Struct SandboxExecutor 

pub struct SandboxExecutor { /* private fields */ }

Owns the active strategy and resolved policy for a session.

Construct one at session start via SandboxExecutor::from_config and thread it into crate::tools::ToolContext::sandbox. Tools call SandboxExecutor::wrap before spawning.

Implementations

impl SandboxExecutor

pub fn from_config(config: &SandboxConfig, project_dir: &Path) -> Self

Build an executor from config and the session’s project directory.

If config.enabled is false, the returned executor’s [wrap] is a no-op. If the selected strategy is unavailable on the current platform (e.g. seatbelt on Linux), falls back to NoopStrategy and logs a warning — the caller should still treat this as enabled for /sandbox reporting so the degradation is visible.

pub fn from_config_with_bypass( config: &SandboxConfig, project_dir: &Path, allow_bypass: bool, ) -> Self

Build an executor, explicitly setting whether per-call bypass is allowed.

Call sites with access to the full crate::config::Config should prefer SandboxExecutor::from_session_config, which reads the bypass flag from security.disable_bypass_permissions.

pub fn from_session_config(config: &Config, project_dir: &Path) -> Self

Build an executor from the top-level crate::config::Config, honoring the enterprise security.disable_bypass_permissions flag.

pub fn strategy_name(&self) -> &'static str

Strategy name for diagnostics (e.g. /sandbox command output).

pub fn is_active(&self) -> bool

Whether sandboxing is active (config enabled and a real strategy is selected).

pub fn policy(&self) -> &SandboxPolicy

Access the resolved policy for diagnostics.

pub fn allow_bypass(&self) -> bool

Whether a tool call may request per-call bypass (e.g. the Bash tool’s dangerouslyDisableSandbox parameter).

Returns false when security.disable_bypass_permissions = true.

pub fn wrap(&self, cmd: Command) -> Command

Wrap cmd with the active strategy, reapplying piped stdio.

If the executor is disabled or the strategy is a no-op, returns cmd unchanged. Callers should use this before .spawn().

pub fn disabled() -> Self

A “disabled” executor for tests and default construction.