feat: sandbox exec calls with bwrap and run container as non-root

2026-03-16 23:55:19 -07:00
parent 49fc50b1e6
commit 7913e7150a
8 changed files with 1204 additions and 7 deletions
@@ -92,7 +92,7 @@ class SubagentManager:
        try:
            # Build subagent tools (no message tool, no spawn tool)
            tools = ToolRegistry()
-            allowed_dir = self.workspace if self.restrict_to_workspace else None
+            allowed_dir = self.workspace if (self.restrict_to_workspace or self.exec_config.sandbox) else None
            extra_read = [BUILTIN_SKILLS_DIR] if allowed_dir else None
            tools.register(ReadFileTool(workspace=self.workspace, allowed_dir=allowed_dir, extra_allowed_dirs=extra_read))
            tools.register(WriteFileTool(workspace=self.workspace, allowed_dir=allowed_dir))
@@ -102,6 +102,7 @@ class SubagentManager:
                working_dir=str(self.workspace),
                timeout=self.exec_config.timeout,
                restrict_to_workspace=self.restrict_to_workspace,
+                sandbox=self.exec_config.sandbox,
                path_append=self.exec_config.path_append,
            ))
            tools.register(WebSearchTool(config=self.web_search_config, proxy=self.web_proxy))