Skip to content

mgit v0.4.4

Choose a tag to compare

View all tags
@github-actions github-actions released this 11 Aug 08:11
· 26 commits to main since this release
v0.4.4
b685147

mgit — a sandboxed, checkpointed working substrate for LLM coding agents

mgit gives a coding agent two things together: containment — its untrusted code (npm/pip installs, builds, tests) runs in a disposable per-task microVM, not on your machine — and a checkpointed working substrate — every step is a task-tagged micro-commit in an isolated .mgit store that never touches your real .git, so you review and land only the squashed result.

Beta. The microVM sandbox is the differentiator; it is live-validated on Linux (firecracker/KVM) and macOS (libkrun, Apple Silicon — the macOS default backend since ADR-010; -tags vzf selects Virtualization.framework instead). Windows runs core mgit without the sandbox. See Known limitations in the CHANGELOG.

Highlights

  • Per-task microVM containment — installs/builds/tests run in a disposable, hardware-isolated VM; a poisoned dependency burns the VM, not your host. Default-deny per-task egress allowlist; verified land (dual-hash + task binding + host-anchored attestation) through an airlock.
  • mgit work — one command starts an agent on a task: a task-bound worktree with the agent's shell wired through mgit run into the sandbox.
  • Runs over your existing git repo — a self-contained .mgit store; your project's .git is provably never mutated, and the base stays in sync with your local working state automatically (no manual sync).
  • Checkpointed, reviewable history — task-tagged micro-commits; backtrack / fork / cherry-pick to course-correct; squash --to-git | git apply lands a byte-for-byte patch.
  • Multi-agent worktree isolation, REST + MCP integration surfaces, dual-hash integrity, append-only audit.
  • Pure Go, zero CGO — single static binary (Linux, macOS, Windows; amd64 + arm64).

Quality

  • 2,200+ automated tests, race-detector clean under -race, zero lint warnings, and the microVM behaviour proven on real hardware rather than only in unit tests.

Install

Each archive below ships two host binaries: mgit and, where a
sandbox backend exists (Linux and macOS arm64), the mgit-sandboxd
daemon next to it. Homebrew installs both.

# Install script (macOS/Linux) — verifies checksums, and avoids the macOS
# quarantine trap below because curl does not set the attribute
curl -fsSL https://raw.githubusercontent.com/hyper-swe/mgit/main/install.sh | sh

# Homebrew (installs mgit + mgit-sandboxd)
brew install hyper-swe/tap/mgit

# Go — core mgit
go install github.com/hyper-swe/mgit/cmd/mgit@latest

# Go — the sandbox daemon (Linux works out of the box; on macOS the
# go-installed binary is unsigned and needs the virtualization
# entitlement — prefer brew or the release archive there)
go install github.com/hyper-swe/mgit/cmd/mgit-sandboxd@latest

# Binary — download the archive below for your platform (contains both)

macOS: a BROWSER-downloaded archive will not run until you clear
quarantine. The install script above and Homebrew are unaffected — curl
and brew are not quarantine-aware apps, so the attribute is never set.
A browser download is: the binaries are ad-hoc signed (no notarization
yet), and on Apple Silicon Gatekeeper kills a quarantined ad-hoc-signed
binary outright — no dialog, just zsh: killed or a "cannot verify this
app is free of malware" alert. Both binaries are affected, and the
attribute survives extraction.

xattr -d com.apple.quarantine mgit mgit-sandboxd

After that both run normally — the binaries are fine. The attribute is
written by the downloading app on your machine, so nothing in this build
can remove it; only notarization fixes the browser path. (MGIT-64)

The microVM sandbox also needs a guest image; see
docs/INSTALL-SANDBOX.md.

Pairs with mtix

mgit + mtix form a closed loop for enterprise AI-driven development: mtix tracks what to build, mgit tracks what was built. Task IDs flow between both systems. The unit of failure is a task, not a session.

Changelog

  • b685147 docs(changelog): cut 0.4.4 — install and operability, with the backend matrix stated
  • 026c41d docs(release): the Gatekeeper smoke step invoked a flag the daemon does not have
  • 3b0aefb docs(release): the archive smoke's liveness probe must not depend on a feature flag
  • 0c8f85c feat(install): ship install.sh and make it the headline install path
  • 9845976 feat(release): script the post-publish smoke, and stop it firing malware alerts
  • f3d026f feat(sandboxd): --version, stamped from one shared buildinfo package
  • f1527ee fix(ci): the brew guard stamped a symbol MGIT-83 had moved, and the guard test missed it
  • 7cfcd7e test(release): gate on the tap being reachable UNAUTHENTICATED
Assets 11
Loading