Triage your pull request queue at a glance. Rank, explain, and surface the reviews waiting on you before they go stale.
DevBox is a local, single-user maintainer queue for GitHub. It watches the repositories you maintain, works out which open pull requests are waiting on you and why, and serves a live queue in your browser.
- Whose turn it is: pull requests are sorted by state (waiting on me, needs re-review, stale), not by "someone commented."
- Explains itself: every pull request shows the evidence and history behind its bucket.
- Maintainer-first ranking: milestones and first-time contributors come first, then whoever has waited longest.
- Surfaces hidden gates: fork pull requests whose tests need your approval, pull requests touching CI files, and bot pull requests in their own bucket.
- One live, local view: all your accounts in one queue that updates itself, with one-click hand-off commands for your agent.
DevBox is a single binary for macOS, Linux, and Windows.
brew install thingzio/tap/devboxOr with Go:
go install github.com/thingzio/devbox/cmd/devbox@latestOr download the archive for your platform from the latest release. Every release is signed and carries SLSA build provenance and an SBOM; its notes show how to verify them. To build from source, see CONTRIBUTING.md.
devbox serveDevBox starts on http://127.0.0.1:8484 and opens it in your default browser.
- Add an account in Settings: sign in with GitHub, or paste a classic
personal access token with the
reposcope. - Add the repositories you maintain:
owner/nameor any GitHub URL inside the repository. - Open the Queue. Tiles count each bucket and filter to it; the sidebar lists pull requests ready to merge and every repository you watch. Select a pull request's title to see why it is where it is.
If you use the maintainer-sweep skill, Settings offers its per-repository rule
files (~/.config/maintainer-sweep/repos/<owner>/<repo>.json) for one-click
import.
- Sign in with GitHub uses the device flow and requests
repo read:org. Organizations that restrict OAuth Apps need an owner's approval before DevBox can read their private repositories. - Classic token: a classic personal access token with the
reposcope. Fine-grained tokens are refused because they cannot read notifications.
You can add several accounts, for example personal and work. Each repository is watched by one of them, and the queue shows them all.
devbox serve [--addr 127.0.0.1:8484] [--db PATH] [--poll-interval 2m|1m..15m|manual]
[--debug] [--log-format auto|text|json] [--allow-remote] [--no-browser]
devbox version
| Flag | Default | What it does |
|---|---|---|
--addr |
127.0.0.1:8484 |
Listen address. A non-loopback address also needs --allow-remote. |
--db |
~/.local/share/devbox/devbox.db |
SQLite database (honors XDG_DATA_HOME). |
--poll-interval |
2m |
How often repositories are checked: 1m to 15m, or manual to check only when you press Refresh. Settings → Polling can override it. |
--no-browser |
off | Don't open the queue in the default browser on start; the URL is logged either way. |
--debug |
off | Log every GitHub request (never tokens, bodies, or diffs). |
--log-format |
auto |
text, json, or auto (text on a terminal, JSON otherwise). |
--allow-remote |
off | Accept connections from other machines. The UI has no login, so only use this on a trusted network. |
- Everything runs on your machine. DevBox only reads from GitHub; it never comments, approves, or merges.
- Tokens live in your OS keychain, never in the database, and are never logged.
- The UI listens on loopback by default and rejects requests from other sites and unexpected host names.
Prometheus metrics are at /metrics and a health check at /healthz.
Bug reports, ideas, and pull requests are welcome. See CONTRIBUTING.md for how to build, test, and change DevBox.