Skip to content

mgit v0.4.3

Choose a tag to compare

View all tags
@github-actions github-actions released this 10 Aug 12:08
· 34 commits to main since this release
v0.4.3
7e78768

mgit — a sandboxed, checkpointed working substrate for LLM coding agents

mgit gives a coding agent two things together: containment — its untrusted code (npm/pip installs, builds, tests) runs in a disposable per-task microVM, not on your machine — and a checkpointed working substrate — every step is a task-tagged micro-commit in an isolated .mgit store that never touches your real .git, so you review and land only the squashed result.

Beta. The microVM sandbox is the differentiator; it is live-validated on Linux (firecracker/KVM) and macOS (libkrun, Apple Silicon — the macOS default backend since ADR-010; -tags vzf selects Virtualization.framework instead). Windows runs core mgit without the sandbox. See Known limitations in the CHANGELOG.

Highlights

  • Per-task microVM containment — installs/builds/tests run in a disposable, hardware-isolated VM; a poisoned dependency burns the VM, not your host. Default-deny per-task egress allowlist; verified land (dual-hash + task binding + host-anchored attestation) through an airlock.
  • mgit work — one command starts an agent on a task: a task-bound worktree with the agent's shell wired through mgit run into the sandbox.
  • Runs over your existing git repo — a self-contained .mgit store; your project's .git is provably never mutated, and the base stays in sync with your local working state automatically (no manual sync).
  • Checkpointed, reviewable history — task-tagged micro-commits; backtrack / fork / cherry-pick to course-correct; squash --to-git | git apply lands a byte-for-byte patch.
  • Multi-agent worktree isolation, REST + MCP integration surfaces, dual-hash integrity, append-only audit.
  • Pure Go, zero CGO — single static binary (Linux, macOS, Windows; amd64 + arm64).

Quality

  • 2,200+ automated tests, race-detector clean under -race, zero lint warnings, and the microVM behaviour proven on real hardware rather than only in unit tests.

Install

Each archive below ships two host binaries: mgit and, where a
sandbox backend exists (Linux and macOS arm64), the mgit-sandboxd
daemon next to it. Homebrew installs both.

# Homebrew (installs mgit + mgit-sandboxd)
brew install hyper-swe/tap/mgit

# Go — core mgit
go install github.com/hyper-swe/mgit/cmd/mgit@latest

# Go — the sandbox daemon (Linux works out of the box; on macOS the
# go-installed binary is unsigned and needs the virtualization
# entitlement — prefer brew or the release archive there)
go install github.com/hyper-swe/mgit/cmd/mgit-sandboxd@latest

# Binary — download the archive below for your platform (contains both)

macOS: a downloaded archive will not run until you clear quarantine.
Any transfer that sets com.apple.quarantine — a browser download,
AirDrop, anything but scp or a local build — triggers this. The
binaries are ad-hoc signed (no notarization yet), and on Apple Silicon
Gatekeeper kills a quarantined ad-hoc-signed binary outright: no dialog,
just zsh: killed. Both mgit and mgit-sandboxd are affected.

xattr -d com.apple.quarantine mgit mgit-sandboxd

After that both run normally — the binaries are fine; this is purely a
distribution/signing gap. Whether a Homebrew install carries the same
problem is not yet verified. (MGIT-64)

The microVM sandbox also needs a guest image; see
docs/INSTALL-SANDBOX.md.

Pairs with mtix

mgit + mtix form a closed loop for enterprise AI-driven development: mtix tracks what to build, mgit tracks what was built. Task IDs flow between both systems. The unit of failure is a task, not a session.

Changelog

  • 651b2c2 Merge MGIT-72: live egress policy mutation + hygiene
  • 5ffe62d Merge MGIT-73: guest->host artifact export
  • 74b59f0 Merge MGIT-76: ship mgit sandbox sync
  • 530612a Merge MGIT-77: refuse empty commits, and make the generated agent loop match
  • 51d57cc Merge MGIT-78: the Linux firecracker live gate now runs in CI
  • 224122b Merge MGIT-80: keep mgit's generated scaffolding out of the landed patch
  • 9bc5d34 Merge MGIT-81: exported artifacts keep the guest's mode
  • 7597026 Merge pull request #10 from hyper-swe/fix-flaky-kill-test
  • 8f265bc ci(e2e): allow on-demand dispatch of the e2e gate
  • fd6788c ci(e2e): run the Linux firecracker live gate on hosted runners (MGIT-78)
  • 9d5e218 docs(adr): ADR-011 promised a sandbox sync verb that never shipped
  • 7e78768 docs(changelog): assemble the 0.4.3 release section
  • dee4da8 docs(release): correct the release notes, and close two stale tap checklist items
  • 4ecfd49 docs+fix: record the live Linux gate, and unbreak GOOS=linux go vet ./cmd/mgit
  • 0cce4ae feat(sandbox): guest->host artifact export, host-named, bounded and audited
  • 686802d feat(sandbox): host->child control channel for running libkrun VMs (MGIT-74) (#8)
  • 549e573 feat(sandbox): live egress policy — grant, then revoke, without a relaunch
  • fa14df6 feat(sandbox): ship mgit sandbox sync, the verb ADR-011 promised
  • 0e88be6 fix(brew): core mgit installs without the untrusted libkrun tap (MGIT-75)
  • 459f08c fix(brew): stage before committing in the no-libkrun smoke test
  • ea94c55 fix(commit): refuse an empty commit — mgit reported success for work it never recorded
  • 6b49f8f fix(export): reproduce the mode the guest set, not the share's placeholder
  • 1021a72 fix(lint): justify the portability conversion unconvert flags on linux/amd64
  • bac0882 fix(staging): apply the worktree mode explicitly, not through O_CREATE
  • 2f4d75d fix(work): keep mgit's own generated scaffolding out of the landed patch
  • 372a875 style(egress): US spelling to satisfy misspell
  • c416c91 test(egress): fix the flaky revoke-kills-flows test, and unmask its drain twin
  • 334487c test(firecracker): poll for the published-port bytes, not just a connect
Assets 11
Loading