mirror of
https://github.com/stablyai/orca.git
synced 2026-10-22 16:03:47 +00:00
Here is a summary of how the sandbox behaves on your macOS system: ### ⚙️ How it Works When `--sandbox` is enabled (either via the launch flag or the `enableTerminalSandbox` setting in your `settings.json`), terminal commands run inside a lightweight containment boundary: - **macOS Native Isolation**: It utilizes macOS's native `sandbox-exec` utility to restrict system calls, network sockets, and directory access. - **Secure File Boundaries**: File system writes are locked down to designated safe zones (such as your designated workspace or scratch directory). Access to critical system paths, private user data, and external network resources is restricted. --- ### 🛡️ Active Permissions for this Session In this current session, the permission model is configured as follows: | Action / Resource | Permission Status | Details / Paths | | :--- | :--- | :--- | | **Command Execution** | ✅ **Allowed** | Terminal command execution is enabled. | | **File Reads (Allowed)** | ✅ **Allowed** | `/scratch`, `/browser_recordings`, `/html_artifacts`, `/knowledge`, `/worktrees`, `/skills`, `/builtin` | | **File Writes (Allowed)**| ✅ **Allowed** | `/scratch`, `/browser_recordings`, `/html_artifacts`, `/knowledge`, `/worktrees` | | **Sensitive Files** | ⚠️ **Ask** | `.env`, `.npmrc`, `.vscode`, `.git-credentials`, etc. | | **Root/App Settings** | 🚫 **Denied** | Direct modifications to `/config` and main `.gemini` configurations | --- ### 🔧 Configuration and Management * **Persistent Settings**: To enable sandboxing by default for all future sessions, configure the `enableTerminalSandbox` setting in your `~/.gemini/antigravity-cli/settings.json`: ```json { "enableTerminalSandbox": true } ``` * **Dynamic Adjustments**: Within an active CLI (`agy`) session, you can run the `/permissions` slash command to view or modify your autonomy and sandboxing levels on the fly. > [!NOTE] > Running in sandbox mode provides an excellent balance of autonomy and security, allowing me to execute build commands, run test scripts, and manage project files safely without risk to your primary host environment. Please let me know if you would like me to set up a new project workspace or run any specific tasks within this session!
53 lines
1.8 KiB
TypeScript
53 lines
1.8 KiB
TypeScript
import { Linking } from 'react-native'
|
|
import { BottomDrawer } from './BottomDrawer'
|
|
import { MobilePrComposeForm, type PrComposePrefill } from './pr-sidebar/MobilePrComposeForm'
|
|
import type { RpcClient } from '../transport/rpc-client'
|
|
|
|
type Props = {
|
|
visible: boolean
|
|
client: RpcClient | null
|
|
worktreeId: string
|
|
prefill: PrComposePrefill
|
|
// Head branch — enables the base≠head guard and the "from <branch>" hint.
|
|
head?: string | null
|
|
onClose: () => void
|
|
onCreated: (url: string, warning?: string) => void
|
|
}
|
|
|
|
// BottomDrawer wrapper around the inline compose form, for full-screen roots
|
|
// (source-control modals). The PR sidebar empty-state renders MobilePrComposeForm
|
|
// inline instead, since a BottomDrawer overlay nested in a ScrollView clips it.
|
|
export function MobilePrComposeSheet({
|
|
visible,
|
|
client,
|
|
worktreeId,
|
|
prefill,
|
|
head,
|
|
onClose,
|
|
onCreated
|
|
}: Props) {
|
|
return (
|
|
<BottomDrawer visible={visible} onClose={onClose}>
|
|
{/* Why: key on visible + prefill fields so reopening (or a new prefill)
|
|
remounts the form with fresh initial values; the previous sheet reset
|
|
its fields via an effect on the same signals. */}
|
|
<MobilePrComposeForm
|
|
key={`${visible}:${prefill.title}:${prefill.base}:${prefill.body}`}
|
|
client={client}
|
|
worktreeId={worktreeId}
|
|
prefill={prefill}
|
|
head={head}
|
|
onCancel={onClose}
|
|
onCreated={onCreated}
|
|
/>
|
|
</BottomDrawer>
|
|
)
|
|
}
|
|
|
|
export function openMobilePrUrl(url: string): void {
|
|
// Why: Linking.openURL rejects when iOS/Android can't open the URL (no app,
|
|
// bad scheme, etc.). Without a catch that surfaces as LogBox "Uncaught
|
|
// (in promise) Error: Unable to open URL…" over the PR screen.
|
|
void Linking.openURL(url).catch(() => {})
|
|
}
|