---
url: >-
  https://adk.nht.io/api/@nhtio/adk/batteries/sandbox/interfaces/CreateSandboxOptions.md
description: 'Options for [`createSandbox`](https://adk.nht.io/api/@nhtio/adk/batteries/sandbox/functions/createSandbox).'
---

# Interface: CreateSandboxOptions

Defined in: [src/batteries/sandbox/manager.ts:80](https://github.com/NHTIO/ADK/blob/v1.20260824.1/src/src/batteries/sandbox/manager.ts#L80)

Options for [createSandbox](../functions/createSandbox.md).

## Properties

| Property                                                                   | Modifier   | Type                                                                   | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | Defined in                                                                                                                        |
| -------------------------------------------------------------------------- | ---------- | ---------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------- |
|  `allowUnsandboxedFallback?` | `readonly` | `boolean`                                                              | Permit running WITHOUT OS containment when the environment cannot provide it. **Remarks** Fires only for pre-execution conditions resolved once at construction — a platform the backend cannot sandbox that we still run on, dependency errors, or an absent optional peer. It NEVER fires for a violation (a violation means the sandbox worked), and native Windows is refused outright rather than degraded. When it fires the handle is permanently marked, every invocation emits a loud event, and the tool descriptions tell the model it has no OS containment. | [src/batteries/sandbox/manager.ts:113](https://github.com/NHTIO/ADK/blob/v1.20260824.1/src/src/batteries/sandbox/manager.ts#L113) |
|  `enforcer`                                  | `readonly` | [`SandboxPolicyEnforcer`](SandboxPolicyEnforcer.md)                    | The boundary itself. Node's SRT-backed enforcer lives on the `sandbox/node` subpath.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | [src/batteries/sandbox/manager.ts:92](https://github.com/NHTIO/ADK/blob/v1.20260824.1/src/src/batteries/sandbox/manager.ts#L92)   |
|  `fsNodeVersion?`                       | `readonly` | `string`                                                               | Recorded on observability events so a rules-versus-backend mismatch is diagnosable without a bisect.                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | [src/batteries/sandbox/manager.ts:119](https://github.com/NHTIO/ADK/blob/v1.20260824.1/src/src/batteries/sandbox/manager.ts#L119) |
|  `onSandbox?`                               | `readonly` | (`event`: [`SandboxEvent`](../type-aliases/SandboxEvent.md)) => `void` | Observability firehose: bypasses, fallbacks, drift outcomes, and the SRT version rules came from.                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | [src/batteries/sandbox/manager.ts:102](https://github.com/NHTIO/ADK/blob/v1.20260824.1/src/src/batteries/sandbox/manager.ts#L102) |
|  `optionalPeerPresent?`           | `readonly` | `boolean`                                                              | Whether the optional peer resolved; feeds the preflight decision above.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | [src/batteries/sandbox/manager.ts:117](https://github.com/NHTIO/ADK/blob/v1.20260824.1/src/src/batteries/sandbox/manager.ts#L117) |
|  `policy`                                      | `readonly` | [`SandboxPolicy`](SandboxPolicy.md)                                    | ADK-owned policy vocabulary, mapped to the backend's config inside the enforcer. **Remarks** The per-axis defaults DIFFER and are not a symmetry worth "fixing": reads default to ALLOW (absent `denyRead` means everything is readable, and `allowRead` re-permits WITHIN a deny), while writes default to DENY and network is an allow-list. A checker that unified them would disagree with the OS by construction.                                                                                                                                                   | [src/batteries/sandbox/manager.ts:90](https://github.com/NHTIO/ADK/blob/v1.20260824.1/src/src/batteries/sandbox/manager.ts#L90)   |
|  `strictMode?`                             | `readonly` | `boolean`                                                              | Ignore the per-call escape entirely, matching the reference consumer's strict mode.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | [src/batteries/sandbox/manager.ts:115](https://github.com/NHTIO/ADK/blob/v1.20260824.1/src/src/batteries/sandbox/manager.ts#L115) |
|  `translator?`                             | `readonly` | [`PathTranslator`](PathTranslator.md)                                  | Model-path translation, and the redaction used on every observability event. **Remarks** Supply it if you want host identifiers scrubbed from the event stream — no battery-generated surface should carry the sandbox root, home directory, or user name.                                                                                                                                                                                                                                                                                                               | [src/batteries/sandbox/manager.ts:100](https://github.com/NHTIO/ADK/blob/v1.20260824.1/src/src/batteries/sandbox/manager.ts#L100) |