didvc/ai-bwrap

README preview

# ai-bwrap

**Run AI coding agents inside a [bubblewrap](https://github.com/containers/bubblewrap) sandbox — one wrapper, any agent.**

[![CI](https://github.com/didvc/ai-bwrap/actions/workflows/ci.yml/badge.svg)](https://github.com/didvc/ai-bwrap/actions/workflows/ci.yml)
[![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE)
[![Shell](https://img.shields.io/badge/shell-bash-1f425f.svg)](ai-bwrap)
[![Platform: Linux](https://img.shields.io/badge/platform-linux-blue.svg)](#requirements)

`ai-bwrap` launches an AI coding agent — **Claude Code**, **opencode**, **Grok**, or a plain **shell** — inside a `bwrap` namespace. The agent gets read-write access **only to your current working directory**; the rest of `$HOME` stays hidden. Just the config, cache, and state directories an agent actually needs are passed through.

It is the multi-agent sequel to [`opencode-bwrap`](https://github.com/didvc/opencode-bwrap): instead of wrapping a single tool, agents are declared as small shell functions, so the registry is **extensible without touching the wrapper**.

![ai-bwrap --help](assets/screenshots/help.png)

## Why

AI coding agents run shell commands, edit files, and fetch from the network on your behalf. Run directly, they can read anything you can — `~/.ssh`, `~/.aws`, browser profiles, every other project on disk. `ai-bwrap` confines them to the directory you're actually working in, while still passing through the toolchains and credentials they legitimately need (git, `gh`, Node/NVM, Cargo, …).

![What the sandbox blocks vs. passes through](assets/screenshots/isolation.png)

View full repository on GitHub →