# mikenuguid/silverstripe-ai-dev-sandbox architecture

> Architecture diagram of the GitHub repository mikenuguid/silverstripe-ai-dev-sandbox, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-13). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/mikenuguid/silverstripe-ai-dev-sandbox
- Repository: https://github.com/mikenuguid/silverstripe-ai-dev-sandbox

## Overview

Silverstripe AI Dev Sandbox provides a host-controlled, network-restricted devcontainer for unattended coding agents. The main workflow is to install the sandbox into a project, start it with `ccnet`, open the network briefly for setup, close it for agent work, and check enforcement before unattended sessions. Separate components configure the container, apply firewall rules, warn about an open airlock, and guard agent network tools. The README describes these relationships; source excerpts were not provided, so the graph omits unverified implementation details.

Main entry points: [`install.sh`](https://github.com/mikenuguid/silverstripe-ai-dev-sandbox/blob/main/install.sh) (Sandbox installer), [`bin/ccnet`](https://github.com/mikenuguid/silverstripe-ai-dev-sandbox/blob/main/bin/ccnet) (Host CLI), [`core/init-firewall.sh`](https://github.com/mikenuguid/silverstripe-ai-dev-sandbox/blob/main/core/init-firewall.sh) (Firewall initialization), [`core/net-open.sh`](https://github.com/mikenuguid/silverstripe-ai-dev-sandbox/blob/main/core/net-open.sh) (Open airlock)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_setup["Setup and Configuration"]
  node_installer["Sandbox installer<br/>[install.sh]"]
  node_templates["Container templates"]
  node_preset["PHP MySQL preset"]
  node_sandbox_config["Sandbox config"]
  node_allowlist["Network allowlist"]
end

subgraph group_control["Host Airlock Control"]
  node_ccnet["Host CLI"]
  node_net_open["Open airlock<br/>[net-open.sh]"]
  node_net_close["Close airlock<br/>[net-close.sh]"]
end

subgraph group_runtime["Sandbox Runtime"]
  node_firewall_init["Firewall initialization<br/>[init-firewall.sh]"]
  node_shell_setup["Shell setup"]
  node_container["Devcontainer"]
end

subgraph group_agent["Agent Safeguards"]
  node_net_guard["Network tool guard<br/>[net-guard.sh]"]
  node_airlock_warn["Airlock warning<br/>[airlock-warn.sh]"]
end

node_host_user(("Host operator"))
node_project["Project workspace"]
node_agent_actor(("Coding agent"))
node_anthropic(("Claude API"))
node_docker["Docker host"]

node_host_user -->|"runs install"| node_installer
node_installer -->|"writes sandbox"| node_project
node_installer -->|"generates from"| node_templates
node_installer -->|"provisions preset"| node_preset
node_host_user -->|"runs commands"| node_ccnet
node_ccnet -->|"starts or stops"| node_container
node_host_user -->|"opens network"| node_net_open
node_host_user -->|"closes network"| node_net_close
node_sandbox_config -->|"configures generation"| node_installer
node_allowlist -->|"permits destinations"| node_net_open
node_container -->|"applies firewall"| node_firewall_init
node_firewall_init -->|"allows API access"| node_anthropic
node_container -->|"hosts agent"| node_agent_actor
node_agent_actor -->|"network tools checked"| node_net_guard
node_airlock_warn -->|"warns when open"| node_agent_actor
node_shell_setup -->|"sets shell environment"| node_container
node_docker -->|"runs"| node_container
node_project -->|"workspace mounted"| node_container

click node_installer "https://github.com/mikenuguid/silverstripe-ai-dev-sandbox/blob/main/install.sh"
click node_templates "https://github.com/mikenuguid/silverstripe-ai-dev-sandbox/tree/main/templates"
click node_preset "https://github.com/mikenuguid/silverstripe-ai-dev-sandbox/tree/main/presets/php-mysql"
click node_sandbox_config "https://github.com/mikenuguid/silverstripe-ai-dev-sandbox/blob/main/templates/sandbox.conf.example"
click node_allowlist "https://github.com/mikenuguid/silverstripe-ai-dev-sandbox/blob/main/templates/allowlist.txt.example"
click node_ccnet "https://github.com/mikenuguid/silverstripe-ai-dev-sandbox/blob/main/bin/ccnet"
click node_firewall_init "https://github.com/mikenuguid/silverstripe-ai-dev-sandbox/blob/main/core/init-firewall.sh"
click node_net_open "https://github.com/mikenuguid/silverstripe-ai-dev-sandbox/blob/main/core/net-open.sh"
click node_net_close "https://github.com/mikenuguid/silverstripe-ai-dev-sandbox/blob/main/core/net-close.sh"
click node_net_guard "https://github.com/mikenuguid/silverstripe-ai-dev-sandbox/blob/main/core/net-guard.sh"
click node_airlock_warn "https://github.com/mikenuguid/silverstripe-ai-dev-sandbox/blob/main/core/airlock-warn.sh"
click node_shell_setup "https://github.com/mikenuguid/silverstripe-ai-dev-sandbox/blob/main/core/zshrc"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_installer,node_templates,node_preset,node_sandbox_config,node_allowlist toneBlue
class node_ccnet,node_net_open,node_net_close toneAmber
class node_firewall_init,node_shell_setup,node_container,node_anthropic toneMint
class node_net_guard,node_airlock_warn toneRose
class node_host_user,node_project,node_agent_actor,node_docker toneIndigo
```

## Components

### Setup and Configuration

- [Sandbox installer](https://github.com/mikenuguid/silverstripe-ai-dev-sandbox/blob/main/install.sh): `install.sh`
- [Container templates](https://github.com/mikenuguid/silverstripe-ai-dev-sandbox/tree/main/templates): `templates`
- [PHP MySQL preset](https://github.com/mikenuguid/silverstripe-ai-dev-sandbox/tree/main/presets/php-mysql): `presets/php-mysql`
- [Sandbox config](https://github.com/mikenuguid/silverstripe-ai-dev-sandbox/blob/main/templates/sandbox.conf.example): `templates/sandbox.conf.example`
- [Network allowlist](https://github.com/mikenuguid/silverstripe-ai-dev-sandbox/blob/main/templates/allowlist.txt.example): `templates/allowlist.txt.example`

### Host Airlock Control

- [Host CLI](https://github.com/mikenuguid/silverstripe-ai-dev-sandbox/blob/main/bin/ccnet): `bin/ccnet`
- [Open airlock](https://github.com/mikenuguid/silverstripe-ai-dev-sandbox/blob/main/core/net-open.sh): `core/net-open.sh`
- [Close airlock](https://github.com/mikenuguid/silverstripe-ai-dev-sandbox/blob/main/core/net-close.sh): `core/net-close.sh`

### Sandbox Runtime

- [Firewall initialization](https://github.com/mikenuguid/silverstripe-ai-dev-sandbox/blob/main/core/init-firewall.sh): `core/init-firewall.sh`
- [Shell setup](https://github.com/mikenuguid/silverstripe-ai-dev-sandbox/blob/main/core/zshrc): `core/zshrc`
- **Devcontainer**

### Agent Safeguards

- [Network tool guard](https://github.com/mikenuguid/silverstripe-ai-dev-sandbox/blob/main/core/net-guard.sh): `core/net-guard.sh`
- [Airlock warning](https://github.com/mikenuguid/silverstripe-ai-dev-sandbox/blob/main/core/airlock-warn.sh): `core/airlock-warn.sh`

### Other components

- **Host operator**
- **Project workspace**
- **Coding agent**
- **Claude API**
- **Docker host**

## Connections

- Host operator → Sandbox installer: runs install (evidence: `README.md`)
- Sandbox installer → Project workspace: writes sandbox (evidence: `README.md`)
- Sandbox installer → Container templates: generates from (evidence: `README.md`)
- Sandbox installer → PHP MySQL preset: provisions preset (evidence: `README.md`)
- Host operator → Host CLI: runs commands (evidence: `README.md`)
- Host CLI → Devcontainer: starts or stops (evidence: `README.md`)
- Host operator → Open airlock: opens network (evidence: `README.md`)
- Host operator → Close airlock: closes network (evidence: `README.md`)
- Sandbox config → Sandbox installer: configures generation (evidence: `README.md`)
- Network allowlist → Open airlock: permits destinations (evidence: `README.md`)
- Devcontainer → Firewall initialization: applies firewall (evidence: `README.md`)
- Firewall initialization → Claude API: allows API access (evidence: `README.md`)
- Devcontainer → Coding agent: hosts agent (evidence: `README.md`)
- Coding agent → Network tool guard: network tools checked (evidence: `README.md`)
- Airlock warning → Coding agent: warns when open (evidence: `README.md`)
- Shell setup → Devcontainer: sets shell environment (evidence: `README.md`)
- Docker host → Devcontainer: runs (evidence: `README.md`)
- Project workspace → Devcontainer: workspace mounted (evidence: `README.md`)