| j%SrSSKJr SSKrSSKrSSKrSSKJr SrSr SSjr SSjr Sq S \ S 'SS jrSS jrSS jrSSjrSSSjjrSSjrg)uOptional OS-level sandbox for shell command execution (roadmap P0-L3). Defense-in-depth layered on top of the permission engine and the dangerous-command blocklist. When enabled *and* a sandbox backend is present, ``run_command`` executes commands inside an OS sandbox that confines filesystem writes to the current workspace. Design constraints (see the roadmap): * **Opt-in** — disabled by default (``sandbox = false`` in config). Local users already get the permission prompts + blocklist; the sandbox is an extra layer for ``auto_approve`` / untrusted-skill scenarios. * **Graceful degradation** — if no backend is detected the command runs normally under the existing permission layer. The sandbox never blocks startup and never raises out of ``run_command``. * **Best-effort boundary** — this raises the cost of a destructive or runaway command; it is *not* a hardened security boundary. Treat it as confinement, not isolation. Backends: * macOS: Seatbelt via ``sandbox-exec`` (built into macOS). The profile keeps the default-allow policy but denies filesystem writes outside the workspace and temp areas, so process execution, reads, and networking are unaffected and normal dev commands keep working. * Linux: bubblewrap (``bwrap``) when installed. bwrap confines by remapping the filesystem, so it is more restrictive; commands that write outside the workspace/temp will fail. ) annotationsN)Optionalseatbeltbwrapc[RS:Xa#[R"S5(a[$S$[RR S5(a#[R"S5(a[ $S$g)uReturn the available sandbox backend name, or ``None``. macOS prefers ``sandbox-exec`` (Seatbelt); Linux prefers ``bwrap``. Windows has no supported backend. Detection only checks for the tool's presence on PATH — it never starts a sandbox. darwin sandbox-execNlinuxr)sysplatformshutilwhichSEATBELT startswithBWRAPڤC:\Users\johnn\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.13_qbz5n2kfra8p0\LocalCache\local-packages\Python313\site-packages\dashscope/acli/sandbox.pydetect_backendr,sZ ||x!<<77xATA ||w'' W--u747 rc[5SL$)z8True when a sandbox backend is detected on this machine.N)rrrr availabler:s  4 ''rOptional[bool]_enabled_overridecUqg)zCOverride sandbox enablement; pass ``None`` to use the config value.N)r)values r set_enabledrDs rc[b[[5$SSKJn [UR 5R 5$![ a gf=f)zWhether sandboxing is enabled (config-driven, overridable). Reads ``sandbox`` from the loaded config on each call so config changes take effect; degrades to ``False`` on any error so the sandbox can never break command execution. rConfigF)rbooldashscope.acli.configrloadsandbox Exceptionrs r is_enabledr%JsG$%&&0FKKM))** s(A A Ac `URSS5nSRSSSSUS3S S S S /5$) a6Build a macOS Seatbelt profile confining writes to the workspace. The base policy stays default-allow; only filesystem writes are denied, then re-allowed for the workspace and standard temp/cache locations. Reads, process execution, and networking are untouched so ordinary development commands keep working. "z\" z (version 1)z(allow default)z(deny file-write*)z(allow file-write* (subpath "z"))z,(allow file-write* (subpath "/private/tmp"))z$(allow file-write* (subpath "/tmp"))z4(allow file-write* (subpath "/private/var/folders"))z)(allow file-write* (literal "/dev/null")))replacejoin)cwdsafe_cwds rseatbelt_profiler-[sK{{3&H 99   +H:S 9 : 2 B 7   rc*SSSSSUUSSSSS S S US S U/$)uBuild a ``bwrap`` argv that runs *command* with a read-only root. The whole filesystem is bound read-only, then the workspace and a fresh ``/tmp`` are made writable. Commands that need to write elsewhere (e.g. package caches) will fail — this is the intended confinement. rz --ro-bind/z--bindz--tmpfs/tmpz--procz/procz--devz/devz--chdir/bin/sh-cr)commandr+s r bwrap_argvr4rsD       % rcU=(d [5nU[:XaSS[U5SSU/$U[:Xa [ X5$g)uReturn an argv to run *command* inside the sandbox, or ``None``. ``None`` means "no sandbox available — run the command normally". ``backend`` may be passed explicitly (mainly for tests); otherwise it is detected. r z-pr1r2N)rrr-rr4)r3r+backends r build_argvr7sR))G(   S !      %''' rc[RRU5nUSS4H1nX#:Xd)UR U[R -5(dM1 g g![[4a gf=f)zTrue when *path* is inside the writable workspace or temp areas. Informational helper (e.g. for messages); not a security check. Fr0z /private/tmpT)ospathabspathOSError ValueErrorrsep)r:r+abs_pathbases ris_sandboxed_pathrAsk 77??4(fn-  x224"&&=AA.  Z sAA/.A/)return Optional[str])rBr )rrrBNone)r+strrBrE)r3rEr+rErBz list[str])N)r3rEr+rEr6rCrBzOptional[list[str]])r:rEr+rErBr )__doc__ __future__rr9r r typingrrrrrr__annotations__rr%r-r4r7rArrrrJs<#   (%)>( ".@"   4 r