Struct SandboxInputs 

pub struct SandboxInputs {
    pub enforce: SandboxEnforce,
    pub session_cwd: PathBuf,
    pub mission_dir: PathBuf,
    pub tmpdir: PathBuf,
    pub extra_write: Vec<PathBuf>,
    pub egress: Vec<String>,
    pub validator_read_deny_roots: Vec<PathBuf>,
}

Inputs used to build a session sandbox.

Fields

enforce: SandboxEnforce

session_cwd: PathBuf

mission_dir: PathBuf

tmpdir: PathBuf

The session-PRIVATE scratch root — the only TMPDIR-side path the session may write (the cleared child env points HOME/TMPDIR under it; see crate::agent_env). NOT the shared system temp root: allowing all of TMPDIR made every sibling mission’s worktree and merge scratch worker-writable (P1, ticket sandbox-writable-scope). build_inputs defaults it to the mission’s gitignored probe scratch; the runner overrides it per session with crate::backend_claude::scratch_home_root(session_id).

extra_write: Vec<PathBuf>

egress: Vec<String>

validator_read_deny_roots: Vec<PathBuf>

Mandatory validator containment (ticket validator-mandatory-containment): the REAL checkout roots a VALIDATOR session must not read — the checkout the snapshot was taken from, plus the primary checkout when worktree mode separates them. Empty for every non-validator session (workers, orchestrator turns) and for engine-run gates: those legitimately work in the real tree, and an empty set keeps the generated profile/argv byte-identical to the pre-containment shape. The validator’s own snapshot worktree is never in this set — it lives under the mission dir, which the read-deny carve-outs (<root>/.git, <root>/.kranz) deliberately keep reachable; see [validator_read_deny_entries].

Trait Implementations

impl Clone for SandboxInputs

fn clone(&self) -> SandboxInputs

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SandboxInputs

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.