Sonny: sandbox leads and tasks by default by lydakis · Pull Request #285 · lydakis/agent

Daemon: sandbox a bot's commands, writes and edits as Codex does

claude

committed

f6de576

Sandbox: placeholders removed with no lock held, confined writes take a process slot, a child's roots keep what its creator's keep read-only

claude

committed

8a219bc

Sandbox: probe off the runtime thread for bots from before a restart; pass on no root the creator keeps read-only

claude

committed

0760bd8

Sandbox: deny the daemon's socket to sandboxed commands, as Codex does; children inherit the sandbox without ceilings; take placeholders before a process slot

claude

committed

00ae9ae

Sandbox: keep a daemon socket inside a writable folder from being renamed or linked; each Seatbelt rule names only its own paths, once

claude

committed

1782065

Sandbox: on macOS, anchor the folders above every kept path, not only the socket

claude

committed

8349f5a

Merge remote-tracking branch 'origin/main' into claude/project-thread-6zwinw

claude

committed

e588ccb

Sandbox: a sandboxed bot reaches the daemon through its own socket, capped to what it may do

claude

committed

dd51373

Sandbox: hide the other bots' sockets; a bot made from a sandbox gets only the answered tools its maker passes on

claude

committed

7c7bad8

Measurements: a matched screen for the sandboxed bots' own sockets

claude

committed

23972e6

Merge remote-tracking branch 'origin/claude/project-thread-6zwinw' into claude/project-thread-6zwinw

claude

committed

3ad1eca

Merge main; lay out the tool contract's own socket as the daemon does

claude

committed

bfe1141

Bind each sandbox root by the folder opened for it

claude

committed

4b0e9bb

Cap forks' client-answered tools and every sandboxed turn's folder; close a bot's socket with it

claude

committed

fbd8aaa

Check sandbox roots by real path instead of pinning them; close bots' sockets off the runtime thread

claude

committed

2b8dae0

Merge remote-tracking branch 'origin/main' into claude/project-thread-6zwinw

claude

committed

159f4d7

Merge remote-tracking branch 'origin/main' into claude/project-thread-6zwinw

claude

committed

c58f65b

Pass on only the client-answered tools the caller may call; keep inferred attribution stable across retries

claude

committed

9e834d9

Let a resent delete through the cap; a fork's callable tools follow its source's allowed list

claude

committed

7c67935

Merge remote-tracking branch 'origin/main' into claude/project-thread-6zwinw

claude

committed

56ce5eb

Let a resent fork through the cap once its source is gone

claude

committed

b5cae03

Merge the merged #276 branch's history; main already holds its changes

claude

committed

4838d0b

Sonny sandboxes leads and tasks by default; configure sets a bot's sandbox

claude

committed

e860f68

Make a new project's lead sandboxed; refresh a moved lead's writable; keep per-worktree-config git folders read-only

claude

committed

aa39c8b

Know a git folder by its name, not by a HEAD the bot can move

claude

committed

a59e692

Give a bot its repository's git folder only when it is named as one

claude

committed

c211593

Make a tool-made project's lead with its gate; keep included config and submodules' git folders read-only

claude

committed

a375dc9

Keep git's commondir read-only in a git folder a bot may write

claude

committed

9d9f1db

Remove sandbox placeholders on a thread of their own

claude

committed

2d4f109

Remove only the git folder's own commondir after a command

claude

committed

fd8bd93

Merge main into the sandbox-by-default branch

claude

committed

1c74670

Navigation Menu

Repository navigation

Sonny: sandbox leads and tasks by default - #285

Sonny: sandbox leads and tasks by default#285
lydakis merged 31 commits into
mainfrom
claude/project-thread-6zwinw

Commits on Oct 28, 2026

Daemon: sandbox a bot's commands, writes and edits as Codex does

Sandbox: placeholders removed with no lock held, confined writes take a process slot, a child's roots keep what its creator's keep read-only

Sandbox: probe off the runtime thread for bots from before a restart; pass on no root the creator keeps read-only

Sandbox: deny the daemon's socket to sandboxed commands, as Codex does; children inherit the sandbox without ceilings; take placeholders before a process slot

Sandbox: keep a daemon socket inside a writable folder from being renamed or linked; each Seatbelt rule names only its own paths, once

Sandbox: on macOS, anchor the folders above every kept path, not only the socket

Merge remote-tracking branch 'origin/main' into claude/project-thread-6zwinw

Sandbox: a sandboxed bot reaches the daemon through its own socket, capped to what it may do

Sandbox: hide the other bots' sockets; a bot made from a sandbox gets only the answered tools its maker passes on

Measurements: a matched screen for the sandboxed bots' own sockets

Merge remote-tracking branch 'origin/claude/project-thread-6zwinw' into claude/project-thread-6zwinw

Merge main; lay out the tool contract's own socket as the daemon does

Bind each sandbox root by the folder opened for it

Cap forks' client-answered tools and every sandboxed turn's folder; close a bot's socket with it

Check sandbox roots by real path instead of pinning them; close bots' sockets off the runtime thread

Merge remote-tracking branch 'origin/main' into claude/project-thread-6zwinw

Merge remote-tracking branch 'origin/main' into claude/project-thread-6zwinw

Pass on only the client-answered tools the caller may call; keep inferred attribution stable across retries

Let a resent delete through the cap; a fork's callable tools follow its source's allowed list

Merge remote-tracking branch 'origin/main' into claude/project-thread-6zwinw

Let a resent fork through the cap once its source is gone

Merge the merged #276 branch's history; main already holds its changes

Sonny sandboxes leads and tasks by default; configure sets a bot's sandbox

Make a new project's lead sandboxed; refresh a moved lead's writable; keep per-worktree-config git folders read-only

Know a git folder by its name, not by a HEAD the bot can move

Give a bot its repository's git folder only when it is named as one

Make a tool-made project's lead with its gate; keep included config and submodules' git folders read-only

Keep git's commondir read-only in a git folder a bot may write

Remove sandbox placeholders on a thread of their own

Remove only the git folder's own commondir after a command

Merge main into the sandbox-by-default branch