Omar SobhandClaude Fable 5
7392ce1d08
- SandboxManager (tc-runtime): one container per agent, provisioned
lazily on first use, reused for the manager's lifetime, replaced
transparently if dead, destroyed on shutdown
- shell.exec tool: sh -lc inside the agent's sandbox; stdout/stderr/
exit_code return to the model as the step output. No external effects
declared — the sandbox boundary (uid 10001, no caps, seccomp
allowlist, read-only rootfs, zero egress) is the §15 control here,
not an approval gate
- RuntimeConfig.sandboxes (+ with_sandboxes builder); [sandbox] config
{image, enabled}; the server connects the Docker driver at boot and
tolerates an absent engine (shell.exec reports it per-call)
- Tests with the REAL DockerDriver: a scripted run executes two
commands — output proves uid 10001 from inside, and /home/agent state
written by the first call is read by the second (same sandbox); a
deployment without a sandbox runtime records honest error steps and
the run still completes
151 Rust tests + 27 Playwright journeys.
Co-Authored-By: Claude Fable 5 <[email protected]>
28 lines
726 B
TOML
28 lines
726 B
TOML
[package]
|
|
name = "teamclaw-server"
|
|
version = "0.1.0"
|
|
edition.workspace = true
|
|
rust-version.workspace = true
|
|
license.workspace = true
|
|
publish.workspace = true
|
|
|
|
[dependencies]
|
|
axum = "0.8"
|
|
serde_json = { workspace = true }
|
|
sqlx = { workspace = true }
|
|
tc-api = { path = "../../tc-api" }
|
|
tc-auth = { path = "../../tc-auth" }
|
|
tc-config = { path = "../../tc-config" }
|
|
tc-db = { path = "../../tc-db" }
|
|
tc-files = { path = "../../tc-files" }
|
|
tc-llm = { path = "../../tc-llm" }
|
|
tc-runtime = { path = "../../tc-runtime" }
|
|
tc-sandbox = { path = "../../tc-sandbox" }
|
|
tc-scheduler = { path = "../../tc-scheduler" }
|
|
tc-domain = { path = "../../tc-domain" }
|
|
time = { workspace = true }
|
|
tokio = { workspace = true }
|
|
|
|
[lints]
|
|
workspace = true
|