macOS Seatbelt
Kernel-level sandboxing on macOS — the default on every Mac.
What is macOS Seatbelt?
macOS Seatbelt (sandbox-exec) is the kernel-level sandbox Watchfire wraps every agent in on Mac. It's part of macOS itself, not a separate dependency, so on a fresh Mac the sandbox is already there.
macOS Seatbelt + Watchfire
Watchfire generates a per-session Seatbelt profile that denies reads of ~/.ssh, ~/.aws, ~/.gnupg, and .env files anywhere in the worktree. Writes are scoped to the task's worktree and Watchfire's own temp directories. The profile inherits into every process the agent spawns — subshells, build scripts, language runtimes, all of it.
Because the profile is kernel-enforced, an agent that tries to read or write a denied path gets an EPERM from the OS — there's nothing it can do at the agent layer to talk its way past the rule.
If sandbox-exec ever isn't available (a stripped-down macOS image, for example) Watchfire refuses to launch the agent rather than falling back to an unsandboxed run. The sandbox is non-optional.
Setup
Seatbelt is the default on macOS — no setup needed beyond watchfire init. See the sandboxing concept for what the generated profile contains.
# .watchfire/project.yaml
sandbox: sandbox-exec # default on macOSGet started with Watchfire
Install in seconds. Define tasks. Let agents ship code for you.
Download for macOSAvailable for macOS, Linux, and Windows
# Install via Homebrew (macOS)brew tap watchfire-io/tapbrew install --cask watchfire-io/tap/watchfire# Set up your project and gowatchfire initwatchfire task add "Build the login page"watchfire start --allIncludes GUI, CLI, and daemon. Also available via Homebrew.