Function run_policy_poll_loop

crates/openshell-sandbox/src/lib.rs:1620–1854

(ctx: PolicyPollLoopContext)

}

async fn run_policy_poll_loop(ctx: PolicyPollLoopContext) -> Result<()> {
    use openshell_core::grpc_client::CachedOpenShellClient;
    use openshell_core::proto::PolicySource;
    use std::sync::atomic::Ordering;

    let client = CachedOpenShellClient::connect(&ctx.endpoint).await?;
    let mut current_config_revision: u64 = 0;
    let mut current_provider_env_revision: u64 = ctx.provider_credentials.snapshot().revision;
    let mut current_policy_hash = String::new();
    let mut current_settings: std::collections::HashMap<
        String,
        openshell_core::proto::EffectiveSetting,
    > = std::collections::HashMap::new();

    // Initialize revision from the first poll.
    match client.poll_settings(&ctx.sandbox_id).await {
        Ok(result) => {
            apply_ocsf_json_setting(&ctx.ocsf_enabled, &result.settings);
            current_config_revision = result.config_revision;
            current_policy_hash = result.policy_hash.clone();
            current_settings = result.settings;
            debug!(
                config_revision = current_config_revision,
                "Settings poll: initial config revision"
            );
        }
        Err(e) => {
            warn!(error = %e, "Settings poll: failed to fetch initial version, will retry");
        }
    }

    let interval = Duration::from_secs(ctx.interval_secs);
    loop {
        tokio::time::sleep(interval).await;

        let result = match client.poll_settings(&ctx.sandbox_id).await {
            Ok(r) => r,
            Err(e) => {
                debug!(error = %e, "Settings poll: server unreachable, will retry");
                continue;
            }
        };

        let provider_env_changed = result.provider_env_revision != current_provider_env_revision;
        if result.config_revision == current_config_revision && !provider_env_changed {
            continue;
        }

        let policy_changed = result.policy_hash != current_policy_hash;

        // Log which settings changed.
        log_setting_changes(&current_settings, &result.settings);

        ocsf_emit!(ConfigStateChangeBuilder::new(ocsf_ctx())
            .severity(SeverityId::Informational)
            .status(StatusId::Success)
            .state(StateId::Other, "detected")
            .unmapped("old_config_revision", serde_json::json!(current_config_revision))