Signature
agent.sandbox(driver: XsafSandboxDriver): XsafAgentA sandbox driver owns executable-tool isolation. XSAF has no implicit host-process fallback: starting an agent with executable tools and no sandbox fails.
Usage
agent.sandbox(containerSandbox);The driver receives the validated tool definition, validated input, execution context, and abort signal. It must enforce the isolation and capability policy appropriate for your deployment.
Explicit local execution
For trusted development only, explicitly opt out of isolation:
import local from "@xsaf/agent/sandbox/local";
agent.sandbox(local({ unsafe: true }));That adapter executes in the host process and is not a security boundary. { unsafe: true } is required so the no-isolation opt-in is deliberate. See Tools & Security for approval ordering, cancellation, and the explicit unsafe local adapter.