Settings

The CLI reads and writes ~/.agentrix/settings.json. The file is created with defaults on first run and can be edited manually.

Full Schema

{
  "sandbox": {
    "enabled": false,
    "network": {
      "allowedDomains": "*",
      "deniedDomains": []
    },
    "filesystem": {
      "allowWrite": ["..."],
      "denyRead": [],
      "denyWrite": []
    }
  },
  "daemonEnv": {
    "enabled": false,
    "variables": {}
  },
  "daemonControl": {
    "allowLanAccess": false
  },
  "allowDirectBash": true
}

---

sandbox

Controls filesystem and network isolation for worker processes.

sandbox.enabled

{ "sandbox": { "enabled": false } }

• false (default) — sandbox is disabled; workers run with your normal user permissions.
• true — workers run inside an isolated environment (macOS: filesystem restrictions; Linux: bubblewrap namespace).

sandbox.network

{
  "sandbox": {
    "network": {
      "allowedDomains": "*",
      "deniedDomains": []
    }
  }
}

• allowedDomains — "*" (allow all) or a list of allowed domain patterns.
• deniedDomains — list of domain patterns to block, even when allowedDomains is "*".

sandbox.filesystem

Controls read/write access for sandboxed workers.

macOS (deny-only mode):

{
  "sandbox": {
    "filesystem": {
      "denyRead": [],
      "allowWrite": ["~/.claude", "~/.codex"],
      "denyWrite": []
    }
  }
}

Linux (allow-only mode):

{
  "sandbox": {
    "filesystem": {
      "allowRead": ["~/.agentrix", "~/.claude", "~/.codex"],
      "autoAllowSystemPaths": true,
      "allowWrite": ["~/.claude", "~/.codex"],
      "denyWrite": []
    }
  }
}

Agentrix pre-populates allowWrite with the paths workers need by default (agent config dirs, etc.). Add your own paths when sandbox is enabled.

---

daemonEnv

Injects environment variables into the daemon and worker processes at startup. Useful for corporate proxies, custom tool paths, or any setting that must be inherited by agents.

daemonEnv.enabled

{ "daemonEnv": { "enabled": false } }

• false (default) — no custom variables are injected (except always-on keys, see below).
• true — all entries in daemonEnv.variables are injected.

daemonEnv.variables

{
  "daemonEnv": {
    "enabled": true,
    "variables": {
      "HTTP_PROXY": "http://proxy.corp.example.com:8080",
      "HTTPS_PROXY": "http://proxy.corp.example.com:8080",
      "NO_PROXY": "localhost,127.0.0.1,.corp.example.com"
    }
  }
}

Proxy aliases — Setting any of the following keys automatically sets both the uppercase and lowercase variant:

• HTTP_PROXY / http_proxy
• HTTPS_PROXY / https_proxy
• NO_PROXY / no_proxy
• ALL_PROXY / all_proxy
• GLOBAL_AGENT_HTTP_PROXY / global_agent_http_proxy

Always-on keys — The following keys are applied even when daemonEnv.enabled is false. They let you point agents at custom config directories without enabling full env injection:

Key	Effect
AGENTRIX_CLAUDE_HOME	Sets CLAUDE_CONFIG_DIR for Claude workers
AGENTRIX_CODEX_HOME	Sets CODEX_HOME for Codex workers
AGENTRIX_GEMINI_HOME	Sets the Gemini config directory
AGENTRIX_CLAUDE_PATH	Path override for the claude binary
AGENTRIX_CODEX_PATH	Path override for the codex binary

Example — custom Claude config directory:

{
  "daemonEnv": {
    "enabled": false,
    "variables": {
      "AGENTRIX_CLAUDE_HOME": "~/.my-team-claude-config"
    }
  }
}

---

daemonControl

Controls how the daemon's built-in HTTP control server listens. This server hosts both local control endpoints and GitLab webhook endpoints.

daemonControl.allowLanAccess

{
  "daemonControl": {
    "allowLanAccess": false
  }
}

• false (default) — the daemon listens only on 127.0.0.1, so only the local machine can reach it.
• true — the daemon listens on 0.0.0.0, so other machines on the LAN can reach daemon endpoints.

Enable this when your private GitLab server and the Agentrix daemon are not on the same machine. When enabled, agentrix git-server list uses the machine's first non-loopback IPv4 address for webhookUrl.

Only enable this on trusted networks, and restrict the source with a firewall or security group when possible. Restart the daemon after changing it.

---

allowDirectBash

{ "allowDirectBash": true }

• true (default) — workers can run bash commands directly.
• false — direct bash execution is restricted (sandbox must be enabled for this to be meaningful).

---

Applying Changes

Settings are read at daemon startup. After editing settings.json, restart the daemon:

agentrix stop
agentrix start