[WIP] Remove ability to disable sandbox.gateway in frontmatter

[Copilot]

Remove ability to disable sandbox.gateway

Plan

• Investigate current implementation of sandbox.gateway disabling
• Remove sandbox: false option from schema
• Remove parser support for sandbox: false
• Remove parser support for sandbox.agent: false
• Update sandbox validation to reject disabled sandbox
• Update tests to verify sandbox: false is rejected
• Remove warning for disabled sandbox in compiler
• Run tests to verify changes
• Run make agent-finish before committing

Changes Made

1. Schema (pkg/parser/schemas/main_workflow_schema.json):

   • Removed boolean option from sandbox.oneOf (was allowing sandbox: false)

2. Parser (pkg/workflow/frontmatter_extraction_security.go):

   • Updated to reject boolean format for sandbox field
   • Updated to reject boolean format for sandbox.agent field
   • Removed code that created Disabled marker configs

3. Validation (pkg/workflow/sandbox_validation.go):

   • Added explicit rejection of disabled sandbox with configuration error
   • Removed suggestion to use sandbox: false from error messages

4. Compiler (pkg/workflow/compiler.go):

   • Removed warning message for disabled sandbox (now invalid)

5. Tests (pkg/workflow/sandbox_disabled_test.go):

   • Updated all tests to verify sandbox: false is rejected
   • Removed tests that verified sandbox: false functionality

Original prompt

Remove the ability to disable the sandbox.gateway in the frontmatter (in schema and parser).

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.