Official Policies
Ready-made rules you include in your project's .stonewall.yml. Included policies apply first, your own
rules last.
Add one with stonewall policy include <url>, or run stonewall policy pick to tick the
ones you need from this list. Remote policies are reviewed once and cached; stonewall policy update
fetches new versions.
These are official stonewall.sh policies and should not be changed locally. Always review remote policies before applying them. Stonewall and its policies come without warranty of any kind.
Operating System and Environment
Base
Provides a safe, minimalistic base policy applicable to any project. It intentionally does NOT include anything language-, framework- or agent-specific rules, and no tools that write, delete, commit or run other programs.
Snap
Makes files installed under /snap readable inside the sandbox. Stonewall only mounts the usual system directories, so a program whose files live under /snap, such as the JDK bundled with a snap-installed IDE, would otherwise start without its libraries. It grants no programs itself: list the ones you need in bin.allowed. Programs started through /snap/bin still fail, because they run through snapd, whose confinement cannot be set up inside the sandbox.
Basic Tools
Git (safe)
Allows read-only git usage like status, diff, log, show and blame. The .git directory is read-only, so commit, checkout, reset, rebase, rm, mv and fetch fail. Intentionally does NOT expose ssh or any credentials.
Git (unsafe)
Allows all git commands, including destructive ones like commit, checkout, reset, rebase, rm, mv and push. Makes .git writable and exposes ~/.ssh read-only, so the agent can read keys. Include after base.yml. Intentionally does NOT include a shell, editor or pager.
Programming Languages & Frameworks
C#
.NET development with the dotnet CLI, common global tools, Mono and MSBuild. NuGet credentials in NuGet.Config become readable; user secrets under ~/.microsoft stay hidden. Intentionally does NOT include shells, curl, wget, git, or tools that delete or move files.
Go
Go development with gopls, the usual linters, formatters and test tools, and the C compiler cgo needs. SDK installations such as goenv stay read-only and modules come through the module proxy. Intentionally does NOT include shells, curl, wget, git, or tools that delete or move files.
Java
JDK development with Maven, Gradle and Ant, including the helper programs their launcher scripts call. JDK installations such as sdkman stay read-only; credentials in ~/.m2/settings.xml or ~/.gradle/gradle.properties become readable. Intentionally does NOT include shells, curl, wget, git, or tools that delete or move files.
JavaScript
Node.js, Bun and Deno development with the usual package managers, linters, test runners and bundlers. Version managers stay read-only and tokens in ~/.npmrc become readable. Intentionally does NOT include shells, python, make, curl, wget, git, or tools that delete or move files, so native addons do not build and npm run needs script-shell=/bin/sh in the project's .npmrc.
Kotlin
Kotlin development with the Kotlin compiler, ktlint and detekt on top of the JDK, Maven, Gradle and Ant. JDK installations such as sdkman stay read-only; credentials in ~/.m2/settings.xml or ~/.gradle/gradle.properties become readable. kotlinc, kotlin and detekt are bash scripts and do not run; Gradle builds and ktlint do. Intentionally does NOT include shells, curl, wget, git, or tools that delete or move files.
PHP
PHP development with Composer and the usual test runners, static analysers, formatters and Symfony or Laravel commands. Interpreter installations such as phpenv stay read-only; credentials in Composer's auth.json become readable. Intentionally does NOT include shells, curl, wget, git, or tools that delete or move files.
Python
Python development with pip, uv, poetry, pdm, pipenv, hatch or conda and the usual test, lint, format and type-check tools. Interpreter installations such as pyenv stay read-only, so packages go into virtual environments or the user site; credentials in pip or uv configuration become readable. pyenv shims are bash scripts and do not run. Intentionally does NOT include shells, make, curl, wget, git, or tools that delete or move files.
Ruby
Ruby development with Bundler, RubyGems, Rake and the usual test runners, linters and Rails commands. Ruby installations such as rbenv stay read-only, so gems install into the project or ~/.gem; credentials in ~/.gemrc or ~/.bundle/config become readable. rbenv shims are bash scripts and do not run. Intentionally does NOT include shells, make, curl, wget, git, or tools that delete or move files, so native extensions do not build.
Scala
Scala development with scala-cli, sbt, mill, coursier, bloop and scalafmt on top of the JDK, Maven, Gradle and Ant. JDK installations such as sdkman stay read-only; credentials in ~/.m2, ~/.gradle or ~/.sbt become readable. scala, scalac and sbt are bash scripts and do not run; scala-cli, coursier and bloop do. Intentionally does NOT include shells, curl, wget, git, or tools that delete or move files.
TypeScript
TypeScript development with the compiler and runners on top of Node.js, Bun and Deno, their package managers, linters, test runners and bundlers. Version managers stay read-only and tokens in ~/.npmrc become readable. Intentionally does NOT include shells, python, make, curl, wget, git, or tools that delete or move files, so native addons do not build and npm run needs script-shell=/bin/sh in the project's .npmrc.
Agents
Aider
Allows access to the minimum binaries and locations needed by Aider. Intentionally does NOT include any additional, potentially invasive tools like sh, bash, git, etc.
Amp
Allows access to the minimum binaries and locations needed by Amp. Intentionally does NOT include any additional, potentially invasive tools like sh, bash, git, etc.
Auggie CLI
Allows access to the minimum binaries and locations needed by Auggie CLI. Intentionally does NOT include any additional, potentially invasive tools like sh, bash, git, etc.
Claude Code
Allows access to the minimum binaries and locations needed by Claude Code. Intentionally does NOT include any additional, potentially invasive tools like sh, bash, git, etc.
Cline CLI
Allows access to the minimum binaries and locations needed by Cline CLI. Intentionally does NOT include any additional, potentially invasive tools like sh, bash, git, etc.
Codex CLI
Allows access to the minimum binaries and locations needed by Codex CLI. Intentionally does NOT include any additional, potentially invasive tools like sh, bash, git, etc.
Continue CLI
Allows access to the minimum binaries and locations needed by Continue CLI. Intentionally does NOT include any additional, potentially invasive tools like sh, bash, git, etc.
Crush
Allows access to the minimum binaries and locations needed by Crush. Intentionally does NOT include any additional, potentially invasive tools like sh, bash, git, LSP or MCP servers, etc.
Cursor CLI
Allows access to the minimum binaries and locations needed by Cursor CLI. Includes bash and a few coreutils because the cursor-agent launcher is a bash script and does not run without them. Intentionally does NOT include git or other potentially invasive tools.
Factory Droid
Allows access to the minimum binaries and locations needed by Factory Droid. Intentionally does NOT include any additional, potentially invasive tools like sh, bash, git, etc.
Gemini CLI
Allows access to the minimum binaries and locations needed by Gemini CLI. Intentionally does NOT include any additional, potentially invasive tools like sh, bash, git, etc.
GitHub Copilot CLI
Allows access to the minimum binaries and locations needed by GitHub Copilot CLI. Intentionally does NOT include any additional, potentially invasive tools like sh, bash, git, etc.
Goose
Allows access to the minimum binaries and locations needed by Goose. Intentionally does NOT include any additional, potentially invasive tools like sh, bash, git, etc.
Grok CLI
Allows access to the minimum binaries and locations needed by Grok CLI. Intentionally does NOT include any additional, potentially invasive tools like sh, bash, git, etc.
Junie CLI
Allows access to the minimum binaries and locations needed by Junie CLI. Intentionally does NOT include any additional, potentially invasive tools like sh, bash, git, etc.
Kilo CLI
Allows access to the minimum binaries and locations needed by Kilo CLI. Intentionally does NOT include any additional, potentially invasive tools like sh, bash, git, etc.
Kimi Code CLI
Allows access to the minimum binaries and locations needed by Kimi Code CLI. Intentionally does NOT include any additional, potentially invasive tools like sh, bash, git, etc.
Kiro CLI
Allows access to the minimum binaries and locations needed by Kiro CLI. Intentionally does NOT include any additional, potentially invasive tools like sh, bash, git, etc.
Mistral Vibe
Allows access to the minimum binaries and locations needed by Mistral Vibe. Intentionally does NOT include any additional, potentially invasive tools like sh, bash, git, etc.
OpenCode
Allows access to the minimum binaries and locations needed by OpenCode. Intentionally does NOT include any additional, potentially invasive tools like sh, bash, git, etc.
OpenHands CLI
Allows access to the minimum binaries and locations needed by OpenHands CLI. Intentionally does NOT include any additional, potentially invasive tools like sh, bash, git, etc.
Pi Coding Agent
Allows access to the minimum binaries and locations needed by Pi Coding Agent. Intentionally does NOT include any additional, potentially invasive tools like sh, bash, git, etc.
Qodo Command
Allows access to the minimum binaries and locations needed by Qodo Command. Intentionally does NOT include any additional, potentially invasive tools like sh, bash, git, etc.
Qwen Code
Allows access to the minimum binaries and locations needed by Qwen Code. Intentionally does NOT include any additional, potentially invasive tools like sh, bash, git, etc.