agent-leash

agent-leash

Sandbox runner for AI coding agents:

• Restricts filesystem access to the current directory
• Custom allow-list to expose more directories as read-only or read-write
• Intercepts all network traffic with interactive per-domain approval
• Controls access to host services (podman, docker, ssh-agent, etc.)

$ pipx install agent-leash
$ aleash claude
Sandbox UI available on http://localhost:7612/

How it works

• Filesystem — bubblewrap restricts the agent to the current working directory. The rest of the filesystem is read-only or hidden.
• Network — mitmproxy intercepts all outbound HTTPS. Each new domain triggers a browser popup (and desktop notification). You choose: always allow, allow once, always block, or block once.
• Web UI — Vue 3 + xterm.js frontend served on localhost:7612. Shows live terminal output, domain decisions

Requirements

mitmproxy is installed automatically as a Python dependency.

Usage

Pass arguments

aleash claude -- --dangerously-skip-permissions
aleash run python script.py --some-flag

Terminal size

By default the local terminal controls the PTY size. The browser shows the fixed-size terminal with scrollbars. Use --browser-master to invert this (browser FitAddon resizes the PTY):

aleash --browser-master claude

Profile override

aleash --profile generic claude   # run claude with the generic profile

Profiles

claude and opencode are auto-detected by binary name. Use --profile to override.

Data

All state lives in CWD/.aleash/:

Delete CWD/.aleash/data.db to reset all history.

Contributing

See CONTRIBUTING.md.

License

MIT — see LICENSE.