Your coding agent's sandbox is off. Here's how to turn it on without breaking everything

说明与用途

使用 sandfit，用户可以自动生成仅允许其编码代理所需操作的 sandbox 策略，从而将破坏命令的比例从 28% 降至 0%，并消除手动添加宽泛允许规则的需求。

问题

Coding agents ship with a deny‑by‑default sandbox that blocks essential operations like npm install, git push, and opening dev servers, causing many users to disable the sandbox or add overly broad allow rules.

结果

Using sandfit, users can automatically generate a sandbox policy that allows only the operations required by their coding agent, reducing broken commands from 28% to 0% on recent history and eliminating the need for manual broad allow rules.

工作流

• 1. Run npx sandfit to analyze current history and report which commands would break with the sandbox on.
• 2. Run npx sandfit explain to see the rationale for each proposed rule.
• 3. Run npx sandfit apply to generate and apply the policy, with a backup kept.
• 4. Verify the sandbox behaves as expected using the built‑in test suite.

证据

Claude Code saves a transcript of every session in ~/.claude/projects, and Codex does the same in ~/.codex/sessions.

来源

I built sandfit to do this.

来源

If you turn on the sandbox today ███████░░░░░░░░░░░░░░░░░░ 28% of your shell commands would break (69 of 243) With the sandfit policy ░░░░░░░░░░░░░░░░░░░░░░░░ 0% would break (0 of 49 commands from your newest 20% of history, which the policy never saw)

来源