sandbox

Documentation

Index

• func FormatSandboxInfo(s Sandbox) string
• type BwrapSandbox
  • func NewBwrapSandbox(projectDir string, level Level) *BwrapSandbox
  • func (s *BwrapSandbox) IsAvailable() bool
  • func (s *BwrapSandbox) Level() Level
  • func (s *BwrapSandbox) Name() string
  • func (s *BwrapSandbox) WrapCommand(ctx context.Context, shell, cmd string, opts ExecOpts) *exec.Cmd
• type CommandCleanupProvider
• type ExecOpts
• type Level
  • func ParseLevel(s string) (Level, error)
  • func (l Level) String() string
• type Manager
  • func NewManager(projectDir string) *Manager
  • func (m *Manager) GetActive() Sandbox
  • func (m *Manager) GetForLevel(level Level) (Sandbox, error)
  • func (m *Manager) SetLevel(level Level) error
• type NoneSandbox
  • func NewNoneSandbox() *NoneSandbox
  • func (s *NoneSandbox) IsAvailable() bool
  • func (s *NoneSandbox) Level() Level
  • func (s *NoneSandbox) Name() string
  • func (s *NoneSandbox) WrapCommand(ctx context.Context, shell, cmd string, opts ExecOpts) *exec.Cmd
• type Sandbox

Functions

func FormatSandboxInfo

func FormatSandboxInfo(s Sandbox) string

FormatSandboxInfo returns a human-readable description of the sandbox state.

Types

type BwrapSandbox

type BwrapSandbox struct {
	// contains filtered or unexported fields
}

BwrapSandbox implements sandbox using bubblewrap (bwrap).

func NewBwrapSandbox

func NewBwrapSandbox(projectDir string, level Level) *BwrapSandbox

NewBwrapSandbox creates a new bubblewrap sandbox.

func (*BwrapSandbox) IsAvailable

func (s *BwrapSandbox) IsAvailable() bool

IsAvailable checks if bwrap is available on this system.

func (*BwrapSandbox) Level

func (s *BwrapSandbox) Level() Level

Level returns the sandbox level.

func (*BwrapSandbox) Name

func (s *BwrapSandbox) Name() string

Name returns "bwrap".

func (*BwrapSandbox) WrapCommand

func (s *BwrapSandbox) WrapCommand(ctx context.Context, shell, cmd string, opts ExecOpts) *exec.Cmd

WrapCommand wraps a command for execution inside bubblewrap.

type CommandCleanupProvider

type CommandCleanupProvider interface {
	CleanupCommand(*exec.Cmd)
}

CommandCleanupProvider is implemented by sandboxes that create temporary command-side resources which must remain available until the process exits.

type ExecOpts

type ExecOpts struct {
	WritablePaths []string          // Additional writable paths
	ReadOnlyPaths []string          // Additional read-only paths (for standard mode)
	NetworkAccess bool              // Enable network access
	EnvVars       map[string]string // Additional environment variables
	WorkDir       string            // Working directory
	Timeout       time.Duration     // Command timeout
}

ExecOpts contains options for executing a command in a sandbox.

type Level

type Level int

Level defines the sandbox restriction level.

const (
	LevelStrict   Level = iota // Plan mode: read-only project, no network
	LevelStandard              // Agent mode: read-write project, no network
	LevelNone                  // YOLO mode: no restrictions
)

func ParseLevel

func ParseLevel(s string) (Level, error)

ParseLevel parses a string into a Level.

func (Level) String

func (l Level) String() string

String returns the string representation of a Level.

type Manager

type Manager struct {
	// contains filtered or unexported fields
}

Manager manages sandbox selection based on mode and availability.

func NewManager

func NewManager(projectDir string) *Manager

NewManager creates a new sandbox manager.

func (*Manager) GetActive

func (m *Manager) GetActive() Sandbox

GetActive returns the active sandbox.

func (*Manager) GetForLevel

func (m *Manager) GetForLevel(level Level) (Sandbox, error)

GetForLevel returns the sandbox for a specific level, checking availability.

func (*Manager) SetLevel

func (m *Manager) SetLevel(level Level) error

SetLevel sets the active sandbox level.

type NoneSandbox

type NoneSandbox struct{}

NoneSandbox executes commands without any sandbox restrictions.

func NewNoneSandbox

func NewNoneSandbox() *NoneSandbox

NewNoneSandbox creates a new no-op sandbox.

func (*NoneSandbox) IsAvailable

func (s *NoneSandbox) IsAvailable() bool

IsAvailable always returns true.

func (*NoneSandbox) Level

func (s *NoneSandbox) Level() Level

Level returns LevelNone.

func (*NoneSandbox) Name

func (s *NoneSandbox) Name() string

Name returns "none".

func (*NoneSandbox) WrapCommand

func (s *NoneSandbox) WrapCommand(ctx context.Context, shell, cmd string, opts ExecOpts) *exec.Cmd

WrapCommand returns a plain command without any sandbox restrictions. It inherits the full parent environment and overlays opts.EnvVars on top.

type Sandbox

type Sandbox interface {
	// WrapCommand wraps a command for execution inside the sandbox.
	WrapCommand(ctx context.Context, shell, cmd string, opts ExecOpts) *exec.Cmd

	// IsAvailable checks if the sandbox can be used on this system.
	IsAvailable() bool

	// Name returns the sandbox implementation name.
	Name() string

	// Level returns the sandbox level.
	Level() Level
}

Sandbox is the interface for sandbox implementations.