core: remove SandboxPolicy from production core

2026-10-30 19:18:49 +00:00 · 2026-05-31 15:13:14 -07:00
parent e93dc98a48
commit 91c318e7bc
40 changed files with 674 additions and 439 deletions
@@ -544,6 +544,42 @@ impl PermissionProfile {
        }
    }

+    pub fn compatibility_sandbox_policy(
+        &self,
+        file_system_policy: &FileSystemSandboxPolicy,
+        network_policy: NetworkSandboxPolicy,
+        cwd: &Path,
+    ) -> SandboxPolicy {
+        self.to_legacy_sandbox_policy(cwd).unwrap_or_else(|_| {
+            let cwd_abs = AbsolutePathBuf::from_absolute_path(cwd).ok();
+            let writable_roots = file_system_policy
+                .get_writable_roots_with_cwd(cwd)
+                .into_iter()
+                .map(|root| root.root)
+                .filter(|root| cwd_abs.as_ref() != Some(root))
+                .collect();
+            let tmpdir_writable = std::env::var_os("TMPDIR")
+                .filter(|tmpdir| !tmpdir.is_empty())
+                .and_then(|tmpdir| {
+                    AbsolutePathBuf::from_absolute_path(std::path::PathBuf::from(tmpdir)).ok()
+                })
+                .is_some_and(|tmpdir| {
+                    file_system_policy.can_write_path_with_cwd(tmpdir.as_path(), cwd)
+                });
+            let slash_tmp = Path::new("/tmp");
+            let slash_tmp_writable = slash_tmp.is_absolute()
+                && slash_tmp.is_dir()
+                && file_system_policy.can_write_path_with_cwd(slash_tmp, cwd);
+
+            SandboxPolicy::WorkspaceWrite {
+                writable_roots,
+                network_access: network_policy.is_enabled(),
+                exclude_tmpdir_env_var: !tmpdir_writable,
+                exclude_slash_tmp: !slash_tmp_writable,
+            }
+        })
+    }
+
    pub fn to_runtime_permissions(&self) -> (FileSystemSandboxPolicy, NetworkSandboxPolicy) {
        (
            self.file_system_sandbox_policy(),
@@ -475,6 +475,39 @@ pub struct ThreadSettingsOverrides {
    pub personality: Option<Personality>,
 }

+impl ThreadSettingsOverrides {
+    pub fn permission_profile_update_for_cwd(
+        &self,
+        cwd: &Path,
+        current_file_system_sandbox_policy: Option<&FileSystemSandboxPolicy>,
+    ) -> Option<PermissionProfile> {
+        if let Some(permission_profile) = self.permission_profile.clone() {
+            return Some(permission_profile);
+        }
+
+        self.sandbox_policy.as_ref().map(|sandbox_policy| {
+            let file_system_sandbox_policy = if let Some(current_file_system_sandbox_policy) =
+                current_file_system_sandbox_policy
+            {
+                FileSystemSandboxPolicy::from_legacy_sandbox_policy_preserving_deny_entries(
+                    sandbox_policy,
+                    cwd,
+                    current_file_system_sandbox_policy,
+                )
+            } else {
+                FileSystemSandboxPolicy::from_legacy_sandbox_policy_for_cwd(sandbox_policy, cwd)
+            };
+            let file_system_sandbox_policy =
+                file_system_sandbox_policy.materialize_project_roots_with_cwd(cwd);
+            PermissionProfile::from_runtime_permissions_with_enforcement(
+                SandboxEnforcement::from_legacy_sandbox_policy(sandbox_policy),
+                &file_system_sandbox_policy,
+                NetworkSandboxPolicy::from(sandbox_policy),
+            )
+        })
+    }
+}
+
 /// Source classification for client-supplied context.
 #[derive(Debug, Clone, Copy, Deserialize, Serialize, PartialEq, Eq, JsonSchema)]
 #[serde(rename_all = "snake_case")]
@@ -4092,6 +4125,48 @@ mod tests {
        assert!(SessionSource::Custom("atlas-dev".to_string()).matches_product_restriction(&[]));
    }

+    #[test]
+    fn thread_settings_legacy_sandbox_policy_binds_project_roots_to_update_cwd() {
+        let cwd = TempDir::new().expect("tempdir");
+        let other_workspace_root = TempDir::new().expect("tempdir");
+        let sandbox_policy = SandboxPolicy::WorkspaceWrite {
+            writable_roots: Vec::new(),
+            network_access: false,
+            exclude_tmpdir_env_var: true,
+            exclude_slash_tmp: true,
+        };
+        let thread_settings = ThreadSettingsOverrides {
+            sandbox_policy: Some(sandbox_policy.clone()),
+            ..Default::default()
+        };
+
+        let actual = thread_settings
+            .permission_profile_update_for_cwd(
+                cwd.path(),
+                /*current_file_system_sandbox_policy*/ None,
+            )
+            .expect("legacy sandbox policy should produce a permission profile update");
+        let expected_file_system_sandbox_policy =
+            FileSystemSandboxPolicy::from_legacy_sandbox_policy_for_cwd(
+                &sandbox_policy,
+                cwd.path(),
+            )
+            .materialize_project_roots_with_cwd(cwd.path());
+        let expected = PermissionProfile::from_runtime_permissions_with_enforcement(
+            SandboxEnforcement::from_legacy_sandbox_policy(&sandbox_policy),
+            &expected_file_system_sandbox_policy,
+            NetworkSandboxPolicy::from(&sandbox_policy),
+        );
+
+        assert_eq!(actual, expected);
+        let actual_file_system_sandbox_policy = actual.file_system_sandbox_policy();
+        assert!(actual_file_system_sandbox_policy.can_write_path_with_cwd(cwd.path(), cwd.path()));
+        assert!(
+            !actual_file_system_sandbox_policy
+                .can_write_path_with_cwd(other_workspace_root.path(), cwd.path())
+        );
+    }
+
    fn sandbox_policy_probe_paths(policy: &SandboxPolicy, cwd: &Path) -> Vec<PathBuf> {
        let mut paths = vec![cwd.to_path_buf()];
        for root in policy.get_writable_roots_with_cwd(cwd) {