Interface: SandboxPolicy
Defined in: src/batteries/sandbox/types.ts:50
Assembly-facing policy. Reads allow by default; writes and network deny by default.
Properties
| Property | Modifier | Type | Description | Defined in |
|---|---|---|---|---|
filesystem | readonly | { allowGitConfig?: boolean; allowRead?: readonly string[]; allowWrite?: readonly string[]; denyRead?: readonly string[]; denyWrite?: readonly string[]; disabled?: boolean; gitSafeDirectories?: readonly string[]; mandatoryDenySearchDepth?: number; } | Filesystem rules; disabled is a kill switch and deliberately does not unify axis defaults. | src/batteries/sandbox/types.ts:52 |
filesystem.allowGitConfig? | readonly | boolean | Whether .git/config is included in the mandatory deny set. | src/batteries/sandbox/types.ts:58 |
filesystem.allowRead? | readonly | readonly string[] | Read rules use deny-then-allow precedence. | src/batteries/sandbox/types.ts:54 |
filesystem.allowWrite? | readonly | readonly string[] | Write rules use allow-only semantics; deny wins inside the allow list. | src/batteries/sandbox/types.ts:56 |
filesystem.denyRead? | readonly | readonly string[] | - | src/batteries/sandbox/types.ts:55 |
filesystem.denyWrite? | readonly | readonly string[] | - | src/batteries/sandbox/types.ts:57 |
filesystem.disabled? | readonly | boolean | When true, no filesystem rules apply. | src/batteries/sandbox/types.ts:53 |
filesystem.gitSafeDirectories? | readonly | readonly string[] | Git safe directories passed to spawned children. | src/batteries/sandbox/types.ts:59 |
filesystem.mandatoryDenySearchDepth? | readonly | number | Linux mandatory-deny scan depth. | src/batteries/sandbox/types.ts:60 |
network | readonly | { allowedDomains?: readonly string[]; deniedDomainReasons?: Readonly<Record<string, string>>; deniedDomains?: readonly string[]; disabled?: boolean; } | Network rules. An absent allow list means deny all unless disabled. | src/batteries/sandbox/types.ts:63 |
network.allowedDomains? | readonly | readonly string[] | - | src/batteries/sandbox/types.ts:65 |
network.deniedDomainReasons? | readonly | Readonly<Record<string, string>> | Model-readable reasons for denied domains. | src/batteries/sandbox/types.ts:67 |
network.deniedDomains? | readonly | readonly string[] | - | src/batteries/sandbox/types.ts:66 |
network.disabled? | readonly | boolean | - | src/batteries/sandbox/types.ts:64 |