The Open Source Drop #1: Agent sandboxes, semantic diffs, and a database TUI you'll actually enjoy

The Lens

goose is an AI agent that runs on your machine and does the work instead of suggesting it: it edits files, runs commands and calls tools, for code or for research and data jobs. Block built it, then in April 2026 donated it to the Linux Foundation's Agentic AI Foundation. Apache 2.0, free, as a desktop app, CLI or API. Nothing to host. It plugs into 70+ MCP extensions and 15+ model providers. Two cheap paths are new: built-in local models with no Ollama and no API key, or your existing Claude Code or ChatGPT Plus/Pro subscription over ACP instead of per-token billing. Local models are slower and weaker at tool calling. There's no paid tier; the model is your only bill. Solo: free. Small teams: free, share recipes (reusable YAML workflows). Larger teams: free, and custom distributions let you ship a preconfigured internal build. The catch: autonomous mode is the default, so out of the box goose can modify and delete files without asking. Switch to Smart Approval first. In July, a high-severity advisory showed goose review in a malicious repo could run an attacker's command before any prompt (fixed in 1.44.0).

The Lens

Boxlite gives you lightweight sandboxes. Each sandbox is a stateful micro-VM with hardware isolation, snapshots, and an API to control it. Picture giving every AI agent its own disposable computer. The project is open source under Apache 2.0 and self-hosting is free. It's early but growing fast. The 'agent sandboxing' space is heating up as AI agents get more autonomous and need safer execution environments. The catch: this is emerging technology. The documentation and ecosystem are still maturing. Running Firecracker-based micro-VMs requires Linux with KVM support. No macOS, no Windows natively. And the question of whether you need full VM isolation versus Docker containers depends on your threat model. For most use cases, Docker is simpler. Boxlite is for when you can't trust the code being executed.

The Lens

Git diffs tell you which lines changed, not which functions did. Sem fixes that. Instead of line-by-line diffs, it gives you entity-level diffs: which functions changed, which classes were renamed, which dependencies shifted. Consider it version control that understands code structure, not just text. It supports 21 languages, runs as a CLI, and adds blame, graph, and impact analysis on top of the structural diff. The impact analysis is the real selling point: change a function and sem tells you what else in your codebase is affected. Written in Rust, Apache 2.0, fully free. No paid tier, no cloud, no account. Install the CLI and go. The catch: nascent stage. The concept is excellent but the ecosystem is tiny. If your language isn't in the 21 supported, you're out of luck. And at this star count, expect rough edges and sparse docs.

The Lens

sqlit is a database client that runs in your terminal. Connect to SQL Server, MySQL, Postgres, SQLite, or Turso, browse tables, run queries, and read results in a formatted grid, all from the keyboard. No browser, no Electron shell, no login. MIT licensed and written in Python. Install is a pip command and you are connected. One unified interface across every backend it supports is the actual selling point, because moving between a Postgres project and a SQL Server project stops meaning moving between tools. It is under active development, with releases landing steadily through 2026. Completely free, with no paid tier and no hosted version. Solo: excellent for quick checks without waiting for a heavy GUI to load. Small teams: good for developers who live in the terminal and want data in front of them fast. Medium and large: this is a personal productivity tool rather than a team platform, so shared database management still wants dbeaver/dbeaver or something web-based with access control. The catch is that it is early and thin next to the mature tools. No saved queries, no ER diagrams, no export wizards. It is a browser, not a workbench. It will not replace DataGrip or DBeaver for schema work, but for the twenty times a day you just need to look at a table, it opens instantly and gets out of the way.