feat: Experimental Sandbox Support (#101)

* feat: Sandbox implementation with seatbelt * refactor: Remove concept of PM_CACHE * fix: Misc fixes * refactor: Sandbox for separation of boundaries * fix: Apply API * fix: Add support for sandbox cleanup * test: Add variable interpolation test * fix: Misc cleanup fixes * chore: Cleanup sandbox registry * chore: Cleanup sandbox policy * chore: Cleanup sandbox * fix: Misc cleanup fixes * fix: Remove violation mode * fix: Update config template * chore: Go mod cleanup * fix: Handle the case when package manager policy is explicitly disabled * fix: Sandbox executor * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com> * test: Remove unused var * test: Add test for seatbelt sandbox driver * fix: Sandbox profile loader from file should use path for caching * test: Add policy test * feat: Add support for config templates * fix: Seatbelt translator handle glob * fix: Merge conflicts * fix: Fix sandbox policy generator for MacOS min permissions * fix: Sandbox path handling bugs * fix: Deny read to dangerous directories * fix: Deny read to dangerous directories * add sandbox e2e (#112) * fix: Sandbox E2E test * fix: Code review fixes * fix: Code review fixes * doc: Add sandbox debugging guide * doc: Update sandbox doc * docs: Add sandbox usage doc * fix: Use better error for sandbox without policy * fix: Add sandbox for npx * fix: Enable PTY for npm --------- Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Sahil Bansal <bansalsahil315@gmail.com>
2026-08-03 07:24:09 +02:00 · 2026-01-13 14:52:02 +05:30
parent c0122898ca
commit 9693428171
35 changed files with 3826 additions and 29 deletions
@@ -0,0 +1,85 @@
+package sandbox
+
+import (
+	"fmt"
+	"strings"
+)
+
+// SandboxPolicy represents a parsed and validated sandbox policy that defines
+// filesystem, network, and process execution restrictions for package managers.
+// Policy violations will block execution.
+type SandboxPolicy struct {
+	Name            string           `yaml:"name" json:"name"`
+	Description     string           `yaml:"description" json:"description"`
+	PackageManagers []string         `yaml:"package_managers" json:"package_managers"`
+	Filesystem      FilesystemPolicy `yaml:"filesystem" json:"filesystem"`
+	Network         NetworkPolicy    `yaml:"network" json:"network"`
+	Process         ProcessPolicy    `yaml:"process" json:"process"`
+
+	// AllowGitConfig allows write access to .git/config file.
+	AllowGitConfig bool `yaml:"allow_git_config" json:"allow_git_config"`
+	// AllowPTY allows pseudo-terminal (PTY) operations.
+	AllowPTY bool `yaml:"allow_pty" json:"allow_pty"`
+}
+
+// FilesystemPolicy defines allowed and denied filesystem access patterns.
+// Deny rules have higher priority than allow rules.
+type FilesystemPolicy struct {
+	AllowRead  []string `yaml:"allow_read" json:"allow_read"`
+	AllowWrite []string `yaml:"allow_write" json:"allow_write"`
+	DenyRead   []string `yaml:"deny_read" json:"deny_read"`
+	DenyWrite  []string `yaml:"deny_write" json:"deny_write"`
+}
+
+// NetworkPolicy defines allowed and denied network access patterns.
+// Patterns are in the format "host:port" or "*:*" for wildcards.
+type NetworkPolicy struct {
+	AllowOutbound []string `yaml:"allow_outbound" json:"allow_outbound"`
+	DenyOutbound  []string `yaml:"deny_outbound" json:"deny_outbound"`
+}
+
+// ProcessPolicy defines allowed and denied process execution patterns.
+// Patterns can be specific paths or glob patterns.
+type ProcessPolicy struct {
+	AllowExec []string `yaml:"allow_exec" json:"allow_exec"`
+	DenyExec  []string `yaml:"deny_exec" json:"deny_exec"`
+}
+
+// Validate validates the sandbox policy for correctness.
+// Returns an error if the policy is invalid.
+func (p *SandboxPolicy) Validate() error {
+	if p.Name == "" {
+		return fmt.Errorf("policy name is required")
+	}
+
+	if len(p.PackageManagers) == 0 {
+		return fmt.Errorf("policy must specify at least one package manager")
+	}
+
+	hasRules := len(p.Filesystem.AllowRead) > 0 ||
+		len(p.Filesystem.AllowWrite) > 0 ||
+		len(p.Filesystem.DenyRead) > 0 ||
+		len(p.Filesystem.DenyWrite) > 0 ||
+		len(p.Network.AllowOutbound) > 0 ||
+		len(p.Network.DenyOutbound) > 0 ||
+		len(p.Process.AllowExec) > 0 ||
+		len(p.Process.DenyExec) > 0
+
+	if !hasRules {
+		return fmt.Errorf("policy must define at least one access rule")
+	}
+
+	return nil
+}
+
+// AppliesToPackageManager returns true if this policy applies to the given package manager.
+func (p *SandboxPolicy) AppliesToPackageManager(pm string) bool {
+	pmLower := strings.ToLower(pm)
+	for _, supported := range p.PackageManagers {
+		if strings.ToLower(supported) == pmLower {
+			return true
+		}
+	}
+
+	return false
+}