v0.3.19

Forgot the console password? The login page now has Forgot your password? with the exact command to run on the server:

./console-login.sh --reset-password

It clears the password using the server's API key (the only credential that can do it — never from the browser), signs out every console session, and prints the console URL; the console then asks you to create a new password. ./console-login.sh --help documents it, and the URL it prints honours CONSOLE_HOST and PREVIEW_URL_SCHEME.

• API: DELETE /v1/auth/password — API-key actor only (401 without credentials, 403 for a console session), audited as auth.password_reset.

No breaking changes.

v0.3.18

Updates you can read before you click.

• Version pill — bottom-left of the console, always showing the running version (and commit in its panel). When a release is out it shows vX.Y.Z available; the panel has What's new (the release notes), Breaking changes boxed first when a release has them, Upgrade now (which requires acknowledging breaking changes), Release notes ↗, Remind me later, and a Report an issue link that pre-fills the version, commit and host style. Upgrade progress and result live in the same place. The top strip is now only for notices.
• upgrade.sh prints what's new for the target release before applying it, breaking changes first; on a terminal it asks for confirmation when there are breaking changes (--yes skips the prompt). The console-driven upgrader never prompts. --check reports whether the latest release has breaking changes. It also now names the failing line instead of exiting silently.
• Untagged builds see updates. Installs running dev or a bare commit (early install scripts) never got the update notice; they now do, worded as "untagged build · latest vX.Y.Z".
• GET /v1/settings gains update_kind, latest_notes, latest_breaking, latest_published_at.
• Fix: install.sh/upgrade.sh aborted on macOS's bash 3.2 when .env did not exist yet.
• For maintainers: put breaking changes in BREAKING.md before ./release.sh; they become the release's "Breaking changes" section (see CONTRIBUTING.md).

No breaking changes in this release.

v0.3.17

Flat preview hostnames (opt-in). PREVIEW_HOST_STYLE=flat puts every hostname one label under PREVIEW_DOMAIN — s-<id>-<port>.<domain>, console.<domain>, api.<domain> — so a single wildcard certificate covers all of them. Cloudflare's free Universal SSL, for example, only covers one level; with the default nested style (s-<id>-<port>.preview.<domain>, unchanged) previews need a second-level wildcard.

• PREVIEW_HOST_TAG=<tag> appends --<tag> to each label (s-<id>-<port>--<tag>.<domain>, console--<tag>.<domain>) so several sandboxd instances can share one domain.
• CONSOLE_HOST sets the console's hostname explicitly (defaults to console.<PREVIEW_DOMAIN>).
• In flat mode the preview-auth cookie is scoped to the exact preview host (never a parent domain), so instances sharing a domain cannot see each other's cookies; each preview host authorises separately.
• GET /v1/settings reports preview_host_style and preview_host_tag; the console shows them in Settings.
• Default behaviour is unchanged. Traefik file rules accept both styles.

v0.3.16

• New unauthenticated GET /version → {"version":"…","commit":"…"} next to /healthz, for monitoring and update tooling. No other data.

v0.3.15

• Telemetry reads the Docker daemon version with docker version instead of docker info, which fails to render on some daemons (Docker 28.5: netip.ParsePrefix: no '/') and left docker_major as unknown.

v0.3.14

Telemetry you can read in one page — and actually turn off (#113)

• The daily anonymous heartbeat now answers the questions that shape the product: are previews reachable (preview_kind: lan / ip / domain / tunnel, preview_tls), is the instance used (apps_bucket, tasks_7d_bucket), which agent, runtime (runc/gVisor), egress mode, install method, Docker major, CPU/memory buckets. Every value is a bucket or an enumerated label — no hostnames, IPs, paths, domain names, app names or content. Full list: docs/telemetry.md.
• A finished console-driven upgrade is reported once (from, to, result), so we can see whether in-place upgrades and rollbacks work in the wild.
• install.sh sends one install_failed { stage } event if it aborts — the stage name only.
• Fix: docker-compose.yml never passed SANDBOXD_TELEMETRY / DO_NOT_TRACK into the control plane, so the documented .env opt-out silently did nothing. It works now (SANDBOXD_TELEMETRY=off or DO_NOT_TRACK=1), and the collector overrides (SANDBOXD_POSTHOG_HOST/KEY) are passed through too. Both are documented in .env.example.

v0.3.13

• Console tells you when previews can't be shared (#112). On a LAN-only preview domain (localhost, a private IP, sslip.io/nip.io over a private IP) or a bare-IP domain without TLS, the console shows one dismissible strip explaining that previews only work on this network — with the two ways out: a public URL via sandboxd Cloud or your own domain. It disappears once a real domain is configured.
• install.sh closes with the same pointer; the README has a short "Get a public URL" section.

v0.3.12

Fixes the console-driven upgrade introduced in v0.3.11, which could not complete on a real install (#111):

• Upgrader trusts the mounted checkout — git refused to operate on a checkout owned by the installing user (dubious ownership) when run from the upgrader container.
• Upgrader uses host networking — upgrade.sh's health check probes 127.0.0.1:<SANDBOXD_API_BIND>, which inside the container was its own loopback, so every console upgrade rolled back even though the new version was healthy.
• Rollback re-stamps the version — after a rollback the rebuilt image now reports the version it rolled back to.

To get this release, run ./upgrade.sh once from your checkout (the upgrader image is built from it). From here on, the Upgrade now button in the console will do it.

New

• Upgrade from the console. The update banner now has Upgrade now: confirm → a detached upgrader runs ./upgrade.sh <tag> (backup, rebuild, restart, health check, auto-rollback) → progress in the banner → healthy on the new version, or rolled back with the reason. Only published release tags; one at a time; refuses under 2 GB free. GET/POST /v1/upgrade in the API. The CLI path is unchanged (#110)

Full Changelog: v0.3.10...v0.3.11

Full Changelog: https://github.com/tastyeffectco/sandboxd/compare/v0.3.9...v0.3.10

Full Changelog: https://github.com/tastyeffectco/sandboxd/compare/v0.3.8...v0.3.9

Full Changelog: https://github.com/tastyeffectco/sandboxd/compare/v0.3.7...v0.3.8

• Fix broken Star History chart in README by @FaintFlower in https://github.com/tastyeffectco/sandboxd/pull/103

New Contributors

• @FaintFlower made their first contribution in https://github.com/tastyeffectco/sandboxd/pull/103

Full Changelog: https://github.com/tastyeffectco/sandboxd/compare/v0.3.6...v0.3.7

What's Changed

• fix(console): stop double-prefixing write paths (console saves went to a phantom dir) by @tastyeffectco in #99
• feat(detect): detect the project's package manager (yarn/npm/bun), not just pnpm by @tastyeffectco in #100

Full Changelog: v0.3.5...v0.3.6

What's Changed

• fix: self-healing start — recreate sandboxes whose container is stale or missing by @tastyeffectco in #97
• fix(authproxy): fail fast with the provider's real message instead of a timeout by @tastyeffectco in #98

Full Changelog: v0.3.4...v0.3.5

What's Changed

• feat(brain): spoke notes (brain/*.md) + shared-concept radar by @tastyeffectco in #96

Full Changelog: v0.3.3...v0.3.4

What's Changed

• feat(brain): [[wikilinks]] between brains + knowledge graph view by @tastyeffectco in #95

Full Changelog: v0.3.2...v0.3.3

What's Changed

• feat: Project Brain — persistent per-app memory (BRAIN.md) by @tastyeffectco in #94

Full Changelog: v0.3.1...v0.3.2

What's Changed

• docs: remove dev-process/phase artifacts; make md match the code by @tastyeffectco in #76
• install: BSD-safe mktemp on macOS by @tastyeffectco in #74
• docs(git): document token rotation (delete + recreate) by @tastyeffectco in #72
• Opt-in gVisor (runsc) isolation for sandboxes — verified end-to-end by @tastyeffectco in #69
• fix(console): terminal WebSocket died with 400 through the console nginx by @tastyeffectco in #77
• fix(console): terminal origin check failed on non-default ports ($host strips the port) by @tastyeffectco in #78
• console: terminal connects on explicit click (not on tab open) by @tastyeffectco in #79
• readme: CTAs for release news + Cloud waitlist by @tastyeffectco in #80
• console(demo): make visitors notice the live preview is a real running app by @tastyeffectco in #81
• readme: affiliate disclosure above the deploy links by @tastyeffectco in #83
• console(home): explainer + live overview stats on the Apps home by @tastyeffectco in #82
• readme: compact 2-column screenshot grid by @tastyeffectco in #85
• feat(agent-auth): add direct MiniMax credentials and upstreams by @octo-patch in #89
• upgrade: rebuild the sandbox base image when runtimed changes by @tastyeffectco in #90
• console: update-available notification (+ checker false-positive fix) by @tastyeffectco in #91
• release tooling: ./release.sh (rolling patch releases + generated changelog) by @tastyeffectco in #92

New Contributors

• @octo-patch made their first contribution in #89

Full Changelog: v0.3.0...v0.3.1

sandboxd 0.3.0 — first public release

The full platform lands on main: an API-first engine for AI-built apps, plus an optional web console to drive it all.

Highlights

• Web console (optional) — create apps, chat to a coding agent, watch the live preview, edit files, commit/push with Git — all from a browser. A pure /v1 client; the engine runs perfectly headless.
• Credential-injecting agent proxy — OpenCode (default) & Claude Code reach their provider through a control-plane proxy, so no API key or OAuth token ever enters a sandbox.
• Runtime presets — React/Vite, Next.js, Node/Express, FastAPI, Worker; each boots to a live preview and reloads after agent edits.
• Agent tasks — stream progress, honest results, every task checkpointed & revertible.
• Live preview URLs + sleep/wake, Git import/commit/push, config & secrets (encrypted, write-only), snapshots / fork / restore, activity timeline, per-process logs, settings/lifecycle.
• One-command install.

Install

curl -fsSL https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/install.sh | bash

Upgrade from 0.2.x

Additive migrations (0014–0021) run automatically (forward-only, fail-closed); data dir + .env preserved. Bounce existing sandboxes after upgrade so they rebuild on the 0.3 image. New .env keys have safe defaults; the console profile needs CONSOLE_BASIC_AUTH.

Docs: https://sandboxd.io · Roadmap: https://sandboxd.io/roadmap · Discussions: https://github.com/tastyeffectco/sandboxd/discussions

Reliability fixes across the core, plus durable apps as first-class entities above sandboxes.

Highlights

• Durable apps above sandboxes — an app owns the user-facing concept (name, description, tags) and outlives the sandbox that is its current running instance. New tenant-scoped /v1/apps API; sandboxes gain a nullable app_id. Additive and backwards-compatible. (#31)
• Working app templates — a real Vite + React + TS react-standard scaffold is seeded on first boot (default; template:"blank" for empty), so the agent edits a known-good app with a passing build and a live preview instead of an empty directory. (#29)
• End-to-end + image-smoke CI — builds the image and drives the real create → seed → install → serve → wake lifecycle on Docker; asserts the agent CLIs + default template are present. (#30)
• Per-task timeout_s and a watcher that no longer fails long tasks at 15 minutes. (#25)

Added

• Durable app model + /v1/apps API (#31)
• Selectable image-baked app templates (#29)
• timeout_s on task submit (#25)
• Per-sandbox idle_policy (sleep / always_on) (#14)
• End-to-end + image-smoke CI job, and go vet (#30)

Fixed

• Snapshot capture on directory-storage workspaces (was 500) (#24)
• POST /v1/sandboxes 400 on a clean install (forced an unseeded template) (#28)
• Several audit correctness items (#21)

Changed / Removed

• Claude Code installed via the official native installer, alongside OpenCode (#18)
• Removed the dormant single-token auto-git-push (#23)

Upgrade notes

Backwards-compatible. The control plane applies migrations on boot (adds the app table and sandbox.app_id); rebuild the base image to pick up the react-standard template and the install-on-first-boot dev command. Existing sandboxes are unaffected (app_id is NULL).

Thanks to @amadeusCaleb, @sullamago, and @ruslan-rm for contributions in this release.

Full changelog: CHANGELOG.md · compare: v0.1.1...v0.2.0

First public release of sandboxed.

• One-command install (./install.sh)
• Create/stop/destroy sandboxes via HTTP API
• Built-in AI agents (OpenCode + Claude Code)
• Preview URLs via Traefik
• Stop-on-idle, wake-on-request
• Hardened containers (cap-drop ALL, no-new-privileges, read-only rootfs)
• Workspace persistence across stops and reboots
• SQLite state + reconciler

Status: beta