Skip to content

v0.9.0

Choose a tag to compare

View all tags
@zdavison zdavison released this 14 Apr 10:33
· 26 commits to main since this release
v0.9.0
b51b2b9

Security & Sandbox

Many security improvements to deerbox isolation.

  • Sandbox isolation is now significantly stronger. Each task gets its own isolated CLAUDE_CONFIG_DIR, preventing tasks from reading each other's Claude configuration or credentials.
  • Sibling task directories are blocked within the sandbox, so tasks can no longer access each other's working files.
  • Credential files are now blocked from sandbox access. If credentials are found in ~/.claude.json (which cannot be fully blocked), a warning is shown.
  • Added an interactive env var policy review, letting you audit which environment variables are exposed before a task runs.
  • Worktrees are now repo-scoped rather than globally scoped, enabling more precise denyList management per repository. (Breaking change — see below.)

Breaking change: Worktrees are now scoped per-repo. Existing worktrees from previous versions will need to be re-created.

GitHub Integration

  • --from <issue-url> now accepts GitHub issue URLs directly, in addition to issue numbers.
  • When using --from <PR>, resolved and outdated review comments are now annotated so the agent understands what feedback has already been addressed.
  • PR bodies generated via --from strategies now include auto-close keywords for the source issue, so merging the PR closes the issue automatically.
  • Git user config is no longer written into worktree setup, keeping worktree configuration clean. [fixes: https://github.com//issues/276]

Proxy & Networking

Many network connectivity and performance improvements, bringing deerbox closer to raw claude network performance.

  • Added a CONNECT tunnel with TLS MITM to the auth proxy, enabling authenticated HTTPS traffic to flow correctly through the sandbox. The CA certificate is automatically trusted within the sandbox environment.
  • The proxy now self-restarts on terminal events, significantly reducing 502 Bad Gateway errors during long-running tasks.
  • Disabled keep-alive on upstream proxy connections to prevent stale sockets causing 502 errors.
  • Fixed auth proxy socket failures on macOS.
  • Persistent proxy logs are now written for easier debugging of proxy issues.

Session & Worktree Management

Automatic pruning of stale worktrees, --continue flag like claude.

  • --continue flag added to resume your most recent session without re-specifying context.
  • Dangling worktrees from previous or crashed tasks are now automatically pruned on startup. Only worktrees with no living proxy are pruned, so active tasks are never interrupted. [fixes: https://github.com//issues/274]
  • Startup pruning is now silent — no output unless something is actually wrong.
  • Added DEER_DATA_DIR support for controlling where Deer stores its data, useful for custom or sandboxed environments.
  • Plugin installPath is now correctly rewritten for sandbox config directories.
Assets 11
Loading