Sandboxed Code Agent (Loopback Only, Deny .env)

This playbook builds a code-reading assistant that can run Bash and NodeRepl inside the native srt sandbox with loopback-only network access and protected secrets, while recalling prior context from local journal memory. Every capability here is config-driven — no code required.

On macOS, mono-agent can install the exact pinned SRT runtime into its private user cache; no global srt or PATH mutation is required. This recipe uses fallback: "fail-closed", so an absent, corrupt, or non-enforcing engine stops the command — a sandbox_prepare_failed tool result — instead of running it on the host.

Who this is for

For finite work that should finish after the turn returns, enable processJobs.enabled and use background process jobs.

Security team deploying an internal code assistant.

Goal

An agent that can read repos and run shell commands or run-scoped JavaScript inside the native srt sandbox with loopback-only network access and protected secrets, recalling context from local memory.

Features used

sandbox.mode — native (srt-wrapped commands) vs off
sandbox.network-policy — enforced none / localhost / allowlist / all
sandbox.filesystem-scopes — readable/writable roots + deny-write globs
sandbox.fallback — fail-closed vs unsafe-host-process when srt is unavailable
tool-policy.allow-all — allow-all tools (["*"]); the sandbox, not an allowlist, is what constrains the code tools
memory.journal — local journal recall for prior context

Configuration

{
  "runtime": {
    "model": "openai-codex:gpt-5.6-terra"
  },
  "tools": {
    "allowedTools": ["*"]
  },
  "sandbox": {
    "mode": "native",
    "network": {
      "mode": "localhost"
    },
    "readableRoots": ["."],
    "writableRoots": ["."],
    "denyWrite": [".env", ".env.*", ".git/config", ".git/hooks/**"],
    "fallback": "fail-closed"
  }
}

The denyWrite globs above are the built-in defaults — listed explicitly here to make the secret-protection contract obvious. Relative readableRoots/writableRoots entries resolve against the workspace. The matching env vars are MONO_AGENT_SANDBOX_MODE, MONO_AGENT_SANDBOX_NETWORK, MONO_AGENT_SANDBOX_READABLE_ROOTS, MONO_AGENT_SANDBOX_WRITABLE_ROOTS, MONO_AGENT_SANDBOX_DENY_WRITE, and MONO_AGENT_SANDBOX_FALLBACK.

Steps

mono-agent init --model openai-codex:gpt-5.6-terra --memory journal
Run mono-agent sandbox status, then mono-agent sandbox setup on macOS. Setup installs in the private cache and runs the full functional check. Use mono-agent sandbox check to re-prove it later.
Leave tools.allowedTools at the allow-all default (["*"]) — under allow-all the code tools (Read/Write/Edit/Glob/Grep/Bash/NodeRepl) are already available, and the sandbox, not an allowlist, is what constrains them. Configure sandbox.mode native + network.mode localhost + the deny-write defaults. (To harden further you can still narrow allowedTools to a specific set, but it is not what makes this agent safe.)
Keep fallback at fail-closed (do NOT set unsafe-host-process).
mono-agent validate --preset code-sandbox; the Sandbox section should be ok. If it is waiting with sandbox_unavailable, start will not silently relax the policy. A corrupt managed install never falls back to a PATH command.
mono-agent start, then mono-agent status; confirm the sandbox line reports effective: native, the srt engine present, and fallback active: no.
Ask the agent to inspect the repo, run a Bash command, and evaluate const n = 40 followed by n + 2 through NodeRepl; confirm REPL state persists for the run, external network calls are blocked while loopback still works, and it cannot write .env.