Module: RobotLab::Sandbox

Defined in:
lib/robot_lab/sandbox.rb,
lib/robot_lab/sandbox/null.rb,
lib/robot_lab/sandbox/seatbelt.rb

Overview

Confines skill-script execution to a granted set of capabilities.

Sandboxing is opt-in (config.sandbox.enabled). When off, every script runs unconfined exactly as before. When on, each script runs under a strategy:

  • Seatbelt on macOS — a generated deny-by-default sandbox-exec profile derived from the effective Capabilities grant.
  • Null elsewhere (or for trust: core skills) — a passthrough.

OS-level confinement is therefore best-effort and platform-specific; it is never a hard dependency.

Defined Under Namespace

Classes: Null, Seatbelt

Class Method Summary collapse

Class Method Details

.enabled?(config = RobotLab.config) ⇒ Boolean

Returns whether sandboxing is turned on in config.

Returns:

  • (Boolean) —

    whether sandboxing is turned on in config



19
20
21
 
# File 'lib/robot_lab/sandbox.rb', line 19

def enabled?(config = RobotLab.config)
  config.respond_to?(:sandbox) && config.sandbox && config.sandbox.enabled == true
end

.for(grant, skill_dir:, macos: macos?) ) ⇒ #wrap, #cleanup

Pick a strategy for the given (already-intersected) grant.

Parameters:

  • grant (Capabilities) —

    effective grant

  • skill_dir (String) —

    skill bundle root, always granted read access

  • macos (Boolean) (defaults to: macos?) ) —

    whether to use the macOS strategy; defaults to the real platform check and is injectable so both branches are testable on any host without stubbing.

Returns:

  • (#wrap, #cleanup) 


35
36
37
38
39
40
41
 
# File 'lib/robot_lab/sandbox.rb', line 35

def for(grant, skill_dir:, macos: macos?)
  return Null.new if grant.core?
  return Seatbelt.new(grant, skill_dir: skill_dir) if macos

  warn_once_non_macos
  Null.new
end

.macos? ⇒ Boolean

Returns:

  • (Boolean) 


23
24
25
 
# File 'lib/robot_lab/sandbox.rb', line 23

def macos?
  RUBY_PLATFORM.include?("darwin")
end

.warn_once_non_macos ⇒ Object 



43
44
45
46
47
48
49
50
 
# File 'lib/robot_lab/sandbox.rb', line 43

def warn_once_non_macos
  return if @warned_non_macos

  @warned_non_macos = true
  RobotLab.config.logger.warn(
    "Sandbox: OS-level confinement is only available on macOS; scripts run unconfined here"
  )
end