Celesto (formerly SmolVM) vs DeltaBox Lite

Celesto (formerly SmolVM) 70

Apache-2.0 in LICENSE and on PyPI (30). The privacy policy of 30 October 2026 links a subprocessor registry and describes the CLI telemetry in the same terms as the docs, but gives no retention periods beyond as long as necessary. Stopped cloud disks are kept 30 days per the pricing page (18 of 30). The changelog marks removals and the breaking rename, and the glossary lists older names still accepted, with no written deprecation policy (10 of 20). Telemetry is disclosed in the README, CLI reference and privacy policy, with three opt-outs, but it is on by default after the notice (16 of 20). Total 74.

DeltaBox Lite 46

Apache-2.0 in LICENSE, Cargo.toml and the npm package (30). The pi-deltabox and dsh-deltabox integration repositories linked from the README were not publicly readable on 17 October, and on 4 November they are still git submodules pointing at the old account, though their npm packages carry Apache-2.0 and MIT. No privacy or data-handling statement. The software is local and the source we read sends nothing to the authors, but nothing says so (10). No deprecation policy and no deprecation notices in six dated changelog entries (2). No telemetry or analytics calls were found in DeltaBox's own source, and the docs don't address it. The Windows build links Microsoft MXC crates that include an ETW diagnostics provider. In the pinned revision it is off unless a request sets experimental.telemetry.enabled, which DeltaBox's source never does (10). Total 52.

Celesto (formerly SmolVM) 66

Read with the local-software lines, because the graded surface runs on the owner's machine. Installs from PyPI as celesto with Python 3.11 or newer on Linux and macOS stated, plus an install script (20). The repository has pytest, e2e, lint, TypeScript and smoke-test workflows and 38 test packages, but GitHub's API answered with a rate limit, so no run result was read (15 of 25, unchecked). 22 open issues and pull requests against about 188 commits in 90 days. The open bugs include a snapshot restore that can lose a VM's disk if interrupted and a thread-safety issue with five replies (18 of 25). A dated changelog with Security, Fixed, Added and Removed sections, and the rename to Celesto marked as a breaking release, though versions stay below 1.0 (13 of 15). Pre-1.0 per SECURITY.md (0). Total 66.

DeltaBox Lite 47

Read with the local-software lines, because DeltaBox Lite runs on the owner's machine. Official npm, Homebrew and checksummed release packages for Linux and macOS on x64 and arm64 and, since 0.1.3, Windows x64, with Node.js 18, glibc 2.39 and a Rust floor stated (20). Since 29 October 2026 a CI workflow runs cargo test for the workspace on Linux and macOS and the session tests on two Windows runners, on every push to main and every pull request. The repository holds 388 test functions on 31 October (288 on 17 October). GitHub's Actions pages are refused to our reader, so no run result was read (15 of 25). Open crash and regression issues could not be read because GitHub's web pages and API answer 403 to our reader, so the line is scored absent (0, unchecked). CHANGELOG.md follows Keep a Changelog and declares semantic versioning, with dated entries for 0.1.0 to 0.1.5. No breaking change has shipped, and the 0.1.0 entry still names the old ddnirvana/tap Homebrew tap (12 of 15). Version 0.1.5, not declared stable (0). Total 47.

Celesto (formerly SmolVM) 81

0.1.13 on PyPI on 5 November 2026, tagged 6 November (30). 22 PyPI releases in the 90 days to 6 November (20). Most open issues are filed by maintainers. Outside reports such as the thread-safety issue got replies, and several recent ones have none yet; pull-request reply times were not read (15 of 25). The Python SDK is current, the TypeScript SDK is an alpha not published to npm (8 of 15). uv and Cargo lock files, CodeQL and publish workflows, with run results unread (8 of 10). Total 81.

DeltaBox Lite 63

v0.1.5 on 30 October 2026, read from the git tags and changelog (30). Six tagged releases in the last 90 days, v0.1.0 and v0.1.1 on 14 October, v0.1.2 on 20 October, v0.1.3 and v0.1.4 on 21 October and v0.1.5 on 30 October. v0.1.4 only renames the Windows npm package and counts half, which still leaves more than three (20). Issues and pull requests could not be read because GitHub's web pages and API answer 403 to our reader. Git history shows pull requests up to #45 merged, the latest on 31 October, but reply times were not seen (0, unchecked). A Node-API binding with TypeScript declarations ships in the npm package, in one language (8 of 15). Cargo.lock, a stated Rust 1.89 floor and test CI on four runners since 29 October. No Dependabot configuration and no npm provenance attestation, so the earlier partial stands (5 of 10). Total 63.

Celesto (formerly SmolVM) 85

Read as an SDK and CLI. The repository ships an OpenAPI document for the local server (24 operations) and the cloud API (171 operations), from which the TypeScript client is generated (25). llms.txt at celesto.ai, plus Markdown docs in the repository (10). The README's runtime table says when to use each runtime, and the automation section says to prefer exec and keep shell, ssh and desktop for interactive work (14 of 20). Network modes are closed values (open, off, public, restricted) and the SDK takes typed keyword arguments, though internet_settings is a plain dict (11 of 15). Examples directory, a JSON envelope for every command and documented cloud error fields such as required_scope, without a full error catalogue (12 of 15). Dated changelog and tags, pre-1.0 (13 of 15). Total 85.

DeltaBox Lite 68

Read as a CLI and library with a documented stdio protocol. docs/protocol.md lists all 15 JSON-RPC methods with their parameters and result shapes, and the npm package ships TypeScript declarations for the Node binding. There is no JSON Schema or other machine-readable contract for the protocol (15 of 25). No llms.txt. The docs are four Markdown files in the repository, plus a plain-text install prompt written for agents (5 of 10). The README and docs say when to choose each filesystem mode, show the right and wrong forms of shell redirection, and state the path-mapping and macOS limits (15 of 20). fs_mode, durability, execution_profile and review kind are closed enums in the protocol and the TypeScript types, and argv is an array. label is free-form by design (12 of 15). A quick start, a JSON-RPC demo script and a documented project-conflict error shape. Other errors share one code and differ only in message text (9 of 15). The protocol is labelled v0.1, with a dated changelog for six releases and git tags (12 of 15). Total 68.

Celesto (formerly SmolVM) 52

Framework reading for local software. No credential is needed for local use, and the local API server and dashboard each require a bearer token, and cloud keys carry named permissions (22 of 30). Each computer has its own guest kernel, browser and display access uses capability URLs with a read-only option, and raw VNC is off. Against that, outbound networking is open by default and the restricting modes are opt-in (12 of 20). The security doc warns against giving connection URLs to a model as page content, but there is no guidance on treating command or page output as untrusted (5 of 15). computer logs shows startup output, with no audit log of commands (5 of 15). SECURITY.md with GitHub private vulnerability reporting and a supported-versions table, Security sections in the changelog, no security.txt, bug bounty or certification (8 of 20). Total 52.

DeltaBox Lite 47

No credentials to issue or leak, because the runtime runs on the owner's machine, so the middle band (20 of 30). Least privilege is the product's job. Commands see a confined view, common secret paths are denied, the child environment is scrubbed to nine named variables, writes and pending storage are capped, and changes wait for commit or abort. Against that, the default network mode allows every destination, a read-write profile reaches the host with no rollback, macOS cbcow-through writes the real project at once, and pi-deltabox documents isolation: none as its default (14 of 20). Command output is untrusted content returned to the agent, and we found no guidance for reading it. The agent install prompt itself tells the agent it can star the repository through the user's authenticated GitHub CLI, an action outside the user's request (4 of 15). The session journal records each command's label against its change set, and diffs show every changed path. No network log was found for the allow_audit mode (9 of 15). No SECURITY.md, security.txt, disclosure policy or published advisories (0 of 20). Total 47.