🐶

Chopi 🐶
A macOS-native filesystem and network sandbox to unleash your agents.

Your Mac

No VM, no container: the agent runs with your real tools.

?Seatbelt policy
Chopi appends its own network rules last, so they have the final word on network access.

Agent Safehouse base

  • ?Workspaceread/write
    The root of the git worktree the session runs in. Chopi refuses to run anywhere else, so its git protections always apply.
  • ?Paths you grantread/write or read-only sandbox.sh
    Caches, build outputs, other apps: add them with safehouse's --add-dirs and --add-dirs-ro, or enable presets such as xcode.

Added by chopi

  • ?Git internalsconfig & hooks read-only
    Only git's data (objects, refs, the index) is writable, so nothing the agent writes can later run unsandboxed during a git operation. A rebase or cherry-pick left in progress is aborted when the session ends.
  • ?Other worktreeshidden
    A session sees only its own worktree's files, so the agent can't pick up context from another task. chopi --worktree NAME starts a session in a new worktree on its own branch.
  • ?Safe write targetsedits become patches sandbox.sh
    Files you want to read before they change, like shared guidelines or a CLAUDE.md. The agent can read them, and queues a patch instead of writing.
  • ?Networkchopi-proxy only
    Seatbelt can filter by IP and port but not by hostname, so it allows only the local proxies. A tool that ignores HTTP_PROXY gets no network at all.
configures
Seatbelt sandbox

macOS enforces the policy

network
patches
?Your agent

claude, codex, or any command

It and every process it starts stay confined. Claude Code also gets the sandbox described in its system prompt, so it explains denials and points you to the config change that fixes them.
?Patch review

you approve each change before it lands

Chopi offers the review when the session ends, and chopi-review runs it any time.
?chopi-proxy

outside the sandbox, shared by all sessions

Runs in the foreground in its own terminal, so refused connections are always in view. Chopi won't start a session without it.
?Smokescreen proxy

→ allowed hosts only proxy-rules.yaml

Every other connection is refused and logged, and unexpected ones raise a macOS notification. Rule edits apply immediately.
?Caddy relay

→ GitHub, per allowlisted repo github-allowlist

All github.com git and REST API traffic goes through it. Public repos are readable freely; private repos, pushes and authenticated API calls work only for allowlisted repos. The relay adds your GitHub token itself, so the token never enters the sandbox.

Get started

Two terminals: one for the proxy, one for the agent.

1Install

$ git clone https://github.com/danra/chopi
$ cd chopi && ./install.sh

Then review the configuration: allowed hosts in config/proxy-rules.yaml, pushable repos in config/github-allowlist, and sandbox policy in config/sandbox.sh.

2Start the proxy

$ chopi-proxy    # leave it running; all sessions share it

It runs in the foreground so refused connections are always visible.

3Run your agent

$ cd ~/path/to/your/repo
$ chopi claude                    # or codex, or any command
$ chopi --worktree fix-123 claude # or in a fresh worktree + branch

Running claude? Chopi teaches it about the sandbox via the system prompt, so the agent explains denials and guides you to the right one-line config fix instead of fighting the fence.