MacOSSandbox#

Run commands and agent-written programs inside an operating-system boundary. See the guide.

class zett_agent.sandbox.macos.MacOSSandbox(policy=None, *, memory_strategy=MemoryStrategy.AUTO)[source]#

Confine commands on macOS with a Seatbelt profile.

The platform class is the stable name; Seatbelt is how it is implemented. sandbox-exec runs each command under a profile that build_seatbelt_profile() renders from the policy.

The kernel enforces the profile on the process and every process it starts. Reads are open except the paths the policy hides; writes work only in the policy’s writable paths and the temporary directories; denied_write_paths and the protected files stay unwritable even inside a writable path; and the network is closed unless the policy opens it. A write is judged by where it lands, so a symbolic link that points out of a writable path gives nothing.

Examples

Use it directly when you know you are on macOS:

sandbox = MacOSSandbox(SandboxPolicy.workspace_write("/work/project"))
result = await sandbox.run("make test", cwd="/work/project")

Note

sandbox-exec is deprecated by Apple but ships with macOS, and it is what Chrome, Bazel and the other agent sandboxes use for this.

Warning

A process that is already inside a Seatbelt sandbox cannot start another. Running under a host that sandboxes you makes check() fail with a message that says so.

Parameters:
name: ClassVar[str] = 'macos'#

Short stable name of the backend, reported in results.

isolated: ClassVar[bool] = True#

Whether this backend enforces a boundary. False only for the backend that runs commands as they are.

check()[source]#

Verify that sandbox-exec exists and can apply a profile from this process.

Return type:

None