docs(cli): restructure the Sandbox reference (hooks, MCP env, org mode selector)#1280
Merged
Merged
Conversation
… mode selector Cover three merged sandbox-hardening PRs: - CLI-1148 (mono#15438): hook commands run inside the sandbox and fail closed - AC-616 (mono#15582): sandboxed stdio MCP servers run with a scrubbed env allowlist - AC-536 (mono#15180): admins can set sandbox.mode org-wide via Enterprise Controls Mirrored to JP. Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
Contributor
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Workflows to automatically generate PRs for you. |
Describe MCP tool sandboxing in terms of outcomes and boundaries rather than internal mechanics (drop checkNetworkAccess()/checkFileAccess(), argument inspection, side-effect metadata, and proxy internals). EN + JP. Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
Add a 'How OS-level isolation works' section (OS primitives per platform, network proxy, Windows/WSL2 support) and a 'Security limitations' section, matching the detail level of comparable platform docs. Tighten the MCP tools bullet and replace repeated 'fail closed' jargon with plain outcome language. EN + JP. Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
wenemily
force-pushed
the
docs/sandbox-hooks-mcp-env-enterprise-mode
branch
from
738653f to
612efc3
Compare
Reorganize the sandbox doc into concept, isolation modes, enable/configure, coverage/enforcement, and security limitations; fix per-command mode description, and note that settings files are non-overridably protected. Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
wenemily
changed the title
Contributor
|
Droid finished @wenemily's task —— View job The restructure is clear and substantially improves the sandbox documentation. A few lines should be tightened to avoid misleading security claims or internal inconsistencies, and the JP page should restore |
lukealvoeiro
previously approved these changes
Jul 9, 2026
![factory-droid[bot]](https://avatars.githubusercontent.com/in/358017?s=60&v=4){kind=small}
Scope the MCP minimal-environment claim to ambient env vars, clarify that settings-file write protection applies to sandboxed tool processes, and restore /jp locale prefixes on JP in-text and Related links. Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
wenemily
dismissed stale reviews from factory-ain3sh and lukealvoeiro
via
027ba5a
wenemily
requested review from
factory-ain3sh and
lukealvoeiro
and removed request for
factory-ain3sh
lukealvoeiro
approved these changes
Jul 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Restructures and hardens
docs/cli/configuration/sandbox.mdx(EN + JP) for a user-facing audience, and documents the merged sandbox-hardening PRs under AC-618.Restructure
Reorganized the reference into a clearer reading order, at a level of detail comparable to peer tools' sandbox docs:
per-commandvswhole-process(what runs in the sandbox, how MCP/hooks/subagents are handled, main-process isolation, behavior when isolation is unavailable).droid exec, allow-always persistence, TUI indicators).Removed internal identifiers and jargon throughout in favor of outcome-based, user-facing language.
Linear tickets
Closes CLI-1148, AC-616, AC-536
mcp.json.sandbox.mode(per-command/whole-process) org-wide from Enterprise Controls.Accuracy fixes (verified against factory-mono)
per-commandmode also mediates MCP servers, hooks, and subagents (not only shell commands); the real distinction is that it leaves the main Droid process unsandboxed.settings.json,hooks.json,mcp.json, org-managed settings, etc.) sit behind a non-overridable deny-write floor, so a sandboxed process cannot modify its own policy.All changes mirrored to the JP doc.
Not included: AC-564 (mono#15268, whole-process on macOS) since its source PR is not yet merged.