devSandbox / dev_sandbox
A Sandbox in a local directory on the host, inside an OS confinement (bubblewrap on Linux, sandbox-exec on macOS).
Pass it as agent({sandbox: devSandbox()}). For development: threads start refuses a host whose agent uses it. Each sandbox is a directory named by its operation key, so a lost create answer is found by looking for that directory and lookup is final. It has no snapshots, its network is blocked, a command gets exactly the environment of its call and no home, and the host never follows a symlink inside the sandbox's files. Termination is unconfirmed, so an in-doubt call parks.
Import from @threads/core (TypeScript) or threads.dev (Python).
function devSandbox(options?: {
root?: string;
allowInternet?: boolean;
tool?: string;
}): SandboxParameters
rootstringWhere sandbox directories are made. Omitted: threads-dev in the host's temp directory. Each sandbox is <root>/threads-dev-<32 hex of its operation key>, and closing it removes that directory.
allowInternet / allow_internetbooleandefault falseLifts the confinement's network block. Egress is then unenforced, so the agent must also set egress: "unenforced".
toolstringThe confinement program to run. Omitted: bwrap on Linux and sandbox-exec on macOS. One that is missing, or that can't confine a command on this host, is capability_missing at setup, naming it.
Returns
Throws ConfigError with one of these codes: capability_missing.