pub fn permissions_network_policy(
cap: &CapabilityConfig,
) -> Option<NetworkPolicy>Expand description
P5-1 (design §2 module 12 carry-forward, §3.1
capabilities.permissions.sandbox.network.*): give the
crate::tools::NetworkPolicy enforcement point (ToolContext::check_network,
wired since P4c) its real config source. Reads the network sub-table of
capabilities.permissions.sandbox — note this is nested under
permissions, not a separate permissions.sandbox capability entry (see
module_enabled’s doc comment on the dotted-name convention: nested
modules 11-13 all live in permissions’s own settings, never as
separate BTreeMap keys). None when capabilities.permissions.sandbox
(the TABLE form; the bare-string tier shorthand has no network to read)
is absent entirely — byte-identical to today’s no-policy-configured gap.
Present-but-network-absent still yields Some(NetworkPolicy::default())
(enabled: false), which is a harmless no-op — see NetworkPolicy’s own
doc comment (crate::tools) on enabled: false behaving exactly like
None on the context.