Class SandboxPipeline
Orchestrates sequential sandboxed execution stages connected by kernel pipes (stdout → stdin). The planner completes fully before the executor begins, ensuring strict capability separation.
public static class SandboxPipeline
- Inheritance
-
SandboxPipeline
- Inherited Members
Methods
CreateSandbox(SandboxPolicy)
Creates the appropriate sandbox implementation for the current platform.
public static ISandbox CreateSandbox(SandboxPolicy policy)
Parameters
policySandboxPolicy
Returns
ExecutorPolicy(params string[])
Creates an executor policy: has filesystem/tool access, no network access.
public static SandboxPolicy ExecutorPolicy(params string[] allowedPaths)
Parameters
allowedPathsstring[]
Returns
Plan(SandboxPolicy, SandboxPolicy, string, string)
Builds a pipeline from two stages: a planner (has network, no data) and an executor (has filesystem/tools, no network), connected by a unidirectional pipe.
public static PipelineStage[] Plan(SandboxPolicy plannerPolicy, SandboxPolicy executorPolicy, string plannerExe, string executorExe)
Parameters
plannerPolicySandboxPolicyexecutorPolicySandboxPolicyplannerExestringexecutorExestring
Returns
PlannerPolicy(string?)
Creates a planner policy: has network/API access, no filesystem/data access.
public static SandboxPolicy PlannerPolicy(string? allowedApiEndpoint = null)
Parameters
allowedApiEndpointstring
Returns
RunAsync(PipelineStage[], CancellationToken)
Runs the pipeline sequentially: each stage receives the output of the previous stage via stdin.
public static Task<PipelineExecutionResult> RunAsync(PipelineStage[] stages, CancellationToken ct = default)
Parameters
stagesPipelineStage[]ctCancellationToken