Sandbox
Sandbox profiles can restrict filesystem and child-process network access where the operating system provides the required enforcement. Use one when a task needs a tighter boundary than the permission decision flow alone.
Sandbox mode is off by default, so select a profile explicitly for a new session.
Built-in profiles
| Profile | Read | Write | Child network |
|---|---|---|---|
| off (default) | Unrestricted | Unrestricted | Unrestricted |
| workspace | Everywhere | Working directory, effective product home, and temp directories | Allowed |
| devbox | Everywhere | Top-level directories except /data and virtual filesystems | Allowed |
| read-only | Everywhere | Effective product home and temp directories | Blocked on Linux |
| strict | Working directory and system paths | Working directory, effective product home, and temp directories | Blocked on Linux |
Workspace
rightnow --sandbox workspaceRead-only
rightnow --sandbox read-onlyStrict
rightnow --sandbox strictPlatform support
| Platform | Filesystem enforcement | Child-process network |
|---|---|---|
| Windows | No kernel sandbox is documented | No sandbox network enforcement |
| macOS | Seatbelt | No-op |
| Linux | Landlock on kernel 5.13 or later; bubblewrap for read-deny rules | Seccomp |
On macOS and Linux, the enforcing workspace, read-only, and strict profiles refuse startup when required direct-hook write protection cannot be applied. Every custom profile fails closed when its policy cannot be applied there. The built-in devbox profile can warn and continue.
Custom profiles
This template defines a custom profile in <RIGHTNOW_HOME>/sandbox.toml or .rightnow/sandbox.toml. Replace the paths with locations in your workspace before using it.
[profiles.project]
extends = "workspace"
restrict_network = true
read_only = ["./reference-data"]
read_write = ["./scratch"]
deny = ["**/.env", "**/*.pem", "**/*.key"]Select the custom profile
rightnow --sandbox projectread_only and read_write accept literal directories, while deny accepts exact paths or its documented glob subset. A malformed deny glob makes startup fail closed on macOS and Linux. macOS evaluates deny globs at runtime; Linux expands them at startup, so later-created matching files are not covered there.
If user and project files define the same custom profile differently, the user definition wins and startup warns. In-session /doctor shows both conflicting profile locations. For other startup problems, follow the Troubleshooting guide.
Resolution and resume
- A managed requirement has highest priority for a new session.
- An explicit
--sandboxvalue comes next. RIGHTNOW_SANDBOXoverrides[sandbox] profile.- With no selected profile, the default is
off.
A session keeps its saved profile when resumed. A matching explicit profile is accepted; a different profile is refused, so start a new session to change the boundary.
Process boundary
The sandbox is applied once to the RightNow process, so in-process tools and spawned commands inherit its filesystem boundary. Linux child-process network blocking does not block the model API, web search, or web fetch because those requests run in-process.
Sandbox restrictions cannot be relaxed after startup. The separate shell environment policy filters variables before commands run; see the configuration reference for its keys.