AbsoluteJS

@absolutejs/agent-sandbox

@absolutejs/agent-sandboxv0.2.2betaAI

Deny-by-default capability grants and provider-neutral HTTP, filesystem, process, and credential-safe action adapters for AI agents.

#Installation

BASH
bun add @absolutejs/agent-sandbox

#Capabilities

Overview

Deny-by-default capability sandboxing for agent actions. Grants are scoped to one durable run and one signed agent identity, expire, carry per-capability use limits, and are verified through an issuer-agnostic callback.

HTTP access is restricted by origin, method, path, body/response size, and credential binding. Each broker alias is bound to an exact header or process input name; transport-controlled headers and process-loader variables remain denied even if requested. Filesystem access uses boundary-safe absolute roots. Process access uses exact executable allowlists, argument prefixes, working roots, timeouts, and output limits. Credentials are resolved inside adapters and never returned to the agent.

The broker persists an operation before executing it. Repeating the same grantId + requestId returns the recorded result instead of repeating the external action. Use the Postgres store in production or the memory store in tests. The built-in fetch adapter rejects redirects so an allowed origin cannot bounce an agent to an ungranted destination.

Show 1 more

An adapter failure is deliberately left locked for reconciliation: the remote system may have accepted the effect before the error reached the broker, so an automatic retry would risk duplication. Filesystem adapters must resolve symlinks/real paths before access; process adapters must enforce the grant's timeout and output ceilings at the operating-system boundary.

Outcomes

What you can build

Build on the supported package contract

Use @absolutejs/agent-sandbox through its supported public entry points.

Hardening checklist

Production guidance

Make every external boundary explicitPin the deployed @absolutejs/agent-sandbox version, replace example or memory-backed dependencies with durable implementations, bound external calls, protect credentials, and emit enough evidence to retry or recover safely.

Follow in order

Troubleshooting path

1
Trace from the first failed boundary
Reproduce the smallest canonical @absolutejs/agent-sandbox example, confirm the supported entry point and version in the API explorer, then inspect the first boundary that did not produce its documented result.

#Public entry points

Supported entry points declared by this package manifest.

Package entry point declared in package.json.

@absolutejs/agent-sandbox@absolutejs/agent-sandbox/manifest@absolutejs/agent-sandbox/manifest.json

#Package commands

Scripts declared by this package manifest.

bun run buildrm -rf dist && bun build src/index.ts src/manifest.ts --outdir dist --target=bun --external @absolutejs/manifest --external @sinclair/typebox && tsc -p tsconfig.build.json && absolute-manifest emit
bun run check:packagebun run typecheck && bun run test && bun run build
bun run formatprettier --write "./**/*.{ts,json,md,yml}"
bun run testbun test
bun run typechecktsc --noEmit

#API reference

Search the declarations exported by the current package type files. Expand a symbol to inspect its source-backed signature.

25 symbols
AgentIdentityPintypePermalinkSource
TS
type AgentIdentityPin = {
    descriptorId: string;
    descriptorVersion: string;
    descriptorDigest: string;
};
Exported from @absolutejs/agent-sandbox