{"record":{"id":"4d3d216dd5110032","repo":"mastra-ai/mastra","slug":"allowsystembinaries-false-is-not-supported-by-sea","errorCode":null,"errorMessage":"allowSystemBinaries: false is not supported by seatbelt (macOS). Use bubblewrap on Linux or remove this restriction.","messagePattern":"allowSystemBinaries: false is not supported by seatbelt \\(macOS\\)\\. Use bubblewrap on Linux or remove this restriction\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/core/src/workspace/sandbox/native-sandbox/seatbelt.ts","lineNumber":88,"sourceCode":"  }\n}\n\n/**\n * Generate a seatbelt profile for the given configuration.\n *\n * The profile:\n * - Allows all file reads (can't restrict with subpath on macOS)\n * - Restricts file writes to temp directories, configured writable paths, and the workspace unless read-only\n * - Blocks network unless explicitly allowed\n *\n * @param workspacePath - The workspace directory to sandbox\n * @param config - Additional sandbox configuration\n * @returns The generated SBPL profile content\n */\nexport function generateSeatbeltProfile(workspacePath: string, config: NativeSandboxConfig): string {\n  // Fail-closed: seatbelt cannot restrict process-exec, so reject unsupported config\n  if (config.allowSystemBinaries === false) {\n    throw new Error(\n      'allowSystemBinaries: false is not supported by seatbelt (macOS). ' +\n        'Use bubblewrap on Linux or remove this restriction.',\n    );\n  }\n\n  const lines: string[] = [];\n\n  // Version and default deny\n  lines.push('(version 1)');\n  // Marker comment, so a profile Mastra wrote is still known as ours on a later run.\n  lines.push(GENERATED_PROFILE_MARKER);\n  lines.push('(deny default (with message \"mastra-sandbox\"))');\n  lines.push('');\n\n  // Process permissions\n  lines.push('; Process permissions');\n  lines.push('(allow process-exec)');\n  lines.push('(allow process-fork)');","sourceCodeStart":70,"sourceCodeEnd":106,"githubUrl":"https://github.com/mastra-ai/mastra/blob/75dd419e613fe9c39f846ffc500716141b74fda6/packages/core/src/workspace/sandbox/native-sandbox/seatbelt.ts#L70-L106","documentation":"generateSeatbeltProfile is fail-closed: macOS seatbelt (SBPL) cannot restrict process-exec enough to exclude system binaries, so a NativeSandboxConfig with allowSystemBinaries: false is rejected rather than generating a profile that silently allows more than requested.","triggerScenarios":"Creating a native sandbox with `allowSystemBinaries: false` on macOS (seatbelt backend), e.g. passing { allowSystemBinaries: false } in workspace/native sandbox config while running on darwin.","commonSituations":"Sharing one sandbox config between Linux (bubblewrap) and macOS (seatbelt) machines/CI; tightening security settings after reading Linux-focused docs; a hardened default inherited from a Linux-oriented template.","solutions":["Remove `allowSystemBinaries: false` from the config on macOS.","Set allowSystemBinaries: true (or omit it) when the seatbelt backend is used.","Condition the config on process.platform so Linux keeps bubblewrap's strict setting.","If you need that restriction on macOS, use a different isolation mechanism (e.g. a container/VM)."],"exampleFix":"// before\nconst config = { allowSystemBinaries: false };\n// after\nconst config = process.platform === 'darwin'\n  ? {} // seatbelt cannot support this restriction\n  : { allowSystemBinaries: false };","handlingStrategy":"validation","validationCode":"if (process.platform === 'darwin' && config.allowSystemBinaries === false) {\n  throw new Error('allowSystemBinaries:false unsupported on macOS seatbelt; adjust config');\n}","typeGuard":"function isSeatbeltCompatible(config: { allowSystemBinaries?: boolean }): boolean {\n  return process.platform !== 'darwin' || config.allowSystemBinaries !== false;\n}","tryCatchPattern":"try {\n  const sb = createNativeSandbox(config);\n} catch (e) {\n  if (e instanceof Error && /seatbelt \\(macOS\\)/.test(e.message)) {\n    // fall back to a seatbelt-safe config\n    const { allowSystemBinaries, ...rest } = config;\n    return createNativeSandbox(rest);\n  }\n  throw e;\n}","preventionTips":["Branch sandbox config on process.platform (seatbelt vs bubblewrap).","Keep platform-specific restrictions in separate config profiles.","Test sandbox startup on both Linux and macOS CI runners."],"tags":["sandbox","macos","seatbelt","unsupported-config"],"backgroundTag":"unsupported-platform-config","analyzedSha":"75dd419e613fe9c39f846ffc500716141b74fda6","analyzedAt":"2026-08-30T00:15:31.844Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}