Struct SandboxDecisionDataPolicyResolved 

pub struct SandboxDecisionDataPolicyResolved {

    pub add_current_working_directory: bool,
    pub allow_bypass: bool,
    pub allow_local_network: bool,
    pub allow_outbound: bool,
    pub backend: SandboxBackend,
    pub control: SandboxControl,
    pub degradation_reason: Option<SandboxDegradationReason>,
    pub denied_paths_count: i64,
    pub effective_filesystem_policy: Option<SandboxFilesystemPolicyDetails>,
    pub enforcement_point: SandboxEnforcementPoint,
    pub gh_auth: bool,
    pub git_auth: bool,
    pub keychain_access: bool,
    pub kind: SandboxDecisionDataPolicyResolvedKind,
    pub outcome: SandboxOutcome,
    pub platform: SandboxPlatform,
    pub policy_source: SandboxPolicySource,
    pub proxy_mode: SandboxProxyMode,
    pub readonly_paths_count: i64,
    pub readwrite_paths_count: i64,
    pub tool_call_id: Option<String>,
}

Fields

add_current_working_directory: bool

Whether the current working directory was granted automatically

allow_bypass: bool

Whether callers may opt an individual command out of the sandbox

allow_local_network: bool

Whether the sandboxed process may reach loopback and private-range addresses

allow_outbound: bool

Whether the sandboxed process may open outbound network connections

backend: SandboxBackend

Process-containment implementation backing the sandbox

control: SandboxControl

Enforcement mechanism this decision describes

degradation_reason: Option<SandboxDegradationReason>

Why enforcement is weaker than configured, when it is

denied_paths_count: i64

Number of denied path rules in the effective policy

effective_filesystem_policy: Option<SandboxFilesystemPolicyDetails>

Effective filesystem rules. Populated only when content capture is enabled; the counts above are always present.

enforcement_point: SandboxEnforcementPoint

Runtime subsystem that applied the policy

gh_auth: bool

Whether the sandbox policy permits GitHub CLI credentials inside the sandbox. A policy capability, not proof that a credential was injected into this spawn: injection is per-command

git_auth: bool

Whether the sandbox policy permits git credentials inside the sandbox. A policy capability, not proof that a credential was injected into this spawn: injection is per-command

keychain_access: bool

Whether the macOS keychain was reachable from inside the sandbox. Always false on other platforms.

kind: SandboxDecisionDataPolicyResolvedKind

Sandbox decision variant discriminator.

outcome: SandboxOutcome

Whether the resolved policy is fully active or degraded

platform: SandboxPlatform

Host platform the sandbox is running on

policy_source: SandboxPolicySource

Whether the policy came from built-in defaults or user configuration

proxy_mode: SandboxProxyMode

Whether outbound traffic is unproxied, routed through a loopback proxy, or routed through an external proxy

readonly_paths_count: i64

Number of read-only path rules in the effective policy

readwrite_paths_count: i64

Number of read-write path rules in the effective policy

tool_call_id: Option<String>

Internal tool-call ID, used only to correlate the decision with its owning span. Omitted when the decision is not attributable to a tool call.

Trait Implementations

impl Clone for SandboxDecisionDataPolicyResolved

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SandboxDecisionDataPolicyResolved

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SandboxDecisionDataPolicyResolved

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for SandboxDecisionDataPolicyResolved

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for SandboxDecisionDataPolicyResolved

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.