open-source/cursor-byok
1
0
Fork 0
mirror of https://wget.la/https://github.com/leookun/cursor-byok synced 2026-10-05 04:07:36 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #329 from LyricalNanoha/feat/shell-sandbox-permissions

Browse Source 
feat: add required_permissions support for Shell sandbox policy
This commit is contained in:
leokun
2026-08-24 23:53:45 +08:00
committed by GitHub
parent 283f2296e7 1368a587ca
commit 7dded0d81f
2 changed files with 33 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/src/cursor/tools/codec/request.rs
+24
View File
@@ -49,6 +49,7 @@ pub fn request(id: u32, call: &ToolCall, context: &ExecContext) -> Result<pb::Ag
"request_smart_mode_approval",
"smart_mode_block_reason",
)?,
requested_sandbox_policy: shell_sandbox_policy(call),
close_stdin: true,
conversation_id: Some(context.conversation_id.clone()),
admin_command_denylist: context.admin_command_denylist.clone(),
@@ -365,6 +366,29 @@ pub fn abort(id: u32) -> pb::AgentServerMessage {
}
}
fn shell_sandbox_policy(call: &ToolCall) -> Option<pb::SandboxPolicy> {
let permissions = call.arguments.get("required_permissions")?.as_array()?;
let perms: Vec<&str> = permissions
.iter()
.filter_map(Value::as_str)
.collect();
if perms.contains(&"all") {
Some(pb::SandboxPolicy {
r#type: pb::sandbox_policy::Type::InsecureNone as i32,
network_access: Some(true),
..Default::default()
})
} else if perms.contains(&"full_network") {
Some(pb::SandboxPolicy {
r#type: pb::sandbox_policy::Type::WorkspaceReadwrite as i32,
network_access: Some(true),
..Default::default()
})
} else {
None
}
}
fn shell_timeout(call: &ToolCall) -> Result<i32> {
let value = call
.arguments