Skip to main content
October 24, 2026 · GitHub release · All changes

New features

HTTP CONNECT proxy credentials in every SDK. Python, TypeScript, Go, and Ruby can now send a username and password to an authenticated HTTP CONNECT proxy. Previously, only the CLI and Rust SDK could. The password stays in a host environment variable, and saved configuration stores only the variable name. Outbound proxies are local-only. Outbound proxy

Fixes

  • Terminal sessions exit when the command does. msb run, interactive msb exec, and Rust Sandbox::attach could print a command’s output and never return. Large stdin transfers no longer block output or detach.
  • Empty stdin writes no longer close stdin. Writing empty data to an exec stdin sink now does nothing in Rust, Python, TypeScript, and Go. Call close() to send EOF.
  • Rebuilt sandbox configs keep your explicit choices. Settings and clears you set explicitly now survive rebuilds and local database reloads instead of reverting to defaults.
  • Python now applies SOCKS5 proxy credentials passed to Sandbox.create.
  • Image pruning is safer under load. Prune skips files in use by pulls or sandbox creation, and no longer delays unrelated work while it waits on locks.

Before upgrading

  • Upgrade every client sharing MSB_HOME together. v0.7.11 adds a database migration. Older CLIs and SDKs cannot open an upgraded home until you update them. To roll back, use msb self downgrade. Management commands
  • Detached jobs no longer keep a sandbox awake. The idle timeout now counts only attached exec sessions. A detached job keeps running, but its existence alone no longer resets the timer. Set a maximum lifetime if a detached service needs a fixed one. Automatic lifecycle policies
  • Rust: edit configs through the builder. Use builder setters, overlay(), or modification APIs. Saved caller overrides can overwrite direct edits to a resolved SandboxConfig. Rust configuration

Contributors

Thank you to everyone who contributed to this release.