Sandbox

Release status

RightNow Agent is coming soon for Windows, macOS and Linux. Installation commands and workflows in these guides are reference material until the public release is available.

Sandbox profiles restrict filesystem and child-process network access where the operating system can enforce them, a tighter boundary than the permission decision flow alone. Off by default.

Built-in profiles

Profile	Read	Write	Child network
off (default)	Read: Unrestricted	Write: Unrestricted	Child network: Unrestricted
workspace	Read: Everywhere	Write: Working directory, product home, temp directories	Child network: Allowed
devbox	Read: Everywhere	Write: Top-level directories except /data and virtual filesystems	Child network: Allowed
read-only	Read: Everywhere	Write: Product home, temp directories	Child network: Blocked on Linux
strict	Read: Working directory, product home, system paths	Write: Working directory, product home, temp directories	Child network: Blocked on Linux

Product home: RIGHTNOW_HOME or its legacy alias, else ~/.rightnow or a preserved legacy home (see Locations and updates). Temp: /tmp, /var/tmp, the macOS temp folders, $TMPDIR. Aliases: readonly for read-only, none for off.

Start a session:

text

rightnow --sandbox workspace

Platform support

Platform	Filesystem enforcement	Child-process network
Windows	Not enforced: a selected profile is accepted without a kernel boundary	Not enforced
macOS	Seatbelt	Not restricted
Linux	Landlock (kernel 5.13 or later) and bubblewrap	Seccomp

When enforcement fails

macOS and Linux: workspace, read-only, strict, and custom profiles based on them refuse to start without direct-hook write protection, which on Linux needs bubblewrap.
macOS and Linux: any custom profile, including one that extends devbox, refuses to start when its policy cannot be applied (on Linux, unless it is already running inside bubblewrap): when it is unknown, sandbox.toml is malformed, Seatbelt or Landlock fails, or Linux bubblewrap cannot enforce its deny list.
Windows: every profile, including an unknown custom one, is accepted without enforcement.
The built-in devbox profile warns and continues.

Custom profiles

Define profiles in <RIGHTNOW_HOME>/sandbox.toml (user) or .rightnow/sandbox.toml (project). A project cannot redefine a user profile: the user definition wins, startup warns, and in-session /doctor shows both files. Built-in names cannot be redefined.

toml

[profiles.project]
extends = "workspace"
restrict_network = true
read_only = ["/data"]
read_write = ["/tmp/scratch"]
deny = ["/data/shared-secrets", "**/.env", "**/*.pem"]

Select it with rightnow --sandbox project.

Field	Meaning
extends	Built-in base: workspace (default), devbox, read-only, or strict
restrict_network	Block child-process network (enforced on Linux only)
read_only	Extra directories that can be read but not written
read_write	Extra writable directories
deny	Paths or globs denied for read, write, and rename

read_only and read_write take literal directories: one trailing /** or /* is stripped, and other globs or whitespace-padded entries are skipped with a warning.
deny takes exact paths or *, ?, **, and [...] globs. An unsupported or malformed glob stops startup on macOS and Linux; a relative glob matches only inside the workspace.
macOS applies deny globs at runtime; Linux expands them at launch, so files created later are not covered there.

Resolution and resume

The first match selects the profile:

A managed requirement.
--sandbox <profile>.
RIGHTNOW_SANDBOX.
[sandbox] profile in config.toml.
off.

A resumed session keeps its profile: a matching --sandbox or RIGHTNOW_SANDBOX is accepted and a different one refused, so start a new session to change it.

Process boundary

Applied once at startup and never relaxed: in-process tools and every command they start inherit the filesystem boundary.
Linux child-network blocking spares the model API, web search, and web fetch, which run in-process.
A profile other than off runs the agent in-process, not through the warm agent service.
Profile, failure, and violation events go to <RIGHTNOW_HOME>/sandbox-events.jsonl.
[sandbox] auto_allow_bash = true skips bash approval prompts only while a sandbox is applied.
The shell environment policy filters variables separately; see the configuration reference. Startup errors: Troubleshooting.