Module sandbox 

The OS sandbox for commands speccoder starts.

Checks, the model’s run_command, the formatter, acceptance tests and MCP servers run code the model may have written. The policy decides which commands run; the sandbox confines what they do:

• writes only to the workspace, a private temporary directory and the package caches builds need (never the rest of the state directory — approvals live there — and never ~/.cargo/bin);
• credentials unreadable (~/.ssh, ~/.aws, ~/.cargo/credentials*, …);
• no network beyond loopback, unless the command is allowed it (exactly, [sandbox] network_allow, or by a prefix in [sandbox] network_allow_prefix) or a person approved it.

macOS: Seatbelt (sandbox-exec) with a generated profile. Linux: the speccoder binary re-executes itself as a helper (__sandbox) that applies Landlock and a seccomp filter to itself, sets no_new_privs and executes the command — so the workspace keeps unsafe_code forbidden.

Structs

Config

[sandbox] in speccoder.toml.

Profile

One command’s confinement.

Sandboxed

A runner that confines every command.

Enums

Backend

How this machine sandboxes.

Mode

Whether to sandbox.

Network

What a sandboxed command may reach on the network.

Runner

A sandboxed or a plain runner.

Constants

CACHES

Package caches builds write to, relative to the home directory. Not ~/.cargo as a whole: ~/.cargo/bin would let a test replace cargo.

HELPER_ARG

The helper subcommand (speccoder __sandbox <profile> -- argv…).

HIDDEN

Credentials a command never reads, relative to the home directory.

Functions

backend

The sandbox this machine offers, or why there is none.

helper_main

The helper’s entry (speccoder __sandbox <profile> -- argv…): confines this process and executes the command; returns only on failure.

parse

Reads [sandbox].

resolve_executable

The executable program runs as in cwd with env: a program with a / against cwd, else the first file of that name on PATH (relative PATH entries against cwd too) — canonicalised; None when there is none. A file without an execute bit is skipped, as execvp skips it: the executable named is the one that runs. What a command’s approval names, and what it is checked against again when it runs.

runner

The runner for commands working in root: sandboxed when configured and possible; otherwise the plain runner and a notice (or, with required, an error).

runner_at

runner with [sandbox] read from the speccoder.toml that governs root.

seatbelt

The Seatbelt profile for p. Later rules win.

with_helper

The Linux backend with the helper binary at helper, if the kernel supports Landlock.

wrap

argv confined by p on backend.