08 — Sandbox

Defense in depth. Every tool call that touches the filesystem, shell, or network executes inside a sandbox. Workspace-root containment by default, OS-level isolation when available, allowlist/denylist for shell commands, approval gates for destructive operations. The sandbox is the difference between an agent that helps you and an agent that ransoms your machine.

Threat model

Runtime note

The engine's sandbox modes (read-only/workspace-write/danger-full-access, file effects) map to Picasso permission modes (paranoid→read-only, safe/auto→workspace-write, yolo→danger-full-access), verified with real enforcement.

Host caveat (F11): on macOS the engine's only confinement rung is Seatbelt (sandbox-exec), selected without a functional probe — the first sandbox_apply attempt is a real workspace-write bash call. When the host refuses it (sandbox_apply: Operation not permitted, e.g. the engine child inherits a sandboxed host's profile where nested sandbox_init is denied), every confined call fails closed and the person sees a full-access approval storm instead of quiet confined runs. The app detects this directly: Settings › General › Picasso engine runs the same read-only sandbox-exec probe and shows a muted warning row when the kernel refuses the profile (SandboxSeatbeltProbe in apps/mac/Picasso/Features/Settings/SettingsPanes.swift).