Amr Hassan

barebox is a lightweight sandbox you spawn per AI agent, so the agent can work on your machine with your real tools without being able to do anything irreversible behind your back. Every request the agent makes gets one letter: r (reads) passes, w (changes that can be undone) lands on an undo layer you commit or roll back, and x (pay, send, publish, push, delete) is held at the door until a person says yes in the terminal. One flag picks the mode (ask, auto, trust), and card numbers and payment paths ask in every mode. Many sandboxes share one proxy, one policy gate and one audit file (gate.jsonl, one JSON line per decision, streamable anywhere). It needs no root, no daemon, no Docker image. API keys never enter the sandbox: the agent holds a placeholder, and the proxy swaps in the real key only after a request is approved, and only for that key's hosts. SSH keys, cloud credentials and token files read as empty inside. Measured on Linux: about 8 MB per sandbox, about 0.7 s from start to exit, up to 40 agents per proxy (95-160 MB in normal use, about 241 MB at most in the worst case). A prompt-injected agent's three exfiltration attempts were blocked in every mode. It's open source (Apache-2.0) and published on npm as barebox.