New features
HTTP CONNECT proxy credentials in every SDK. Python, TypeScript, Go, and Ruby can now send a username and password to an authenticated HTTP CONNECT proxy. Previously, only the CLI and Rust SDK could. The password stays in a host environment variable, and saved configuration stores only the variable name. Outbound proxies are local-only. Outbound proxyFixes
- Terminal sessions exit when the command does.
msb run, interactivemsb exec, and RustSandbox::attachcould print a command’s output and never return. Large stdin transfers no longer block output or detach. - Empty stdin writes no longer close stdin. Writing empty data to an exec stdin sink now does nothing in Rust, Python, TypeScript, and Go. Call
close()to send EOF. - Rebuilt sandbox configs keep your explicit choices. Settings and clears you set explicitly now survive rebuilds and local database reloads instead of reverting to defaults.
- Python now applies SOCKS5 proxy credentials passed to
Sandbox.create. - Image pruning is safer under load. Prune skips files in use by pulls or sandbox creation, and no longer delays unrelated work while it waits on locks.
Before upgrading
- Upgrade every client sharing
MSB_HOMEtogether. v0.7.11 adds a database migration. Older CLIs and SDKs cannot open an upgraded home until you update them. To roll back, usemsb self downgrade. Management commands - Detached jobs no longer keep a sandbox awake. The idle timeout now counts only attached exec sessions. A detached job keeps running, but its existence alone no longer resets the timer. Set a maximum lifetime if a detached service needs a fixed one. Automatic lifecycle policies
- Rust: edit configs through the builder. Use builder setters,
overlay(), or modification APIs. Saved caller overrides can overwrite direct edits to a resolvedSandboxConfig. Rust configuration