Struct SandboxPolicy 

pub struct SandboxPolicy {
    pub read_paths: Vec<PathPermission>,
    pub write_paths: Vec<PathPermission>,
    pub exec_paths: Vec<PathPermission>,
    pub network: NetworkPolicy,
    pub timeout: Option<Duration>,
    pub allow_spawn: bool,
    pub env_passthrough: Vec<String>,
    pub flags: PolicyFlags,
}

Sandbox policy configuration

Fields

read_paths: Vec<PathPermission>

Paths with read access

write_paths: Vec<PathPermission>

Paths with write access

exec_paths: Vec<PathPermission>

Paths with execute access

network: NetworkPolicy

Network access policy

timeout: Option<Duration>

Execution timeout

allow_spawn: bool

Allow process spawning

env_passthrough: Vec<String>

Environment variables to pass through

flags: PolicyFlags

Additional policy flags

Implementations

impl SandboxPolicy

pub fn new() -> Self

Create a new empty policy

pub fn default_for_tools(cwd: PathBuf) -> Self

Create a restrictive default policy for agent tools

pub fn allow_read(self, path: impl Into<PathBuf>) -> Self

Allow reading a path

pub fn allow_write(self, path: impl Into<PathBuf>) -> Self

Allow writing a path

pub fn allow_exec(self, path: impl Into<PathBuf>) -> Self

Allow executing from a path

pub fn with_network(self, policy: NetworkPolicy) -> Self

Set network policy

pub fn deny_network(self) -> Self

Deny all network access

pub fn allow_localhost(self) -> Self

Allow localhost network access

pub fn allow_full_network(self) -> Self

Allow full network access

pub fn with_timeout(self, timeout: Duration) -> Self

Set execution timeout

pub fn allow_spawn(self, allow: bool) -> Self

Allow process spawning

pub fn pass_env(self, var: impl Into<String>) -> Self

Pass through environment variable

Trait Implementations

impl Clone for SandboxPolicy

fn clone(&self) -> SandboxPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SandboxPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SandboxPolicy

fn default() -> SandboxPolicy

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for SandboxPolicy

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for SandboxPolicy

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.