SeatbeltSandbox

Run commands and agent-written programs inside an operating-system boundary. See the guide.

class zett_agent.sandbox.seatbelt.SeatbeltSandbox(policy=None, *, memory_strategy=MemoryStrategy.AUTO)

Confine commands with a Seatbelt profile (macOS).

The kernel enforces the profile on the process and every process it starts. Reads are open except the paths the policy hides; writes work only in the policy's writable paths and the temporary directories; denied_write_paths and the protected files stay unwritable even inside a writable path; and the network is closed unless the policy opens it. A write is judged by where it lands, so a symbolic link that points out of a writable path gives nothing.

示例

Use it directly when you know you are on macOS:

sandbox = SeatbeltSandbox(SandboxPolicy.workspace_write("/work/project"))
result = await sandbox.run("make test", cwd="/work/project")

备注

sandbox-exec is deprecated by Apple but ships with macOS, and it is what Chrome, Bazel and the other agent sandboxes use for this.

警告

A process that is already inside a Seatbelt sandbox cannot start another. Running under a host that sandboxes you makes check() fail with a message that says so.

参数:

• policy (SandboxPolicy | None)

• memory_strategy (MemoryStrategy | str)

name: ClassVar[str] = 'seatbelt'

Short stable name of the backend, reported in results.

isolated: ClassVar[bool] = True

Whether this backend enforces a boundary. False only for the backend that runs commands as they are.

check()

Verify that sandbox-exec exists and can apply a profile from this process.

返回类型:

None