Module sandbox 

Optional OS sandboxing for model-driven shell commands.

Two independent confinement dimensions, one platform-neutral facade:

• A network kill-switch (--no-network / safety.network = "deny"). Linux: a seccomp-BPF filter — creating an internet socket (AF_INET / AF_INET6) dies with SIGSYS, while AF_UNIX and other local socket domains keep working so nscd / D-Bus / X11 are unaffected. SIGSYS is a distinctive, catchable signal, which the exec tool maps to a clear “blocked by the network sandbox” outcome. macOS: a Seatbelt (deny network*) sparing AF_UNIX, denied at use time with EPERM (no signal — detection is a hedged text signature).
• A filesystem write-confinement (--confine-fs / safety.filesystem = "project"). Write-class access (create / write / truncate / remove / rename) is allowed only beneath an explicit set of directories; everything else fails with a permission error. Reads and execution stay unrestricted. Linux: Landlock, best-effort by design — a kernel without it (pre-5.13) degrades to a warned no-op rather than refusing to run. macOS: Seatbelt deny file-write* outside the roots.

Everything funnels through enforce, called from the mermaid __sandbox-exec launcher — ordinary, single-threaded code — just before it runs the real command. On Linux the restrictions are applied to the launcher itself (Enforcement::SelfApplied) and survive execve and fork; on macOS the argv is rewritten to run under /usr/bin/sandbox-exec (Enforcement::ExecArgv), whose profile is likewise inherited by everything the command spawns. Platforms without a backend return Err when confinement was requested, so the launcher fails closed (exit 126) instead of ever running the command unconfined.

Structs

SandboxPolicy

What the caller asked the OS to confine. Both dimensions are independent; an all-off policy enforces nothing (and enforce is a no-op for it on every platform).

Enums

Enforcement

How the platform enforced a SandboxPolicy — the contract between enforce and the __sandbox-exec launcher.

Functions

enforce

Enforce policy for the command argv. Called from single-threaded launcher code. Any Err means the requested confinement could not be applied — the caller MUST fail closed (exit 126), never run unconfined.

fs_confinement_available

Whether filesystem write-confinement is really available on this platform: Linux when the Landlock ruleset assembles, macOS when /usr/bin/sandbox-exec exists, false everywhere else. Like network_killswitch_available: a safe probe that restricts nothing. (On Linux enforcement remains best-effort at apply time — a pre-Landlock kernel builds the ruleset but cannot enforce it.)

network_killswitch_available

Whether the network kill-switch is really available on this platform: Linux when the seccomp filter assembles (supported arch), macOS when /usr/bin/sandbox-exec exists, false everywhere else (Windows AppContainer is a follow-up). Used by mermaid self-test and the exec tool as a safe, fork-free probe — it installs nothing.