(allowedTools []string, sandboxConfig *SandboxConfig)
| 354 | } |
| 355 | |
| 356 | func appendSandboxWritableTools(allowedTools []string, sandboxConfig *SandboxConfig) []string { |
| 357 | if sandboxConfig == nil { |
| 358 | return allowedTools |
| 359 | } |
| 360 | writablePaths := []string{defaultClaudeTmpWritePath} |
| 361 | if sandboxConfig.Agent != nil && sandboxConfig.Agent.Config != nil && sandboxConfig.Agent.Config.Filesystem != nil { |
| 362 | writablePaths = append(writablePaths, sandboxConfig.Agent.Config.Filesystem.AllowWrite...) |
| 363 | } |
| 364 | seenPatterns := make(map[string]struct{}, len(writablePaths)) |
| 365 | for _, writablePath := range writablePaths { |
| 366 | pattern, ok := normalizeSandboxWritablePattern(writablePath) |
| 367 | if !ok { |
| 368 | continue |
| 369 | } |
| 370 | if _, seen := seenPatterns[pattern]; seen { |
| 371 | continue |
| 372 | } |
| 373 | seenPatterns[pattern] = struct{}{} |
| 374 | allowedTools = sliceutil.MergeUnique(allowedTools, fmt.Sprintf("Read(%s)", pattern)) |
| 375 | allowedTools = sliceutil.MergeUnique(allowedTools, fmt.Sprintf("Write(%s)", pattern)) |
| 376 | allowedTools = sliceutil.MergeUnique(allowedTools, fmt.Sprintf("Edit(%s)", pattern)) |
| 377 | allowedTools = sliceutil.MergeUnique(allowedTools, fmt.Sprintf("MultiEdit(%s)", pattern)) |
| 378 | } |
| 379 | return allowedTools |
| 380 | } |
| 381 | |
| 382 | func normalizeSandboxWritablePattern(writablePath string) (string, bool) { |
| 383 | path := strings.TrimSpace(writablePath) |
no test coverage detected