Sandboxing

RedCell runs tools inside an OS sandbox so the agent can read, edit, and execute within your workspace while access outside it, and to the network, stays controlled. You choose how much access a session has, and RedCell asks for approval before it does anything the active mode does not already allow.

Prerequisites

The sandbox uses the native isolation layer on each platform:

• macOS — the built-in Seatbelt sandbox. No install needed.
• Linux — bubblewrap (bwrap). RedCell ships a bundled copy, but you can install your own with your OS package manager.
• Windows — the default RedCell agent sandbox. Some organizations require it before the agent can run.

Sandbox Modes

Pick the access level that fits the task. You can change it at any time from the approval presets:

• Read Only — RedCell can read files in the current workspace. Approval is required to edit files or access the internet.
• Auto — RedCell can read and edit inside the workspace; actions outside it ask first.
• Full Access — RedCell can edit files outside the workspace and access the internet without asking. Use with caution.

Approvals

When the agent needs to step outside the active mode, it pauses and asks. Approve the action, or decline and tell RedCell what to do differently. Approval settings are saved per workspace in config.toml.