strands-agents / box

Strands Box 
 An open source sandbox engine for AI agents. 
## Overview
Strands Box is an open source sandbox for AI agents.
It combines operating-system isolation with semantic policies
written in Dogwood, so you can control
what agents can access and the conditions under which they can act.
Box is harness-agnostic. You choose the agent program or binary to run, configure
its access in `box.toml`, and write its policies in `policy.dw`.
The host OS enforces the direct access restrictions in `box.toml`. Strands Shell,
Monty for Python, the egress gateway, and the MCP broker send the operations
they handle to the embedded Dogwood Local Engine, which evaluates the rules in
`policy.dw`. Box enforces its allow or deny decisions outside the agent process.
Dogwood uses `permit` and `forbid` rules. Operations checked by the engine are
denied by default: a matching `permit` must allow the operation, and a matching
`forbid` overrides that permission.
Box's interpreters and gateways share an event history, so rules can use earlier
actions and elapsed time to decide what is allowed next. For example, a file read
through Shell or Python can cause the gateway to deny a later outbound HTTP request.
**Preview:** Box currently supports local execution on macOS with Apple silicon.
We welcome feedback through GitHub issues.
Read CONTRIBUTING.md before submitting a change.
## Key capabilities
- **File, program, and network restrictions.** The agent's sandbox limits its
 direct access. Box reports the configured grants at startup.
- **Semantic and temporal policies.** Dogwood rules can depend on the requested
 operation, its arguments, earlier actions, and elapsed time. Operations checked
 by the policy engine are denied unless a rule permits them.
- **Policy across code and tools.** Strands Shell, Monty for Python, the egress
 gateway, and the MCP broker use one policy engine and event history. A file read
 through one interpreter can affect whether a later network request is allowed.
- **Request and tool-call checks.** The egress gateway checks connections and
 HTTP requests, including their method and path. The MCP integration checks
 configured tool calls and their arguments.
- **Credential injection.** The gateway authenticates permitted requests with
 configured API credentials or AWS SigV4 signing. The agent does not receive the
 underlying secrets.
- **Decision records.** Box records policy decisions in OTLP JSON. By default,
 records go to ` /private/telemetry/records.jsonl`.
Direct filesystem grants in `box.toml` are enforced by the OS and do not produce
individual Dogwood decisions. To apply a policy to file operations, use the
interpreters and keep those files out of the agent's direct grants. See
filesystem access and policy.
## Use Box as a Rust library
Link the `strands-box` package in `crates/box`, then call:
 [code] 
This runs the existing Box command in the calling process and waits until it finishes.
It uses the process's terminal and returns its e