FR: sandboxing

[thiswillbeyourgithub]

Hi,

So it might be out of scope but it seems nobody asked for it yet, so I'd rather have your opinion on this.

I think sandboxing would be really nice to add. There seems to be many tools popping up left and right for this. But although I could be using bubblewrap or smolvm outside dirac as a wrapper, it would also mean that I can't use the user interface to selectively allow a folder access or network access, for example. To add an exception, I would have to edit the wrapper command every time.

So it would be ideal to have Dirac embed directly a sandboxing tool.

What's your take on this? Is that out of scope of this project?

[dirac-run]

This is a bit of a lift. I think the right way to go about this is to integrate something that already exists with Dirac. I haven't thought about it. Do you happen to know any agent doing this?

have Dirac embed directly a sandboxing tool.

This would still not solve the granular permissions, or am I missing your point?

[thiswillbeyourgithub]

Do you happen to know any agent doing this?

Claude code does it: docs. Maybe in the leaked source code you can find more details?

This would still not solve the granular permissions, or am I missing your point?

What I'm proposing is having dirac "wrap a sandboxing tool that contains the coding agent". Explicitely: if dirac asks "Can I do cmd?" and you say yes but it then gets a "permission denied" because the cmd itself, unbeknownst to you nor dirac would need to use some external files or something but was thankfully blocked by the sandbox, then dirac can see the error, and ask the user if it wants to selectively lift a given aspect of the sandbox (like authorizing a specific network domain access, or accessing some files etc). So permissions can look like they do the same thing as a sandbox but in reality the permission applies to what the agent launches, but the sandbox guarantees whatever it launches won't have unexpected edge effects outside of the scope you allow it to have. And yes it's basically what claude code does.

[thiswillbeyourgithub]

One thought occured: if you don't feel like implementing full on sandboxing, maybe you could add a prefix setting to specify whatever string to always prepend command with. So that if you set it to bwrap and the agent asks to run "curl something" it would actually run "bwrap curl something". This might be a useful middleground.

Might be interesting to you: https://github.com/afshinm/zerobox

[dirac-run]

Thanks that makes a lot of sense. Prepending is a good call and I have thought about it for some time from another perspective also.

Basically, implementing a passthrough wrapper, something like diracwrapper <command> could have multiple benefits. One is what you mentioned, another is, we can optimize the token efficiency by removing known pointless info from the input we return back to LLM.

Last time I thought about it, I had left it in my head as 'do the research to see if existing wrappers exist' and haven't gotten back to it.

Happy to put this on the roadmap as the upside is significant.

[thiswillbeyourgithub]

Now that I got zerobox to work i think it's promising as it was done with that use case in mind, isn't slow and is cross platform

[dirac-run]

This looks promising!