Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrDeprecatedNetworkKeys = errors.New("sandbox.network.allow_cidrs / allow_hosts are no longer supported; use allow_external (bool)")
var ErrDropRuleMissingPattern = errors.New(`each sandbox.command.drop entry requires a non-empty "pattern"`)
var ErrInvalidToolMode = errors.New(`invalid tool_mode (must be "mcp" or "hook")`)
var ErrMissingContainerBuildContext = errors.New("missing required field: sandbox.container.build_context")
var ErrMissingContainerDockerfile = errors.New("missing required field: sandbox.container.dockerfile")
var ErrMissingContainerImage = errors.New("missing required field: sandbox.container.image")
var ErrMissingMCPCommandOutputDir = errors.New("missing required field: mcp.command_output_dir")
Functions ¶
This section is empty.
Types ¶
type CommandConfig ¶ added in v0.8.0
type Config ¶
type Config struct {
ToolMode string `toml:"tool_mode"`
MCP MCPConfig `toml:"mcp"`
Sandbox SandboxConfig `toml:"sandbox"`
}
func Load ¶
Load composes the optional user-scope config (~/.config/agent-sandbox/config.toml) with the project-scope config at path, then validates the merged result. Scalars: project overrides user. Lists (command.allow, command.drop, container.env_passthrough, and the sandbox.host lists): de-duplicated union.
type ContainerConfig ¶
type DropRule ¶ added in v0.14.3
DropRule is one drop pattern with an optional custom refusal message. Every drop entry is written as a table so the shape is the same with or without a message:
drop = [
{ pattern = "git *" },
{ pattern = "gh *", message = "gh is disabled" },
]
An omitted message leaves Message empty, and the router falls back to the default `dropped: command matches drop pattern "<pattern>"` line.
type HostConfig ¶ added in v0.13.0
type HostConfig struct {
Capabilities []string `toml:"capabilities"`
Allow []string `toml:"allow"`
Read []string `toml:"read"`
AllowFile []string `toml:"allow_file"`
ReadFile []string `toml:"read_file"`
AllowEnv []string `toml:"allow_env"`
}
HostConfig declares, in nono-agnostic terms, the host-side access the sandboxed agent process gets. Capabilities are named bundles expanded by internal/sandboxhost; the remaining lists are raw grants.
type MCPConfig ¶ added in v0.8.0
type MCPConfig struct {
CommandOutputDir string `toml:"command_output_dir"`
}
type NetworkConfig ¶ added in v0.8.0
type NetworkConfig struct {
AllowExternal bool `toml:"allow_external"`
}
type SandboxConfig ¶
type SandboxConfig struct {
Network NetworkConfig `toml:"network"`
Command CommandConfig `toml:"command"`
Container ContainerConfig `toml:"container"`
Host HostConfig `toml:"host"`
}
Source Files