sandbox-node

Human-in-the-loop secure install for npm/pnpm/yarn/bun deps, driven by the `sandbox` CLI (@jagreehal/sandbox-node). Runs a read-only `check` review pass (no Docker) that reports supply-chain risk WITHOUT installing, surfaces each finding with a recommended action (including a concrete older version to pin), lets the user choose, then runs the real install with the matching flags. Use when the user wants to install, add, remove, or update dependencies safely, vet a package before installing, review supply-chain risk (fresh releases, OSV advisories, known malware), or asks to "sandbox install" / "check this package".

Contain a coding agent (Claude Code, Cursor, Codex, …) so the package-manager and dependency code it runs can't touch host credentials, persistence, or the network — using the `sandbox` CLI (@jagreehal/sandbox-node). Covers the two lifecycles: ephemeral (agent on the host, every dangerous command jailed by a PreToolUse hook via `sandbox init --agent`) and persistent (agent + editor INSIDE a hardened devcontainer via `sandbox devcontainer init`). Use when the user wants to run an AI coding agent safely, stop an agent from running bare `npm install`/`npx`, isolate an untrusted repo or agent session, or asks to "sandbox my agent" / "lock down Claude in this repo".

Harden a repo's CI/cron with the read-only, no-Docker gates of the `sandbox` CLI (@jagreehal/sandbox-node) — `verify` (the sandbox boundary is committed and un-loosened), `delta` (gate only the dependency changes a PR introduces), `scan` (retroactive malware sweep over the committed lockfile), `secrets` (committed-credential tripwire), and signed `verify --sign` receipts. Use when the user wants a CI gate for supply-chain risk, a PR check for new dependencies, a scheduled malware re-scan, a committed-secret check, a "sandboxed" badge, or asks to "add sandbox to CI" / "gate dependency changes".