build_seatbelt_profile#

Run commands and agent-written programs inside an operating-system boundary. See the guide.

zett_agent.sandbox.macos.build_seatbelt_profile(resolved, *, temp_directories=())[source]#

Render a resolved policy as a Seatbelt profile and its parameters.

Paths never appear in the profile text. Each is a (param "KEY") that sandbox-exec -D KEY=value fills in, so a path holding a quote, a parenthesis or a newline cannot change what the profile means.

Rules are ordered so that the last match wins: permissions first, then the denials that override them.

Returns:

The profile text and the KEY -> value parameters it refers to.

Parameters:

resolved (ResolvedPolicy)
temp_directories (tuple[Path, ...])

Return type:

tuple[str, dict[str, str]]