Repository navigation
DevBox source code, first public release - #1
Merged
Merged
Conversation
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
There was a problem hiding this comment.
🟡 Changes recommended
Credential exposure, cross-stack container deletion, retained abort listeners, and missing test isolation remain unresolved.
4 open issues
What changed in this PR
Introduces devbox’s initial public source snapshot, including the control plane, sandbox harness, CLI, Helm deployment support, CI workflows, and community policies.
Changes:
- Adds harness orchestration, agent middleware, artifact contracts, evaluation utilities, and tests.
- Adds control-plane services, integration and token handling, operational scripts, and CLI commands.
- Adds deployment resources, configuration examples, branding, automation, and public-project documentation.
Unresolved issues:
- Critical —
control-plane/.dockerignore:3: Generated proxy-signing and sandbox API keys enter the development image throughCOPY . .. Exclude these credentials from the build context. - Critical —
control-plane/scripts/local-down.sh:11: Teardown can forcibly remove containers from unrelated OpenSandbox installations. Scope both container queries to the stack’sdevboxnetwork. - Moderate —
cli/devbox.ts:23: Stream reconnection delays retain abort listeners after normal timer completion. Remove listeners on completion and handle already-aborted signals immediately. - Moderate —
package.json:25: The root test command bypasses the control plane’s required--isolatesetting. Invoke its component test script to prevent cross-file mock leakage.
| File | Description |
|---|---|
SECURITY.md |
Defines vulnerability reporting and support policy. |
package.json |
Adds root setup, deployment, and test commands. |
LICENSE |
Adds the MIT license. |
harness/tests/test_task_identity.py |
Tests task identity and channel detection. |
harness/tests/test_stage_timing.py |
Tests stage timing events and sandbox identity. |
harness/tests/test_sessions_registry.py |
Tests session claims, release, and concurrency. |
harness/tests/test_prompt_wording.py |
Checks channel-neutral prompt wording. |
harness/tests/test_isolation.py |
Checks disposable test workspaces. |
harness/tests/test_followup_prompts.py |
Tests follow-up prompt composition. |
harness/tests/schema_support.py |
Adds strict tool-schema assertions. |
harness/src/harness/stages.py |
Defines pipeline stage identifiers. |
harness/src/harness/schemas/common.py |
Adds shared structured-output contracts. |
harness/src/harness/schemas/__init__.py |
Exports artifact and stage-output contracts. |
harness/src/harness/prompts/read_discipline.md |
Guides targeted source inspection. |
harness/src/harness/prompts/merge_conflict_handling.md |
Guides branch synchronization and conflict handling. |
harness/src/harness/prompts/git_safety.md |
Defines repository-boundary safeguards. |
harness/src/harness/plan_utils.py |
Resolves checkouts and scoped knowledge paths. |
harness/src/harness/handlers/user_review.py |
Processes submitted PR-review follow-ups. |
harness/src/harness/handlers/comment.py |
Processes comment follow-ups and progress events. |
harness/src/harness/handlers/__init__.py |
Documents inbox-handler dispatch. |
harness/src/harness/evaluation/archive.py |
Reads and validates archived evidence. |
harness/src/harness/evaluation/__main__.py |
Adds the evaluation module entry point. |
harness/src/harness/evaluation/__init__.py |
Exports evaluation helpers. |
harness/src/harness/emit.py |
Adds best-effort progress-event emission. |
harness/src/harness/deepagents/registry.py |
Prevents concurrent session-identity reuse. |
harness/src/harness/deepagents/middleware/system_prompt.py |
Adds shared system-prompt middleware. |
harness/src/harness/deepagents/middleware/repo.py |
Composes repository-scoped knowledge, skills, and memory middleware. |
harness/src/harness/deepagents/middleware/ci_rerun.py |
Exposes failed-job reruns as an agent tool. |
harness/src/harness/deepagents/middleware/arguments.py |
Adds tool-argument validation and error formatting. |
harness/src/harness/deepagents/middleware/__init__.py |
Keeps middleware package initialization minimal. |
harness/src/harness/deepagents/event_contract.py |
Defines execution-event names and versions. |
harness/src/harness/deepagents/dense_turns.py |
Adds tool-call batching guidance. |
harness/src/harness/deepagents/agents/plan_review.py |
Adds the plan-review agent preset. |
harness/src/harness/deepagents/agents/orientation.py |
Adds the repository-orientation preset. |
harness/src/harness/deepagents/agents/__init__.py |
Keeps agent package initialization minimal. |
harness/src/harness/deepagents/__init__.py |
Documents import-light initialization. |
harness/src/harness/cmd_runner.py |
Adds subprocess execution helpers. |
harness/src/harness/ci_logs.py |
Downloads failed CI job logs. |
harness/src/harness/archive.py |
Adds artifact archive creation. |
harness/src/harness/__init__.py |
Initializes the harness package. |
harness/scripts/harness-entrypoint.sh |
Runs bootstrap before starting the daemon. |
harness/scripts/bootstrap.sh |
Configures proxy trust, Git authentication, and ownership trust. |
harness/pyproject.toml |
Defines Python dependencies, packaging, and tooling. |
harness/Makefile |
Adds setup, test, lint, and image-build targets. |
harness/.vscode/settings.json |
Configures Ruff editor integration. |
harness/.python-version |
Pins the development Python version. |
harness/.gitignore |
Excludes local harness artifacts. |
harness/.dockerignore |
Filters harness image build inputs. |
docs/kubernetes/examples/Dockerfile.harness |
Demonstrates a customized harness toolchain. |
docs/brand/logo/devbox-mark-on-light.svg |
Adds the light-background brand mark. |
docs/brand/logo/devbox-mark-on-dark.svg |
Adds the dark-background brand mark. |
docs/brand/logo/devbox-icon.svg |
Adds the application icon. |
docs/brand/logo/devbox-avatar.svg |
Adds the project avatar. |
devbox.config.example.json |
Provides repository and LLM configuration placeholders. |
deploy/helm/devbox/tests/values/slack.yaml |
Exercises Slack integration values. |
deploy/helm/devbox/tests/values/sandbox-options.yaml |
Exercises sandbox scheduling and volume options. |
deploy/helm/devbox/tests/values/replicas.yaml |
Exercises multi-replica configuration. |
deploy/helm/devbox/tests/values/llm-stages.yaml |
Exercises stage-specific model configuration. |
deploy/helm/devbox/tests/values/linear.yaml |
Exercises Linear integration values. |
deploy/helm/devbox/tests/values/ingress-webhooks.yaml |
Exercises webhook-only ingress. |
deploy/helm/devbox/tests/values/ingress-both.yaml |
Exercises separate API and webhook ingresses. |
deploy/helm/devbox/tests/values/ingress-api.yaml |
Exercises API ingress. |
deploy/helm/devbox/tests/values/github-app.yaml |
Exercises managed GitHub App tokens. |
deploy/helm/devbox/tests/values/github-app-external.yaml |
Exercises externally supplied GitHub App tokens. |
deploy/helm/devbox/tests/values/external-db.yaml |
Exercises external database configuration. |
deploy/helm/devbox/tests/values/byo-secrets.yaml |
Exercises existing integration secrets. |
deploy/helm/devbox/tests/values/base.yaml |
Supplies baseline chart-test values. |
deploy/helm/devbox/tests/strict-yaml.test.ts |
Checks rendered YAML validity. |
deploy/helm/devbox/tests/snapshot-builder.test.ts |
Checks builder hooks, cleanup, and scratch storage. |
deploy/helm/devbox/tests/golden.test.ts |
Compares rendered resources with golden fixtures. |
deploy/helm/devbox/tests/fake-git.sh |
Stubs Git for snapshot-builder tests. |
deploy/helm/devbox/templates/sandbox.yaml |
Defines sandbox pod-template configuration. |
deploy/helm/devbox/templates/postgres.yaml |
Defines optional PostgreSQL resources. |
deploy/helm/devbox/templates/NOTES.txt |
Prints post-install connection instructions. |
deploy/helm/devbox/templates/ingress.yaml |
Defines optional API and webhook routing. |
deploy/helm/devbox/templates/extra-manifests.yaml |
Renders operator-supplied manifests. |
deploy/helm/devbox/README.md.gotmpl |
Defines generated chart documentation. |
deploy/helm/devbox/hack/vendor-opensandbox.sh |
Downloads and verifies the vendored dependency. |
deploy/helm/devbox/Chart.yaml |
Defines chart metadata and the OpenSandbox dependency. |
deploy/helm/devbox/.helmignore |
Excludes chart development files from packaging. |
control-plane/tsconfig.json |
Configures strict TypeScript checking. |
control-plane/src/winstonLogger.ts |
Adds structured logging and key-based redaction. |
control-plane/src/types/harnessEvent.ts |
Defines harness-to-control-plane events. |
control-plane/src/types/agentSession.ts |
Defines parsed Linear session events. |
control-plane/src/types/__tests__/api.test.ts |
Checks that shared API contracts remain type-only. |
control-plane/src/services/githubStatus.service.ts |
Reports GitHub token and webhook status. |
control-plane/src/services/experimentalFlags.ts |
Parses and validates task-level experimental flags. |
control-plane/src/services/__tests__/githubStatus.service.test.ts |
Tests GitHub integration status responses. |
control-plane/src/sandboxConfig.ts |
Parses sandbox runtime and Git identity settings. |
control-plane/src/routes/webhook.ts |
Registers integrations with request-body limits. |
control-plane/src/routes/health.ts |
Registers the health endpoint. |
control-plane/src/requestLimits.ts |
Defines route and server request limits. |
control-plane/src/repositories/apiToken.repository.ts |
Adds API-token persistence and revocation. |
control-plane/src/logger.ts |
Exports the logger through a mockable boundary. |
control-plane/src/index.ts |
Wires migrations, HTTP serving, processing, and shutdown. |
control-plane/src/githubTokenMinter.ts |
Adds the GitHub App token-minter entry point. |
control-plane/src/githubToken/sinks.ts |
Writes tokens to files or Kubernetes Secrets. |
control-plane/src/githubToken/jwt.ts |
Signs GitHub App JWTs. |
control-plane/src/githubToken/__tests__/jwt.test.ts |
Tests JWT claims and signatures. |
control-plane/src/db/migrate.ts |
Serializes migrations with an advisory lock. |
control-plane/src/db/index.ts |
Initializes the database client. |
control-plane/src/db/__tests__/migrate.test.ts |
Tests concurrent migration runners. |
control-plane/src/controllers/health.controller.ts |
Probes database health without exposing errors publicly. |
control-plane/src/controllers/__tests__/health.controller.test.ts |
Tests health responses and error sanitization. |
control-plane/src/clock.ts |
Adds an injectable, abortable clock. |
control-plane/src/clients/slack.ts |
Exports Slack operations through a mock boundary. |
control-plane/src/clients/repoSnapshots.ts |
Defines managed snapshot selectors. |
control-plane/src/clients/linear.ts |
Exports Linear operations through a mock boundary. |
control-plane/src/clients/github.ts |
Exports GitHub operations through a mock boundary. |
control-plane/src/apiConfig.ts |
Parses authentication, hosting, and streaming settings. |
control-plane/src/__tests__/apiConfig.test.ts |
Tests API configuration parsing. |
control-plane/scripts/up/localKey.ts |
Reads or creates local server keys. |
control-plane/scripts/up/localKey.test.ts |
Tests local-key creation and reuse. |
control-plane/scripts/up/fakeTerminal.ts |
Supplies scripted terminal input for tests. |
control-plane/scripts/up/bunVersion.ts |
Enforces the minimum supported Bun version. |
control-plane/scripts/up/bunVersion.test.ts |
Tests Bun version validation. |
control-plane/scripts/setup.ts |
Validates Bun and installs component dependencies. |
control-plane/scripts/quickstart/style.ts |
Adds terminal-aware quickstart styling. |
control-plane/scripts/quickstart/style.test.ts |
Tests color selection and formatting. |
control-plane/scripts/quickstart/configReport.ts |
Reports configuration and detects example placeholders. |
control-plane/scripts/local-down.sh |
Removes sandbox containers and stops Compose services. |
control-plane/scripts/linear/manifest.ts |
Builds prefilled Linear application manifests. |
control-plane/scripts/linear/manifest.test.ts |
Tests manifest contents and links. |
control-plane/scripts/lib/openUrl.ts |
Opens setup URLs on supported desktop platforms. |
control-plane/scripts/lib/knownError.ts |
Classifies expected setup errors. |
control-plane/scripts/lib/knownError.test.ts |
Tests expected-error classification and hints. |
control-plane/scripts/lib/destructive.ts |
Adds confirmation for destructive commands. |
control-plane/scripts/lib/destructive.test.ts |
Tests interactive and noninteractive confirmations. |
control-plane/scripts/lib/configFile.ts |
Updates selected configuration keys. |
control-plane/scripts/lib/capture.ts |
Captures subprocess output with optional timeouts. |
control-plane/scripts/k8s/run.ts |
Adds context-scoped Kubernetes and Helm execution. |
control-plane/scripts/k8s/run.test.ts |
Tests command context selection and errors. |
control-plane/scripts/k8s/refresh.ts |
Starts and monitors snapshot-refresh jobs. |
control-plane/scripts/k8s/quantity.ts |
Parses resource quantities for node-fit checks. |
control-plane/scripts/k8s/quantity.test.ts |
Tests CPU and memory quantity parsing. |
control-plane/scripts/k8s/profileName.ts |
Derives CLI profile names from Kubernetes contexts. |
control-plane/scripts/k8s/profileName.test.ts |
Tests context-name normalization. |
control-plane/scripts/k8s/kind-guard.sh |
Restricts end-to-end operations to the local kind cluster. |
control-plane/scripts/k8s/fakeRunner.ts |
Supplies scripted installer command results. |
control-plane/scripts/k8s/clusterIP.ts |
Selects an available proxy Service address. |
control-plane/scripts/k8s/clusterIP.test.ts |
Tests proxy-address selection. |
control-plane/scripts/gen-iron-proxy-ca.sh |
Generates the local proxy certificate authority. |
control-plane/package.json |
Defines control-plane dependencies and scripts. |
control-plane/infra/opensandbox.toml |
Configures the local OpenSandbox runtime. |
control-plane/drizzle/meta/_journal.json |
Records the baseline migration. |
control-plane/drizzle.config.ts |
Configures database migration generation. |
control-plane/Dockerfile.dev |
Builds the local development control-plane image. |
control-plane/biome.json |
Configures TypeScript linting and formatting. |
control-plane/.gitignore |
Excludes generated files and local credentials. |
control-plane/.dockerignore |
Filters control-plane image build inputs. |
CODE_OF_CONDUCT.md |
Defines community conduct and reporting channels. |
cli/tsconfig.json |
Configures CLI checking and shared API types. |
cli/package.json |
Defines CLI dependencies, tests, and binary builds. |
cli/interface/usageError.ts |
Defines command-usage errors. |
cli/interface/runtime.ts |
Warns about unsupported Bun versions. |
cli/interface/program.ts |
Assembles commands and parses arguments. |
cli/interface/privateFile.ts |
Writes private configuration files. |
cli/interface/main.ts |
Resolves configuration and maps command errors to exits. |
cli/interface/io.ts |
Defines injectable CLI I/O. |
cli/interface/input.ts |
Reads text from arguments, files, or stdin. |
cli/interface/format.ts |
Formats task states, ages, and references. |
cli/interface/exit.ts |
Defines command exit-code mappings. |
cli/interface/duration.ts |
Parses human-readable timeout values. |
cli/interface/config.ts |
Resolves connection flags, environment, and profiles. |
cli/interface/commands/whoami.ts |
Displays API authentication identity. |
cli/interface/commands/wait.ts |
Waits for task completion. |
cli/interface/commands/send.ts |
Sends task follow-up messages. |
cli/interface/commands/restart.ts |
Restarts tasks with optional definition changes. |
cli/interface/commands/logs.ts |
Displays or follows task events. |
cli/interface/commands/index.ts |
Registers CLI commands. |
cli/interface/commands/create.ts |
Creates tasks from supplied text. |
cli/interface/command.ts |
Defines shared command contracts. |
cli/interface/__tests__/runtime.test.ts |
Tests Bun warnings and CI pin consistency. |
cli/interface/__tests__/parsing.ts |
Adds argument-parsing test helpers. |
cli/interface/__tests__/format.test.ts |
Tests display formatting. |
cli/interface/__tests__/exit.test.ts |
Tests exit-code mappings. |
cli/interface/__tests__/duration.test.ts |
Tests duration parsing. |
cli/devbox.ts |
Wires real API access, I/O, and interruption handling. |
cli/core/ops.ts |
Binds core operations to an API client. |
cli/core/limits.ts |
Defines the maximum supported timeout. |
cli/core/account.ts |
Retrieves API authentication identity. |
cli/core/__tests__/ops.test.ts |
Tests bound core operations. |
cli/core/__tests__/account.test.ts |
Tests account retrieval. |
cli/.gitignore |
Excludes dependencies and compiled binaries. |
cli/__tests__/fixtures.ts |
Supplies shared API and event fixtures. |
AGENTS.md |
Documents environment and workspace conventions. |
.truffleignore |
Excludes dependency and OS paths from image secret scanning. |
.gitignore |
Excludes local configuration, dependencies, and private keys. |
.github/workflows/dependency-scan.yml |
Scans Bun lockfiles for vulnerabilities. |
.github/workflows/cli.yml |
Tests, typechecks, and compiles the CLI. |
.github/pull_request_template.md |
Adds change and testing prompts. |
.github/ISSUE_TEMPLATE/feature_request.yml |
Structures feature requests. |
.github/ISSUE_TEMPLATE/config.yml |
Routes questions and security reports. |
.github/ISSUE_TEMPLATE/bug_report.yml |
Collects deployment and reproduction details. |
.github/dependabot.yml |
Configures automated dependency updates. |
.gitattributes |
Marks chart golden files as generated. |
Review effort: Balanced
Comment on lines
+3
to
+5
| .env | ||
| *.log | ||
| .DS_Store |
|
|
||
| ROOT="$(cd "$(dirname "$0")/.." && pwd)" | ||
|
|
||
| sandboxes="$(docker ps -aq --filter label=opensandbox.io/id; docker ps -aq --filter label=opensandbox.io/egress-sidecar-for)" |
Comment on lines
+21
to
+32
| const sleep = (ms: number, signal: AbortSignal) => | ||
| new Promise<void>((resolve) => { | ||
| const timer = setTimeout(resolve, ms); | ||
| signal.addEventListener( | ||
| "abort", | ||
| () => { | ||
| clearTimeout(timer); | ||
| resolve(); | ||
| }, | ||
| { once: true }, | ||
| ); | ||
| }); |
| "github:status": "bun control-plane/scripts/github.ts status", | ||
| "github:disable": "bun control-plane/scripts/github.ts disable", | ||
| "test:chart": "bun test deploy/helm/devbox/tests", | ||
| "test": "cd harness && make test && cd ../control-plane && bun test && cd ../cli && bun test && cd .. && bun run test:chart" |
fxenik
force-pushed
the
import/initial-release
branch
from
October 27, 2026 07:30
a71d9a8 to
2d8537c
Compare
rahulkumark
approved these changes
Oct 27, 2026
fxenik
changed the title
fxenik
force-pushed
the
import/initial-release
branch
from
October 27, 2026 07:39
2d8537c to
9145b3c
Compare
DevBox is a self-hosted coding agent. It takes a ticket, plans and writes the change, runs the tests, reviews its own work and opens a draft pull request, then pushes fixes for review comments to the same branch. This commit contains the full source tree: the control plane, the sandbox harness, the CLI, the Helm chart and deployment docs, the CI workflows, and the community files.
fxenik
force-pushed
the
import/initial-release
branch
from
October 27, 2026 07:40
9145b3c to
658924e
Compare
gitcommitshow
approved these changes
Oct 27, 2026
| <p align="center"> | ||
| <a href="https://youtu.be/wJQK3yCfYoI"><img alt="DevBox demo: a Linear issue is delegated to DevBox, it reviews its own diff, opens draft pull requests in each repo, and pushes a fix after a review comment. Click to watch the full video on YouTube." src="docs/images/devbox-demo.gif" width="100%"></a> | ||
| <br> | ||
| <a href="https://youtu.be/wJQK3yCfYoI">Watch the full launch video (2 min)</a> |
Collaborator
There was a problem hiding this comment.
Suggested change
| <a href="https://youtu.be/wJQK3yCfYoI">Watch the full launch video (2 min)</a> | |
| <a href="https://youtu.be/F5RIdaJRal8">Watch the full launch video (2 min)</a> |
Co-authored-by: gitcommitshow <56937085+gitcommitshow@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this changes
Imports the devbox source tree as a single commit on top of the initial README commit: the control plane, the sandbox harness, the CLI, the Helm chart and deployment docs, the GitHub workflows, and the community files (LICENSE, CONTRIBUTING, CODE_OF_CONDUCT, SECURITY).