Documentation
¶
Overview ¶
Package claude builds and runs the sandboxed `claude` command: it parses the launcher's arguments, constructs the `nono wrap … claude …` invocation (including the hook settings injected in hook mode), and executes it.
Index ¶
- Constants
- func BrokerArgs(cfg *config.Config, nonoPath, selfPath, sockPath, workdir string) []string
- func BrokerSocketPath() (string, error)
- func BuildArgs(cfg *config.Config, opts Options, mcpConfigPath, profilePath string, ...) (string, []string, error)
- func GithubMCPEnabled() bool
- func RedactedGithubMCPConfigJSON() ([]byte, error)
- func Run(cfg *config.Config, opts Options) error
- func ValidatePassthrough(claudeOpts []string, githubMCPEnabled bool) error
- type Options
Constants ¶
const GithubMCPTokenEnv = "GITHUB_MCP_TOKEN"
GithubMCPTokenEnv is the environment variable that both enables the GitHub MCP server (by being non-empty) and supplies its token. It is mapped to the github-mcp-server's expected GITHUB_PERSONAL_ACCESS_TOKEN in the generated config. Supply it via --env or the ambient host environment.
Variables ¶
This section is empty.
Functions ¶
func BrokerArgs ¶ added in v0.17.0
BrokerArgs builds the `nono run` argv for the command broker's session.
The broker is a sibling of the agent's sandbox, not a child of it: nono refuses to nest, and the broker must be the session entrypoint so the profile applies to everything it executes. It is deliberately not given --allow-cwd; the working directory reaches the profile through --workdir, which is what $WORKDIR expands to inside it.
Everything the broker needs in order to *start* is granted here, on the command line, rather than being left to the operator's profile. --read-file covers its own binary (a read grant carries the execute right), and --allow-unix-socket-bind covers the socket. Measured: under a profile that grants neither, an absolute-path invocation of this binary exits 127 with no output; adding --read-file alone makes the same invocation run. Keeping these on the launcher's side means an operator narrowing what *commands* may reach cannot accidentally stop the broker from starting, and it removes the profile's grants from the set of things that decide whether a session comes up at all.
The entrypoint is invoked by its absolute path. It was invoked by base name while the profile carried command_policies, because tool-sandbox treats an absolute-path invocation of a policy-controlled command as a direct exec bypass and refuses it. With no command_policies left, that constraint is gone and only base-name resolution's own hazard would remain: nono resolves the bare name through this launcher's PATH, so a different, stale copy earlier on PATH would silently become the broker instead of this one.
func BrokerSocketPath ¶ added in v0.15.0
BrokerSocketPath returns a per-process socket path under policysnapshot.StateDir(). It stays short on purpose: unix socket paths are limited to about 104 bytes on macOS.
It is exported so `agent-sandbox debug` can print the same `--allow-unix-socket` grant the launcher builds.
func BuildArgs ¶
func BuildArgs(cfg *config.Config, opts Options, mcpConfigPath, profilePath string, brokerSocket string) (string, []string, error)
BuildArgs constructs the nono executable path and the argv used to launch Claude under the sandbox for cfg. It injects the operator's profile at profilePath via `--profile` (no user nono options are forwarded) and, in hook mode, injects the PreToolUse hook via `claude --settings`; otherwise it disables the Bash and Monitor tools. The injected settings carry the hook and the GitHub MCP denies only; the profile contributes nothing to them.
func GithubMCPEnabled ¶ added in v0.14.0
func GithubMCPEnabled() bool
GithubMCPEnabled reports whether the GitHub MCP server should be configured: true iff GITHUB_MCP_TOKEN holds a non-empty (trimmed) value.
func RedactedGithubMCPConfigJSON ¶ added in v0.13.0
RedactedGithubMCPConfigJSON renders the GitHub MCP config the launcher would generate, with the token replaced by a placeholder. It is for display (e.g. `agent-sandbox debug`) so the real PAT never reaches the terminal or logs.
func Run ¶
Run generates the sandbox profile, starts the command broker, launches Claude under nono, and tears the broker down when Claude exits. It replaces the old syscall.Exec approach so the launcher can outlive Claude and run teardown.
func ValidatePassthrough ¶
ValidatePassthrough rejects claude passthrough options that agent-sandbox reserves for itself: --settings always, and --mcp-config / --strict-mcp-config when the built-in GitHub MCP config is enabled.
Types ¶
type Options ¶
Options carries the claude passthrough options (everything after "--"). agent-sandbox no longer forwards options to nono.
func ParseArgs ¶
ParseArgs splits the raw args into the config-file path and the claude passthrough options. The first standalone "--" separates agent-sandbox's own region (before) from claude options (after). Only "--config <val>" / "--config=<val>" and "--env <ref>" / "--env=<ref>" are accepted before "--"; any other pre-"--" token is an error, because agent-sandbox no longer forwards options to nono (the sandbox profile is configured via [agents.<name>].profile in agent-sandbox.toml). defaultConfig is used when no "--config" is given.
Source Files