Choose the branch before giving the agent a task
Sandcastle can sandbox a coding agent while letting it write directly into your current working directory. Its branch guide makes head the default for bind-mount providers. Choosing a sandbox therefore leaves a second decision: where should the agent's changes land?
The README describes a TypeScript orchestration library. You supply an agent, select an execution provider and choose a branch strategy. Native OS providers, Docker and Podman sit alongside cloud options. Consider it when you need to script these choices around coding-agent tasks. The supplied run did not establish an authenticated agent workflow or verify a generated change.
Start an evaluation with a disposable repository and a named output branch. Check where files change and what remains after a failed run. This is a proposed acceptance check, not a test completed for this review.
What happened when we ran it
The November 3, 2026 run at commit 8c2c568 installed successfully in 23 seconds and built successfully in 33 seconds. The record lists 1,069 dependencies and 642 MB on disk. Tests failed with exit 1 after 192 seconds. Vitest reported 3,122 passed, 1 failed and 130 skipped of 3,253, plus 1 error.
The tail names tests/readme-native-picker.test.ts with one failed case. It also reports seven failed test files, 88 passed files and two skipped files out of 97. File outcomes and individual test outcomes are separate counts. Several Bubblewrap-related files show skipped cases, but the supplied excerpt contains neither the failed assertion nor the underlying error. Those names do not establish a missing package, kernel restriction or documentation defect.
The sandbox configuration recorded 3 CPUs and 8 GB RAM with image label lab-node:22. That label does not verify the actual Node or operating-system version. The supplied npm audit reported zero known vulnerabilities. This is a dependency-advisory result, not an assessment of sandbox containment.
The run establishes a successful repository build and an unsuccessful test command. It does not establish agent task quality, escape resistance or reliable commit return.
Native sandboxes leave localhost reachable
The provider guide says native sandboxes use host tools, with a private home and constrained writable paths. Linux and WSL2 use Bubblewrap; macOS uses Seatbelt. These providers avoid building a separate image.
Those providers leave networking open, including access to localhost. If a developer machine exposes a database or administration endpoint there, selecting a native sandbox does not isolate that service from the agent. The guide also says Seatbelt does not promise to keep an agent away from macOS Keychain. Evaluate another execution boundary if your workflow requires those restrictions.
Native providers do not support interactive(). The guide says that call throws rather than opening an interactive session. Check provider support before planning an interactive handoff. The common library interface does not give every provider the same capabilities.
Separate branches require an explicit choice locally
The branch guide distinguishes head, merge-to-head and named-branch strategies. Head writes directly into the host directory for bind-mount providers. Merge-to-head uses a temporary branch and merges commits back automatically; isolated providers use it by default. The branch strategy puts commits on an explicitly named branch in a Git worktree.
For an initial evaluation, choose a named branch so you can inspect the result before accepting it. A branch does not provide an approval system. The docs warn that Git commands you later run yourself are outside Sandcastle's control. Review the agent's changes before running commands that read repository configuration in a repository the sandbox has written to.
The getting-started guide requires Git, an execution provider and explicit agent authentication. Its Claude Code example uses an OAuth token or Anthropic API key because the native sandbox hides stored host logins. Installing the library does not establish a working authenticated agent session.
When a process restriction tool is enough
Anthropic Sandbox Runtime is a CLI and library for filesystem and network restrictions on processes. Its README labels it a research preview. Evaluate it when you already handle orchestration and Git changes and need a process restriction layer.
Bubblewrap constructs Linux sandbox environments from command-line arguments. Its README makes the caller responsible for the security model. Consider it directly when you intend to implement that policy yourself.
Documentation receives 4/5 for explicit provider boundaries, authentication prerequisites and branch defaults. The documentation scale runs from 1 for missing essentials to 5 for independently verified instructions across documented paths. The documented agent workflows were not independently exercised, so this rating does not establish that those paths work.
Setup ease, community support and production maturity remain unassessed. Supplied repository metadata observed on November 4, 2026 records a last push at 2026-11-04T03:07:21Z. The supplied release metadata lists v0.14.0 dated November 2, 2026. These records are separate from the measured checkout at 8c2c568 and do not establish issue responsiveness or community support.
Before using Sandcastle with an important repository, obtain the missing failure details and verify the chosen provider and branch behavior in a disposable repository.