applySandboxDefaults applies default values to sandbox configuration If no sandbox config exists, creates one with awf as default agent If sandbox config exists but has no agent, sets agent to awf (unless agent is explicitly disabled) If sandbox.agent is an object with no id/type (e.g., version-only
(sandboxConfig *SandboxConfig, engineConfig *EngineConfig)
| 156 | // If sandbox config exists but has no agent, sets agent to awf (unless agent is explicitly disabled) |
| 157 | // If sandbox.agent is an object with no id/type (e.g., version-only), defaults the type to awf |
| 158 | func applySandboxDefaults(sandboxConfig *SandboxConfig, engineConfig *EngineConfig) *SandboxConfig { |
| 159 | // First, migrate any SRT references to AWF (codemod) |
| 160 | sandboxConfig = migrateSRTToAWF(sandboxConfig) |
| 161 | |
| 162 | // If agent sandbox is explicitly disabled (sandbox.agent: false), preserve that setting |
| 163 | if sandboxConfig != nil && sandboxConfig.Agent != nil && sandboxConfig.Agent.Disabled { |
| 164 | sandboxLog.Print("Agent sandbox explicitly disabled with sandbox.agent: false, preserving disabled state") |
| 165 | return sandboxConfig |
| 166 | } |
| 167 | |
| 168 | // If no sandbox config exists, create one with awf as default |
| 169 | if sandboxConfig == nil { |
| 170 | sandboxLog.Print("No sandbox config found, creating default with agent: awf") |
| 171 | sandboxConfig = &SandboxConfig{ |
| 172 | Agent: &AgentSandboxConfig{ |
| 173 | Type: SandboxTypeAWF, |
| 174 | NetworkIsolation: true, // Default: sudo: false (network isolation enabled) |
| 175 | }, |
| 176 | } |
| 177 | ensureDefaultAgentWritePath(sandboxConfig) |
| 178 | return sandboxConfig |
| 179 | } |
| 180 | |
| 181 | // If sandbox config exists with legacy Type field set, don't override with awf default |
| 182 | // The legacy Type field indicates explicit sandbox configuration |
| 183 | if sandboxConfig.Type != "" { |
| 184 | sandboxLog.Printf("Sandbox config uses legacy Type field: %s, preserving it", sandboxConfig.Type) |
| 185 | ensureDefaultAgentWritePath(sandboxConfig) |
| 186 | return sandboxConfig |
| 187 | } |
| 188 | |
| 189 | // If sandbox config exists but has no agent, set agent to awf |
| 190 | if sandboxConfig.Agent == nil { |
| 191 | sandboxLog.Print("Sandbox config exists without agent, setting default agent: awf") |
| 192 | sandboxConfig.Agent = &AgentSandboxConfig{ |
| 193 | Type: SandboxTypeAWF, |
| 194 | NetworkIsolation: true, // Default: sudo: false (network isolation enabled) |
| 195 | } |
| 196 | ensureDefaultAgentWritePath(sandboxConfig) |
| 197 | return sandboxConfig |
| 198 | } |
| 199 | |
| 200 | // If sandbox.agent is configured but has no type/ID set (e.g., a version-only object |
| 201 | // like { version: "v0.25.29" } that reached here without a prior `return`), default |
| 202 | // the type to awf so the sandbox is always enabled. This prevents a bare |
| 203 | // sandbox.agent object from silently disabling the firewall by leaving the type empty. |
| 204 | // Note: this block is only reached when Agent != nil and Disabled == false (the |
| 205 | // Disabled case returned early above). |
| 206 | if !isSupportedSandboxType(getAgentType(sandboxConfig.Agent)) { |
| 207 | sandboxLog.Print("Sandbox agent has no type/ID configured, defaulting to awf") |
| 208 | sandboxConfig.Agent.Type = SandboxTypeAWF |
| 209 | } |
| 210 | |
| 211 | // Apply the default sudo: false (network isolation) when sudo was not explicitly |
| 212 | // set to true in frontmatter. This ensures network isolation is the default. |
| 213 | if !sandboxConfig.Agent.SudoExplicitlyEnabled { |
| 214 | sandboxConfig.Agent.NetworkIsolation = true |
| 215 | } |