Documentation
¶
Overview ¶
Package claude builds and runs the sandboxed `claude` command: it parses the launcher's arguments, constructs the `nono wrap … claude …` invocation (including the hook settings injected in hook mode), and executes it.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func BuildArgs ¶
func BuildArgs(cfg *config.Config, opts Options, snapshotPath, mcpConfigPath, profilePath string, denyRules []string) (string, []string, error)
BuildArgs constructs the nono executable path and the argv used to launch Claude under the sandbox for cfg. It injects the generated profile at profilePath via `--profile` (no user nono options are forwarded) and, in hook mode, grants read-only access to the frozen policy snapshot at snapshotPath and injects the PreToolUse hook via `claude --settings`, routing it through that snapshot; otherwise it disables the Bash and Monitor tools. denyRules are folded into the injected settings as additional capability denies.
func RedactedGithubMCPConfigJSON ¶ added in v0.13.0
RedactedGithubMCPConfigJSON renders the GitHub MCP config the launcher would generate, with the token replaced by a placeholder. It is for display (e.g. `agent-sandbox debug`) so the real PAT never reaches the terminal or logs.
func Run ¶
Run ensures the sandbox is up, launches Claude under it, and — if this call started the sandbox — tears it down when Claude exits. It replaces the old syscall.Exec approach so the launcher can outlive Claude and run teardown.
func ValidatePassthrough ¶
ValidatePassthrough rejects claude passthrough options that agent-sandbox reserves for itself: --settings always, and --mcp-config / --strict-mcp-config when the built-in GitHub MCP config is enabled.
Types ¶
type Options ¶
type Options struct {
ClaudeOpts []string
}
Options carries the claude passthrough options (everything after "--"). agent-sandbox no longer forwards options to nono.
func ParseArgs ¶
ParseArgs splits the raw args into the config-file path and the claude passthrough options. The first standalone "--" separates agent-sandbox's own region (before) from claude options (after). Only "--config <val>" / "--config=<val>" is accepted before "--"; any other pre-"--" token is an error, because agent-sandbox no longer forwards options to nono (the sandbox profile is configured in [sandbox.host]). defaultConfig is used when no "--config" is given.
Source Files