Skip to content

Milestones

List view

  • 1.7.0 — Secretless credentials (broker-not-mount)

    Move raw credentials out of the sandbox: the agent should never hold a durable root-of-trust (OAuth refresh token / long-lived API key). Adopt CB4A/broker principles AT SANDY'S SCALE (single-dev Docker tool, not a SPIRE/PDP fleet). Phased: (1) host-side credential broker over a localhost socket that holds the durable secret and hands the container only short-lived access tokens — no proxy change, no TLS termination, no provider cooperation needed; directly removes the OAuth refresh token from the container (implements HF-defender #3 'keep roots-of-trust out'). (2) OPTIONAL/later: proxy-side credential injection for raw API keys (true secretless) — deliberately breaks the proxy's no-MITM invariant for an allowlist of provider hosts; large lift, evaluate only if Phase-1 residual is insufficient. (3) DEFERRED: DPoP/sender-constraint + per-sandbox identity — track CB4A (IETF draft, exp 2026-09), don't depend on it. Design eval + the 'is the egress proxy the right injection point' verdict: docs/security/CREDENTIAL_BROKER_EVALUATION.md. Version number provisional — resequence vs 1.6.0 as needed.

    No due date
    •2/3 issues closed
    66% complete1 open2 closed

  • 1.6.0

    Longer-horizon / parked. Teleport (checkpoint-and-resume) is under reconsideration: Remote-SSH via sandy-ui now covers much of the 'use a session from another machine' use case, so its marginal value is in question.

    No due date
    •2/7 issues closed
    28% complete5 open2 closed

  • 1.5.0

    Next additive minor. Shipped: Grok Build agent support (#99). Remaining: a supported in-sandy git-switch path (#80), and multi-agent tmux pane labels (#64). (Teleport / checkpoint-and-resume moved to 1.6.0.)

    No due date
    •9/9 issues closed
    100% complete0 open9 closed

  • 1.2.1

    Fixes landing after the 1.2.0 (--update-sessions) release. Renamed from 1.1.1 — 1.2.0 ships first (additive), so these patches are 1.2.1.

    No due date
    •5/5 issues closed
    100% complete0 open5 closed

  • 1.0.1

    Post-1.0 bugfix batch. Work #14 FIRST — its signal-trap exit + atomic lock-takeover + PID-owned release restructure is the foundation 1.1.0's daemon-mode builds on; landing it early maximizes soak time.

    No due date
    •8/8 issues closed
    100% complete0 open8 closed

  • 1.0.0-rc2

    Second release candidate. Low-risk, soak-safe fixes surfaced during the rc1 soak / sandy-ui dogfooding. Additive changes allowed only if they don't touch the soaked default paths. Cutting rc2 resets the soak week.

    No due date
    •5/5 issues closed
    100% complete0 open5 closed