Feature · Platform
Runners
On macOS, work on your runner runs in a sandbox. It can write only its own task folder and reach only the model vendor and allowed package registries.
How it works
Where work happens
Each task gets its own folder under ~/.agent-runner/sandbox. For code work, the runner clones the repository there with your own git access and removes the clone's remote. Work comes back to Agent as a diff. The runner never pushes, opens a pull request or changes a tracker. Agent checks the diff, then applies, verifies and delivers it.
The macOS sandbox
On macOS, the CLI and everything it starts run in a sandbox that denies by default:
- It writes only the task folder and the CLI's own login location.
- It cannot change the clone's
.gitfolder or your settings. - Its only network is the runner's proxy. The proxy reaches the CLI's vendor and, when the repository allows installs, the package registries Agent names.
- It keeps only the environment variables its CLI needs. Your other tokens stay out.
- It cannot use the keychain or other secret stores, except Claude Code's own sign-in item.
Shell commands
A runner started with --allow-shell lets work use the CLI's shell. Where there is no sandbox, such as Linux, such a runner takes no shell work. See Runner platforms.
A result with a secret in it
When a result contains something shaped like a token, the whole result is refused. Only the reason goes back.
From the help article The runner's sandbox, checked against the product on .
What you can do
The operations this feature's screens call. Each one is POST /api/<name>, and the badge says who may call it.
MemberlistLocalRunnersLists local runners.
Types:
ListLocalRunnersRequestreturnsLocalRunnerListDto
MemberlistRunnerTasksLists runner tasks.
Types:
ListRunnerTasksRequestreturnsRunnerTaskListDto
ViewerNo API tokensgetPlanUsageGets plan usage.
Types:
GetPlanUsageRequestreturnsPlanUsageDto
ViewergetLocalRunnerSettingsGets local runner settings.
Types:
EmptyRequestreturnsLocalRunnerSettingsDto
MemberNo API tokensrevokeLocalRunnerRevokes the local runner.
Types:
LocalRunnerIdRequestreturnsLocalRunnerDto
AdminNo API tokensupdateLocalRunnerSettingsUpdates local runner settings.
Types:
UpdateLocalRunnerSettingsRequestreturnsLocalRunnerSettingsDto
MemberNo API tokenscreateLocalRunnerCreates a local runner.
Types:
CreateLocalRunnerRequestreturnsCreateLocalRunnerResult
MemberNo API tokenscreateRunnerTaskCreates a runner task.
Types:
CreateRunnerTaskRequestreturnsRunnerTaskDto
MembergetRunnerTaskGets the runner task.
Types:
GetRunnerTaskRequestreturnsRunnerTaskDetailDto
MembercancelRunnerTaskCancels the runner task.
Types:
RunnerTaskIdRequestreturnsRunnerTaskDto
ViewergetHostLoginSettingsGets host login settings.
Types:
EmptyRequestreturnsHostLoginSettingsDto
AdminNo API tokensupdateHostLoginSettingsUpdates host login settings.
Types:
UpdateHostLoginSettingsRequestreturnsHostLoginSettingsDto
ViewerlistMembersLists members.
Types:
EmptyRequestreturnsListMembersResponse
Screens
What it records
The feature writes these events to the audit log, the permanent record of what happened.
- Policy changed
- Connector run reported
- Connector run started
- Delegate ended
- Vendor trigger fired
- Vendor trigger removed
- Vendor trigger saved