Documentation
¶
Overview ¶
Package sandboxhost is the single source of truth for host-access capabilities. It expands the config's host sections into the two nono profiles agent-sandbox needs — one for the launched agent (Resolve), one for the shell sandbox each brokered command runs in (ResolveShell) — plus the coordinated permission-deny rules for the agent's own file tools. Both profiles come from the same expansion and differ only in which config sections feed them, so a grant's scope is decided by where it is written, not by a rule in here. The nono-specific JSON rendering lives here; nothing about nono leaks into the user-facing config.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CapabilityNames ¶ added in v0.16.2
func CapabilityNames() []string
CapabilityNames returns the catalog's capability names, sorted. It exists so the agent-facing documentation can list the names an operator (or the agent editing the config) may actually write, rather than restating the catalog in prose where it would drift the moment a bundle is added.
func ShellAllowDomains ¶ added in v0.16.2
ShellAllowDomains are the domains a brokered command may reach on top of the fixed developer network profile: what [sandbox.shell] writes as allow_domains, plus what the capabilities declared for that side bring with them. Like ShellFilesystemGrants it exists so agent-facing documentation can state the resolved answer instead of the config sections it came from.
Types ¶
type Resolved ¶
type Resolved struct {
DenyRules []string
// contains filtered or unexported fields
}
Resolved is the outcome of expanding a HostConfig: the nono profile to write and the deduped Claude permission-deny rules to inject via --settings.
func Resolve ¶
Resolve builds the profile for the launched agent: the shared [sandbox.shared] base plus [sandbox.agent], on the given agent's nono base profile. agentOnlyEnv (the broker socket path) is granted here and never in ResolveShell's profile — see baselineEnv's comment in catalog.go.
func ResolveShell ¶ added in v0.16.0
ResolveShell builds the profile for the shell sandbox a single brokered command runs in: the working directory read+write, the shared [sandbox.shared] base plus [sandbox.shell], and the fixed developer network profile plus the extra domains ShellAllowDomains resolves.
It shares expand with Resolve because the two profiles differ only in which config sections feed them: a grant the shell sandbox must not have belongs under [sandbox.agent], where this call never looks.
func (*Resolved) EnvAllowVars ¶ added in v0.15.0
EnvAllowVars returns the profile's environment allow_vars patterns.
The command broker uses it to build the nono supervisor's own environment: it forwards exactly those of the launcher's variables that this list already permits inside the sandbox. Sharing the list keeps the two in step — in particular baselineEnv and the capability allowVars (the mise capability's "MISE*" / "__MISE*") are declared in exactly one place, this package, rather than being restated by the broker where they could silently drift.
Entries are patterns, not plain names; see broker's envAllowlist for the supported syntax.
func (*Resolved) ProfileJSON ¶
ProfileJSON marshals the resolved nono profile.
func (*Resolved) ProtectedGrants ¶ added in v0.16.0
ProtectedGrants returns the profile's filesystem grants that fall under protectedPrefixes, sorted. Raw grants can never produce one (expand rejects them), so a non-empty result means a capability carrying host credentials was declared for this side — worth surfacing on the shell profile, where it is usually a mistake.
func (*Resolved) WriteProfile ¶
WriteProfile marshals the profile to a 0600 temp file and returns its path plus a cleanup func that removes it. The file is read by nono itself on the host before the sandbox applies, so callers do NOT grant --read-file for it.
type ShellGrants ¶ added in v0.16.0
ShellGrants are the filesystem paths the shell sandbox can reach outside its working directory — the shared [sandbox.shared] base plus [sandbox.shell], expanded. The working directory and the built-in baseline files are excluded: they are true of every command and say nothing about this config.
func ShellFilesystemGrants ¶ added in v0.16.0
func ShellFilesystemGrants(cfg *config.Config) (ShellGrants, error)
ShellFilesystemGrants resolves ShellGrants for cfg. It exists so agent-facing documentation can state what a sandboxed command actually reaches instead of describing the config sections and leaving the agent to work it out — the answer depends entirely on where grants were written.
Source Files