reviewsandbox

Documentation

Index

• Constants
• func InheritedCommandEnvironment(runtimeDir string) []string
• func PermissionArgs(command, runtimeDir string) []string
• func PermissionArgsWithReadRoots(command, runtimeDir string, additionalReadRoots ...string) []string
• func PrepareRuntime(runtimeDir string) error
• func RestrictedCommandEnvironment(runtimeDir string) []string
• func ToolEnvironment(runtimeDir string) map[string]string
• type Executor
  • func NewExecutor() *Executor
  • func NewExecutorWithCodexCommand(command string) *Executor
  • func NewSessionExecutorWithCodexCommand(command string) *Executor
  • func (e *Executor) Close() error
  • func (e *Executor) Verify(parent context.Context, request Request) Result
• type Kind
• type Language
• type Request
• type Result
• type Status
• type Verifier

Constants

const PermissionProfileName = "buckley-review-snapshot"

Functions

func InheritedCommandEnvironment

func InheritedCommandEnvironment(runtimeDir string) []string

InheritedCommandEnvironment preserves the caller environment for Codex provider authentication while forcing all sandbox temp paths into runtimeDir. The child command still receives only ToolEnvironment through the permission profile's shell_environment_policy.

func PermissionArgs

func PermissionArgs(command, runtimeDir string) []string

PermissionArgs returns the Codex CLI overrides for a review verification sandbox. The current Codex working directory is read-only, only its private TMPDIR is writable, and direct network access is disabled.

func PermissionArgsWithReadRoots

func PermissionArgsWithReadRoots(command, runtimeDir string, additionalReadRoots ...string) []string

PermissionArgsWithReadRoots is PermissionArgs plus narrowly-scoped, read-only toolchain or dependency roots required by the verification run.

func PrepareRuntime

func PrepareRuntime(runtimeDir string) error

PrepareRuntime creates the private writable directories referenced by the shared review sandbox environment. Native Codex and API verification must both call this before launching any build or test process.

func RestrictedCommandEnvironment

func RestrictedCommandEnvironment(runtimeDir string) []string

RestrictedCommandEnvironment is safe for `codex sandbox`: it does not inherit credentials, proxy variables, hooks, or user configuration.

func ToolEnvironment

func ToolEnvironment(runtimeDir string) map[string]string

ToolEnvironment is the complete environment visible to a verification process inside Codex's sandbox. Build and package managers are forced offline; all writable caches and temporary output live below runtimeDir.

Types

type Executor

type Executor struct {
	// contains filtered or unexported fields
}

func NewExecutor

func NewExecutor() *Executor

func NewExecutorWithCodexCommand

func NewExecutorWithCodexCommand(command string) *Executor

NewExecutorWithCodexCommand configures an absolute Codex executable. When command is empty, discovery is limited to the fixed trusted executable path.

func NewSessionExecutorWithCodexCommand

func NewSessionExecutorWithCodexCommand(command string) *Executor

NewSessionExecutorWithCodexCommand reuses one private build runtime until Close. This lets verification calls share safe compiler caches.

func (*Executor) Close

func (e *Executor) Close() error

Close removes a session executor's private build runtime.

func (*Executor) Verify

func (e *Executor) Verify(parent context.Context, request Request) Result

type Kind

type Kind string

const (
	KindBuild Kind = "build"
	KindTest  Kind = "test"
	KindCheck Kind = "check"
)

type Language

type Language string

const (
	LanguageAuto   Language = "auto"
	LanguageGo     Language = "go"
	LanguageRust   Language = "rust"
	LanguagePython Language = "python"
	LanguageNode   Language = "node"
)

type Request

type Request struct {
	SnapshotRoot   string
	SourceRoot     string
	Kind           Kind
	Language       Language
	Path           string
	Pattern        string
	Timeout        time.Duration
	MaxOutputBytes int
}

type Result

type Result struct {
	Kind         Kind
	Language     Language
	Path         string
	Pattern      string
	Command      string
	Argv         []string
	ExitCode     int
	Status       Status
	Stdout       string
	Stderr       string
	Duration     time.Duration
	Truncated    bool
	NoTestFiles  bool
	NoTestScript bool
	Error        string
}

type Status

type Status string

const (
	StatusPass          Status = "PASS"
	StatusFail          Status = "FAIL"
	StatusNotApplicable Status = "NOT_APPLICABLE"
	StatusUnavailable   Status = "UNAVAILABLE"
)

type Verifier

type Verifier interface {
	Verify(context.Context, Request) Result
}