llms.txt
+3 −3
− - **Somewhere to put the dangerous work.** A page linked from an issue, a repository you did not write, a downloaded file: `sandbox_browse`, `sandbox_run` and `sandbox_open` (macOS) hand it to a locked-down child agent in a throwaway VM, with no credentials and network only to the hosts you allow. You get the answer or a patch back, plus every attempt it made to get out. The content never gets near your user's keys.− - **Where it works.** macOS and Linux (`install.sh`), and Windows (`install.ps1`). In Claude Code and Cursor alike, a blocked call is refused before it runs; a held call becomes the client's own approval prompt where it has one. The shell jail is for Claude Code (on Windows it needs Git for Windows), and the sandbox needs Apple silicon with macOS 26 or later. Across a fleet, IT pushes the same installer through Jamf, Intune or Kandji, run in the logged-in user's context (on Windows, `install.ps1− - **What it changes.** It installs the `golem` binary and a per-user background service (launchd on macOS, systemd on Linux). It adds `golem-*` MCP entries and hooks to the agent clients it finds (Claude Code, Cursor, Codex and others) and leaves every other entry alone. On Apple silicon with macOS 26 or later it also sets up the sandbox, which asks for your user's password once.+ - **Somewhere to put the dangerous work.** A page linked from an issue, a repository you did not write, a downloaded file: `sandbox_browse`, `sandbox_run` and `sandbox_open` (macOS, and Linux with KVM) hand it to a locked-down child agent in a throwaway VM, with no credentials and network only to the hosts you allow. You get the answer or a patch back, plus every attempt it made to get out. The content never gets near your user's keys.+ - **Where it works.** macOS and Linux (`install.sh`), and Windows (`install.ps1`). In Claude Code and Cursor alike, a blocked call is refused before it runs; a held call becomes the client's own approval prompt where it has one. The shell jail is for Claude Code (on Windows it needs Git for Windows), and the sandbox needs Apple silicon with macOS 26 or later, or Linux with KVM. Across a fleet, IT pushes the same installer through Jamf, Intune or Kandji, run in the logged-in user's context (on Wi+ - **What it changes.** It installs the `golem` binary and a per-user background service (launchd on macOS, systemd on Linux). It adds `golem-*` MCP entries and hooks to the agent clients it finds (Claude Code, Cursor, Codex and others) and leaves every other entry alone. On Apple silicon with macOS 26 or later it also sets up the sandbox, which asks for your user's password once; on Linux with KVM it downloads the sandbox's VM images without asking.