Struct SandboxConfig 

pub struct SandboxConfig {
    pub allowed_dirs: Vec<PathBuf>,
    pub deny_globs: Vec<String>,
}

Application-layer filesystem sandbox configuration.

When present, a CorePathPolicy is built from allowed_dirs and deny_globs and applied to all filesystem builtins (read, write, edit, patch). On Linux with the sandbox feature, bash also gets a wrapped SandboxPolicy for Landlock kernel enforcement.

Fields

allowed_dirs: Vec<PathBuf>

Directories the agent is allowed to access. When empty, the policy denies all directory-level access (files may still pass glob checks).

deny_globs: Vec<String>

Glob patterns for paths to deny regardless of allowed_dirs. Example: ["**/.env", "**/secrets/**"].

Trait Implementations

impl Clone for SandboxConfig

fn clone(&self) -> SandboxConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SandboxConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SandboxConfig

fn default() -> SandboxConfig

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for SandboxConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.