What's Changed

• fix(console): stop double-prefixing write paths (console saves went to a phantom dir) by @tastyeffectco in #99
• feat(detect): detect the project's package manager (yarn/npm/bun), not just pnpm by @tastyeffectco in #100

Full Changelog: v0.3.5...v0.3.6

• fix(console): stop double-prefixing write paths (console saves went to a phantom dir) by @tastyeffectco in https://github.com/tastyeffectco/sandboxd/pull/99
• feat(detect): detect the project's package manager (yarn/npm/bun), not just pnpm by @tastyeffectco in https://github.com/tastyeffectco/sandboxd/pull/100

Full Changelog: https://github.com/tastyeffectco/sandboxd/compare/v0.3.5...v0.3.6

v0.3.6 — package-manager detection, Excalidraw, console write-path fix Latest

Latest

Compare

Choose a tag to compare

What's Changed

• fix: self-healing start — recreate sandboxes whose container is stale or missing by @tastyeffectco in #97
• fix(authproxy): fail fast with the provider's real message instead of a timeout by @tastyeffectco in #98

Full Changelog: v0.3.4...v0.3.5

• fix: self-healing start — recreate sandboxes whose container is stale or missing by @tastyeffectco in https://github.com/tastyeffectco/sandboxd/pull/97
• fix(authproxy): fail fast with the provider's real message instead of a timeout by @tastyeffectco in https://github.com/tastyeffectco/sandboxd/pull/98

Full Changelog: https://github.com/tastyeffectco/sandboxd/compare/v0.3.4...v0.3.5

v0.3.5 — upgrades reach every sandbox; provider errors fail fast

Compare

Choose a tag to compare

What's Changed

• feat(brain): spoke notes (brain/*.md) + shared-concept radar by @tastyeffectco in #96

Full Changelog: v0.3.3...v0.3.4

• feat(brain): spoke notes (brain/*.md) + shared-concept radar by @tastyeffectco in https://github.com/tastyeffectco/sandboxd/pull/96

Full Changelog: https://github.com/tastyeffectco/sandboxd/compare/v0.3.3...v0.3.4

v0.3.4 — Brain spoke notes & shared-concept radar

Compare

Choose a tag to compare

What's Changed

• feat(brain): [[wikilinks]] between brains + knowledge graph view by @tastyeffectco in #95

Full Changelog: v0.3.2...v0.3.3

• feat(brain): [[wikilinks]] between brains + knowledge graph view by @tastyeffectco in https://github.com/tastyeffectco/sandboxd/pull/95

Full Changelog: https://github.com/tastyeffectco/sandboxd/compare/v0.3.2...v0.3.3

v0.3.3 — Brain wikilinks & knowledge graph

Compare

Choose a tag to compare

What's Changed

• feat: Project Brain — persistent per-app memory (BRAIN.md) by @tastyeffectco in #94

Full Changelog: v0.3.1...v0.3.2

• feat: Project Brain — persistent per-app memory (BRAIN.md) by @tastyeffectco in https://github.com/tastyeffectco/sandboxd/pull/94

Full Changelog: https://github.com/tastyeffectco/sandboxd/compare/v0.3.1...v0.3.2

v0.3.2 — Project Brain: persistent per-app memory

Compare

Choose a tag to compare

What's Changed

• docs: remove dev-process/phase artifacts; make md match the code by @tastyeffectco in #76
• install: BSD-safe mktemp on macOS by @tastyeffectco in #74
• docs(git): document token rotation (delete + recreate) by @tastyeffectco in #72
• Opt-in gVisor (runsc) isolation for sandboxes — verified end-to-end by @tastyeffectco in #69
• fix(console): terminal WebSocket died with 400 through the console nginx by @tastyeffectco in #77
• fix(console): terminal origin check failed on non-default ports ($host strips the port) by @tastyeffectco in #78
• console: terminal connects on explicit click (not on tab open) by @tastyeffectco in #79
• readme: CTAs for release news + Cloud waitlist by @tastyeffectco in #80
• console(demo): make visitors notice the live preview is a real running app by @tastyeffectco in #81
• readme: affiliate disclosure above the deploy links by @tastyeffectco in #83
• console(home): explainer + live overview stats on the Apps home by @tastyeffectco in #82
• readme: compact 2-column screenshot grid by @tastyeffectco in #85
• feat(agent-auth): add direct MiniMax credentials and upstreams by @octo-patch in #89
• upgrade: rebuild the sandbox base image when runtimed changes by @tastyeffectco in #90
• console: update-available notification (+ checker false-positive fix) by @tastyeffectco in #91
• release tooling: ./release.sh (rolling patch releases + generated changelog) by @tastyeffectco in #92

New Contributors

• @octo-patch made their first contribution in #89

Full Changelog: v0.3.0...v0.3.1

• docs: remove dev-process/phase artifacts; make md match the code by @tastyeffectco in https://github.com/tastyeffectco/sandboxd/pull/76
• install: BSD-safe mktemp on macOS by @tastyeffectco in https://github.com/tastyeffectco/sandboxd/pull/74
• docs(git): document token rotation (delete + recreate) by @tastyeffectco in https://github.com/tastyeffectco/sandboxd/pull/72
• Opt-in gVisor (runsc) isolation for sandboxes — verified end-to-end by @tastyeffectco in https://github.com/tastyeffectco/sandboxd/pull/69
• fix(console): terminal WebSocket died with 400 through the console nginx by @tastyeffectco in https://github.com/tastyeffectco/sandboxd/pull/77
• fix(console): terminal origin check failed on non-default ports ($host strips the port) by @tastyeffectco in https://github.com/tastyeffectco/sandboxd/pull/78
• console: terminal connects on explicit click (not on tab open) by @tastyeffectco in https://github.com/tastyeffectco/sandboxd/pull/79
• readme: CTAs for release news + Cloud waitlist by @tastyeffectco in https://github.com/tastyeffectco/sandboxd/pull/80
• console(demo): make visitors notice the live preview is a real running app by @tastyeffectco in https://github.com/tastyeffectco/sandboxd/pull/81
• readme: affiliate disclosure above the deploy links by @tastyeffectco in https://github.com/tastyeffectco/sandboxd/pull/83
• console(home): explainer + live overview stats on the Apps home by @tastyeffectco in https://github.com/tastyeffectco/sandboxd/pull/82
• readme: compact 2-column screenshot grid by @tastyeffectco in https://github.com/tastyeffectco/sandboxd/pull/85
• feat(agent-auth): add direct MiniMax credentials and upstreams by @octo-patch in https://github.com/tastyeffectco/sandboxd/pull/89
• upgrade: rebuild the sandbox base image when runtimed changes by @tastyeffectco in https://github.com/tastyeffectco/sandboxd/pull/90
• console: update-available notification (+ checker false-positive fix) by @tastyeffectco in https://github.com/tastyeffectco/sandboxd/pull/91
• release tooling: ./release.sh (rolling patch releases + generated changelog) by @tastyeffectco in https://github.com/tastyeffectco/sandboxd/pull/92

New Contributors

• @octo-patch made their first contribution in https://github.com/tastyeffectco/sandboxd/pull/89

Full Changelog: https://github.com/tastyeffectco/sandboxd/compare/v0.3.0...v0.3.1

v0.3.1 — in-console terminal, MiniMax models, update notifications & safer upgrades

Compare

Choose a tag to compare

sandboxd 0.3.0 — first public release

The full platform lands on main: an API-first engine for AI-built apps, plus an optional web console to drive it all.

Highlights

• Web console (optional) — create apps, chat to a coding agent, watch the live preview, edit files, commit/push with Git — all from a browser. A pure /v1 client; the engine runs perfectly headless.
• Credential-injecting agent proxy — OpenCode (default) & Claude Code reach their provider through a control-plane proxy, so no API key or OAuth token ever enters a sandbox.
• Runtime presets — React/Vite, Next.js, Node/Express, FastAPI, Worker; each boots to a live preview and reloads after agent edits.
• Agent tasks — stream progress, honest results, every task checkpointed & revertible.
• Live preview URLs + sleep/wake, Git import/commit/push, config & secrets (encrypted, write-only), snapshots / fork / restore, activity timeline, per-process logs, settings/lifecycle.
• One-command install.

Install

curl -fsSL https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/install.sh | bash

Upgrade from 0.2.x

Additive migrations (0014–0021) run automatically (forward-only, fail-closed); data dir + .env preserved. Bounce existing sandboxes after upgrade so they rebuild on the 0.3 image. New .env keys have safe defaults; the console profile needs CONSOLE_BASIC_AUTH.

Docs: https://sandboxd.io · Roadmap: https://sandboxd.io/roadmap · Discussions: https://github.com/tastyeffectco/sandboxd/discussions

The major platform release: a web console, one-step runtime presets, live preview URLs, agent tasks, app config & secrets, snapshots / fork / restore, and git import / commit / push — with one headline change: every coding agent now reaches its model provider through a credential-injecting proxy, so no API key or OAuth token ever enters a sandbox.

Added

• Credential-injecting auth proxy for all agents. claude-code and opencode route through a control-plane proxy (internal/authproxy) that holds the real credential and injects it on the wire; the sandbox gets only a base URL + a dummy key, and nothing secret is mounted or env-injected into the workspace. SANDBOXD_OPENCODE_ZEN_PATH selects the OpenCode Zen endpoint (zen pay-as-you-go or zengo subscription).
• OpenCode is the default agent, and --continue is the default for follow-up tasks — tri-state (continue omitted → continue when a prior session exists, gated so the first task in a sandbox starts fresh; true/false force it).

Platform

This release adds the full self-hosted platform: a web console; one-step runtime presets (React/Vite, Next.js, Node/Express, FastAPI, Worker); live preview URLs; agent tasks; app config & secrets (write-only secrets); snapshots / fork / restore; managed agent auth (API-key / import / guided OAuth); git import, commit & push; runtime detection & manifest; an activity / events timeline; per-process logs; and a settings view with editable idle / keepalive lifecycle controls.

v0.3.0 — first public release

Compare

Choose a tag to compare

Reliability fixes across the core, plus durable apps as first-class entities above sandboxes.

Highlights

• Durable apps above sandboxes — an app owns the user-facing concept (name, description, tags) and outlives the sandbox that is its current running instance. New tenant-scoped /v1/apps API; sandboxes gain a nullable app_id. Additive and backwards-compatible. (#31)
• Working app templates — a real Vite + React + TS react-standard scaffold is seeded on first boot (default; template:"blank" for empty), so the agent edits a known-good app with a passing build and a live preview instead of an empty directory. (#29)
• End-to-end + image-smoke CI — builds the image and drives the real create → seed → install → serve → wake lifecycle on Docker; asserts the agent CLIs + default template are present. (#30)
• Per-task timeout_s and a watcher that no longer fails long tasks at 15 minutes. (#25)

Added

• Durable app model + /v1/apps API (#31)
• Selectable image-baked app templates (#29)
• timeout_s on task submit (#25)
• Per-sandbox idle_policy (sleep / always_on) (#14)
• End-to-end + image-smoke CI job, and go vet (#30)

Fixed

• Snapshot capture on directory-storage workspaces (was 500) (#24)
• POST /v1/sandboxes 400 on a clean install (forced an unseeded template) (#28)
• Several audit correctness items (#21)

Changed / Removed

• Claude Code installed via the official native installer, alongside OpenCode (#18)
• Removed the dormant single-token auto-git-push (#23)

Upgrade notes

Backwards-compatible. The control plane applies migrations on boot (adds the app table and sandbox.app_id); rebuild the base image to pick up the react-standard template and the install-on-first-boot dev command. Existing sandboxes are unaffected (app_id is NULL).

Thanks to @amadeusCaleb, @sullamago, and @ruslan-rm for contributions in this release.

Full changelog: CHANGELOG.md · compare: v0.1.1...v0.2.0

Reliability fixes across the core, and durable "apps" as first-class entities above sandboxes.

Added

• Durable app model. Apps are now first-class entities above sandboxes. An app owns the user-facing concept (name, description, tags) and outlives the sandbox that is its current running instance. New tenant-scoped /v1/apps API (POST / GET / GET {id} / PATCH {id} / POST {id}/sandbox) with optional external_* integration tags; sandboxes gain a nullable app_id. Additive and backwards-compatible — the existing sandbox API is unchanged. (#31)
• Selectable app templates. A working Vite + React + TypeScript react-standard scaffold ships in the image at /opt/templates/<name> and is seeded into a new workspace on first boot (default react-standard; template: "blank" for an empty workspace). The agent now edits a known-good app with a passing build and a live preview instead of scaffolding from an empty directory. (#29)
• Per-task timeout. timeout_s on POST /v1/sandboxes/{id}/tasks (0 or omitted → 10m default, max 24h). The control-plane task watcher now derives its streaming window from the task timeout instead of a fixed 15 minutes, so long tasks are no longer marked failed prematurely. (#25)
• Per-sandbox idle policy. idle_policy: sleep | always_on. (#14)
• End-to-end + image-smoke CI. A job that builds the base image and drives the real create → seed → install → serve → wake lifecycle on a Docker daemon, and asserts the agent CLIs and the default template are present on the image. Adds go vet to the Go job. (#30)

Fixed

• Snapshot capture targeted the old loopback .img model and returned 500 on the default directory-storage workspaces; it now copies the workspace tree crash-consistently and round-trips through from_snapshot. (#24)
• POST /v1/sandboxes returned 400 on a clean install because it forced an unseeded react-standard template; a no-template create is now provisioned cleanly. (#28)
• Four confirmed correctness items from the security/code audit. (#21)

Changed

• The image installs Claude Code via the official native installer, alongside OpenCode. (#18)

Removed

• The dormant single-token auto-git-push path (undocumented, unused). (#23)

v0.2.0 — reliable core + durable app model

Compare

Choose a tag to compare

First public release of sandboxed.

• One-command install (./install.sh)
• Create/stop/destroy sandboxes via HTTP API
• Built-in AI agents (OpenCode + Claude Code)
• Preview URLs via Traefik
• Stop-on-idle, wake-on-request
• Hardened containers (cap-drop ALL, no-new-privileges, read-only rootfs)
• Workspace persistence across stops and reboots
• SQLite state + reconciler

Status: beta

• Initial release.

v0.1.0 — Initial release

Compare

Choose a tag to compare