CodeGuardian is an autonomous software engineering agent designed to inspect repositories, diagnose issues, formulate repair plans, write patches, and execute verification test suites.

Notice: Docker is not a dependency of CodeGuardian and is not required or utilized in this project. CodeGuardian executes builds and tests inside isolated temporary repository workspaces using guarded subprocess execution, environment sanitization, timeout enforcement, path confinement, process-tree termination, and secret redaction.

CodeGuardian's Constrained Local Process Sandbox enforces several layered protections:

• Canonical Absolute Path Resolution: All file read and write operations are strictly validated using canonical absolute path resolution (Path.resolve()).
• Path Traversal Blocking: Any attempt to reference ../, system directories (/etc, /var, /private), user sensitive directories (~/.ssh, ~/.aws, ~/.gnupg), or escape outside the sandbox workspace root raises a PathTraversalError.
• Zero In-Place Modification: Autonomous operations never modify the user's original source repository. Execution always occurs inside a dedicated, isolated temporary working copy (.codeguardian/runs/<task_id>/repo or OS tempdir).

• Credential Stripping: Subprocesses executing repository builds and tests do not inherit the full parent environment. Sensitive environment variables—including OPENAI_API_KEY, ANTHROPIC_API_KEY, GROQ_API_KEY, GITHUB_TOKEN, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and DATABASE_URL—are stripped.
• Strict Allowlisting: Only explicitly approved variables (PATH, HOME, TMPDIR, LANG, LC_ALL, PYTHONPATH, NODE_ENV) are provided.
• Output Redaction: All stdout and stderr streams pass through regex redactors before logging, streaming via Server-Sent Events, or saving to persistent storage. Known API key patterns (OpenAI, Anthropic, GitHub, AWS, Bearer tokens) are replaced with [REDACTED].

• Process Group Tracking: Each child execution is spawned with os.setsid(), creating an independent process group.
• Two-Stage Process Termination: Upon timeout, a SIGTERM is sent to the entire process group. If child processes fail to terminate within a brief grace period, a SIGKILL is issued to the group.
• Output Size Caps: Combined stdout/stderr output is truncated if it exceeds maximum limits (default 1 MB) to prevent denial-of-service via log explosion.

• No Unrestricted Shells: Subprocesses are invoked with shell=False and structured argument arrays.
• Prohibited Patterns: Commands containing rm -rf /, sudo, shutdown, reboot, mkfs, dd if=, pipe-to-shell patterns (curl ... | sh), or system-level configuration changes are rejected before execution.

Honesty regarding security boundaries is essential:

• Not a Virtual Machine: The sandbox shares the host operating system kernel.
• Not a Container: There is no cgroup or namespace isolation unless container tooling is provided externally.
• No Absolute Network Isolation: Commands such as pip install or pnpm install may make outbound network connections to resolve package dependencies.
• Not a Malware Analysis Sandbox: The constrained process sandbox is engineered to protect developers and CI environments against erroneous code generation, path traversal bugs, and runaway processes. It is not an adversarial sandbox for detonating untrusted binaries.

Important: "CodeGuardian's constrained-process sandbox is intended for controlled developer repositories and autonomous coding workflows. It should not be treated as a secure malware-analysis sandbox."