Beejs v0.1.2 Agent Sandbox

Beejs v0.1.2 turns the runtime into a tool process for Agent hosts. Models stay outside (OpenAI, Anthropic, llama.cpp). Beejs executes JS/TS tools under a default-deny permission broker.

What shipped

bee run --sandbox denies fs/net/env/run, then overlays --allow-* or --permission-policy.
--allow-read ./workspace is a directory prefix jail, not an exact-path allow.
--audit-log writes JSONL decisions (kind, action, resource, decision). It does not record env values or file contents.
--export-tools prints tool schemas from tools.json or exported functions.
bee session is stdin JSON-RPC (tools/list, tools/call). --isolate-per-call creates a new isolate per call.
bee mcp is an MCP stdio server for the same tool file.
Node conformance is 24 fixtures, including Agent denial paths.

Example

bee run --sandbox --permission-policy examples/agent/echo.policy.json --export-tools examples/agent/echo_tool.ts
bee session --sandbox --permission-policy examples/agent/echo.policy.json examples/agent/echo_tool.ts

See Current Scope for what is stable versus preview. feature=ai is not a product LLM.