@kaged/sandbox

CageCompiler, SandboxRunner, and SandboxHandle for subprocess isolation via bubblewrap with cgroups, network gatekeeper, and seccomp plans

9
source files
6
test files
~2.4k
lines
✓ 13 pass
tests
pass
typecheck
clean
lint

Test results 13

buildSystemdPrefix > produces systemd-run with --scope and --slice [0.200ms]
SandboxRunner: caged path compilation > enabled policy with net.allow emits gatekeeper_degraded [0ms]
SandboxRunner: caged path compilation > compile error on path escape throws SandboxSpawnError [1.27ms]
SandboxRunner: walltime in disabled path > walltime from enabled policy is applied even when noSandbox [1.00s]
SandboxRunner: shutdown > shutdown is safe to call [0.650ms]
SandboxRunner: degraded sandbox guard > bwrapAvailable=false throws SandboxDegradedError for caged policy [0.890ms]
SandboxRunner: degraded sandbox guard > bwrapAvailable=false allows uncaged spawn when noSandbox=true [2.26ms]
SandboxRunner: degraded sandbox guard > bwrapAvailable=false allows disabled policy (DSL disabled) [1.30ms]
SandboxRunner: degraded sandbox guard > bwrapAvailable defaults to true (no guard triggered) [1.19ms]
probeBwrapAvailability > returns available=true when bwrap works [0.890ms]
probeBwrapAvailability > returns available=false with stderr when bwrap exits non-zero [0.400ms]
probeBwrapAvailability > returns available=false when bwrap is not on PATH [0.470ms]
SandboxDegradedError > extends SandboxSpawnError with degraded phase [0.130ms]

Mentioned in

Type Document
adr ADR-0009: Sandbox technology is bubblewrap; network allowlist is kaged-managed
adr ADR-0012: Agentic substrate is Mastra v1.x
spec Spec: Agent Tooling
spec Spec: Agent Harness
spec Spec: Daemon
spec Spec: Plugin Host
spec Spec: Project DSL
spec Spec: Sandbox
spec Spec: Session Manager
spec Spec: Task Runner