Sandbox

Plugin ID: clawql-sandbox
Package: packages/clawql-sandbox — SandboxPlugin

Two layers:

sandbox_exec MCP — isolated code snippets inside the MCP server pipeline
clawql sandbox CLI — macOS Seatbelt containment for full agent harnesses (Codex, Claude, Cursor, OpenCode)

Local agent containment (fail-closed)

Prevent subagent shell incidents (rm -rf $HOME, etc.) on developer Macs:

clawql sandbox init
clawql sandbox verify    # macOS — must pass when failClosed
clawql codex             # launches inside Seatbelt when configured

Never fail open: if verification fails, harness launch exits with an error.

Tool	Purpose
`sandbox_exec`	Execute a code snippet in an isolated environment and return stdout/stderr

Env	Default	Effect
`CLAWQL_ENABLE_SANDBOX=1`	off	Register `SandboxPlugin` and `sandbox_exec`

Value	Typical use
`kata`	Kubernetes Jobs with Kata Containers (production)
`docker`	Docker socket backend (single-node dev)
`macos-seatbelt`	macOS Seatbelt sandbox
`bridge`	Cloudflare sandbox bridge (default off-cluster)
`auto`	Seatbelt → Docker → bridge (or Kata in-cluster when configured)

Helm: enableSandbox: true plus optional sandboxKata / sandboxDocker blocks.