v0.9.0

A security-focused release. VMs get no access by default and are isolated from each other. It also adds a new backend, boxery cp, and lets agents ask you for grants. There are breaking changes, so read "Upgrading" first.

Highlights

• LLM access is now a grant. VMs no longer get every LLM provider the host has set up. You give access per provider with boxery grant VM llm:chatgpt (or llm:openai, llm:anthropic, llm:ollama), and revoking takes effect on the next request (#111).
• Agents can ask for grants. With the new vm_grant tool, an agent requests github, ssh-agent, env:VAR or file: access. You approve or decline in a prompt the agent can't answer. Boxery's own secrets, ~/.ssh and ~/.gnupg are always refused (#91, #109).
• boxery cp copies files to, from and between VMs, including across hosts. It uses the same code as vm_copy (#87).
• Multi-host in pi. pi now has --vm-host, /vm host, and a host parameter on every tool, matching MCP (#121).
• Several backends on one machine. boxery host add exe local --backend exe adds one, with its own proxy port and services (#88).
• Experimental boat.dev backend. boxery-host init --backend boat runs VMs as boat.dev sandboxes. It needs a paid boat plan (#80).
• Newer toolchain in VMs. VMs get Node 24, and git 2.56 from the git-core PPA instead of Ubuntu's 2.43 (#89).
• Smaller images on libvirt. Space freed in the guest is returned to the host, so snapshots, forks and pool resets stop copying deleted data (#100).

Security

• SSH host keys are pinned for every VM and checked strictly, on every backend (#114).
• Guests are isolated from each other.
  • libvirt: guests can no longer reach each other, the host, the LAN, the tailnet or cloud metadata (#113).
  • Lima on macOS: guests can reach only the proxy port on the Mac's loopback (#103).
• Pool VMs get a new proxy token on each lease, and their grants are tied to that lease. A previous holder can't keep using them after the lease ends (#98).
• The VM desktop requires a VNC password. boxery desktop sets a fresh one for each session (#110).
• MCP over HTTP is locked down.
  • --no-auth only works on loopback addresses.
  • Tokens are compared in constant time.
  • vm_copy won't touch local: paths unless you pass --copy-root (#101, #108).
• The Node download in the image build is checked against its checksum before it's unpacked (#107).

Other changes

• Tool and listing cleanup, based on feedback from agents (#92):
  • lookups (list, shapes, grants, snaps, images, hosts) are only on vm_info;
  • the VM parameter is called vm on every tool;
  • listings use disk_size/disk_used and ssh_addr.
• Upgrade rollback restores state too. A failed boxery-host upgrade now restores each profile's lease store and state files along with the code (#102).
• Fixed: with several host profiles, each profile's init or upgrade rewrote the shared guest-to-proxy bridge, so the other profiles' VMs lost the proxy. Each profile now gets its own bridge (#119).

Upgrading

• Upgrade the host before the controllers (boxery upgrade-host).
• Existing VMs lose LLM access until you grant it: boxery grant VM llm:PROVIDER.
• The legacy host is gone. Every host needs a registered name. If you still use the old root ~/.boxery profile, register it with boxery host add NAME --config-dir ~/.boxery. BOXERY_HOST and BOXERY_HOST_BIN are no longer read (#90).
• The agentvm migration shims are removed (#83).
• Node >= 22.13 is now required, on both the laptop and the host (#104).
• Prompts or scripts that use the vm_* tools may need updating for #92 (lookups moved to vm_info, name → vm, renamed listing fields).
• libvirt: VMs that were already running stay on the open network until you restart them with boxery stop NAME && boxery start NAME.
• Cloud Hypervisor: run boxery pin NAME --from-guest once for each existing VM.
• exe.dev: detach the account's default llm integration before you create or start VMs.