ResolvedPolicy#
Run commands and agent-written programs inside an operating-system boundary. See the guide.
- class zett_agent.sandbox.policy.ResolvedPolicy(writable, denied_write, protected_write, denied_read, network, warnings=())[source]#
A policy turned into concrete absolute paths that a backend can enforce.
- Parameters:
writable (tuple[Path, ...])
denied_write (tuple[Path, ...])
protected_write (tuple[Path, ...])
denied_read (tuple[Path, ...])
network (NetworkMode)
warnings (tuple[str, ...])
- writable#
Existing directories or files the process may write, with symbolic links resolved.
- Type:
tuple[pathlib.Path, …]
- denied_write#
Paths the caller marked unwritable.
- Type:
tuple[pathlib.Path, …]
- protected_write#
Default-protected paths inside the writable ones. A path may not exist yet; a backend that cannot deny a missing path skips it.
- Type:
tuple[pathlib.Path, …]
- denied_read#
Paths hidden from reads, the caller’s and the defaults that exist on this machine.
- Type:
tuple[pathlib.Path, …]
- network#
The network mode.
- warnings#
Things the policy asked for that could not be set up.
- Type:
tuple[str, …]
- property unwritable: tuple[Path, ...]#
the caller’s denials, then the protected ones.
- Type:
Every path to keep unwritable