Sandbox Win

v0.5.1沙箱与基础设施

opencode-sandbox-win

OpenCode plugin that sandboxes agent commands using @anthropic-ai/sandbox-runtime (seatbelt on macOS, bubblewrap on Linux)

维护活跃

#opencode #opencode-plugin #sandbox #security #anthropic #seatbelt

GitHub 仓库 npm 页面官方主页

GitHub 星标

月装机量

近 7 天 11

综合评分SCORE

27.7

生态多维模型

快速安装与配置

opencode.json

写入当前项目的 opencode.json，只对这个仓库生效。

opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "plugin": ["opencode-sandbox-win@0.5.1"]
}

opencode 启动时会通过内嵌运行时自动加载 npm 依赖并缓存至本地目录，无需手动在全局环境执行安装。

README.md

查看原始文件→

opencode-sandbox-win

An OpenCode plugin that sandboxes agent-executed commands using @anthropic-ai/sandbox-runtime. Every bash tool invocation is wrapped with OS-level filesystem and network restrictions.

Platform	Mechanism	Bash FS isolation	File-tool FS policy	Network isolation
macOS	`sandbox-exec` (Seatbelt)	Yes	Yes	Yes
Linux	`bubblewrap` (namespaces)	Yes	Yes	Yes
Windows	`srt-win` (WFP)	No	Yes	Yes

Install

// opencode.json
{
  "plugin": ["opencode-sandbox-win"]
}

Linux prerequisites

1. Install bubblewrap:

# Debian/Ubuntu
sudo apt install bubblewrap

# Fedora
sudo dnf install bubblewrap

# Arch
sudo pacman -S bubblewrap

2. Ubuntu 24.04+ (AppArmor fix):

sudo apt install apparmor-profiles
sudo ln -s /etc/apparmor.d/bwrap-userns-restrict /etc/apparmor.d/force-complain/bwrap-userns-restrict
sudo apparmor_parser -r /etc/apparmor.d/bwrap-userns-restrict

Verify with: bwrap --ro-bind / / --dev /dev --proc /proc -- echo "sandbox works"

Windows prerequisites

1. Install srt-win:

cargo install --git https://github.com/LLukas22/sandbox-runtime.git --branch elevation srt-win

2. Set SRT_WIN_PATH:

$env:SRT_WIN_PATH = (Get-Command srt-win).Source
[System.Environment]::SetEnvironmentVariable("SRT_WIN_PATH", $env:SRT_WIN_PATH, "User")

3. Install the network sandbox:

srt-win install --name sandbox-runtime-net

Log out and back in after installing.

What it does

Write protection — commands can only write to the project directory and temp. Everything else is read-only.
Credential protection — access to ~/.ssh, ~/.aws/credentials, ~/.gnupg, etc. is blocked.
Network allowlist — only approved domains (npm, PyPI, GitHub, etc.) are reachable.

If anything goes wrong (sandbox init fails, wrapping fails), commands run normally. The plugin never breaks your workflow.

Default restrictions

Deny-read path	Linux/macOS	Windows
`~/.ssh`, `~/.aws/credentials`, `~/.azure`	Yes	Yes
`~/.kube`, `~/.docker/config.json`	Yes	Yes
`~/.npmrc`, `~/.netrc`, `~/.env`, `~/.gnupg`	Yes	Yes
`~/.config/gcloud`, `~/.config/gh`	Yes	—
`%APPDATA%\gnupg`, `%APPDATA%\gcloud`, `%APPDATA%\GitHub CLI`	—	Yes

Allow-write: project directory, worktree, system temp.

Network allow-only: registry.npmjs.org, pypi.org, crates.io, github.com, gitlab.com, bitbucket.org, api.openai.com, api.anthropic.com, *.googleapis.com (and their wildcards).

Configuration

The plugin uses ~/.srt-settings.json as its config file (the same path used by @anthropic-ai/sandbox-runtime). On first run it creates the file with all defaults written out so you can edit them.

The OPENCODE_SANDBOX_CONFIG env var (JSON string) overrides the file. See the sandbox-runtime configuration docs for the full schema.

Disable

OPENCODE_DISABLE_SANDBOX=1 opencode

Or set "disabled": true in the config file.

Contributing

See CONTRIBUTING.md for development setup, architecture, and guidelines.