Module sandbox 

Per-agent sandbox policy definitions.

The SandboxPolicy struct defines the runtime security restrictions for an agent or plugin. It maps from per-agent config (~/.clawft/agents/<id>/config.toml) to enforceable sandbox rules.

The SandboxType enum determines which isolation mechanism is used:

• Wasm – WASM sandbox (cross-platform, default for WASM plugins)
• OsSandbox – seccomp + landlock on Linux (default for native on Linux)
• Combined – both WASM + OS sandbox layers

Secure by default: The default sandbox type is NOT None. WASM plugins get Wasm, native execution on Linux gets OsSandbox.

Structs

EnvPolicy

Environment variable access policy.

FilesystemPolicy

Filesystem access policy for a sandboxed agent.

NetworkPolicy

Network access policy for a sandboxed agent.

ProcessPolicy

Process execution policy for a sandboxed agent.

SandboxAuditEntry

Audit log entry for a sandbox decision.

SandboxPolicy

Per-agent sandbox policy.

Enums

SandboxType

Sandbox isolation mechanism.