Documentation
¶
Overview ¶
Package sandbox provides OS-level sandboxing for agent-executed commands.
enforce.go — adds a sandbox enforcement mode
Package sandbox wraps a shell command in an OS-level jail so the model's `bash` calls are confined: it may read freely but write only inside the workspace (plus temp and toolchain caches) and reach the network only when allowed. This is the *enforcement* layer beneath the permission rules (*policy*): a permitted command still cannot escape the box.
Supported backends: macOS Seatbelt (sandbox-exec), Linux Landlock (kernel 5.13+). On every other OS, or when the kernel support is missing, Command falls back to running unwrapped (see Available). Confining the in-process file-writer built-ins is handled separately, in package tool/builtin.
Index ¶
- Variables
- func Available() bool
- func BlockedFetchIP(ip net.IP) bool
- func Command(spec Spec, shell, command string) ([]string, bool)
- func Enforce() string
- func LandlockExec(args []string)
- func SandboxExec(args []string)
- func SetMode(m Mode)
- func WrapProcess(pid int, spec Spec) error
- type Mode
- type Spec
Constants ¶
This section is empty.
Variables ¶
var ErrSandboxRequired = fmt.Errorf("sandbox enforcement: no isolation available — set sandbox.mode = \"warn\" to allow, or install AppContainer (Windows) / Landlock (Linux 5.13+) / sandbox-exec (macOS)")
ErrSandboxRequired is returned when sandbox enforcement is active but the platform cannot provide isolation.
Functions ¶
func Available ¶
func Available() bool
Available probes whether the kernel supports landlock (5.13+).
func BlockedFetchIP ¶
BlockedFetchIP reports whether ip is an address that must not be reached by outbound HTTP clients (web_fetch, MCP plugin connections). Covers private, link-local, unspecified, and CGNAT ranges.
func Command ¶
Command returns args that re-exec the current binary as a landlock wrapper. The wrapper applies landlock, then execs the real command. The second return is always true when enforcement is active.
func LandlockExec ¶
func LandlockExec(args []string)
LandlockExec is the --landlock-exec re-exec entry point called from main(). Parses args, applies landlock, then execs the target command. Never returns (calls os.Exit on error or execs on success).
func SandboxExec ¶
func SandboxExec(args []string)
SandboxExec is a stub — the --sandbox-exec re-exec path is Windows-only.
func WrapProcess ¶
WrapProcess is a no-op on non-Windows platforms — OS-level sandbox confinement is applied in-process (Seatbelt on macOS, Landlock on Linux) before exec, not after start.
Source Files