Federated_Computer/coredesktop
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Page: Sandboxed AI Agents
Pages
Configure Items Configure Home How CoreDesktop Works Installing Migrations Sandboxed AI Agents Sibling Projects Software and Settings Troubleshooting Update Hooks Updating
Clone
1
Sandboxed AI Agents
David Young edited this page 2026-10-26 16:01:09 -06:00
Table of Contents

Sandboxed AI Agents

CoreDesktop installs three AI coding agents: opencode, Hermes Agent and Claude Code. It runs all three in a sandbox, so an agent can't read your secrets or change files outside your project.

Before using an agent the first time, sign in with configure.

What the sandbox allows

A sandboxed agent:

  • can change files only in the directory you start it from, plus its own settings, /tmp and a few package caches. Start it from a project directory: it refuses to start from your home folder or /.
  • can't read your SSH and GPG keys, password stores, keyrings, browser profiles, cloud and Git credentials, or the other agents' logins
  • can reach only AI providers and common developer sites: GitHub, Gitea, npm, PyPI, crates.io, RubyGems, the Go module proxy and archlinux.org

How it works

Agent Sandbox
opencode, hermes, hermes-agent Run inside Anthropic's sandbox runtime (srt), which uses bubblewrap and socat
Hermes' gateway Its background service, which lets you talk to Hermes over Matrix, runs in the same sandbox. It can also reach the Matrix server in Hermes' settings.
Claude Code Uses its own built-in sandbox for every command it runs. See /sandbox inside Claude.

Typing an agent's name runs it sandboxed, because sandbox/bin comes first on your PATH. To run one without the sandbox:

unsandboxed opencode

Allowing more

If an agent needs a site or folder the sandbox blocks, add it in:

  • ~/.config/coredesktop/sandbox/base.json, for every agent
  • ~/.config/coredesktop/sandbox/<agent>.json, for one agent: opencode.json or hermes.json
{
  "network": { "allowedDomains": ["docs.example.com"] },
  "filesystem": { "allowWrite": ["~/notes"] }
}

Your files only add to CoreDesktop's defaults, which are in sandbox/config/ in the repository. The change applies the next time you start the agent. For Hermes' gateway, run systemctl --user restart hermes-gateway.

For Claude Code, change the sandbox section of ~/.claude/settings.json. CoreDesktop only fills in defaults there and never overwrites what you've set.

Using CoreDesktop

Working on CoreDesktop