Module sandbox 

Opt-in Landlock filesystem sandbox (Linux only, EXPERIMENTAL).

Set WINX_SANDBOX=1 before starting winx to confine the winx process and the PTY shell children it spawns: writes are restricted to the workspace (the cwd at startup) plus /tmp, and the home directory is deliberately NOT in the allowlist, so a manipulated agent can neither read ~/.ssh / ~/.aws nor modify files outside the project.

This is coarse and best-effort. A command that needs a path outside the allowlist (a compiler reading ~/.cargo, say) will fail; extend the allowlist with WINX_SANDBOX_RO_PATHS / WINX_SANDBOX_RW_PATHS (:-separated absolute paths). On kernels without Landlock (< 5.13) it logs a warning and runs unsandboxed (the Landlock default compatibility is best-effort). Off by default: winx is unaffected unless you opt in.

Known limitation: /proc is read-allowed because many programs need /proc/self, and Landlock (ABI v1) cannot scope rules within procfs. That also exposes other processes’ /proc/<pid>/environ. On a single-user local machine (winx’s target) those are same-user processes the agent could already read without the sandbox, so this isn’t a regression - but don’t rely on the sandbox to hide env-passed secrets from co-tenant processes.

Structs

SandboxReport

Deferred diagnostics from sandbox setup. Landlock must be applied before logging creates its non-blocking writer thread; messages are therefore stored and emitted immediately after the subscriber is installed.

Functions

apply_if_requested

Apply the Landlock sandbox if WINX_SANDBOX is set. Infallible: any problem is reported and the process continues (possibly unsandboxed). The cwd at startup is taken as the workspace and granted read-write. MUST be called before logging or the async runtime create threads so every child inherits the Landlock domain.