landstrip 0.18.0

Sandbox for coding agents with parametrized state
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117

// SPDX-License-Identifier: LGPL-2.1-or-later
// Copyright (c) 2026 Jarkko Sakkinen

//! OS-specific sandbox implementations that enforce a lowered engine policy.
//!
//! Each target selects its implementation and re-exports its [`execute`] entry
//! point, so callers depend on `crate::platform::execute` without naming an OS.

#[cfg(not(any(target_os = "linux", target_os = "macos", target_os = "windows")))]
mod fallback;
#[cfg(target_os = "linux")]
mod linux;
#[cfg(target_os = "macos")]
mod macos;
#[cfg(target_os = "windows")]
mod windows;

use crate::outcome::DoctorReport;
#[cfg(any(target_os = "linux", target_os = "macos"))]
use crate::outcome::SandboxImplementation;
#[cfg(target_os = "windows")]
use crate::outcome::WindowsStatusReport;

#[cfg(not(any(target_os = "linux", target_os = "macos", target_os = "windows")))]
pub(crate) use fallback::execute;
#[cfg(target_os = "linux")]
pub(crate) use linux::execute;
#[cfg(target_os = "macos")]
pub(crate) use macos::execute;
#[cfg(target_os = "windows")]
pub(crate) use windows::execute;

#[cfg(target_os = "linux")]
pub(crate) use linux::fd;

#[cfg(target_os = "linux")]
#[allow(clippy::unnecessary_wraps, reason = "uniform platform validation API")]
pub(crate) fn validate(_policy: &crate::engine::policy::AccessPolicy) -> anyhow::Result<()> {
    Ok(())
}

#[cfg(target_os = "macos")]
pub(crate) fn validate(policy: &crate::engine::policy::AccessPolicy) -> anyhow::Result<()> {
    policy.validate()?;
    Ok(())
}

#[cfg(target_os = "windows")]
pub(crate) fn validate(policy: &crate::engine::policy::AccessPolicy) -> anyhow::Result<()> {
    windows::validate(policy)
}

#[cfg(not(any(target_os = "linux", target_os = "macos", target_os = "windows")))]
pub(crate) fn validate(_policy: &crate::engine::policy::AccessPolicy) -> anyhow::Result<()> {
    Err(crate::engine::error::Error::PlatformUnsupported.into())
}

#[cfg(target_os = "windows")]
pub(crate) fn manage_windows(
    command: &crate::cli::WindowsCommand,
) -> anyhow::Result<WindowsStatusReport> {
    windows::manage(command)
}

#[cfg(target_os = "windows")]
pub(crate) fn run_worker(request: &std::path::Path) -> anyhow::Result<i32> {
    windows::run_worker(request)
}

#[cfg(target_os = "linux")]
#[allow(clippy::unnecessary_wraps, reason = "uniform platform doctor API")]
pub(crate) fn doctor() -> anyhow::Result<DoctorReport> {
    Ok(doctor_report(
        SandboxImplementation::LandlockSeccomp,
        linux::doctor(),
    ))
}

#[cfg(target_os = "macos")]
#[allow(clippy::unnecessary_wraps, reason = "uniform platform doctor API")]
pub(crate) fn doctor() -> anyhow::Result<DoctorReport> {
    Ok(doctor_report(
        SandboxImplementation::Seatbelt,
        macos::doctor(),
    ))
}

#[cfg(target_os = "windows")]
pub(crate) fn doctor() -> anyhow::Result<DoctorReport> {
    let status = windows::status()?;
    let error = (!status.healthy).then(|| "restricted-user installation is unhealthy".to_owned());
    Ok(DoctorReport {
        ok: status.healthy,
        platform: std::env::consts::OS,
        implementation: status.active,
        error,
    })
}

#[cfg(not(any(target_os = "linux", target_os = "macos", target_os = "windows")))]
pub(crate) fn doctor() -> anyhow::Result<DoctorReport> {
    Err(crate::engine::error::Error::PlatformUnsupported.into())
}

#[cfg(any(target_os = "linux", target_os = "macos"))]
fn doctor_report(
    implementation: SandboxImplementation,
    result: anyhow::Result<()>,
) -> DoctorReport {
    let error = result.err().map(|error| format!("{error:#}"));
    DoctorReport {
        ok: error.is_none(),
        platform: std::env::consts::OS,
        implementation,
        error,
    }
}