Windows sandbox

Windows has two sandbox tiers, and each engine uses the strongest one its self-test proves.

Execution containers (MXC)

On Windows 11 machines new enough for Microsoft Execution Containers’ base-container tier, Bash commands run in a container, with no trust question and nothing changed on your folders. The shell there is brush, a Bash-compatible shell that Synoec ships, with busybox versions of the Unix tools first on PATH; Git Bash cannot start in a container. Synoec also ships Microsoft’s wxc-exec.exe, and makes busybox’s tool links under %LOCALAPPDATA%\Synoec\sandbox\mxc\tools on first use.

A command can read and write its approved folders, read the toolchains on PATH, and nothing else in your profile. .git and .synoec are read-only, the network is off unless the call declares it, and this computer’s own services stay out of reach either way. A BashSession stays confined too. git add, git commit, Git hooks, bun add and tasklist do not work inside; sandbox: "disabled" asks and runs your installed Git Bash. A command can still decrypt DPAPI data in files it may read and capture the screen, and Synoec puts back any permission change it makes to the project or .git when it ends.

The self-test takes about four seconds, and its last answer is in %LOCALAPPDATA%\Synoec\sandbox\last-self-test-mxc.json. A machine without this tier, or with any failed check, uses the Low integrity tier below.

Low integrity

On Windows the sandbox limits what a command can change. It does not limit what it can read or where it can send it. That is what is possible with no admin rights. Before this, every command asked and then ran with no limits at all.

Adding a project asks once whether to trust it. Under Approve for me, Bash commands in a trusted project run with no prompt, in real Git Bash, under your own account at Low integrity, started by Synoec’s small helper. Leaving the sandbox asks, and runs your installed Git Bash. So does a BashSession, once. Your right-side terminal panel is not affected, and hooks still run in Git Bash outside the sandbox, as they always have on Windows.

Without trust, including a Quick Chat, nothing is labelled and every command asks. Settings, Permissions, Sandboxed projects can remove trust at any time. That and removing a project take the changes back at once, and stop any command still running there.

	macOS	Windows
Write, delete or rename outside approved folders and temp	Refused	Refused, except below
Another trusted project in use at that moment	Refused	Not refused, though its .git is
AppData\LocalLow	Refused	Not refused
.git and .synoec	Protected, even before they exist	Protected once they exist. One that a command creates is protected when it ends, so that one command could write to it
Read your home folder, including credentials files	Refused	Not refused
List stored credential names, read the clipboard	Keychains refused	Not refused
Network unless declared, including this computer	Refused	Not refused
Stop your other programs	Allowed	Not refused
Change a file’s permissions inside the project	Refused	Not refused, and only the project folder’s own are put back when the command ends
git status, diff, log, node, bun test, npm run, cargo run	Work	Work
git add, git commit	Fail: .git is protected	Fail: .git is protected, so they ask
Interactive BashSession	Confined	Not confined. Opening it asks once

Each engine runs a self-test on your machine in about two seconds. Any failed check, a missing Git Bash, or a project the helper will not touch, such as your whole profile, means nothing changes: every call asks. %LOCALAPPDATA%\Synoec\sandbox\last-self-test.json holds the latest result and why it failed.

When a chat first needs a trusted project, Synoec changes that folder: a Low integrity label on it and the files inside, and a Medium one on .git and .synoec. They show only under icacls, and do not reduce what you can do. A small project takes about a fifth of a second. A very large one shows “Preparing this project for sandboxed commands…”: 77,000 files took 18 seconds on the test machine. While it is open you cannot rename or delete a project with a .git, and other Low integrity programs you run could change its files.

Five minutes after the last command, or when Synoec quits, it puts everything back, including the folder’s own permissions, and clears its temp files. 77,000 files took 37 seconds, behind the scenes. If Synoec is killed, a helper finishes this, and any start of Synoec finishes what is left. Synoec also keeps a private copy of the parts of Git it needs, about 93 MB, beside the record.

Every open project is recorded in %LOCALAPPDATA%\Synoec\sandbox, and problems closing one are in issues.txt there. The uninstaller removes them. To remove them all yourself, with the private Git and your trust answers:

& "<helper>" --windows-sandbox revoke --state-dir "$env:LOCALAPPDATA\Synoec\sandbox" --all

The desktop app and a source checkout carry the helper, which is synoec-process-guardian.exe, or resources\app\out\runtime\guardian\Synoec Desktop.exe in the desktop app. The CLI looks for it beside its own executable or at SYNOEC_WINDOWS_SANDBOX_HELPER; without it, every call asks.