Wormbox 0.2.0: Claude Code in the sandbox

The first release covered the Node toolchain. Version 0.2.0 moves beyond Node: to Claude Code (claude), which constantly runs foreign code and processes content from untrusted sources.

brew tap head1328/wormbox \
  https://codeberg.org/head1328/homebrew-wormbox.git
brew trust --formula head1328/wormbox/wormbox
brew install wormbox

Claude Code in the sandbox

#

Claude Code runs with broad access and presents a large attack surface. It calls MCP servers, processes file and web content, runs arbitrary commands through its bash tool, and installs dependencies. Each path is a possible entry point: a compromised MCP server, a prompt injection in a file, a malicious dependency.

The new claude profile has one goal: isolate host credentials. Through none of those paths should code reach credentials outside a trusted set.

• Strict filesystem. Reads and writes only in the working directory where claude starts, plus ~/.claude and temp. Everything else denied.
• Network intentionally open. Claude Code fetches arbitrary URLs; a deny-default at the network layer would make the tool unusable. The protection sits at the filesystem and credentials, not the network.

Layer C: secret files stay denied inside the project

#

The readable project tree often holds secrets of its own. Layer C denies project-local secret files even when the rest stays readable:

• .env and .env.*
• *.pem, *.key, *.p12, *.pfx
• SSH private keys, including the FIDO variant (_sk); the matching .pub files stay readable
• .git-credentials, .netrc
• KeePass databases (*.kdb, *.kdbx)

So the agent can work inside the project without an injected tool call reading the .env or the deploy key.

KeePass coverage

#

The credential paths now cover the common KeePass clients on macOS: KeePassXC, MacPass, and KeePassX.

Configurable: fs and network

#

Two new blocks in config.json:

• fs. Widen the filesystem deliberately when a tool legitimately needs more access.
• network. Set the network policy per tool and per project: deny, loopback, or all.

Local dev servers work again

#

The run profiles were blocking local dev servers. npm run dev and the node/pnpm/yarn/bun equivalents can now bind a loopback port and accept connections; external egress stays denied.

Tests and toolchain

#

• A new end-to-end suite built on bats-core. It runs against a real install in a throwaway macOS VM and produces a JUnit report.
• Built with go1.26.5 to pick up the crypto/tls fix for GO-2026-5856 (a privacy leak through Encrypted Client Hello).

Breaking change: re-run setup

#

Coming from 0.1.0, you need to run wormbox setup again. The base profile references new credential parameters, and the shim sources its parameters from wormbox shim-params.

brew update
brew upgrade wormbox
wormbox setup

License

#

MIT. Contributions, issues, and forks welcome: codeberg.org/head1328/wormbox .