Struct Sandbox 

pub struct Sandbox { /* private fields */ }

Approval-owning boundary around one execution backend.

Implementations

impl Sandbox

pub fn new(backend: Arc<dyn SandboxBackend>, policy: ApprovalPolicy) -> Self

Creates a sandbox with its initial approval policy.

pub fn isolated_execution(&self) -> Result<Self>

Creates a child execution boundary with independent temporary files and workers.

Errors

Returns an error if validation or an operation required by this function fails.

pub fn attached_folders(self, primary: PathBuf, attached: Vec<PathBuf>) -> Self

Adds the primary workspace and attached folder paths to the model prompt.

pub fn read<'a>( &'a self, path: &'a str, permissions: &'a ToolPermissions, ) -> BoxFuture<'a, Result<String>>

Reads a UTF-8 file.

pub fn read_bytes<'a>( &'a self, path: &'a str, max_bytes: usize, permissions: &'a ToolPermissions, ) -> BoxFuture<'a, Result<Vec<u8>>>

Reads one bounded binary file.

pub fn write<'a>( &'a self, path: &'a str, content: &'a str, permissions: &'a ToolPermissions, ) -> BoxFuture<'a, Result<()>>

Writes a UTF-8 file when this call has mutation authority.

pub fn execute<'a>( &'a self, command: &'a str, permissions: &'a ToolPermissions, ) -> BoxFuture<'a, Result<CommandOutput>>

Runs a command when this call has mutation authority.

pub async fn evaluate_worker( &self, command: &WorkerCommand, permissions: &ToolPermissions, request: &[u8], timeout: Duration, reset: bool, ) -> Result<Vec<u8>>

Evaluates one authorized request, preserving runtime state until explicit reset or loss.

Errors

Returns an error if validation or an operation required by this function fails.

pub async fn browser_page( &self, permissions: &ToolPermissions, ) -> Option<String>

The page a call’s chat may drive in a browser outside the sandbox, as a DevTools endpoint. That browser reaches the network from outside the sandbox, so only calls allowed network access are lent one.

pub fn has_background_commands(&self, session_id: &str) -> Result<bool>

Reports whether one session still owns a background command result.

Errors

Returns an error if validation or an operation required by this function fails.

Trait Implementations

impl Middleware for Sandbox

fn name(&self) -> &'static str

Stable ID used to reject duplicate registrations.

fn frontend(&self) -> FrontendContribution

Declares commands and status data that any frontend may render.

fn prompt_section( &self, _runtime: &RuntimeContext, ) -> Result<Option<PromptSection>>

Contributes one immutable system-prompt section while the agent is created.

fn render(&self, event: &EventMsg, _session_id: &str) -> Option<FrontendBlock>

Renders an event owned by this capability for the destination session.

fn session_start<'a>( &'a self, context: &'a mut SessionStartContext<'_>, ) -> BoxFuture<'a, Result<()>>

Starts or re-enters a session lifecycle.

fn session_end<'a>( &'a self, runtime: &'a RuntimeContext, ) -> BoxFuture<'a, Result<()>>

Releases session-local state when the agent runtime stops.

fn incompatible_middleware(&self) -> &'static [&'static str]

Middleware IDs that cannot share a stack with this configured capability.

fn register( &self, _catalog: &mut Catalog, _runtime: &RuntimeContext, ) -> Result<()>

Adds tools to the catalog while the agent is created.

fn command<'a>( &'a self, context: MiddlewareCommandContext<'a>, ) -> BoxFuture<'a, Result<MiddlewareCommandOutput>>

Handles a command declared by this middleware’s frontend contribution.

fn handles_messages(&self) -> bool

Reports whether this middleware is the session’s conversation-message preparer.

fn route_message( &self, _context: &mut MessageRouteContext<'_>, ) -> Result<SubmissionResult>

Validates and prepares one conversation message for its lifecycle boundary.

fn message_boundary_events(&self, _submission_id: &str) -> Vec<EventMsg>

Produces capability UI cleanup when one queued message reaches its boundary.

fn message_submit<'a>( &'a self, _context: &'a mut MessageSubmitContext<'_>, ) -> BoxFuture<'a, Result<()>>

Intercepts a prepared conversation message at its delivery boundary.

fn active_command<'a>( &'a self, _context: &'a mut ActiveCommandContext<'_>, ) -> BoxFuture<'a, Result<Option<SubmissionResult>>>

Handles a capability command while a turn is active.

fn pre_model<'a>( &'a self, _context: &'a mut ModelContext<'_>, ) -> BoxFuture<'a, Result<()>>

Mutates durable context before the next model request is assembled.

fn model_request<'a>( &'a self, _context: &'a mut ModelRequestContext<'_>, ) -> BoxFuture<'a, Result<()>>

Applies request-only context after every durable transform has completed.

fn tool_exposure<'a>( &'a self, _context: &'a mut ToolExposureContext<'_>, ) -> BoxFuture<'a, Result<()>>

Hides registered tools whose capability is unavailable at this boundary.

fn pre_tool_use<'a>( &'a self, _context: &'a mut PreToolUseContext<'_>, ) -> BoxFuture<'a, Result<()>>

Intercepts one normalized tool call before authorization and persistence.

fn permission_request<'a>( &'a self, _context: &'a mut PermissionRequestContext<'_>, ) -> BoxFuture<'a, Result<()>>

Decides whether an approval request should be deferred, allowed, or denied.

fn post_tool_use<'a>( &'a self, _context: &'a mut PostToolUseContext<'_>, ) -> BoxFuture<'a, Result<()>>

Transforms model-visible feedback after a tool has executed.

fn pre_compact<'a>( &'a self, _context: &'a mut CompactContext<'_>, ) -> BoxFuture<'a, Result<()>>

Intercepts context immediately before compaction and may stop the active turn.

fn prepare_compacted_input( &self, _original: &[Value], _compacted: &mut Vec<Value>, )

Repairs or discards capability-owned projections before compacted input is committed. The original input is read-only; changes are validated before the rewrite is saved.

fn post_compact<'a>( &'a self, _context: &'a mut CompactContext<'_>, ) -> BoxFuture<'a, Result<()>>

Intercepts the committed compacted context and may stop the active turn.

fn stop<'a>( &'a self, _context: &'a mut StopContext<'_>, ) -> BoxFuture<'a, Result<()>>

Decides whether a naturally stopped model should continue once more.

fn turn_end<'a>( &'a self, _context: &'a mut TurnEndContext<'_>, ) -> BoxFuture<'a, Result<()>>

Observes terminal bookkeeping for a completed or aborted turn.