SessionLimitsChoice

Experimental

The session/start limits choice: every member is optional — a start names only the axes it chooses (an omitted axis reads as the ceiling, except trust, which reads the daemon default — untrusted, except trusted under --trust-workspace --listen, ADR 59770 D4a). Reports use SessionLimits, whose members are always present.

Fields and variants

• sandboxEnabled — Experimental
• sandboxNetwork — Experimental
• shellEnabled — Experimental
• workspaceTrusted — Experimental
• writesEnabled — Experimental

Source

schema/msp/experimental/msp.schema.json#/types/SessionLimitsChoice

{
  "description": "The `session/start` `limits` choice: every member is\noptional — a start names only the axes it chooses (an omitted axis\nreads as the ceiling, except trust, which reads the daemon default —\nuntrusted, except trusted under `--trust-workspace --listen`,\nADR 59770 D4a). Reports use `SessionLimits`, whose members are\nalways present.",
  "properties": {
    "sandboxEnabled": {
      "description": "Shell filesystem/network sandboxing (`--disable-sandbox` absent).",
      "type": "boolean"
    },
    "sandboxNetwork": {
      "$ref": "#/$defs/LimitsNetworkMode",
      "description": "Sandbox network policy (`--sandbox-network` grammar)."
    },
    "shellEnabled": {
      "description": "Workspace shell execution (`--disable-shell` absent).",
      "type": "boolean"
    },
    "workspaceTrusted": {
      "description": "Loading the workspace's skills and rules (`--trust-workspace`).",
      "type": "boolean"
    },
    "writesEnabled": {
      "description": "Non-shell workspace filesystem writes (`--disable-write` absent).",
      "type": "boolean"
    }
  },
  "type": "object",
  "x-msp-descriptor": "session/start.limits",
  "x-msp-stability": "experimental"
}