Run a sandboxed offline session

Use this when an agent must not reach the network at all, and you want that enforced by a proxy the agent cannot lift rather than by Barry’s own checks. The recipe uses the sandboxed-offline bound that ships with Barry. The commands act as the bonanza identity from Build a Barry; use your own identity’s command in its place.

Before you begin

You installed Barry, and bonanza starts a session.
The session runs on a harness, mode, and model endpoint that declares the egress sandbox. Today only Claude Code in hosted mode does, and only with a model endpoint that keeps it: z.ai keeps it, while Ollama and llama.cpp endpoints do not. Check the egress sandbox column in enforcement coverage for your setup.

Know what the bound does

The sandboxed-offline bound sets three rules:

network:
  actions: [all]
  enforce: sandbox
  allowDomains: []

actions: [all] denies every network operation that Barry’s guards recognize. enforce: sandbox adds the agent runtime’s egress proxy, which filters every outbound connection from the agent’s process tree by hostname. An empty allowDomains list lets nothing through except localhost.

The guards alone are cooperative: a script the agent writes to disk, or a program Barry’s classifier does not know, gets past them. The proxy covers those too, which is why this recipe needs a harness that has one.

Start the session

Start a hosted session under the bound:

bonanza session start --mode hosted --claude --bound sandboxed-offline

--claude picks Claude Code for this session only; the identity’s default harness stays as it is. Barry checks the harness and model endpoint before it opens the session. If either cannot enforce the sandbox, the session refuses to start rather than run with the guards alone.

Let one host through

To open a single destination, such as your package registry, write your own bound instead of editing the shipped one. Under enforce: sandbox, the allowDomains list names the only hosts the proxy lets through:

network:
  enforce: sandbox
  allowDomains: [registry.npmjs.org]

The proxy knows hosts, not HTTP methods. A hosted session refuses to start when a sandboxed bound splits reads from writes, such as actions: [write] alone.

Verify

Once the session opens, Barry has already confirmed the sandbox, since a session that cannot enforce it refuses to start. Ask the agent to fetch any public web page, for example with curl. The request fails: Barry’s guards deny it, and a request that gets past them fails at the proxy. Then ask it to read a local file, which still works, because the bound removes only network access.

If it fails

The session refuses to start and names the egress sandbox. The harness or model endpoint cannot enforce the sandbox. Switch to hosted Claude Code with an endpoint that keeps the sandbox, or accept the weaker no-network bound, which denies the same operations with guards only.
The session refuses to start because of network action restrictions. A bound in the merged policy splits reads from writes, which the proxy cannot enforce. Add read and write together, or all.
A request got through. Confirm the session ran in hosted mode, then see A bound did not stop the agent.