final case class WorkspaceSandboxConfig(limits: WorkspaceLimits, excludePatterns: List[String], shellAllowed: Boolean, defaultCommandTimeout: FiniteDuration, readOnlyPaths: List[String], allowedPaths: List[String], networkAllowed: Boolean, allowedCommands: Set[String])
Explicit sandbox configuration for workspace operations.
Describes allowed/blocked paths, resource limits, shell access, and timeouts. When provided, this config is validated at startup and enforced by the runner.
'''Phase 1:''' Config structure, validation, and documentation. '''Phase 2:''' Enforcement in runner and tools. '''Phase 3:''' Advanced policies (profiles, allowlists).
This config with more programs on its allowlist, as the runner's WORKSPACE_EXTRA_COMMANDS adds them.
This config with more programs on its allowlist, as the runner's WORKSPACE_EXTRA_COMMANDS adds them.
Each name must be a bare program name (letters, digits, ., _, +, -), not a Windows batch file (.bat, .cmd, which Windows runs through cmd.exe) and not one of WorkspaceSandboxConfig.NeverAllowedCommands, in any case, with or without a .exe / .com extension and with or without a version (BASH.EXE is bash, python3.12 is python).
'''An added program is trusted code execution.''' It is held to the same checks as the built-in ones (no shell, forbidden characters, path arguments inside the workspace, the environment allowlist), but it has no per-program option rules (bar those that stop tar, zip, rsync, scp and sftp running a program, #1805), so it can do whatever its own arguments let it - and a build tool such as sbt runs the code in the workspace by design. The denylist only stops the obvious ways to run anything (shells, interpreters, launchers, loaders); it is not a boundary. Add only what the agent needs.
A config that does not run commands at all (shellAllowed = false, the locked profile) refuses any name, rather than report programs added that can never run (#1761).