1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
|
#!/bin/bash
# Copyright 2025 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# usage: scripts/sandbox_command.sh [-q]
# -q: quiet mode (do not print command, just exit w/ code 0 or 1)
set -euo pipefail
# parse flags
QUIET=false
while getopts ":q" opt; do
case ${opt} in
q) QUIET=true ;;
\?)
echo "Usage: $0 [-q]"
exit 1
;;
esac
done
shift $((OPTIND - 1))
# if GEMINI_SANDBOX is not set, see if it is set in user settings
# note it can be string or boolean, and if missing jq will return null
USER_SETTINGS_FILE="$HOME/.gemini/settings.json"
if [ -z "${GEMINI_SANDBOX:-}" ] && [ -f "$USER_SETTINGS_FILE" ]; then
USER_SANDBOX_SETTING=$(sed -e 's/\/\/.*//' -e 's/\/\*.*\*\///g' -e '/^[[:space:]]*\/\//d' "$USER_SETTINGS_FILE" | jq -r '.sandbox')
if [ "$USER_SANDBOX_SETTING" != null ]; then
GEMINI_SANDBOX=$USER_SANDBOX_SETTING
fi
fi
# if GEMINI_SANDBOX is not set, try to source .env in case set there
# allow .env to be in any ancestor directory (same as findEnvFile in config.ts)
if [ -z "${GEMINI_SANDBOX:-}" ]; then
current_dir=$(pwd)
dot_env_sourced=false
while [ "$current_dir" != "/" ]; do
if [ -f "$current_dir/.env" ]; then
source "$current_dir/.env"
dot_env_sourced=true
break
fi
current_dir=$(dirname "$current_dir")
done
# if .env is not found in any ancestor directory, try ~/.env as fallback
if [ "$dot_env_sourced" = false ] && [ -f "$HOME/.env" ]; then
source "$HOME/.env"
dot_env_sourced=true
fi
fi
# copy and warn about deprecated GEMINI_CODE_SANDBOX
if [ -n "${GEMINI_CODE_SANDBOX:-}" ]; then
echo "WARNING: GEMINI_CODE_SANDBOX is deprecated. Use GEMINI_SANDBOX instead." >&2
GEMINI_SANDBOX=$GEMINI_CODE_SANDBOX
export GEMINI_SANDBOX
fi
# lowercase GEMINI_SANDBOX
GEMINI_SANDBOX=$(echo "${GEMINI_SANDBOX:-}" | tr '[:upper:]' '[:lower:]')
# if GEMINI_SANDBOX is set to 1|true, then try to use docker or podman
# if non-empty and not 0|false, treat as custom command and check that it exists
# if empty or 0|false, then fail silently (after checking for possible fallbacks)
command=""
if [[ "${GEMINI_SANDBOX:-}" =~ ^(1|true)$ ]]; then
if command -v docker &>/dev/null; then
command="docker"
elif command -v podman &>/dev/null; then
command="podman"
else
echo "ERROR: install docker or podman or specify command in GEMINI_SANDBOX" >&2
exit 1
fi
elif [ -n "${GEMINI_SANDBOX:-}" ] && [[ ! "${GEMINI_SANDBOX:-}" =~ ^(0|false)$ ]]; then
if ! command -v "$GEMINI_SANDBOX" &>/dev/null; then
echo "ERROR: missing sandbox command '$GEMINI_SANDBOX' (from GEMINI_SANDBOX)" >&2
exit 1
fi
command="$GEMINI_SANDBOX"
else
# if we are on macOS and sandbox-exec is available, use that for minimal sandboxing
# unless SEATBELT_PROFILE is set to 'none', which we allow as an escape hatch
if [ "$(uname)" = "Darwin" ] && command -v sandbox-exec &>/dev/null && [ "${SEATBELT_PROFILE:-}" != "none" ]; then
command="sandbox-exec"
else # GEMINI_SANDBOX is empty or 0|false, so we fail w/o error msg
exit 1
fi
fi
if [ "$QUIET" = false ]; then echo "$command"; fi
exit 0
|
