Struct SandboxConfig 

pub struct SandboxConfig {
    pub allowed_paths: Vec<PathBuf>,
    pub sudo_override: bool,
}

Filesystem sandbox configuration for built-in tools.

Controls which paths a tool is allowed to access. When allowed_paths is non-empty, only files under those directories are permitted. An empty allowed_paths means permissive mode (dev default).

Part of the multi-layer sandboxing stack (k3:D12): governance gate -> environment config -> sudo override.

Fields

allowed_paths: Vec<PathBuf>

Directories the tool is allowed to access. Empty = permissive (all paths allowed).

sudo_override: bool

Whether sudo override is active for this execution. When true and path is denied by environment config, access is granted anyway (but logged to chain). Governance denials can never be overridden.

Implementations

impl SandboxConfig

pub fn is_path_allowed(&self, path: &Path) -> bool

Check whether a path is allowed by this sandbox config.

Returns true if allowed_paths is empty (permissive mode) or the path is under at least one allowed directory.

pub fn check_path_multilayer(&self, path: &Path) -> SandboxDecision

Multi-layer sandbox check (k3:D12).

Evaluates the environment layer and optional sudo override. The governance layer is evaluated separately by the caller (via GovernanceEngine::evaluate) because it requires the full GovernanceRequest context.

Evaluation order:

1. Environment config (allowed_paths) – if empty, permit.
2. If denied and sudo_override is true, permit with SandboxLayer::SudoOverride (caller must log to chain).
3. Otherwise deny with SandboxLayer::Environment.

Trait Implementations

impl Clone for SandboxConfig

fn clone(&self) -> SandboxConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SandboxConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SandboxConfig

fn default() -> SandboxConfig

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for SandboxConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for SandboxConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.