Summary

Add optional sandboxing for the coding agent child processes spawned during /run, restricting filesystem and network access to reduce risk from autonomous AI code execution.

Problem / Context

When Wiggum runs an autonomous coding loop, the spawned agent has full access to the filesystem, network, and system. As loops run longer and with less supervision (especially with parallel execution from S5), the blast radius of a misbehaving agent increases. Competitors already support bubblewrap (Linux) and sandbox-exec/Seatbelt (macOS) sandboxing. Enterprise and security-conscious users will expect this as a trust signal for production use.

Roadmap phase: Phase 7 — SHIP ("Production-ready, enterprise-trustworthy")

Proposed Solution

Platform Support

Configuration

// ralph.config.cjs
module.exports = {
  sandbox: {
    enabled: true,
    allowNetwork: false,
    allowPaths: ['./src', './tests', '.ralph'],
    denyPaths: ['~/.ssh', '~/.aws', '~/.config'],
    readOnlyPaths: ['/usr', '/bin'],
  }
}

Auto-Detection

• Detect available sandbox runtime per platform
• Graceful fallback to unsandboxed execution with warning
• wiggum doctor reports sandbox availability

Files to Modify

Acceptance Criteria

• --sandbox flag wraps agent process in platform-appropriate sandbox
• bubblewrap support on Linux with configurable allow/deny paths
• sandbox-exec support on macOS with generated Seatbelt profile
• Network access configurable (allow/deny)
• Auto-detection of available sandbox with fallback + warning
• wiggum doctor reports sandbox availability
• Documentation for sandbox configuration