Skip to main content

Module sandbox_exec

wm_dispatch

Module sandbox_exec 

Source
Expand description

Scoped-thread sandbox executor — the Landlock v1 per-tool pathway.

P-SANDBOX-3 (2026-09-10, Glama execution-sandboxing thread): tools that declare wm_core::Sandbox::StoreScoped run on a fresh OS thread that applies a thread-local confinement before the tool body executes. Landlock restriction is irreversible and thread-local, so a fresh thread per dispatch is the safe unit: the confined thread exits after the call and the async workers never inherit a restriction.

Why scoped threads instead of spawn_blocking: block-pool workers are reused, and a thread-local Landlock restriction applied there would taint every future task the pool hands that thread. Why not a confined tokio runtime: Tool::call borrows &mut Context, so the future is not 'static and cannot be moved into a long-lived worker. A scoped thread creates the future on the confined thread, so the borrow stays valid and the future never crosses a thread boundary.

Degradation doctrine (matches Landlock v0 / profile-contract): a failed or unsupported confinement is loud, never fatal — the tool runs unconfined, a WARN names the reason, and stats().degraded counts it. The closure supplied by the caller (wm-mcp injects the Landlock ruleset) is the only confinement mechanism here; this crate stays free of the landlock dependency, preserving the dependency direction.

v1 scope limits, documented rather than hidden:

  • WM_DISPATCH_TIMEOUT_MS is enforced inside the confined thread: the tool future is dropped on timeout (the same semantics as the normal dispatch path). with_timeout overrides the env-derived value.
  • The per-dispatch cost is one OS thread + one current-thread runtime (measured in the acceptance tests; parked-thread pooling is v1.1).
  • Subprocess-creating tools take a different seam: they declare wm_core::Sandbox::Subprocess and build spawns through the SpawnPolicy injected on the context (B2, crate::subprocess_sandbox), because thread-local Landlock cannot confine a child process.

Structs§

ScopedSandboxExecutor
Runs Sandbox::StoreScoped tools on a confined scoped thread.

Constants§

V1_FLAG_ENV
Environment knob: WM_LANDLOCK_V1=1 enables the per-tool pathway.

Functions§

v1_requested
Whether the per-tool pathway was requested. Strict == "1" parse.

Type Aliases§

RestrictFn
Confinement callback: Ok(()) = the current thread is restricted; Err(reason) = confinement unavailable (loud-degrade, run unconfined).