Files
computer-playbook/scripts/install/sandbox.sh
kevinveenbirkenbachandClaude Opus 5 5137465c6f style: delete every comment the comments-valid policy rejects
3529 invalid comments in 528 files, grandfathered in while the linter
only saw the working-tree diff. Removal ran through the linter's own
collectors, so detection and deletion cannot drift: a comment whose
opener line is blank before it and whose closer line is blank after it
loses all its lines, anything else loses only the comment region, and a
line left holding a bare delimiter goes with it.

Five files keep their comments behind a nocheck marker instead. Four are
upstream configs whose inline docs are upstream's own (mautrix, systemd
journald, nextcloud-oidc-login, MediaWiki). In littlejs the
commented-out entries ARE the deactivation mechanism for an example
tile, so deleting them would delete configuration.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-18 03:22:02 +02:00

113 lines
2.5 KiB
Bash
Executable File

#!/usr/bin/env bash
#
# Install OS-level dependencies required by the Claude Code sandbox.
#
# Installs `bubblewrap` (bwrap) and `socat`, which the sandbox backend
# needs to confine agent-launched commands. See:
# docs/contributing/tools/agents/claude/sandbox.md
#
# Supported distributions:
# - Debian / Ubuntu (apt-get)
# - Fedora (dnf)
# - CentOS / RHEL (dnf or yum)
# - Arch Linux (pacman)
#
set -euo pipefail
PACKAGES=(bubblewrap socat)
run_privileged() {
if [[ $EUID -eq 0 ]]; then
"$@"
elif command -v sudo >/dev/null 2>&1; then
sudo "$@"
else
echo "[sandbox-deps] ERROR: need root or sudo to install packages" >&2
exit 1
fi
}
detect_distro_id() {
if [[ -r /etc/os-release ]]; then
# shellcheck disable=SC1091
. /etc/os-release
echo "${ID:-unknown}"
else
echo "unknown"
fi
}
install_apt() {
echo "[sandbox-deps] Installing via apt-get: ${PACKAGES[*]}"
export DEBIAN_FRONTEND=noninteractive
run_privileged apt-get update
run_privileged apt-get install -y --no-install-recommends "${PACKAGES[@]}"
}
install_dnf() {
echo "[sandbox-deps] Installing via dnf: ${PACKAGES[*]}"
run_privileged dnf -y install "${PACKAGES[@]}"
}
install_yum() {
echo "[sandbox-deps] Installing via yum: ${PACKAGES[*]}"
run_privileged yum -y install "${PACKAGES[@]}"
}
install_pacman() {
echo "[sandbox-deps] Installing via pacman: ${PACKAGES[*]}"
run_privileged pacman -Sy --noconfirm --needed "${PACKAGES[@]}"
}
main() {
local id
id="$(detect_distro_id)"
echo "[sandbox-deps] Detected distribution: ${id}"
case "${id}" in
debian | ubuntu | linuxmint | pop | raspbian)
install_apt
;;
fedora)
install_dnf
;;
centos | rhel | rocky | almalinux)
if command -v dnf >/dev/null 2>&1; then
install_dnf
else
install_yum
fi
;;
arch | manjaro | endeavouros)
install_pacman
;;
*)
if command -v apt-get >/dev/null 2>&1; then
install_apt
elif command -v dnf >/dev/null 2>&1; then
install_dnf
elif command -v yum >/dev/null 2>&1; then
install_yum
elif command -v pacman >/dev/null 2>&1; then
install_pacman
else
echo "[sandbox-deps] ERROR: unsupported distribution '${id}' and no known package manager found" >&2
exit 1
fi
;;
esac
echo "[sandbox-deps] Verifying installed binaries..."
for bin in bwrap socat; do
if ! command -v "${bin}" >/dev/null 2>&1; then
echo "[sandbox-deps] ERROR: '${bin}' not found on PATH after install" >&2
exit 1
fi
printf '[sandbox-deps] %s -> %s\n' "${bin}" "$(command -v "${bin}")"
done
echo "[sandbox-deps] Done."
}
main "$@"