.12)
  • 030c97c docs(release): record the GA backend split in CHANGELOG and the checklist
  • e6c21ec docs(sandbox): correct libkrun comments that no longer describe the code
  • f71f387 docs(sandbox): refresh the libkrun package doc after open mode landed
  • 1c45c2b feat(cli): boot the registered guest base when no --image is given
  • 53d6f45 feat(cli): compose a guest base from an OCI image (mgit sandbox base from)
  • b984666 feat(cli): mgit sandbox base set — the bring-your-own-tree guest base
  • be03005 feat(release): ship the linux guest binaries beside mgit so an install can compose a base
  • 31565fd feat(sandbox): attest the guest base a commit was produced in
  • 6c613ff feat(sandbox): deliver the SEC-03 quarantine and SEC-09 publishing on libkrun
  • 5170132 feat(sandbox): fail closed when libkrun lacks networking support
  • 948f6c3 feat(sandbox): give open mode an authorizer so it is unrestricted but audited
  • 783dfbd feat(sandbox): libkrun backend core + rootless netstack egress gateway
  • e590bcc feat(sandbox): libkrun backend, rootless egress gateway, and OCI guest bases (#1)
  • c8c02b2 feat(sandbox): libkrun re-exec VM lifecycle + Hypervisor.CreateVM
  • fb0d533 feat(sandbox): make libkrun the default backend on macOS
  • 6e3b46c feat(sandbox): mgit sandbox image install — one-command sandbox activation (MGIT-61.1)
  • 0506501 feat(sandbox): pin a libkrun guest base by tree digest
  • 92015d7 feat(sandbox): publish multi-platform image bundles + default install source (MGIT-61.2)
  • d2c3fa9 feat(sandbox): pull an OCI image into a guest base tree, stdlib only
  • c0c571d feat(sandbox): ship the mgit CLI inside the guest image
  • 104acec fix(cli): CI first-run fixes for the guest boot-token merge and libkrun jobs
  • aae1787 fix(cli): collapse to one Homebrew formula source, fix drift found by reading the live tap
  • 4209caa fix(cli): compose a guest base without a manual image init first
  • c95ea11 fix(cli): find the shipped guest binaries however mgit was installed
  • 2ec0537 fix(cli): make the macOS live sandbox gate exercise the shipped OCI path
  • 3503a3a fix(cli): make the macOS live sandbox gate exercise the shipped OCI path (#2)
  • bd65973 fix(cli): the actual formula/checklist/doc fixes from the prior commit
  • 28a7514 fix(cli): widen the claude-hook real-process test's build timeout
  • fe7d63b fix(deps): clear 7 disclosed vulnerabilities in the storage engine
  • a10e639 fix(guest): boot the real mgit-guest under libkrun
  • 6b446f0 fix(release): brew formula never installed mgit-sandboxd, and pointed at the wrong repo
  • 4c5a62d fix(release): install libkrun on the release runner
  • 64c1222 fix(sandbox): five defects that stopped any real base from booting on a Mac
  • 9eb52d5 fix(sandbox): give TestKVM_CreateVM_InvalidConfigSurfaces a StateDir
  • 885649c fix(sandbox): launch a sandbox for a task that was never squashed
  • 2bc8f61 fix(sandbox): make a failed daemon activation say why, and stop it failing at all on first run
  • 6dca717 fix(sandbox): make the libkrun control plane and child loader path portable
  • 8f02c72 fix(sandbox): make the libkrun net-capability probe compile and link on Linux
  • 8231a02 fix(sandbox): refuse a base digest carried outside the layout that signs it
  • 420608d fix(sandbox): sandbox published always reported empty on a real launch
  • ad7d872 fix(sandbox): stop the netstack gateway swallowing its failures
  • 8148eb1 fix(store): stop flattenTree silently swallowing tree-walker errors
  • 98792a6 perf(sandbox): measure virtio-fs on a real dependency tree and the DAX window
  • b5cf8c5 refactor(sandbox): fix the missing-directory class, and let the daemon speak plainly
  • 2a2d14c refactor(sandbox): reuse the egress splice and extract the bind prologue
  • 47ba2ba style(cli): gofmt the published-port real-VM test
  • 2ee5901 test(cli): close cmd-level gaps for squash --to-main, sandbox subcommands, worktree prune
  • 9a88e0b test(cli): close two remaining test-debt gaps from the sandbox audit
  • 52c1332 test(cli): cover the first-use sandbox flow end to end
  • 8a4228a test(cli): give claude-hook its first real-process proof
  • ce67619 test(cli): pin arch selection and the launch digest end to end
  • 3bbcd83 test(cli): pin that re-composing the same image produces the same digest
  • aecd2b3 test(packaging): assert what the tarball contains, not what dist/ contains
  • ab759ec test(sandbox): boot real libkrun microVMs and assert the egress contract
  • f5f4571 test(sandbox): cover the layer semantics real images depend on
  • d4bd3eb test(sandbox): cover the libkrun wiring seams and exit classification
  • 184d67e test(sandbox): cover the virtio-fs DAX window resolution
  • 7599c0f test(sandbox): measure virtio-fs under an npm-install-class workload
  • aa2a704 test(sandbox): prove an agent can commit inside a real sandbox
  • f35a0cf test(sandbox): prove concurrent isolation and cover the fail-closed paths
  • 2de6f1d test(sandbox): prove litmus leg 1 in a real microVM
Assets 11
Loading