-
Notifications
You must be signed in to change notification settings - Fork 1
Roadmap
vkmtx edited this page Jul 27, 2026
·
3 revisions
Status legend: ✅ done · 🧪 experimental · 🔭 planned
| Feature | Status |
|---|---|
| token-aware rendering | ✅ |
addressable output store (sh_detail, match) |
✅ |
| disk-backed record store (survives restart, TTL-pruned) | ✅ |
| effects-as-data diff (git porcelain / trace-derived) | ✅ |
inline assertions (expect) |
✅ |
| declarative retry / timeout | ✅ |
static blast-radius classification (segment-aware) gating every sh_run
|
✅ |
| checkpoint / rollback | ✅ |
atomic CoW checkpoints (APFS clonefile) |
✅ |
real sandbox enforcement (macOS sandbox-exec) |
✅ |
veil init zero-friction setup |
✅ |
background / long-running processes (sh_run background:true, sh_logs, sh_kill) for dev servers / watchers |
✅ |
| Linux sandbox (bubblewrap) | 🧪 needs unprivileged userns |
structured syscall trace (Linux strace) |
🧪 |
namespace-free Linux sandbox (Landlock via landrun) — covers containers/Codespaces |
🧪 experimental — arg-builder unit-tested (#9) |
| streaming / PTY (interactive processes) | 🔭 planned |
The macOS sandbox backend relies entirely on sandbox-exec, which Apple has
deprecated. It is the only sandbox mechanism on macOS today.
Why this is currently safe: the honesty contract is fail-closed. If sandbox-exec
is unavailable, a sandbox:true request refuses to run rather than executing
unconfined — a command is never silently downgraded to an unsandboxed run.
User-visible impact if a future macOS removes it: macOS users would have no
sandbox at all. Every sandbox:true call would refuse, and write-confinement /
network-deny / secret read-confine would be unavailable on the platform.
Candidate fallbacks to evaluate:
- Endpoint Security framework — finer-grained, but needs a provisioned Apple entitlement (and the distribution/signing that implies).
- Container- or VM-based confinement — heavier, but does not depend on a deprecated host primitive.
- At minimum, a loud capability banner so users know confinement is gone and are not lulled by a silent loss of protection.
- 🌱 Good first issues
- 🙌 Help wanted
- 💬 Propose ideas in Discussions
See CHANGELOG.md for shipped versions.