Your coding agent's sandbox is off. Here's how to turn it on without breaking everything

Description and use

Using sandfit, users can automatically generate a sandbox policy that allows only the operations required by their coding agent, reducing broken commands from 28% to 0% on recent history and eliminating the need for manual broad allow rules.

Problem

Coding agents ship with a deny‑by‑default sandbox that blocks essential operations like npm install, git push, and opening dev servers, causing many users to disable the sandbox or add overly broad allow rules.

Outcome

Using sandfit, users can automatically generate a sandbox policy that allows only the operations required by their coding agent, reducing broken commands from 28% to 0% on recent history and eliminating the need for manual broad allow rules.

Workflow

• 1. Run npx sandfit to analyze current history and report which commands would break with the sandbox on.
• 2. Run npx sandfit explain to see the rationale for each proposed rule.
• 3. Run npx sandfit apply to generate and apply the policy, with a backup kept.
• 4. Verify the sandbox behaves as expected using the built‑in test suite.

Evidence

Claude Code saves a transcript of every session in ~/.claude/projects, and Codex does the same in ~/.codex/sessions.

Source

I built sandfit to do this.

Source

If you turn on the sandbox today ███████░░░░░░░░░░░░░░░░░░ 28% of your shell commands would break (69 of 243) With the sandfit policy ░░░░░░░░░░░░░░░░░░░░░░░░ 0% would break (0 of 49 commands from your newest 20% of history, which the policy never saw)

Source