{"slug": "panic-room-a-local-zero-dependency-sandbox-for-agents", "title": "Panic Room, a local zero-dependency sandbox for agents", "summary": "Panic Room, an open-source MIT-licensed tool, provides a zero-dependency sandbox for AI agents, giving each agent a cloned repo, fake credentials, a throwaway database, and a container, with an audit trail and a diff for human approval. The tool, available as a single Python file, logs every agent action, blocks network access to production hosts, and generates screenshots, aiming to make agent-driven code changes safe and reviewable.", "body_md": "Open source, MIT. Your agent gets a copy of the repo, fake credentials, a throwaway database and a container. You get an audit trail and a diff to sign off.\n\n```\nln -s $PWD/panic.py ~/.local/bin/panic\n\ncd ~/code/myapp\npanic run --db -c \"claude -p 'refactor the billing module'\"\npanic shot <id> http://localhost:3000 --serve \"npm run dev\"\npanic report <id>      # files, commands, sql, egress, screenshots\npanic diff <id>\npanic approve <id>     # applies to the real repo, unstaged\npanic rm <id>\n```\n\nFirst run builds a `panicroom:base`\n\nimage (node 22, git, chromium, psql, claude-code). After that a\nsandbox costs a `git clone`\n\n.\n\n**Files.** The repo is cloned to `~/.panicroom/<id>/repo`\n\n, your uncommitted work is carried over and\ncommitted as a baseline, so every later diff is the agent's doing and not yours. `panic diff`\n\nis a\nplain git diff; `approve`\n\nis a plain `git apply`\n\n, left unstaged for you to read before committing.\nNo filesystem watcher, git already knows.\n\n**Commands.** `$HOME/.claude/settings.json`\n\nin the sandbox carries a PreToolUse hook that appends\nevery tool call to `/panic/audit.jsonl`\n\n. That is the agent's real actions, not scraped terminal\noutput, and it lives outside the repo so it never shows up in the diff.\n\n**Database.** `--db`\n\nstarts a throwaway postgres beside the sandbox with `log_statement=all`\n\nand\npoints every SQL-shaped env var at it. On exit the log is kept and `panic report`\n\nshows the writes,\nreads filtered out. `--db-schema dump.sql`\n\nseeds it so the agent works against your real shape.\n\n**Network.** A proxy bound to the docker gateway, never the LAN. Every host the sandbox connects to\nis logged, and every host that appears in your real `.env`\n\nis refused with a 403. If the agent tries\nto reach prod, it fails and the attempt is on the record. Hosts and ports, no TLS interception.\n\n**Screenshots.** `panic shot`\n\nstarts your dev server inside the sandbox, waits, and drives headless\nchromium at it. PNGs land in the sandbox audit dir.\n\nEvery `.env*`\n\nin the source is read for its keys, never its values. URLs keep their scheme and point\nat localhost, connection strings become `panic:panic@localhost`\n\n, everything else becomes\n`panic-dummy-<key>`\n\n. The generated `.env`\n\nis git-excluded, so it can never ride along into `approve`\n\n,\nand it is passed to the container as `--env-file`\n\nso shell tools see it too. Only your agent API key\ncrosses the boundary from your own environment.\n\nCheck: `python3 test_panic.py`\n\n(round trip, proxy allow and block, sql filtering, no creds in the patch).\n\nTeams, billing, a web dashboard, a hosted control plane. One founder, one repo, one terminal.\n\nIssues and pull requests are welcome. Keep it to one Python file with no dependencies outside the\nstdlib, and make `python3 test_panic.py`\n\npass.\n\nMIT, see [LICENSE](/storesm/panicroom/blob/main/LICENSE).", "url": "https://wpnews.pro/news/panic-room-a-local-zero-dependency-sandbox-for-agents", "canonical_source": "https://github.com/storesm/panicroom", "published_at": "2026-09-02 15:15:40+00:00", "updated_at": "2026-09-02 15:23:24.588481+00:00", "lang": "en", "topics": ["ai-tools", "ai-safety", "developer-tools"], "entities": ["Panic Room", "Claude", "Postgres", "Chromium", "Node.js", "Git"], "alternates": {"html": "https://wpnews.pro/news/panic-room-a-local-zero-dependency-sandbox-for-agents", "markdown": "https://wpnews.pro/news/panic-room-a-local-zero-dependency-sandbox-for-agents.md", "text": "https://wpnews.pro/news/panic-room-a-local-zero-dependency-sandbox-for-agents.txt", "jsonld": "https://wpnews.pro/news/panic-room-a-local-zero-dependency-sandbox-for-agents.jsonld"}}