Nanobot merges an opt-in macOS shell sandbox with explicit filesystem limits

Nanobot has merged a macOS Seatbelt backend for shell subprocesses, extending its sandbox story beyond the existing Linux bwrap path. The September 9 merge is the concrete event; the stable release feed still points to v0.3.0 from July 25, so mainline availability must not be confused with a newly published package.

The backend uses the system sandbox-exec launcher and makes filesystem policy explicit. Workspace writes, read-only media and narrow extra roots are permitted; host temporary directories are not simply shared wholesale. That gives Mac operators a more bounded shell lane, but the proposal’s limitations are as important as its feature list. Network access remains enabled, and Seatbelt does not create a new OS identity or mount namespace.

The facts

- PR #5628 was merged September 9 at 16:00:45 UTC and adds the opt-in seatbelt value under tools.exec.sandbox. - The backend uses /usr/bin/sandbox-exec without introducing a new dependency. - HOME and TMPDIR point into the workspace, while other installations and caches may need explicit read-only or read-write binds. - Read-only binds revoke workspace writes beneath them; explicit read-write binds are applied last. - The documented policy permits networking and leaves existing empty/bwrap defaults unchanged. - The author reports 332 focused Python tests passing with six skips, including 18 native macOS regressions. - A missing configured Unix backend fails instead of silently falling back to unsandboxed execution.

Why it matters

A small runtime still needs a serious answer to what its shell can touch. This change makes that answer more useful for Mac deployments without pretending to provide container isolation. The bind precedence is an operator decision with consequences: an overly broad allowed root can make valuable files reachable again, and credentials inside the workspace are not protected merely because the parent directory is denied. Network access also means filesystem containment should not be marketed as an exfiltration guarantee.

Current

Inspected on 2026-09-10. The Nanobot stable-release baseline is v0.3.0 published 2026-07-25T08:08:47Z. The main source was merged 2026-09-09T16:00:45Z when captured. Release metadata is a version boundary; an open proposal, a merged mainline change and a packaged release remain different states.

Evidence

The primary evidence is HKUDS/nanobot PR #5628 (https://github.com/HKUDS/nanobot/pull/5628). Supporting context comes from Nanobot — security policy and sandbox guidance (https://raw.githubusercontent.com/HKUDS/nanobot/main/SECURITY.md); Nanobot — current official README (https://raw.githubusercontent.com/HKUDS/nanobot/main/README.md). These pages were inspected directly. Related project records explain the source cluster; they are not independent replications of contributor test claims.

Operator take

Before enabling the backend, inventory the tools and caches the intended workload actually needs. Use disposable peer files to prove denied reads and writes, check symlink behavior, and exercise explicit scratch paths under TMPDIR. Record the exact installed revision and confirm the packaged build contains the merged backend. Keep secrets outside the workspace and every configured bind rather than relying on the sandbox label.

Caveat

The merged implementation and its documented policy were inspected; illmethinks did not execute the native macOS regression suite. The cited results are author-reported and do not establish a full-repository or cross-platform pass. Seatbelt remains opt-in and its network permission is an intentional boundary, not an omission in this report.