Skip to content

v0.0.1 — Initial release: air-gapped Box agent memory

Choose a tag to compare

View all tags
@mrdulasolutions mrdulasolutions released this 24 May 22:23
· 2 commits to main since this release
v0.0.1
ab6aa2e

The on-prem variant of mrdulasolutions/BOX. Skills make zero outbound calls to Box during execution; all operations go through the local Box Drive desktop-app mount. Box Drive handles compliant sync to Box cloud — where SOC 2 / HIPAA BAA / FedRAMP attestations apply.

What ships

9 skills (each is also a /box-* slash command):

Skill Purpose
box-drive-detect Probe Box Drive mount + writability + sync state
box-airgap-status Report trust boundaries for the current session
box-init Bootstrap a workspace on the local Box Drive folder
box-write Save a memory file locally (lockfile-protected)
box-recall Find memories via local _index.json
box-companion Generate companion .md for a local binary file
box-team Create local team subtrees
box-status Read workspace state from local config + index
box-index-rebuild Rebuild indexes from FS scan; merge .conflict files

Plugin zip stats

  • Compressed: 27922 bytes (~28 KB)
  • Files: 23 entries
  • File permissions: 0644 / 0755 (Cowork-compatible)

Verification

Artifact SHA256
box-memory-onprem-plugin.zip 16034032e77950d0ace41befbbdbc3af9a57282eb325599520e3e32c998a5d49
box-memory-onprem-skills.zip 503e4a2260308ae12ec52eac353fe1e64494dc7cb1ac8564ffd1de225e0a66fa

Verify before install: shasum -a 256 box-memory-onprem-plugin.zip should match the value above.

Install

Claude Code

mkdir -p ~/.claude/plugins/box-memory-onprem
curl -L -o /tmp/plugin.zip https://github.com/mrdulasolutions/BOX-Onprem/releases/latest/download/box-memory-onprem-plugin.zip
unzip -o /tmp/plugin.zip -d ~/.claude/plugins/box-memory-onprem/

Claude Cowork (admin)

Settings → Plugins → Add plugin → upload box-memory-onprem-plugin.zip.

Compliance scope

  • Air-gap claim: the plugin's 9 skills make zero outbound calls to Box. Verified by scripts/ci-check-airgap.sh in CI.
  • Box's compliance posture: applies to Box Drive (the sync engine) + Box cloud (storage). Not in scope of this plugin.
  • LLM API path: separate trust boundary. See references/supported-llm-configs.md for supported configurations:
    • Anthropic API + signed BAA (HIPAA-eligible)
    • AWS Bedrock with Claude (FedRAMP Moderate)
    • Azure Government AI Foundry (FedRAMP High, DoD IL4/IL5, ITAR)
    • Self-hosted / local models (true air-gap)

See references/airgap-trust-model.md for the full trust-boundary breakdown.

Schema pinned to BOX repo

This release pins shared docs (schema, tier-matrix, architecture, operational-notes) to mrdulasolutions/BOX@180f27268b083189883343cc2219321f20e24989. Schema changes land in BOX first; bumping the pin here is a separate reviewable PR.

Platform support

  • macOS — supported in v0.0.1
  • Windows — planned for v0.0.4
  • Linux — no official Box Drive; community workarounds (WebDAV / rclone) not validated

Supply chain hygiene

5-layer enforcement (see SECURITY.md):

  1. Local pre-commit hook
  2. GitHub Actions CI (airgap + schema-sync gates)
  3. SHA256 published per release (above)
  4. Per-release audit log
  5. Quarterly designated security reviewer (template at references/designated-security-reviewer-template.md)

GPG signing of release artifacts planned for v0.0.5.

Assets 13
Loading