Features · Control · OS sandbox

Let it run commands. The OS keeps them in the project.

With the sandbox on, commands the agent runs through bash and run_code execute inside the operating system's sandbox: Seatbelt on macOS, bubblewrap on Linux. A command can read the machine but write only in the project, with no network unless you allow it.

Sandbox

sandbox.pylive

from shipit_agent.sdk import AgentOptionsoptions = AgentOptions(sandbox={"enabled": True})

$ pythonexample output

running…

How it works

bash / run_code

a command to run

OS sandbox

Seatbelt or bubblewrap

Writes

only in the project

Network

off unless allowed

See it run

The code is a checked example from the docs; the output is an example of what it prints.

sandbox.py

from shipit_agent.sdk import AgentOptions

options = AgentOptions(sandbox={"enabled": True})

$ pythonexample output

running…

Go deeper

5 more ways to use it

Each example is from the docs and checked against the library.

What a sandboxed command can do

Read in the docs

example.py

options = AgentOptions(sandbox={
    "enabled": True,
    "excludedCommands": ["docker *"],
    "filesystem": {
        "denyWrite": ["/home/me/project/.env"],
        "allowWrite": ["/home/me/.cache/pip"],
    },
    "network": {"allowedDomains": ["pypi.org"], "allowLocalBinding": True},
})

What you get

No approval needed
A sandboxed command can't do lasting damage outside the project.
Settings
Allow more folders, deny paths, or allow chosen domains.
What the model sees
A refused write shows as Operation not permitted, so it adapts.
Limits
File tools aren't sandboxed by the OS; they refuse paths outside the project themselves.

Agent parameters

Parameter	Default	What it does
project_root	'/tmp'	The folder the file tools and bash work in; paths outside it are refused.

More in Control

Next: Verifier

Go deeper

5 more ways to use it

Each example is from the docs and checked against the library.

What a sandboxed command can do

Read in the docs

example.py

options = AgentOptions(sandbox={
    "enabled": True,
    "excludedCommands": ["docker *"],
    "filesystem": {
        "denyWrite": ["/home/me/project/.env"],
        "allowWrite": ["/home/me/.cache/pip"],
    },
    "network": {"allowedDomains": ["pypi.org"], "allowLocalBinding": True},
})

What you get

No approval needed

A sandboxed command can't do lasting damage outside the project.

Settings

Allow more folders, deny paths, or allow chosen domains.

What the model sees

A refused write shows as Operation not permitted, so it adapts.

Limits

File tools aren't sandboxed by the OS; they refuse paths outside the project themselves.

Parameter

Default

What it does

project_root

'/tmp'

The folder the file tools and bash work in; paths outside it are refused.