Documentation
¶
Overview ¶
Package sandbox wraps a shell command in an OS-level jail so the model's `bash` calls are confined: it may read freely but write only inside the workspace (plus temp and toolchain caches) and reach the network only when allowed. This is the *enforcement* layer beneath the permission rules (*policy*): a permitted command still cannot escape the box.
Only macOS (Seatbelt via sandbox-exec) is implemented; on every other OS, or when the OS tooling is missing, Command falls back to running the command unwrapped (see Available). Confining the in-process file-writer built-ins is handled separately, in package tool/builtin.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Available ¶
func Available() bool
Available reports whether an OS sandbox is available on this platform. On Linux, this checks for bubblewrap (bwrap) on PATH.
func Command ¶
Command runs the command unwrapped: no OS sandbox is implemented for this platform yet (Linux bubblewrap/landlock is the next step). The permission layer still gates the call.
When spec.Mode is "enforce" and bubblewrap (bwrap) is available on PATH, the command is wrapped in a bubblewrap sandbox with a profile analogous to macOS Seatbelt: writes confined to WriteRoots, network denied unless spec.Network is true. When bwrap is unavailable the command runs unconfined (boot and acp warn about this once at startup).
Types ¶
type Shell ¶
Shell is the resolved interpreter the bash tool executes commands with: a kind (so callers can adapt prompts) and the executable to invoke.
func ResolveShell ¶
func ResolveShell() Shell
ResolveShell picks the interpreter the shell tool runs commands under. It prefers a real bash so the model's POSIX habits work; on Windows, where bash is usually absent from PATH, it probes the Git-for-Windows install locations and only then falls back to PowerShell so the tool still functions. The result is cached for the process lifetime since the shell path does not change once the process is running.
func (Shell) SupportsChaining ¶
SupportsChaining reports whether the shell parses '&&' / '||'. bash does; Windows PowerShell 5.1 (powershell.exe) does not — only PowerShell 7+ (pwsh).
type Spec ¶
type Spec struct {
// Mode is "enforce" to wrap the command, anything else (incl. "off" and "")
// to run it unwrapped.
Mode string
// WriteRoots are directories the command may write to (the workspace root
// plus any configured extras). Temp dirs and common toolchain caches are
// added automatically so builds and package managers keep working.
WriteRoots []string
// Network allows network egress from inside the sandbox. Off blocks it so a
// command cannot exfiltrate or fetch; many dev commands (module/package
// downloads) need it, so it defaults on at the config layer.
Network bool
// RequireAvailable, when true, makes Mode "enforce" fail-closed (refuse all
// commands) if no OS sandbox backend exists on this platform, rather than
// silently degrading to unconfined. Mirrors config.SandboxConfig.RequireAvailable.
RequireAvailable bool
// StrictWrites narrows the toolchain-cache write grants (macOS Seatbelt) to
// true cache subdirs only — e.g. ~/.cargo/registry/cache instead of all of
// ~/.cargo. Default (false) keeps the broad grants so `go install`/`cargo
// build`/`npm install` keep working (they write to bin/pkg dirs outside the
// cache). High-security deployments that don't expect build-tool execution
// turn this on to close the "drop a binary in ~/.cargo/bin" persistence
// vector. Audit A8.
StrictWrites bool
}
Spec describes how to confine one command. The zero value (Mode == "") does not enforce, so an unconfigured caller runs commands unchanged.
Source Files