How anthropic-experimental/sandbox-runtime works
srt wraps a command-line process or library-managed process in OS-enforced filesystem and network restrictions. The principal flow loads and validates settings, initializes platform isolation and host-side network proxies, then wraps and launches the command; proxy requests are filtered before being forwarded. The graph also preserves credential handling, TLS interception, and violation monitoring as product capabilities. README documentation supports the platform and isolation overview; sampled excerpts clarify CLI, manager, and proxy ownership, but do not expose every subsystem’s internal wiring.
Main entry points: sandbox-manager.ts Sandbox manager · cli.ts CLI · http-proxy.ts HTTP proxy · tls-terminate-proxy.ts TLS termination
Components 21
Entry and configuration
- CLI
src/cli.ts - Config loader
src/utils/config-loader.ts - Config schemas
src/sandbox/sandbox-config.ts - Sandbox manager
src/sandbox/sandbox-manager.ts
Process isolation
- macOS isolation
src/sandbox/macos-sandbox-utils.ts - Linux isolation
src/sandbox/linux-sandbox-utils.ts - Windows isolation
src/sandbox/windows-sandbox-utils.ts
Network mediation
- HTTP proxy
src/sandbox/http-proxy.ts - SOCKS proxy
src/sandbox/socks-proxy.ts - Proxy mux
src/sandbox/mux-proxy.ts - Request filter
src/sandbox/request-filter.ts - Parent proxy
src/sandbox/parent-proxy.ts - TLS termination
src/sandbox/tls-terminate-proxy.ts - MITM certificates
src/sandbox/mitm-ca.ts
Credentials and monitoring
- Credential controls
src/sandbox/credential-extract.ts - Body substitution
src/sandbox/body-substitution.ts - Violation monitor
src/sandbox/linux-violation-monitor.ts - Violation store
src/sandbox/sandbox-violation-store.ts
Other components
- Caller
- Sandboxed process
- Remote network
Connections 24
- Caller → CLI: runs command
- CLI → Config loader: loads settings
- Config loader → Config schemas: validates config
- CLI → Sandbox manager: initializes sandbox
- Sandbox manager → macOS isolation: builds isolation
- Sandbox manager → Linux isolation: builds isolation
- Sandbox manager → Windows isolation: builds isolation
- CLI → Sandbox manager: wraps command
- CLI → Sandboxed process: spawns wrapped command
- Sandbox manager → Proxy mux: starts listeners
- Proxy mux → HTTP proxy: dispatches HTTP
- Proxy mux → SOCKS proxy: dispatches TCP
- HTTP proxy → Request filter: checks requests
- HTTP proxy → TLS termination: terminates TLS
- HTTP proxy → Parent proxy: forwards via parent
- TLS termination → Request filter: checks requests
- TLS termination → MITM certificates: mints certificates
- TLS termination → Body substitution: transforms bodies
- HTTP proxy → Remote network: forwards traffic
- SOCKS proxy → Remote network: forwards traffic
- TLS termination → Remote network: forwards HTTPS
- Sandbox manager → Violation monitor: enables monitoring
- Violation monitor → Violation store: records events
- Request filter → Credential controls: applies credential rules