Implementing a secure sandbox for local agents

This post details the implementation of agent sandboxing across macOS, Linux, and Windows. On macOS, it leverages the Seatbelt framework with dynamically generated profiles. For Linux, it uses Landlock and seccomp, mapping ignored files with Landlocked copies. On Windows, it utilizes WSL2. The post also describes how agents are made sandbox-aware through updated Shell tool descriptions and improved error surfacing for sandbox-related failures, leading to more graceful recovery and improved offline eval performance.