Local agent sandbox (macOS Seatbelt)

Contain AI coding agents and subagents to company repo paths only — fail-closed, never fail-open.

The Matt Shumer class incident (rm -rf after $HOME mis-expansion in a subagent) is blocked at the kernel: Seatbelt denies file-write* outside explicit allowed paths even when the shell command is wrong.

One-liner setup

curl -fsSL https://clawql.com/install | bash
clawql sandbox init
clawql sandbox verify
clawql doctor --smoke          # includes sandbox verify when enabled
clawql codex                   # per-harness sandbox-exec wrapper

Architecture: two layers for Claude Code

Same defense-in-depth idea as Kata + Istio in enterprise — applied locally.

clawql sandbox command surface

clawql sandbox init              # profiles + Claude settings.json
clawql sandbox status            # per-harness profile paths
clawql sandbox verify            # kernel-level containment probes
clawql sandbox edit --harness claude   # customize profile in $EDITOR

Per-harness profiles

Launch: clawql <harness> → sandbox-exec -f \{harness\}.sb -D WORK_DIR=$PWD … -- <binary>

Parameterized profile template

Profiles use Seatbelt (param "…") filled at launch via -D:

(version 1)
(allow default)
(deny file-write*)
(allow file-write*
  (subpath "/tmp")
  (subpath (param "WORK_DIR"))
  (subpath (param "CLAWQL_DIR")))
(deny file-read*
  (subpath (param "HOME_SSH"))
  (subpath (param "HOME_AWS"))
  (subpath (param "HOME_CONFIG")))

clawql sandbox init also bakes in team allowedPaths / deniedPaths as literal subpath rules.

Fail-closed rules

• sandbox-exec missing → harness launch aborts
• clawql sandbox verify fails → harness launch aborts
• clawql doctor --smoke runs verify when sandbox is enabled

Never silently proceeds unsandboxed when failClosed: true (default).

Escalation path

Related

• Sandbox plugin
• ADR 0008