1const (
2    ModeReadOnly         SandboxMode = "read-only"
3    ModeWorkspaceWrite   SandboxMode = "workspace-write"
4    ModeDangerFullAccess SandboxMode = "danger-full-access"
5)

 1ps := sandbox.NewPolicyService(sandbox.ModeReadOnly, "/fallback/root")
 2
 3// 1) 会话记录了 workspace-write → 覆盖默认模式
 4p1 := ps.Resolve(sandbox.SandboxPolicyRequest{Session: sess})
 5// p1.Mode = "workspace-write", p1.WorkspaceRoot = sess.Cwd()
 6
 7// 2) 显式 override → 最高优先级，越过会话记录
 8danger := sandbox.ModeDangerFullAccess
 9p2 := ps.Resolve(sandbox.SandboxPolicyRequest{Session: sess, Mode: &danger})
10// p2.Mode = "danger-full-access", p2.IsDanger() = true
11
12// 3) 无会话（agentless）→ 回落部署默认 + 回落根
13p3 := ps.Resolve(sandbox.SandboxPolicyRequest{})
14// p3.Mode = "read-only", p3.WorkspaceRoot = "/fallback/root"

1type SandboxProvider interface {
2    // Confine 把 argv 包裹为在指定策略下受约束执行的形式。
3    // 必须 FAIL CLOSED：无可用后端或包裹失败时返回错误，
4    // 绝不允许静默无约束放行。
5    Confine(argv []string, policy SandboxPolicy) (ConfinedArgv, error)
6}

1type UnavailableProvider struct{}
2
3func (*UnavailableProvider) Confine([]string, SandboxPolicy) (ConfinedArgv, error) {
4    return ConfinedArgv{}, &SandboxUnavailableError{
5        Msg: "no usable sandbox backend",
6    }
7}

 1# 原始命令
 2["bash", "-c", "echo hello > /workspace/app/out.txt"]
 3
 4# Confine() 之后（bwrap）
 5["bwrap",
 6 "--ro-bind", "/", "/",                    # 根目录以只读挂载
 7 "--dev", "/dev",                           # 提供 /dev
 8 "--unshare-pid",                           # 隔离 PID 命名空间
 9 "--proc", "/proc",                         # 挂载 /proc
10 "--die-with-parent",                       # 父进程死亡时杀掉沙箱
11 "--tmpfs", "/tmp",                         # /tmp 可写（临时）
12 "--bind", "/workspace/app", "/workspace/app",  # 工作区可读写
13 "--",                                       # 分隔符
14 "bash", "-c", "echo hello > /workspace/app/out.txt"]

1["landlock-run",
2 "--read-only", "/",                # 所有内容可读
3 "--read-write", "/dev/null",       # /dev/null 可写（必需）
4 "--read-write", "/tmp",            # /tmp 可写
5 "--read-write", "/workspace/app",  # 工作区可写
6 "--",
7 "bash", "-c", "..."]

1["sandbox-exec",
2 "-p",
3 "(version 1) (allow default) (deny file-write*) (allow file-write* (literal \"/dev/null\")) (allow file-write* (subpath \"/workspace/app\"))",
4 "--",
5 "bash", "-c", "..."]

 1type ConfinedArgv struct {
 2    // Argv 是包裹后的命令：runner + profile 参数 + 分隔符 + 原始 argv。
 3    Argv []string `json:"argv"`
 4
 5    // Enforcement 报告后端对策略承诺的覆盖完整度。
 6    //   "full"    — 后端强制执行策略声明的每一种文件效果
 7    //   "partial" — 活动后端或旧内核 ABI 只覆盖子集；
 8    //               要求绝对边界的消费者不得当作 full 使用
 9    Enforcement SandboxEnforcement `json:"enforcement"`
10
11    // DenialSignatures 是表示"沙箱拒绝了"的 stderr 子串集合。
12    // 当包裹后的命令失败时，消费者扫描 stderr 查找这些子串，
13    // 以区分"沙箱拒绝了写入"和"命令本身失败了"。
14    DenialSignatures []string `json:"denialSignatures"`
15
16    // RunnerFailureRules 是结构化规则，用于区分"沙箱 runner 自身启动失败"
17    // 和"命令运行后以非零码退出"。这很重要：runner 失败是基础设施问题
18    // （重试 / 告警），而命令失败是正常的业务结果。
19    RunnerFailureRules []RunnerFailureRule `json:"runnerFailureRules"`
20}

1type RunnerFailureRule struct {
2    AllowedExitCodes   []int    // 可能是 runner 失败的非零退出码
3    FatalSignatures    []string // 确认 runner 失败的 stderr 子串
4    InformationalLines []string // 匹配前忽略的完整 stderr 行（如 fallback 警告）
5}
6
7func (r RunnerFailureRule) Matches(exitCode int, stderr string) (string, bool)

 1rule := RunnerFailureRule{
 2    AllowedExitCodes:   []int{125},
 3    FatalSignatures:    []string{"cannot start sandbox runner", "exec format error"},
 4    InformationalLines: []string{"landlock: fallback to baseline"},
 5}
 6
 7// exitCode=125，stderr 包含 fallback 警告 + 致命行
 8stderr := "landlock: fallback to baseline\ncannot start sandbox runner: permission denied\n"
 9sig, ok := rule.Matches(125, stderr)
10// ok = true, sig = "cannot start sandbox runner"
11// （信息行在匹配前已被移除）

 1// SandboxExecutionPolicy → SandboxPolicy
 2func (p SandboxExecutionPolicy) ToConfined() (SandboxPolicy, error) {
 3    switch p.Mode {
 4    case ModeReadOnly:
 5        return SandboxPolicy{SandboxExecutionPolicy: p, Mode: ConfinedReadOnly}, nil
 6    case ModeWorkspaceWrite:
 7        return SandboxPolicy{SandboxExecutionPolicy: p, Mode: ConfinedWorkspaceWrite}, nil
 8    default:
 9        // danger-full-access 无法被约束 — 调用方必须绕过沙箱
10        return SandboxPolicy{}, fmt.Errorf("sandbox: cannot confine danger-full-access policy")
11    }
12}

1func CanonicalPath(path string) string {
2    resolved, err := filepath.EvalSymlinks(path)
3    if err != nil {
4        return filepath.Clean(path) // 保守：返回原路径
5    }
6    abs, _ := filepath.Abs(resolved)
7    return filepath.Clean(abs)
8}

1type SandboxModeData struct {
2    Mode   string // "read-only" | "workspace-write" | "danger-full-access"
3    Source string // "user" | "delegation" | "escalation"
4}

1func EffectiveSandboxMode(events []session.SessionEvent) (SandboxMode, bool) {
2    for i := len(events) - 1; i >= 0; i-- {
3        if events[i].Type == session.EventSandboxMode {
4            data := events[i].Data.(session.SandboxModeData)
5            return SandboxMode(data.Mode), true
6        }
7    }
8    return "", false
9}

 1func (p *LocalProvider) tryBwrap() bool {
 2    if _, err := exec.LookPath("bwrap"); err != nil {
 3        return false
 4    }
 5    cmd := exec.Command("bwrap",
 6        "--ro-bind", "/", "/", "--dev", "/dev",
 7        "--unshare-pid", "--proc", "/proc", "--die-with-parent",
 8        "--", "true")
 9    return cmd.Run() == nil
10}

1provider := sandbox.NewLocalProvider(&sandbox.LocalConfig{
2    RunnerCommand: "custom-bwrap-wrapper",
3    BackendType:   sandbox.BackendBwrap,
4})

 1// 1. 创建受限令牌（DuplicateTokenEx）
 2var dupToken windows.Token
 3windows.DuplicateTokenEx(procToken, windows.TOKEN_ALL_ACCESS,
 4    nil, windows.SecurityImpersonation, windows.TokenPrimary, &dupToken)
 5
 6// 2. 在工作区根目录上授予 ACL
 7// （SetEntriesInAcl + SetNamedSecurityInfo with FILE_ALL_ACCESS）
 8
 9// 3. 以受限令牌启动进程
10windows.CreateProcessAsUser(dupToken, nil, cmdLine,
11    nil, nil, false, flags, envBlock, workDirPtr, &si, &pi)

1sandbox.InvariantEnabled = true  // 开发模式（默认）
2sandbox.InvariantEnabled = false // 生产模式（跳过校验以提高性能）

1func ApproveEscalation(ctx context.Context, req EscalationRequest, approver EscalationApprover) (SandboxMode, error)

1var widerModes = map[SandboxMode][]SandboxMode{
2    ModeReadOnly:       {ModeWorkspaceWrite, ModeDangerFullAccess},
3    ModeWorkspaceWrite: {ModeDangerFullAccess},
4    // danger-full-access：无（它是顶点）
5}

1type EscalationApprover interface {
2    Request(ctx context.Context, req EscalationApprovalRequest) (EscalationOutcome, error)
3}

1policy := ps.Resolve(req)
2if policy.IsDanger() {
3    return exec.Command(argv[0], argv[1:]...) // 完全绕过沙箱
4}
5confined, err := provider.Confine(argv, policy.ToConfined())
6if err != nil {
7    return nil, err // SANDBOX_UNAVAILABLE → fail closed
8}
9return exec.Command(confined.Argv[0], confined.Argv[1:]...)

1preset, _ := presets.Resolve("safe")
2// preset.SandboxMode    = "read-only"
3// preset.ApprovalPolicy = "ask-dangerous"