Documentation
¶
Overview ¶
Package sandboxhost is the single source of truth for host-access capabilities. It expands a config.HostConfig for a launch agent into a nono profile (what the host process may touch) and the coordinated Claude permission-deny rules (what the agent's own file tools may not read). The nono-specific JSON rendering lives here; nothing about nono leaks into the user-facing config.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Resolved ¶
type Resolved struct {
DenyRules []string
// contains filtered or unexported fields
}
Resolved is the outcome of expanding a HostConfig: the nono profile to write and the deduped Claude permission-deny rules to inject via --settings.
func Resolve ¶
Resolve expands cfg.Sandbox.Host for the given launch agent. All output lists are sorted and de-duplicated so the result is deterministic.
func (*Resolved) ProfileJSON ¶
ProfileJSON marshals the resolved nono profile.
func (*Resolved) WriteProfile ¶
WriteProfile marshals the profile to a 0600 temp file and returns its path plus a cleanup func that removes it. The file is read by nono itself on the host before the sandbox applies, so callers do NOT grant --read-file for it.
Source Files