eval_magic/sandbox/
mod.rs

1//! Execution sandbox: write-guard install/teardown and write-boundary policy.
2//!
3//! The hook entry points are hidden subcommands on this binary (see [`guard`] and
4//! `cli`), so the installed PreToolUse hook invokes `eval-magic guard <marker>`
5//! or `eval-magic guard-codex <marker>` — no separate hook script to ship or
6//! locate.
7
8pub mod decide;
9pub mod guard;
10pub mod install;
11pub mod policy;
12
13pub(crate) use decide::marker_is_armed;
14pub use decide::{GuardDecision, GuardMarker, decide};
15pub use guard::{codex_guard_decision, guard_decision, read_marker};
16pub(crate) use install::guard_is_armed;
17pub use install::{GUARD_MANIFEST, GUARD_MARKER, install_guard, teardown_guard};
18pub use policy::{WRITE_TOOLS, classify_bash, is_under, is_under_any, is_write_tool, path_arg};
19
20use std::time::{SystemTime, UNIX_EPOCH};
21
22/// Current wall clock in epoch milliseconds. chrono ships without its `clock`
23/// feature (it parses timestamps but never reads the clock), so the time comes
24/// from `std::time`. Shared by the guard's expiry check and marker stamping.
25pub(crate) fn now_ms() -> i64 {
26    SystemTime::now()
27        .duration_since(UNIX_EPOCH)
28        .unwrap_or_default()
29        .as_millis() as i64
30}
eval_magic/sandbox/mod.rs

eval_magic/sandbox/
mod.rs
