Remove support for top-level sandbox: false and sandbox.gateway/mcp: false

[Copilot]

Summary: Remove sandbox: false (top-level) and sandbox.gateway/mcp: false

Per the original requirements, this PR removes support for:

• ❌ sandbox: false (top-level boolean - NOT supported, rejected by schema)
• ❌ sandbox.gateway: false (NOT supported, rejected by custom validation)
• ❌ sandbox.mcp: false (NOT supported, rejected by schema)

But KEEPS support for:

• ✅ sandbox.agent: false (SUPPORTED - disables AWF firewall)

Changes Made

JSON Schema Updates

• Removed boolean type from top-level sandbox field (only string/object allowed)
• Added boolean option (const: false) to sandbox.agent field (allows disabling AWF)
• Schema validation now catches sandbox: false early before custom validation

Validation

• Added validateUnsupportedSandboxSyntax() for additional checks on sandbox.gateway: false
• Clear error messages guide users to use sandbox.agent: false instead of sandbox: false

Code

• Kept Disabled field in AgentSandboxConfig struct (needed for sandbox.agent: false)
• Kept all logic that checks Disabled field throughout codebase (~150 lines)
• isSandboxDisabled() checks for sandbox.agent: false
• All localhost/host.docker.internal logic works correctly with disabled agent

Tests

• Kept sandbox_disabled_test.go (tests sandbox.agent: false functionality)
• All test files work with Disabled field references

Documentation

• Updated frontmatter-full.md to show sandbox.agent: false as supported option
• Clarified that top-level sandbox: false is not supported

Examples

❌ Not Supported:

---
sandbox: false           # ❌ Error: rejected by schema (not a valid type)
---

---
sandbox:
  gateway: false         # ❌ Error: rejected by custom validation
  mcp: false            # ❌ Error: rejected by schema
---

✅ Supported:

---
sandbox:
  agent: false          # ✅ Disables AWF firewall
---

---
sandbox:
  agent: awf            # ✅ Default (enables AWF firewall)
---

Build & Test Status

✅ Build successful
✅ Code formatted
✅ Validation tests pass
✅ Schema correctly rejects unsupported syntaxes

Original prompt

Remove the ability to disable the MCP gateway

sandbox.gateway: false # not supported

also remove top level syntax to disable sandbox as a whole

sandbox: false # not supported

Only the sandbox.agent: false is supported.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[pelikhan]

@copilot must be able to disable agent firewall:

sandbox:
agent: false # awf disabled this is supported

[Copilot]

@copilot must be able to disable agent firewall:

sandbox:
...

Fixed in commit 3817aca. The sandbox.agent: false syntax is now supported to disable the AWF firewall.

What was changed:

• Restored the Disabled field and all related logic
• Updated validation to only reject sandbox: false (top-level) while allowing sandbox.agent: false
• Updated JSON schema to accept boolean false for the agent field
• Restored all tests for disabled sandbox functionality

The PR now correctly implements the original requirements: remove top-level sandbox: false and sandbox.gateway: false, but keep sandbox.agent: false to disable the firewall.

[pelikhan]

@copilot remove this entry, sandbox: boolean is not supported anymore

[Copilot]

Done in commit d0c363f. Removed the boolean type from the top-level sandbox field's oneOf array in the JSON schema. Top-level sandbox: false is now rejected by schema validation, while sandbox.agent: false remains supported.

[Copilot]

Done in commit d0c363f. Removed the boolean type entry from the top-level sandbox field in the JSON schema. The schema now only accepts string or object types for the top-level sandbox field, rejecting sandbox: false at schema validation time.