Versions in this module Expand all Collapse all v0 v0.720.2 Sep 18, 2026 Changes in this version + const BackendBwrapLandlock + const BackendJobObject + const BackendLandlock + const BackendNone + const BackendSeatbelt + const EnvVar + const GapBwrapNever + const GapGuardedPorts + const GapGuardedPortsAny + const GapNotEnforced + const GapProtectedPaths + const GapProtectedPathsAny + const OpRead + const OpWrite + var DefaultExtendTo = []Purpose + var ErrSBPLPath = errors.New("sandbox: path cannot be used in a Seatbelt profile") + var ErrWrapFailed = errors.New("sandbox: cannot apply policy to command") + func Active() bool + func AttachProcessTree(p *os.Process) (release func(), err error) + func AutoAllowBash() bool + func CloseEventWriter() + func CurrentPolicyHash() string + func Emit(_ context.Context, e Event) + func EmitSpawn(ctx context.Context, purpose Purpose, covered bool, p Policy, c Capability) + func GenerateSBPL(p Policy) (profile string, params []string, err error) + func GenerateSBPLWith(p Policy, opts SBPLOptions) (profile string, params []string, err error) + func Guarantees(p Policy, c Capability) (full bool, gaps []string) + func GuardedPorts() []int + func IsCoreEnvName(name string) bool + func IsSecretEnvName(name string) bool + func IsWSL() bool + func RegisterGuardedPort(port int, owner string) (unregister func()) + func ResetEventsForTests() + func SandboxExecArgs(profile string, params []string, argv []string) []string + func ScrubEnv(env []string, p Policy) []string + func SetDefaultForTests(w Wrapper) (restore func()) + func WrapCmd(cmd *exec.Cmd, purpose Purpose) (Policy, Capability, error) + type BwrapPolicy string + const BwrapAlways + const BwrapAuto + const BwrapNever + type Capability struct + Backend string + BlocksPorts bool + Enforced bool + ProtectsNestedPaths bool + Reason string + Version string + func (c Capability) String() string + type Counters struct + Applied uint64 + Denied uint64 + EscalationDenied uint64 + EscalationGranted uint64 + EscalationRequested uint64 + Unavailable uint64 + func EventCounters() Counters + type Denial struct + Evidence string + Kind DenialKind + Op string + Path string + WorkspaceRootEntry bool + func Classify(exitCode int, output string, p Policy) (Denial, bool) + func ClassifyAt(exitCode int, output string, p Policy, cwd string) (Denial, bool) + type DenialKind string + const DenialFS + const DenialNet + type EnvInherit string + const EnvInheritAll + const EnvInheritCore + const EnvInheritNone + type EnvPolicy struct + Exclude []string + Inherit EnvInherit + Keep []string + ScrubSecrets bool + type Event struct + AutoAllowed bool + Backend string + Command string + Kind string + Mode string + Op string + Path string + Reason string + SessionID string + Time time.Time + Type EventType + func RecentEvents() []Event + type EventType string + const EventApplied + const EventDenied + const EventEscalationDenied + const EventEscalationGranted + const EventEscalationRequested + const EventUnavailable + type Mode string + const ModeOff + const ModeReadOnly + const ModeStrict + const ModeWorkspaceWrite + func ParseMode(s string) (Mode, bool) + type Network string + const NetworkAllowed + const NetworkRestricted + type Policy struct + AllowAutoEscalation bool + AutoAllowBash bool + DenyConnectPorts []int + DenyPaths []string + Env EnvPolicy + ExtendTo []Purpose + Mode Mode + Network Network + ProtectedPaths []string + ReadableRoots []string + Source Source + UseBwrap BwrapPolicy + Workspace string + WritableRoots []string + func Current() Policy + func Resolve(cfg *config.Config, workspace string) Policy + func ResolveConfig(sc config.SandboxConfig, workspace string, opts ResolveOptions) Policy + func (p Policy) Covers(purpose Purpose) bool + func (p Policy) Enabled() bool + func (p Policy) Hash() string + func (p Policy) RestrictsNetwork() bool + type Purpose string + const PurposeACPTerminals + const PurposeBash + const PurposeMCP + const PurposeSkills + const PurposeSubagents + type ResolveOptions struct + DataDir string + GOOS string + GuardedPorts []int + HomeDir string + IsLocked func(path string) bool + LocalConfigFile string + LookupEnv func(string) (string, bool) + type SBPLOptions struct + Canonical func(path string) string + Exists func(path string) bool + func OSSBPLOptions() SBPLOptions + type Source string + const SourceConfig + const SourceDefault + const SourceEnv + const SourceLock + type Status struct + Active bool + Capability Capability + Full bool + Gaps []string + Hash string + Policy Policy + func CurrentStatus() Status + func NewStatus(p Policy, c Capability) Status + func (s Status) Label() string + type Wrapper interface + Capability func() Capability + Wrap func(cmd *exec.Cmd, p Policy) error + func Default() Wrapper
Go to main page