Portable policy. Native isolation.
Keep the agent
on this slab.
One sandbox.toml compiles to bubblewrap on Linux or Seatbelt on macOS—then probes the boundary it actually got.
Sibling files denied
Outbound network denied
Capability gaps reported
01 / the fracture
Agent settings are not an OS boundary.
Trust prompts and tool-specific permissions change from agent to agent. Hand-built sandbox flags change from laptop to CI. The result is a boundary nobody can review in one place.
WSM makes the boundary a small file you can diff—and a probe you can fail a build on.
02 / policy compiler
See what your manifest means.
Runs entirely in this page. Nothing is uploaded or saved.
03 / mechanism
Declare. Compile. Prove.
- 01
Declare once
Review file scopes, network posture, entry commands, and inherited environment in TOML.
- 02
Compile locally
Translate into explicit bubblewrap arguments or a deny-by-default Seatbelt profile.
- 03
Probe the edge
Seed a sibling path and test reads, writes, and outbound connections against the real backend.
04 / capability, not theater
Same intent.
Honest differences.
When a primitive cannot enforce a policy, WSM exits 3. It does not replace “allow these hosts” with “allow the internet.”
| Capability | Linux | macOS |
|---|---|---|
| Workspace binds | ● bwrap | ● Seatbelt |
| Deny network | ● net namespace | ● default deny |
| Host allowlist | × refused | × refused |
| Boundary probe | ● included | ● included |
05 / install
Put the boundary in the repo.
cargo install --git https://github.com/B-Divyesh/sf-workspace-sandbox-manifest
wsm initwsm doctorwsm run -- codexwsm probe --jsonSecurity note: this reduces host access through tested OS primitives. It is not a VM, and entry-command allowlisting does not constrain descendants. Read the boundary model.