Browser unavailable in sandbox

[waxen vine]

Hello all. I am unable to get the browser tool to appear to my agent while using a sandboxed runtime. I did build the images, but still nothing works. Relevant config:

...
  "agents": {
    "defaults": {
      "thinkingDefault": "low",
      "contextTokens": 50000,
      "model": {
        "primary": "xai/grok-4-1-fast",
        "fallbacks": [
          "anthropic/claude-opus-4-5",
          "openwebui/google.gemini-3-pro-preview",
          "openwebui/deepseek.deepseek-reasoner",
          "moonshotai/kimi-k2-thinking-turbo",
          "openwebui/winlite.gpt-oss:20b",
          "openwebui/procuda.llama3.2:1b"
        ]
      },
      "elevatedDefault": "ask",
      "sandbox": {
        "mode": "all",
        "workspaceAccess": "rw",
        "docker": {
          "image": "clawdbot-sandbox:bookworm-slim",
          "binds": [
            "/mnt/nas:/mnt/nas:ro"
          ],
          "readOnlyRoot": true,
          "network": "bridge"
        },
        "browser": {
          "allowHostControl": true,
          "image": "clawdbot-sandbox-browser:bookworm-slim",
          "enabled": true
        }
      },
      "workspace": "/home/regulad/clawd",
      "memorySearch": {
        "provider": "openai",
        "remote": {
          "batch": {
            "enabled": true,
            "concurrency": 2
          }
        },
        "fallback": "openai",
        "model": "text-embedding-3-small",
        "sync": {
          "watch": true
        }
      },
      "compaction": {
        "mode": "safeguard"
      },
      "maxConcurrent": 4,
      "subagents": {
        "maxConcurrent": 8
      }
    }
  },
  "tools": {
    "sandbox": {
      "tools": {
        "allow": [ 
          "*"
        ]
      }
    },
    "web": {
      "search": {
        "enabled": true,
        "provider": "perplexity",
        "perplexity": {
          "apiKey": "${PERPLEXITY_API_KEY}",
          "baseUrl": "https://api.perplexity.ai",
          "model": "sonar"
        }
      },
      "fetch": {
        "enabled": false
      }
    },
    "elevated": {
      "enabled": true, 
      "allowFrom": {
        "discord": [
          "440468612365680650"
        ]
      }
    }
  },
  "messages": {
    "ackReactionScope": "group-mentions"
  },
  "commands": {
    "native": "auto",
    "nativeSkills": "auto"
  },
  "hooks": {
    "internal": {
      "enabled": true,
      "entries": {
        "boot-md": {
          "enabled": true
        },
        "command-logger": {
          "enabled": true
        },
        "session-memory": {
          "enabled": true
        }
      }
    }
  },
...

[obtuse cipher]

To help others find answers, you can mark your question as solved via Right click solution message -> Apps -> ✅ Mark Solution

[swift sandal]

Based on the documentation I found, here's the issue and solution:

The Problem

The browser tool is denied by default in sandboxed mode. From the docs:

"Sandbox defaults: allowlist bash, process, read, write, edit, sessions_list, sessions_history, sessions_send, sessions_spawn; denylist browser, canvas, nodes, cron, discord, gateway."

Your config sets tools.sandbox.tools.allow: ["*"], but the deny rule takes precedence ("deny always wins").

Solutions

Option 1: Remove browser from the deny list

"tools": {
  "sandbox": {

    "tools": {
      "allow": ["*"],
      "deny": [
        "canvas",
        "nodes", 
        "cron",
        "discord",
        "gateway"
      ]
    }
  }
}

Option 2: Use the group:ui shorthand (browser + canvas)

"tools": {
  "sandbox": {
    "tools": {
      "allow": ["group:ui", "group:runtime", "group:fs", "group:sessions", "group:memory"]
    }
  }
}

Option 3: Explicitly allow browser

"tools": {
  "sandbox": {
    "tools": {
      "allow": ["browser"]

    }
  }
}

Debug It

Run this to see what's actually happening:

clawdbot sandbox explain

This will show you the effective sandbox mode, tool policy, and whether browser is blocked.

Also Verify