✦ Features 29
- breakadd optional terminal and readiness callback to library run
- breaksplit the pinned address into ip4 and ip6
- measure fresh workload startup
- embed Info.plist in the shipped macOS binaries
- add opt-in policy checks for native file operations on macOS
- choose native file checks for each workload
- expose run command as library
- match macOS tool execution on Linux
- reload an authored policy over a live authority
- package ARM64 previews with explicit opt-in
- check native file permission changes with policy
- read and check a tool pack file
- sign and test native macOS packages before publication
- check a configuration's policy without a run, with each finding's rule, line, and hint
- tool packs parser for shell commands
- add Linux native kernel mechanisms
- generate the Cedar schema of a tool pack
- notarize and staple the macOS package before publication
- expose the interpreter alias names and a read-grant check to library callers
- refuse a temporal predicate that names an action group
- bind a tool pack on the program file and the command name
- decide and record tool pack actions in the policy engine
- select a stdio MCP server by its full command
- add reload library API
- emit tool pack action instead of shell:spawn
- report the kind of an env refusal and a read-grant refusal to library callers
- publish Linux ARM64 in stable releases
- load a tool grammar from box.toml
- let the agent read pidinfo of its own children
⊘ Fixes 51
- follow the redirect when resolving the latest release
- give each box its own alias image inode
- port the jailbreak test from bash to rust
- compare box paths by disk identity on macOS
- refuse Linux terminal input injection
- refuse mutations of box directory ancestors
- stop workload descendants and protect state ancestors
- normalize addresses with fluent-uri
- test ancestor identities and clarify mutation refusals
- act only on the host identity that admission judged
- discover transitive system libraries
- refuse the box's private tree in the kernel
- refuse a frame with a duplicate object key
- reject Linux write grants without explicit read access
- bound Linux loader dependencies to granted paths
- name the target when a filesystem grant is a symlink
- judge a host literal against the spelling the gateway binds
- bound writable dependency reads at startup
- preserve Linux grant identity through mounting
- pin Linux refusal mount targets
- follow nested env interpreter branches
- keep Linux metadata-only parents empty and read-only
- retain wakeup connection until listener exits
- keep a command substitution cut on a UTF-8 character boundary
- select a [tool] table by the name a program was called by
- make lstat on a host bind read the link, not its target
- prevent rename from replacing newly created files
- refuse a rule that reads the input across action families
- tool pack validator fixes and increased the test corpus
- record the destination address on a net:connect outcome
- record an answered stat, lstat, or access as a response
- report the real transport on an http response event
- locate macOS helpers beside the running executable
- block proc mem executable page writes
- restrict Linux terminal and console controls
- harden Linux namespace supervisor memory
- retain Linux bind mount targets
- refuse unsafe Linux file permission requests
- hold a tool call whose name carries a quote or a backslash
- protect denial ancestors while preserving permitted renames
- reject unresolved host paths and bound native filename scans
- prevent workload changes to configured tool commands
- reject implicit writable loader execution
- preserve setup failures through executable launch
- close resource URI respellings that dodge a uri rule
- record an answered Python metadata check as a response
- require exec grants for writable libraries
- record a metadata read of an unresolved path as a response
- require existing grants for script interpreters
- protect Box executables from workload writes
- ensure grammar bindings and policy engine agree on the tool grammars
⋯ Other 35
- run the workload suite nightly on a pinned model
- remove stale lifecycle command guidance
- check native file edits and agent behavior after denial
- stop requiring manual native test receipts
- bump taiki-e/install-action from 2.87.21 to 2.87.29
- restore Linux Git and Cargo workflows
- repair Linux fixtures and extend integration coverage
- expand Linux unit coverage and fix executable offsets
- make a code change carry the docs it makes wrong
- reach protected directory guards on Linux
- add team/designs with the tool packs design
- bump rustls from 0.23.45 to 0.23.46
- classify new issues and add auto-close and bot PR gates
- prepare containment handoff for Linux native policy
- reviewer uses prompt v7 on Claude Opus 5.5, effort high
- send the Shell's HTTP through Box's kernel wrapper
- fuzz the tool pack shell parser
- read and write HTTP with hyper, and delete the hand-written HTTP/1.1 code
- cover Linux native server helpers
- strengthen Linux boundary and credential-daemon checks
- add portable Linux target validation
- require real Linux test execution
- remove the gateway's dead code, and merge its duplicate code
- pin the degraded tool refusal so a refactor cannot undo it
- improved agents.md
- rename Tool Packs to Tool Grammars
- cut redundant runs on shared runner capacity
- define the external site publication contract
- add request re-routing design doc
- clean up concurrent integration fixtures and share move scenarios
- cover mount restrictions in nested user namespaces
- add Linux EKS and AgentCore Runtime deployment guides
- correct hosted shell denial assertions
- separate integration runtime discovery from fixture execution
- move core pull request checks to ARM64