Function main

crates/openshell-sandbox/src/main.rs:197–365

()

}

fn main() -> Result<()> {
    // Handle `copy-self <DEST>` before clap so it works without any of the
    // sandbox flags. Kubernetes init containers invoke this path to seed an
    // emptyDir volume that the agent container then executes from.
    let raw_args: Vec<String> = std::env::args().collect();
    if raw_args.get(1).map(String::as_str) == Some(COPY_SELF_SUBCOMMAND) {
        let dest = raw_args.get(2).ok_or_else(|| {
            miette::miette!("usage: openshell-sandbox {COPY_SELF_SUBCOMMAND} <DEST>")
        })?;
        return copy_self(dest);
    }

    // Handle `debug-rpc <subcommand> [args]` before clap. Uses a small
    // dedicated runtime so we don't pay the supervisor's full startup cost.
    if raw_args.get(1).map(String::as_str) == Some(DEBUG_RPC_SUBCOMMAND) {
        let runtime = tokio::runtime::Builder::new_current_thread()
            .enable_all()
            .build()
            .into_diagnostic()?;
        return runtime.block_on(async move {
            let _ = rustls::crypto::ring::default_provider().install_default();
            let exit = openshell_supervisor_process::debug_rpc::run(&raw_args[2..]).await?;
            std::process::exit(exit);
        });
    }

    let args = Args::parse();

    // Try to open a rolling log file; fall back to stderr-only logging if it fails
    // (e.g., /var/log is not writable in custom workload images).
    // Rotates daily, keeps the 3 most recent files to bound disk usage.
    let file_logging = tracing_appender::rolling::RollingFileAppender::builder()
        .rotation(tracing_appender::rolling::Rotation::DAILY)
        .filename_prefix("openshell")
        .filename_suffix("log")
        .max_log_files(3)
        .build("/var/log")
        .ok()
        .map(|roller| {
            let (writer, guard) = tracing_appender::non_blocking(roller);
            (writer, guard)
        });

    let console_filter =
        EnvFilter::try_from_default_env().unwrap_or_else(|_| EnvFilter::new(&args.log_level));

    let runtime = tokio::runtime::Builder::new_multi_thread()
        .enable_all()
        .build()
        .into_diagnostic()?;

    let exit_code = runtime.block_on(async move {
        // Install rustls crypto provider before any TLS connections (including log push).
        let _ = rustls::crypto::ring::default_provider().install_default();

        // Set up optional log push layer (gRPC mode only).
        let log_push_state = if let (Some(sandbox_id), Some(endpoint)) =
            (&args.sandbox_id, &args.openshell_endpoint)