Sandbox Policy
The permissions an agent actually runs under — filesystem, network and process execution. Built to make the dangerous configuration look dangerous: an allow-list of `/` is functionally no sandbox, and it says so.
src/components/ui/sandbox-policy.tsxAbout
From the component's own source, where it was written.
The permissions an agent actually runs under.
Filesystem, network and process execution, each with an explicit mode and the paths or hosts it applies to. This is the screen someone is asked to approve before an agent is let near a real machine, so it is built to make the dangerous configuration look dangerous.
**A wide-open scope is called out, not rendered as an ordinary row.** An allow-list of / or * is functionally "no sandbox", and a UI that shows it in the same grey mono as /tmp is technically accurate and practically useless. unrestricted flags those rows.
**Deny wins, and says so.** Every real sandbox evaluates deny before allow; showing the two lists side by side without that ordering invites someone to assume an allow entry re-opens something a deny closed.
Install
npx astralyx-ui add sandbox-policy
Usage
import { SandboxPolicy } from '@/components/ui/sandbox-policy'
<SandboxPolicy scopes={scopes} onToggle={setScopeEnabled} />Composer
Change the props and the source below follows.
Filesystem
Allow-listReads and writes are confined to these roots.
Always denied
~/.ssh~/.aws**/.envPermitted
/Users/ada/work/astralyx/tmpNetwork
Allow-listOutbound HTTP only, to these hosts.
Always denied
169.254.169.254Permitted
api.anthropic.comregistry.npmjs.orgProcess execution
BlockedThe agent cannot spawn processes.
<SandboxPolicy scopes={scopes} onToggle={setScopeEnabled} />Examples
A confined agent
<SandboxPolicy scopes={scopes} />An allow-list of everything
<SandboxPolicy scopes={[{ id: 'fs', kind: 'filesystem', mode: 'allowlist', allow: ['/'] }]} />API
Generated from the source, so it cannot fall behind the code. One table per exported component, then hooks, functions and types.
SandboxPolicy
The permissions an agent actually runs under.
Extends Omit<ComponentProps<'div'>, 'children' | 'onToggle'>.
| Prop | Type | Default | Description |
|---|---|---|---|
| scopes | SandboxScope[] | required | An empty policy renders as a warning: the agent runs with the host’s own permissions. |
| onToggle | (id: string, enabled: boolean) => void | — | — |
| modeLabels | Partial<Record<SandboxMode, string>> | — | — |
| denyLabel | string | 'Always denied' | — |
| allowLabel | string | 'Permitted' | — |
| unrestrictedLabel | string | 'This grants access to everything.' | — |
| emptyLabel | string | 'No sandbox configured — the agent runs with the host’s own permissions.' | — |
| label | string | 'Sandbox policy' | — |
| open | automatic | — | /, *, **, ~ and 0.0.0.0/0 in an allow-list are flagged — they are “everything” wearing an allow-list costume. |
Types
SandboxScope
| Field | Type | Description |
|---|---|---|
| id | string | — |
| kind | 'filesystem' | 'network' | 'exec' | — |
| mode | SandboxMode | Blocked, allow-list, or unrestricted. Only the middle one renders its allow list. |
| allow? | string[] | Every real sandbox evaluates deny first. Showing the lists side by side invites the assumption that an allow entry re-opens what a deny closed. |
| deny? | string[] | Every real sandbox evaluates deny first. Showing the lists side by side invites the assumption that an allow entry re-opens what a deny closed. |
| label? | ReactNode | — |
| description? | ReactNode | — |
| enabled? | boolean | Toggle the whole scope. Omit for a read-only policy. |
| Type | Definition | Description |
|---|---|---|
SandboxMode | 'none' | 'allowlist' | 'full' | — |