The latest release of zanegittins/skybreaker is v0.9.0. The tool runs Claude Code, Codex, and pi inside per-project gVisor sandboxes on user-managed Linux machines, and provides a setup that does not expose credentials to agents directly. However, the given materials contain no changelog or release notes for v0.9.0, so what changed in this version cannot be confirmed. The repository description presents the project as one that runs coding agents in an isolated environment.
The core of it is credential brokering: a broker holds the secrets and allows, holds, or denies agent requests according to policy. Outbound actions are also treated as audit targets. Work can be continued from a web interface, a phone, a terminal, or VS Code, and the setup is arranged so that commits, pushes, and review requests happen after approval and change review. The documentation also explains how to connect via Tailscale. It is written in Go and uses the AGPL-3.0 license. This configuration stands out in that its purpose is clearly to separate agent execution from credential management.
That said, the repository documentation notes that it is a pre-1.0 version and that the setup may change. The provided materials give no specific change details for v0.9.0 and no performance measurements for judging the effectiveness of the isolation, so the extent of this release's improvements and the actual level of protection are hard to confirm. Therefore, what can be confirmed at this point is only the design direction of credential brokering and policy-based request handling, and before applying it in production one needs to look at the configuration that may change and the scope of the evidence that has been made public.