v2.10.0

Released 2026-07-02.

Features

• --sandbox docker now provisions a real Docker sandbox for spawned agents end to end: the seed launcher wires DockerSandboxBackend into the spawner, the host repo is bind-mounted read-only and cloned into an isolated workspace, and a host-side heartbeat proxy keeps sandboxed agents visible to the stall watchdog. Falls back to the legacy path when Docker is unavailable. Known limits of this first cut (result sync-back, per-agent sessions) are tracked in #2162. Contributed by @shanemmattner. (#2156)
• bernstein run --worker <role> spawns a single worker directly against the seed goal, bypassing manager decomposition; combining it with an inline goal or --plan-file is a usage error. (#2156)

Fixes

• Role templates render again: the orchestrator passed the templates root where the spawner expects templates/roles/, so every role silently fell back to a generic prompt. The fallback now warns, and a regression test pins the call site. (#2155, #2156)
• --model propagates to manager-created child tasks and the server launch path instead of a hardcoded default, so non-Claude CLIs run on the requested model end to end. A/B pinned models survive the server round trip. (#2156)
• Container execution hardening: adapter commands are shell-quoted, only the resolved adapter's API keys are forwarded into a sandbox, the sandbox container uses host networking for task-server parity with the legacy path, and containers are cleaned up on provisioning failure and on orchestrator exit. (#2156)

Dependencies

• Routine updates: vite 8.1.3, lucide-react 1.23.0, prom/prometheus v3.13.0, docker/build-push-action, docker/login-action, and oss-fuzz base-builder digest bumps.