- 01
It asks
A command you haven't allowed waits for you. Approve it once, or choose Always to add an allow rule for it.
- 02
It runs sandboxed
On macOS commands run under Seatbelt, on Linux under bubblewrap. If neither is available, Metaphor says so instead of pretending.
- 03
Rules hold
If any file or command in a request is denied, the whole request is denied. Sensitive paths ask first.
The details
- macOS: Seatbelt (sandbox-exec). Linux: bubblewrap.
- On Linux, network access is cut off when the policy doesn't allow it, and the workspace is mounted read-only unless the mode needs to write.
- The sandbox is on by default.
- Windows has no OS sandbox yet: commands run natively there, still behind your approvals.
- Installing plugins or skills, saving agents and switching modes always ask, every time.
Questions
Which sandbox does Metaphor use?
Seatbelt on macOS and bubblewrap on Linux. Windows has no OS sandbox yet, so commands there run natively, still behind your approvals.
Does it run commands without asking?
Only ones you've allowed. Anything else waits for you. Choosing Always adds an allow rule so the same command doesn't ask again.
Does my code leave my machine?
The agent, your repo and the shell run locally. Only the prompt and the files the agent picks go to the model. There is no cloud copy of your repo.