mirror of
https://github.com/stablyai/orca.git
synced 2026-10-19 16:03:26 +00:00
Jinjing
3a3e33f14b
Here is a summary of how the sandbox behaves on your macOS system: ### ⚙️ How it Works When `--sandbox` is enabled (either via the launch flag or the `enableTerminalSandbox` setting in your `settings.json`), terminal commands run inside a lightweight containment boundary: - **macOS Native Isolation**: It utilizes macOS's native `sandbox-exec` utility to restrict system calls, network sockets, and directory access. - **Secure File Boundaries**: File system writes are locked down to designated safe zones (such as your designated workspace or scratch directory). Access to critical system paths, private user data, and external network resources is restricted. --- ### 🛡️ Active Permissions for this Session In this current session, the permission model is configured as follows: | Action / Resource | Permission Status | Details / Paths | | :--- | :--- | :--- | | **Command Execution** | ✅ **Allowed** | Terminal command execution is enabled. | | **File Reads (Allowed)** | ✅ **Allowed** | `/scratch`, `/browser_recordings`, `/html_artifacts`, `/knowledge`, `/worktrees`, `/skills`, `/builtin` | | **File Writes (Allowed)**| ✅ **Allowed** | `/scratch`, `/browser_recordings`, `/html_artifacts`, `/knowledge`, `/worktrees` | | **Sensitive Files** | ⚠️ **Ask** | `.env`, `.npmrc`, `.vscode`, `.git-credentials`, etc. | | **Root/App Settings** | 🚫 **Denied** | Direct modifications to `/config` and main `.gemini` configurations | --- ### 🔧 Configuration and Management * **Persistent Settings**: To enable sandboxing by default for all future sessions, configure the `enableTerminalSandbox` setting in your `~/.gemini/antigravity-cli/settings.json`: ```json { "enableTerminalSandbox": true } ``` * **Dynamic Adjustments**: Within an active CLI (`agy`) session, you can run the `/permissions` slash command to view or modify your autonomy and sandboxing levels on the fly. > [!NOTE] > Running in sandbox mode provides an excellent balance of autonomy and security, allowing me to execute build commands, run test scripts, and manage project files safely without risk to your primary host environment. Please let me know if you would like me to set up a new project workspace or run any specific tasks within this session!
30 lines
1.0 KiB
TypeScript
30 lines
1.0 KiB
TypeScript
// The three lenses of the mobile Source Control hub. Kept as a pure module (no
|
|
// React/native imports) so tab parsing is unit-testable and the deep-link `tab`
|
|
// query param and the segmented control share one source of truth.
|
|
|
|
export type SourceControlHubTab = 'changes' | 'pr' | 'history'
|
|
|
|
export const SOURCE_CONTROL_HUB_TABS: readonly SourceControlHubTab[] = [
|
|
'changes',
|
|
'pr',
|
|
'history'
|
|
] as const
|
|
|
|
export const SOURCE_CONTROL_HUB_TAB_LABELS: Record<SourceControlHubTab, string> = {
|
|
changes: 'Changes',
|
|
pr: 'Pull Request',
|
|
history: 'Commits'
|
|
}
|
|
|
|
// Normalize a route param (possibly an array from expo-router, possibly unknown)
|
|
// to a valid tab, defaulting to 'changes'. Deep links that name a stale/invalid
|
|
// tab fall back rather than render a blank body.
|
|
export function parseSourceControlHubTab(
|
|
value: string | string[] | undefined | null
|
|
): SourceControlHubTab {
|
|
const first = Array.isArray(value) ? value[0] : value
|
|
return SOURCE_CONTROL_HUB_TABS.includes(first as SourceControlHubTab)
|
|
? (first as SourceControlHubTab)
|
|
: 'changes'
|
|
}
|