| 1 | package sandbox |
| 2 | |
| 3 | import "runtime" |
| 4 | |
| 5 | // SessionTempEnvKeys are the standard temporary-directory environment variables |
| 6 | // Reasonix overrides for session-private temporary directories. |
| 7 | var SessionTempEnvKeys = []string{ |
| 8 | "TMPDIR", "TMP", "TEMP", |
| 9 | // Build tools commonly write to host-global caches even when their inputs |
| 10 | // and outputs stay inside the workspace. Keep those writes session-private |
| 11 | // so normal builds do not need an approval or broaden the sandbox. |
| 12 | "XDG_CACHE_HOME", "NPM_CONFIG_CACHE", "npm_config_cache", "GOCACHE", |
| 13 | } |
| 14 | |
| 15 | // SessionTempEnv returns KEY=value overrides for the session-private temporary |
| 16 | // directory. When linuxSandboxed is true (Linux bwrap with SessionTemp bound at |
| 17 | // /tmp), the variables point at the virtual /tmp path so scripts using $TMPDIR |
| 18 | // and /tmp agree. Otherwise they point at the host private directory. |
| 19 | // |
| 20 | // An empty sessionTemp yields nil (no overrides). |
| 21 | func SessionTempEnv(sessionTemp string, linuxSandboxed bool) []string { |
| 22 | if sessionTemp == "" { |
| 23 | return nil |
| 24 | } |
| 25 | value := sessionTemp |
| 26 | if linuxSandboxed && runtime.GOOS == "linux" { |
| 27 | value = "/tmp" |
| 28 | } |
| 29 | out := make([]string, 0, len(SessionTempEnvKeys)) |
| 30 | for _, key := range SessionTempEnvKeys { |
| 31 | out = append(out, key+"="+value) |
| 32 | } |
| 33 | return out |
| 34 | } |
| 35 | |
| 36 | // SessionTempEnvMap is SessionTempEnv as a name→value map for ACP terminal/create. |
| 37 | func SessionTempEnvMap(sessionTemp string, linuxSandboxed bool) map[string]string { |
| 38 | pairs := SessionTempEnv(sessionTemp, linuxSandboxed) |
| 39 | if len(pairs) == 0 { |
| 40 | return nil |
| 41 | } |
| 42 | out := make(map[string]string, len(pairs)) |
| 43 | for _, kv := range pairs { |
| 44 | for i := range len(kv) { |
| 45 | if kv[i] == '=' { |
| 46 | out[kv[:i]] = kv[i+1:] |
| 47 | break |
| 48 | } |
| 49 | } |
| 50 | } |
| 51 | return out |
| 52 | } |
| 53 |