Struct SandboxConfig 

pub struct SandboxConfig {
    pub add_current_working_directory: Option<bool>,
    pub allow_bypass: Option<bool>,
    pub allow_dev_tool_access: Option<bool>,
    pub auth: Option<SandboxConfigAuth>,
    pub enabled: bool,
    pub sandbox_lsp_servers: Option<bool>,
    pub sandbox_mcp_servers: Option<bool>,
    pub user_policy: Option<SandboxConfigUserPolicy>,
    /* private fields */
}

Resolved sandbox configuration.

Experimental. This type is part of an experimental wire-protocol surface and may change or be removed in future SDK or CLI releases.

Fields

add_current_working_directory: Option<bool>

Whether to auto-add the current working directory to readwritePaths. Default: true.

allow_bypass: Option<bool>

Whether the agent may request that an individual command run outside the sandbox, which the host then approves or denies through the usual permission flow. A host capability flag rather than part of the policy: it is stripped from the effective spawn policy and only has an effect while enabled is true. Fail-closed, unlike the opt-out flags on this object: omitting it offers no bypass. Default: false (opt-in).

allow_dev_tool_access: Option<bool>

Whether to auto-grant read access to tool directories discovered on PATH and in toolchain environment variables (GOROOT, JAVA_HOME, VIRTUAL_ENV, and similar), and to common developer-tool caches, config, and toolchains. Writable grants cover scratch caches, the Unix GitHub CLI cache, and Cargo’s registry, git store, and lock/tracker files. A relocated CARGO_HOME gets the same narrow split: registry and git are read-write; bin is read-only; the home root, config.toml, and credentials.toml stay ungranted. Set to false to disable every grant listed above; user-installed toolchains and caches then need explicit userPolicy.filesystem readonlyPaths and readwritePaths entries. The working directory (see addCurrentWorkingDirectory), temporary storage, session log paths, and system locations follow their own rules and stay granted. Default: true (enabled by default; set to false to opt out).

auth: Option<SandboxConfigAuth>

Credential-injection capability flags.

enabled: bool

Whether sandboxing is enabled for the session.

sandbox_lsp_servers: Option<bool>

Whether language servers the session launches are confined by the sandbox. Only an explicit false opts out. Ignored while enabled is false. Default: true (enabled by default; set to false to opt out).

sandbox_mcp_servers: Option<bool>

Whether MCP servers the session launches are confined by the sandbox. Only an explicit false opts out; doing so also lets remote-MCP egress leave the sandbox, so the flag and enabled are always read together. Ignored while enabled is false. Default: true (enabled by default; set to false to opt out).

user_policy: Option<SandboxConfigUserPolicy>

User-managed sandbox policy fragment merged into the auto-discovered base policy.

Trait Implementations

impl Clone for SandboxConfig

fn clone(&self) -> SandboxConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SandboxConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SandboxConfig

fn default() -> SandboxConfig

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for SandboxConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for SandboxConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.