## Summary

Hard rename of `--sandbox=process|container` to
`--isolation=host|container` for `vault run`, plus the matching env var
(`AGENT_VAULT_SANDBOX` → `AGENT_VAULT_ISOLATION`) and internal package
(`internal/sandbox` → `internal/isolation`).

- **Why now**: future modes won't fit cleanly under "sandbox." Pre-1.0
is the lowest-cost moment to rename before docs/users ossify.
- **Why `host` over `process`**: today's "process" mode has no actual
process isolation — the only boundary is the agent honoring
`HTTPS_PROXY`. Naming it `host` makes the "no isolation" tradeoff
visible and nudges users toward `container` when they want a real
boundary. Also more accurate when future modes (Lima, devcontainers)
land — those run in a VM/container *from the host's perspective*.
- **No aliasing.** `--sandbox` and `AGENT_VAULT_SANDBOX` are removed,
not deprecated. Pre-1.0, the cost of a deprecation cycle outweighs the
small user impact.
- **Default behavior unchanged.** Same code paths, same security
properties, same default.

### Surfaces touched
- **Go**: `cmd/sandbox_flag.go` → `cmd/isolation_flag.go`
(`SandboxMode/Process/Container` → `IsolationMode/Host/Container`);
`internal/sandbox/` → `internal/isolation/` with embed var, image-repo
string (`agent-vault/sandbox` → `agent-vault/isolation`), host CA dir
(`~/.agent-vault/sandbox/` → `~/.agent-vault/isolation/`), and network
label (`agent-vault-sandbox` → `agent-vault-isolation`) all renamed for
consistency. Test files renamed: `internal/{mitm,ca}/sandbox_*_test.go`
→ `isolation_*_test.go`.
- **Agent skills** (versioned together per `CLAUDE.md`):
`cmd/skill_cli.md`, `cmd/skill_http.md`.
- **Docs**: `README.md`, `.env.example`, `docs/reference/cli.mdx`,
`docs/self-hosting/environment-variables.mdx`. Renamed
`docs/guides/container-sandbox.mdx` →
`docs/guides/container-isolation.mdx`; updated `docs/docs.json` nav.
`CLAUDE.md` "Two isolation modes" bullet rewritten.
`.github/dependabot.yml` docker directory path.

### One-time user impact
- Existing users will rebuild the docker image once on next `vault run
--isolation=container` use (image is hash-tagged so the old
`agent-vault/sandbox:*` orphans).
- Any pre-existing `~/.agent-vault/sandbox/` dir from prior runs becomes
orphaned (tiny PEM files; safe to `rm -rf`).
- Any orphan `agent-vault-sandbox`-labeled networks from
previously-crashed runs won't be auto-pruned.

All acceptable for a pre-1.0 hard rename; the plan accepted these
explicitly.

## Test plan

- [x] `go build ./...` — clean
- [x] `go test ./...` — all green (asset hash pin updated for the
Dockerfile comment edit)
- [x] `vault run --help` shows `--isolation` (default `host`);
`--sandbox` absent
- [x] `vault run --sandbox=process` rejected with `unknown flag:
--sandbox`
- [x] Repo-wide grep for
`AGENT_VAULT_SANDBOX|--sandbox|SandboxMode|SandboxProcess|SandboxContainer|internal/sandbox|/guides/container-sandbox`
returns zero hits
- [ ] Reviewer: check Mintlify renders
`docs/guides/container-isolation.mdx` and the nav entry
- [ ] Reviewer: rebase #105 (`feat(sandbox): extend --share-agent-dir`)
against this — its title and any flag references need updating

## Out of scope

- Adding Lima or devcontainer modes (the whole point of this rename is
to prep for those — they land in separate PRs).
- AWS SES / SocketLabs "sandbox mode" wording in `docs/guides/smtp.mdx`
(unrelated).
- Generic "sandboxed agents" SDK terminology in `README.md` and
`docs/quickstart/custom-agent.mdx` (describes external runtimes like
Daytona/E2B/Firecracker, not Agent Vault's flag).
- "vault run is a convenience wrapper, not a sandbox" sentence in
`docs/agents/overview.mdx` and `docs/guides/connect-coding-agent.mdx`
(still reads accurately for the default `host` mode).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>