saphan confine-exec · Saphan Studio documentation

Applies this machine's own filesystem confinement and then runs a command inside it; Saphan Studio invokes it on a remote machine to start an agent within the boundary a run was given.

Applies this machine's own filesystem confinement and then runs a command inside it; Saphan Studio invokes it on a remote machine to start an agent within the boundary a run was given. On Linux it uses a Landlock restriction that cannot be lifted once applied; on macOS it runs the command under sandbox-exec with an inline profile. There is no best-effort mode: a kernel without the required Landlock support, a Mac without sandbox-exec, or a policy the machine cannot express is refused by name and nothing runs. A network rule in the policy can only be enforced by the macOS profile; on Linux a policy carrying one is refused.

⚠ On Linux, Landlock does not cover metadata changes (permissions, ownership, timestamps, extended attributes), so a policy there means "cannot write file contents outside the allowed roots", not "cannot modify anything". Whether the macOS profile also covers metadata changes has not been measured.

saphan confine-exec --policy '{"read_write":["/home/x/wt"],"read_only":["/"]}' -- /usr/bin/claude -p "..."

saphan confine-exec --policy <json> -- <command> [args...]

flag	type	default	what it does
`--engine-git`	bool	`false`	Run one of Saphan Studio's own git operations inside a confinement this machine builds: everything read-only, the directory holding this machine's device key hidden, writes allowed only under the `--rw` directories.
`--expect-common`	string		With `--engine-git`: the git repository the operation is meant to run in; an operation that resolves to a different repository is refused.
`--policy`	string		The boundary to apply, as one JSON value listing at least one read-write path, the read-only paths and, on Linux, the minimum Landlock version; unknown fields are refused, and a minimum version is refused on macOS, which cannot check it.
`--probe`	bool	`false`	With `--engine-git`: build the confinement and run nothing, exiting 0 when this machine can enforce it and with a named refusal when it cannot.
`--rw`	stringArray		With `--engine-git`: an absolute directory the operation may write under. Repeat for several; a directory that does not exist is skipped.

Global options apply to every command — see Every command.