Function load_sandbox_policy

crates/openshell-policy/src/lib.rs:1007–1022

Load a sandbox policy from an explicit source. Resolution order: 1. `cli_path` argument (e.g. from a `--policy` flag) 2. `OPENSHELL_SANDBOX_POLICY` environment variable Returns `Ok(None)` when no policy source is configured, allowing the caller to omit the policy and let the server / sandbox apply its own default.

(cli_path: Option<&str>)

/// caller to omit the policy and let the server / sandbox apply its own
/// default.
pub fn load_sandbox_policy(cli_path: Option<&str>) -> Result<Option<SandboxPolicy>> {
    let contents = if let Some(p) = cli_path {
        let path = Path::new(p);
        std::fs::read_to_string(path)
            .into_diagnostic()
            .wrap_err_with(|| format!("failed to read sandbox policy from {}", path.display()))?
    } else if let Ok(policy_path) = std::env::var("OPENSHELL_SANDBOX_POLICY") {
        let path = Path::new(&policy_path);
        std::fs::read_to_string(path)
            .into_diagnostic()
            .wrap_err_with(|| format!("failed to read sandbox policy from {}", path.display()))?
    } else {
        return Ok(None);
    };
    parse_sandbox_policy(&contents).map(Some)
}

/// Well-known path where a sandbox container image can ship a policy YAML file.
///