The Seatbelt Enclave (src/main/lib/sandbox/seatbelt-enclave.ts) provides a native macOS sandbox backend using sandbox-exec and pf (packet filter). It runs agent shells inside a Seatbelt profile that denies all access except explicitly allowed operations.
Seatbelt Profile
Generated per-session with deny-by-default:
Filesystem: Only workspace directory, /tmp, and system libraries
Network: Only loopback to proxy and authz ports — all other network denied
Process: Only shell binary and /usr/bin, /bin utilities
Blocked: ~/.ssh, ~/.gnupg, ~/.aws, shell history files
pf Rules
Network forcing rules redirect all outbound TCP from the sandbox to the proxy port and block UDP/53 (DNS exfiltration prevention). Applied via pfctl.
buildSpawnArgs(opts) — Get command + args for sandbox-exec -f profile.sb /bin/sh
writeProfile(profile) — Write to temp file, returns path
detect() — Check if sandbox-exec is available (macOS only)
destroy() — Clean up temp files
Testing
Run: npx vitest run src/main/lib/sandbox/seatbelt-enclave.test.ts
1---2name: enclave-seatbelt3description: Enclave Seatbelt (macOS)4---5# Enclave Seatbelt (macOS)67## What This Module Does89The Seatbelt Enclave (`src/main/lib/sandbox/seatbelt-enclave.ts`) provides a native macOS sandbox backend using `sandbox-exec` and `pf` (packet filter). It runs agent shells inside a Seatbelt profile that denies all access except explicitly allowed operations.1011## Seatbelt Profile1213Generated per-session with deny-by-default:14- **Filesystem:** Only workspace directory, /tmp, and system libraries15- **Network:** Only loopback to proxy and authz ports — all other network denied16- **Process:** Only shell binary and /usr/bin, /bin utilities17- **Blocked:** ~/.ssh, ~/.gnupg, ~/.aws, shell history files1819## pf Rules2021Network forcing rules redirect all outbound TCP from the sandbox to the proxy port and block UDP/53 (DNS exfiltration prevention). Applied via `pfctl`.2223## Key API2425- `generateProfile(opts)` — Create Seatbelt .sb profile26- `generatePfRules(opts)` — Create pf rule set27- `buildSpawnArgs(opts)` — Get command + args for `sandbox-exec -f profile.sb /bin/sh`28- `writeProfile(profile)` — Write to temp file, returns path29- `detect()` — Check if sandbox-exec is available (macOS only)30- `destroy()` — Clean up temp files3132## Testing3334Run: `npx vitest run src/main/lib/sandbox/seatbelt-enclave.test.ts`
Run npx skillmds@latest add latchagent/enclave-seatbelt in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
Enclave Seatbelt (macOS) It is listed under Coding & Dev Tools on SkillMD.
This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.
latchagent (@latchagent) published this skill. Their other Agent Skills are listed on their SkillMD profile.
latchagent