Struct SandboxConfig 

pub struct SandboxConfig {
    pub enabled: bool,
    pub fs_rw: Vec<PathBuf>,
    pub tcp: bool,
}

Resolved sandbox knobs.

Built with SandboxConfig::from_env; all knobs are ENV-driven (matching the bridge::config house style) except enabled, which is also reachable through the --sandbox CLI flag.

ENV var	Default	Meaning
AGENT_BLOCK_SANDBOX	off	enable the sandbox
AGENT_BLOCK_SANDBOX_FS_RW	empty	:-separated extra writable paths
AGENT_BLOCK_SANDBOX_TCP	true	0/false/no/off denies TCP

Fields

enabled: bool

Whether the boundary should be installed at all.

fs_rw: Vec<PathBuf>

Extra paths granted write access, on top of the built-in allowlist.

tcp: bool

true (default) leaves TCP untouched; false denies bind + connect.

Implementations

impl SandboxConfig

pub fn from_env(cli_enabled: bool) -> Self

Resolve the config from the environment.

cli_enabled is the --sandbox flag; the sandbox is enabled when either the flag or a truthy AGENT_BLOCK_SANDBOX is present. The env var is read here rather than through a clap env = ... binding: clap parses before the project .env is loaded and would accept only the literal strings true/false, while this path supports the documented truthy/falsy set.

Trait Implementations

impl Clone for SandboxConfig

fn clone(&self) -> SandboxConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SandboxConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SandboxConfig

fn default() -> Self

Returns the “default value” for a type.

impl Eq for SandboxConfig

impl PartialEq for SandboxConfig

fn eq(&self, other: &SandboxConfig) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for SandboxConfig