@anvia/sandbox 1.1.1 → 1.1.3

package/README.md

@@ -32,11 +32,27 @@ Networking is explicit. Use `{ mode: "none" }` or `{ mode: "bridge", ports: [...
 bind only to `127.0.0.1`. Runtime methods use object arguments, propagate abort signals, and expose
 command and process output as bytes. Tool wrappers decode UTF-8 strictly and return structured values.
 
+With `exec.commands.mode: "allow"`, both `exec_command` and `start_process` reject known shell
+executables by default, including path-qualified names such as `/bin/sh`. To permit an allowlisted
+shell, set `exec.commands.allowShellInterpreters` to the boolean `true`. Omitted or `false` keeps the
+guard enabled; non-boolean values such as `"false"` are rejected when creating tools. This guard
+checks executable names only: allowlisted runtimes such as Node.js or Python can still launch other
+commands, so the command policy does not restrict what those programs can execute.
+
 `resources.sharedMemoryMb` maps to a private Docker `/dev/shm` size. A security configuration may use
 explicit `dropCapabilities` and `addCapabilities` arrays, plus
 `seccompProfile: { type: "path", path }` with an absolute host path. These options are used by
 `@anvia/browser` to keep Chromium's own process sandbox enabled.
 
+`createSandbox()` accepts `containerRuntime` — the runtime name registered in the Docker daemon (for
+example `runsc` for gVisor). The runtime must already be registered (`runsc install` followed by a
+daemon restart); creation fails with a `runtime_not_found` error otherwise. `resumeSandbox()` keeps
+the container's original runtime. Under gVisor, workspace files persist through
+`stop()`/`resumeSandbox()` because they live on a Docker volume, but changes to the container's
+writable rootfs outside the workspace do not survive a resume, and `security.seccompProfile` is not
+enforced the way it is on the default runtime because the gVisor sentry mediates application
+syscalls itself.
+
 Studio does not discover sandboxes through tool metadata. Register a read-only inspector explicitly:
 
 ```ts

package/dist/{chunk-4D2GWLEH.js → chunk-D5XZQ2ES.js}

@@ -131,4 +131,4 @@ export {
   assertDockerCli,
   decodeUtf8
 };
-//# sourceMappingURL=chunk-4D2GWLEH.js.map
+//# sourceMappingURL=chunk-D5XZQ2ES.js.map

package/dist/chunk-D5XZQ2ES.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/errors.ts","../src/docker-cli.ts"],"sourcesContent":["export type DockerSandboxErrorCode =\n  | \"docker_unavailable\"\n  | \"docker_command_failed\"\n  | \"image_not_found\"\n  | \"runtime_not_found\"\n  | \"volume_not_found\"\n  | \"sandbox_not_found\"\n  | \"invalid_state\"\n  | \"invalid_path\"\n  | \"timeout\"\n  | \"file_too_large\"\n  | \"tool_policy\"\n  | \"port\"\n  | \"process\";\n\nexport class DockerSandboxError extends Error {\n  constructor(\n    message: string,\n    readonly code: DockerSandboxErrorCode,\n    readonly details?: unknown,\n    options?: ErrorOptions,\n  ) {\n    super(message, options);\n    this.name = \"DockerSandboxError\";\n  }\n}\n\nexport function dockerSandboxError(\n  message: string,\n  code: DockerSandboxErrorCode,\n  cause?: unknown,\n  details?: unknown,\n): DockerSandboxError {\n  return new DockerSandboxError(\n    message,\n    code,\n    details,\n    cause === undefined ? undefined : { cause },\n  );\n}\n","import { spawn } from \"node:child_process\";\nimport { DockerSandboxError } from \"./errors\";\n\nexport interface DockerCliResult {\n  stdout: Uint8Array;\n  stderr: Uint8Array;\n  exitCode: number;\n  durationMs: number;\n  timedOut: boolean;\n  stdoutTruncated: boolean;\n  stderrTruncated: boolean;\n}\n\nexport interface DockerCliOptions {\n  dockerPath: string;\n  timeoutMs?: number | undefined;\n  maxOutputBytes?: number | undefined;\n  input?: string | Uint8Array | undefined;\n  signal?: AbortSignal | undefined;\n  onStdout?: (chunk: Uint8Array) => void;\n  onStderr?: (chunk: Uint8Array) => void;\n}\n\nconst defaultMaxOutputBytes = 1024 * 1024;\n\nexport async function runDockerCli(\n  args: string[],\n  options: DockerCliOptions,\n): Promise<DockerCliResult> {\n  const startedAt = Date.now();\n  const maxOutputBytes = options.maxOutputBytes ?? defaultMaxOutputBytes;\n  const stdout = createOutputCollector(maxOutputBytes, options.onStdout);\n  const stderr = createOutputCollector(maxOutputBytes, options.onStderr);\n\n  return new Promise((resolve, reject) => {\n    const child = spawn(options.dockerPath, args, {\n      stdio: [\"pipe\", \"pipe\", \"pipe\"],\n    });\n\n    let timedOut = false;\n    let settled = false;\n\n    const timeout =\n      options.timeoutMs === undefined\n        ? undefined\n        : setTimeout(() => {\n            timedOut = true;\n            child.kill(\"SIGKILL\");\n          }, options.timeoutMs);\n\n    const abort = () => {\n      child.kill(\"SIGKILL\");\n    };\n\n    if (options.signal?.aborted === true) {\n      abort();\n    } else {\n      options.signal?.addEventListener(\"abort\", abort, { once: true });\n    }\n\n    child.stdout.on(\"data\", (chunk: Buffer) => stdout.accept(chunk));\n    child.stderr.on(\"data\", (chunk: Buffer) => stderr.accept(chunk));\n\n    child.on(\"error\", (error) => {\n      if (settled) {\n        return;\n      }\n      settled = true;\n      clearTimeout(timeout);\n      options.signal?.removeEventListener(\"abort\", abort);\n\n      if ((error as NodeJS.ErrnoException).code === \"ENOENT\") {\n        reject(\n          new DockerSandboxError(\"Docker CLI was not found.\", \"docker_unavailable\", undefined, {\n            cause: error,\n          }),\n        );\n        return;\n      }\n\n      reject(error);\n    });\n\n    child.on(\"close\", (code) => {\n      if (settled) {\n        return;\n      }\n      settled = true;\n      clearTimeout(timeout);\n      options.signal?.removeEventListener(\"abort\", abort);\n\n      if (options.signal?.aborted === true) {\n        reject(options.signal.reason ?? new DOMException(\"Aborted\", \"AbortError\"));\n        return;\n      }\n\n      resolve({\n        stdout: stdout.bytes(),\n        stderr: stderr.bytes(),\n        exitCode: code ?? 1,\n        durationMs: Date.now() - startedAt,\n        timedOut,\n        stdoutTruncated: stdout.truncated,\n        stderrTruncated: stderr.truncated,\n      });\n    });\n\n    if (options.input !== undefined) {\n      child.stdin.end(options.input);\n    } else {\n      child.stdin.end();\n    }\n  });\n}\n\nexport async function assertDockerCli(args: string[], options: DockerCliOptions): Promise<void> {\n  const result = await runDockerCli(args, options);\n\n  if (result.exitCode !== 0) {\n    throw new DockerSandboxError(\n      `Docker command failed: docker ${args.join(\" \")}`,\n      \"docker_command_failed\",\n      result,\n    );\n  }\n}\n\nfunction createOutputCollector(maxBytes: number, onChunk?: (chunk: Uint8Array) => void) {\n  const chunks: Buffer[] = [];\n  let length = 0;\n  let truncated = false;\n\n  return {\n    get truncated() {\n      return truncated;\n    },\n    accept(chunk: Buffer) {\n      onChunk?.(chunk);\n\n      if (length >= maxBytes) {\n        truncated = true;\n        return;\n      }\n\n      const remaining = maxBytes - length;\n      const next = chunk.length > remaining ? chunk.subarray(0, remaining) : chunk;\n      chunks.push(next);\n      length += next.length;\n\n      if (next.length < chunk.length) {\n        truncated = true;\n      }\n    },\n    bytes() {\n      const bytes = Buffer.concat(chunks, length);\n      return new Uint8Array(bytes.buffer, bytes.byteOffset, bytes.byteLength).slice();\n    },\n  };\n}\n\nexport function decodeUtf8(bytes: Uint8Array): string {\n  return new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes);\n}\n"],"mappings":";AAeO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EAC5C,YACE,SACS,MACA,SACT,SACA;AACA,UAAM,SAAS,OAAO;AAJb;AACA;AAIT,SAAK,OAAO;AAAA,EACd;AAAA,EANW;AAAA,EACA;AAMb;;;ACzBA,SAAS,aAAa;AAuBtB,IAAM,wBAAwB,OAAO;AAErC,eAAsB,aACpB,MACA,SAC0B;AAC1B,QAAM,YAAY,KAAK,IAAI;AAC3B,QAAM,iBAAiB,QAAQ,kBAAkB;AACjD,QAAM,SAAS,sBAAsB,gBAAgB,QAAQ,QAAQ;AACrE,QAAM,SAAS,sBAAsB,gBAAgB,QAAQ,QAAQ;AAErE,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAM,QAAQ,MAAM,QAAQ,YAAY,MAAM;AAAA,MAC5C,OAAO,CAAC,QAAQ,QAAQ,MAAM;AAAA,IAChC,CAAC;AAED,QAAI,WAAW;AACf,QAAI,UAAU;AAEd,UAAM,UACJ,QAAQ,cAAc,SAClB,SACA,WAAW,MAAM;AACf,iBAAW;AACX,YAAM,KAAK,SAAS;AAAA,IACtB,GAAG,QAAQ,SAAS;AAE1B,UAAM,QAAQ,MAAM;AAClB,YAAM,KAAK,SAAS;AAAA,IACtB;AAEA,QAAI,QAAQ,QAAQ,YAAY,MAAM;AACpC,YAAM;AAAA,IACR,OAAO;AACL,cAAQ,QAAQ,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;AAAA,IACjE;AAEA,UAAM,OAAO,GAAG,QAAQ,CAAC,UAAkB,OAAO,OAAO,KAAK,CAAC;AAC/D,UAAM,OAAO,GAAG,QAAQ,CAAC,UAAkB,OAAO,OAAO,KAAK,CAAC;AAE/D,UAAM,GAAG,SAAS,CAAC,UAAU;AAC3B,UAAI,SAAS;AACX;AAAA,MACF;AACA,gBAAU;AACV,mBAAa,OAAO;AACpB,cAAQ,QAAQ,oBAAoB,SAAS,KAAK;AAElD,UAAK,MAAgC,SAAS,UAAU;AACtD;AAAA,UACE,IAAI,mBAAmB,6BAA6B,sBAAsB,QAAW;AAAA,YACnF,OAAO;AAAA,UACT,CAAC;AAAA,QACH;AACA;AAAA,MACF;AAEA,aAAO,KAAK;AAAA,IACd,CAAC;AAED,UAAM,GAAG,SAAS,CAAC,SAAS;AAC1B,UAAI,SAAS;AACX;AAAA,MACF;AACA,gBAAU;AACV,mBAAa,OAAO;AACpB,cAAQ,QAAQ,oBAAoB,SAAS,KAAK;AAElD,UAAI,QAAQ,QAAQ,YAAY,MAAM;AACpC,eAAO,QAAQ,OAAO,UAAU,IAAI,aAAa,WAAW,YAAY,CAAC;AACzE;AAAA,MACF;AAEA,cAAQ;AAAA,QACN,QAAQ,OAAO,MAAM;AAAA,QACrB,QAAQ,OAAO,MAAM;AAAA,QACrB,UAAU,QAAQ;AAAA,QAClB,YAAY,KAAK,IAAI,IAAI;AAAA,QACzB;AAAA,QACA,iBAAiB,OAAO;AAAA,QACxB,iBAAiB,OAAO;AAAA,MAC1B,CAAC;AAAA,IACH,CAAC;AAED,QAAI,QAAQ,UAAU,QAAW;AAC/B,YAAM,MAAM,IAAI,QAAQ,KAAK;AAAA,IAC/B,OAAO;AACL,YAAM,MAAM,IAAI;AAAA,IAClB;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,gBAAgB,MAAgB,SAA0C;AAC9F,QAAM,SAAS,MAAM,aAAa,MAAM,OAAO;AAE/C,MAAI,OAAO,aAAa,GAAG;AACzB,UAAM,IAAI;AAAA,MACR,iCAAiC,KAAK,KAAK,GAAG,CAAC;AAAA,MAC/C;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,sBAAsB,UAAkB,SAAuC;AACtF,QAAM,SAAmB,CAAC;AAC1B,MAAI,SAAS;AACb,MAAI,YAAY;AAEhB,SAAO;AAAA,IACL,IAAI,YAAY;AACd,aAAO;AAAA,IACT;AAAA,IACA,OAAO,OAAe;AACpB,gBAAU,KAAK;AAEf,UAAI,UAAU,UAAU;AACtB,oBAAY;AACZ;AAAA,MACF;AAEA,YAAM,YAAY,WAAW;AAC7B,YAAM,OAAO,MAAM,SAAS,YAAY,MAAM,SAAS,GAAG,SAAS,IAAI;AACvE,aAAO,KAAK,IAAI;AAChB,gBAAU,KAAK;AAEf,UAAI,KAAK,SAAS,MAAM,QAAQ;AAC9B,oBAAY;AAAA,MACd;AAAA,IACF;AAAA,IACA,QAAQ;AACN,YAAM,QAAQ,OAAO,OAAO,QAAQ,MAAM;AAC1C,aAAO,IAAI,WAAW,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU,EAAE,MAAM;AAAA,IAChF;AAAA,EACF;AACF;AAEO,SAAS,WAAW,OAA2B;AACpD,SAAO,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,KAAK;AAC/D;","names":[]}

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   assertDockerCli
-} from "./chunk-4D2GWLEH.js";
+} from "./chunk-D5XZQ2ES.js";
 
 // src/cli.ts
 import { lstat, mkdir, readFile, rm, writeFile } from "fs/promises";

package/dist/index.d.ts

@@ -42,6 +42,11 @@ type CreateDockerSandboxOptions = Readonly<{
     workdir?: string;
     workspace: DockerSandboxWorkspace;
     network: DockerSandboxNetwork;
+    /** Docker runtime used to run the container, as registered in the daemon
+     *  (for example "runsc" for gVisor). The runtime must already be registered;
+     *  createSandbox() fails with `runtime_not_found` otherwise. Omitted means
+     *  the daemon default. resumeSandbox() keeps the container's runtime. */
+    containerRuntime?: string;
     files?: Readonly<Record<string, string | Uint8Array>>;
     directories?: readonly string[];
     env?: Readonly<Record<string, string>>;
@@ -208,6 +213,7 @@ type DockerSandboxInspector = Readonly<{
     id: string;
     provider: "docker";
     workdir: string;
+    containerRuntime: string;
     listFiles?: DockerSandboxRuntime["listFiles"];
     readFile?: DockerSandboxRuntime["readFile"];
     publishedPorts?: readonly DockerSandboxPublishedPort[];
@@ -229,6 +235,7 @@ type DockerSandboxToolName = "exec_command" | "read_file" | "write_file" | "list
 type DockerSandboxCommandPolicy = Readonly<{
     mode: "allow";
     values: readonly string[];
+    allowShellInterpreters?: boolean;
 }> | Readonly<{
     mode: "block";
     values: readonly string[];
@@ -270,10 +277,11 @@ declare class DockerSandboxClient {
     private assertImageExists;
     private assertContainerDoesNotExist;
     private assertVolumeExists;
+    private assertRuntimeAvailable;
     private cliOptions;
 }
 
-type DockerSandboxErrorCode = "docker_unavailable" | "docker_command_failed" | "image_not_found" | "volume_not_found" | "sandbox_not_found" | "invalid_state" | "invalid_path" | "timeout" | "file_too_large" | "tool_policy" | "port" | "process";
+type DockerSandboxErrorCode = "docker_unavailable" | "docker_command_failed" | "image_not_found" | "runtime_not_found" | "volume_not_found" | "sandbox_not_found" | "invalid_state" | "invalid_path" | "timeout" | "file_too_large" | "tool_policy" | "port" | "process";
 declare class DockerSandboxError extends Error {
     readonly code: DockerSandboxErrorCode;
     readonly details?: unknown | undefined;

package/dist/index.js

@@ -3,7 +3,7 @@ import {
   assertDockerCli,
   decodeUtf8,
   runDockerCli
-} from "./chunk-4D2GWLEH.js";
+} from "./chunk-D5XZQ2ES.js";
 
 // src/docker-sandbox.ts
 import { randomUUID as randomUUID2 } from "crypto";
@@ -610,6 +610,7 @@ var labels = {
   workspaceType: `${labelPrefix}workspace.type`,
   workspaceVolume: `${labelPrefix}workspace.volume`,
   networkMode: `${labelPrefix}network.mode`,
+  containerRuntime: `${labelPrefix}container-runtime`,
   commandTimeoutMs: `${labelPrefix}runtime.command-timeout-ms`,
   maxOutputBytes: `${labelPrefix}runtime.max-output-bytes`,
   maxFileBytes: `${labelPrefix}runtime.max-file-bytes`,
@@ -650,6 +651,7 @@ var DockerSandboxClient = class {
     assertSandboxId(id);
     const containerName = containerNameFor(id);
     const workdir = options.workdir ?? defaultWorkdir;
+    const containerRuntime = options.containerRuntime ?? "default";
     const runtime = resolveRuntimeLimits(options.runtime);
     const workspace = copyWorkspace(options.workspace);
     const network = copyNetwork(options.network);
@@ -662,6 +664,7 @@ var DockerSandboxClient = class {
     if (workspace.type === "docker-volume") {
       await this.assertVolumeExists(workspace.name, options.abortSignal);
     }
+    await this.assertRuntimeAvailable(containerRuntime, options.abortSignal);
     let containerCreated = false;
     let volumeCreated = false;
     try {
@@ -678,6 +681,7 @@ var DockerSandboxClient = class {
           containerName,
           image: options.image,
           workdir,
+          containerRuntime,
           workspace,
           volumeName,
           env,
@@ -704,6 +708,7 @@ var DockerSandboxClient = class {
         id,
         containerName,
         workdir,
+        containerRuntime,
         workspace,
         volumeName,
         ownsVolume,
@@ -818,6 +823,37 @@ var DockerSandboxClient = class {
       result
     );
   }
+  async assertRuntimeAvailable(name, abortSignal) {
+    if (name === "default") return;
+    const result = await runDockerCli(["info", "--format", "{{json .Runtimes}}"], {
+      ...this.cliOptions(abortSignal),
+      maxOutputBytes: defaultMaxOutputBytes
+    });
+    if (result.exitCode !== 0) {
+      throw new DockerSandboxError(
+        "Unable to inspect Docker runtimes.",
+        "docker_command_failed",
+        result
+      );
+    }
+    let runtimes;
+    try {
+      runtimes = JSON.parse(decodeUtf8(result.stdout));
+    } catch (error) {
+      throw new DockerSandboxError(
+        "Docker returned invalid runtime metadata.",
+        "docker_command_failed",
+        void 0,
+        { cause: error }
+      );
+    }
+    if (!isRecord(runtimes) || !(name in runtimes)) {
+      throw new DockerSandboxError(
+        `Docker runtime is not registered in the daemon: ${JSON.stringify(name)}. Install the runtime (for gVisor: runsc install) and restart the Docker daemon.`,
+        "runtime_not_found"
+      );
+    }
+  }
   cliOptions(abortSignal) {
     return { dockerPath: this.dockerPath, signal: abortSignal };
   }
@@ -853,7 +889,8 @@ var DockerSandboxHandle = class {
     let inspector = {
       id: this.id,
       provider: "docker",
-      workdir: this.configuration.workdir
+      workdir: this.configuration.workdir,
+      containerRuntime: this.configuration.containerRuntime
     };
     if (options.files === true) {
       inspector = {
@@ -1370,6 +1407,7 @@ function createRunArgs(options) {
     [labels.workspaceType]: options.workspace.type,
     [labels.workspaceVolume]: options.volumeName,
     [labels.networkMode]: options.network.mode,
+    [labels.containerRuntime]: options.containerRuntime,
     [labels.commandTimeoutMs]: `${options.runtime.commandTimeoutMs}`,
     [labels.maxOutputBytes]: `${options.runtime.maxOutputBytes}`,
     [labels.maxFileBytes]: `${options.runtime.maxFileBytes}`,
@@ -1385,6 +1423,9 @@ function createRunArgs(options) {
     "-w",
     options.workdir
   ];
+  if (options.containerRuntime !== "default") {
+    args.push("--runtime", options.containerRuntime);
+  }
   for (const [key, value] of Object.entries({ ...options.userLabels, ...runtimeLabels })) {
     args.push("--label", `${key}=${value}`);
   }
@@ -1464,6 +1505,9 @@ function validateCreateOptions(options) {
     if (key.startsWith(labelPrefix)) throw new TypeError(`Docker label is reserved: ${key}`);
   }
   if (options.user !== void 0) assertNonEmptyString(options.user, "user");
+  if (options.containerRuntime !== void 0) {
+    assertNonEmptyString(options.containerRuntime, "containerRuntime");
+  }
   if (options.directories !== void 0 && !Array.isArray(options.directories)) {
     throw new TypeError("directories must be an array.");
   }
@@ -1606,6 +1650,9 @@ function snapshotCreateOptions(options) {
   };
   if (options.id !== void 0) snapshot = { ...snapshot, id: options.id };
   if (options.workdir !== void 0) snapshot = { ...snapshot, workdir: options.workdir };
+  if (options.containerRuntime !== void 0) {
+    snapshot = { ...snapshot, containerRuntime: options.containerRuntime };
+  }
   if (options.files !== void 0) snapshot = { ...snapshot, files: Object.freeze(files) };
   if (options.directories !== void 0) {
     snapshot = { ...snapshot, directories: Object.freeze([...options.directories]) };
@@ -1664,6 +1711,9 @@ function configurationFromInspection(id, containerName, inspection) {
   const workspaceType = requiredLabel(containerLabels, labels.workspaceType);
   const volumeName = requiredLabel(containerLabels, labels.workspaceVolume);
   const networkMode = requiredLabel(containerLabels, labels.networkMode);
+  const labeledRuntime = containerLabels[labels.containerRuntime];
+  const hostRuntime = inspection.HostConfig?.Runtime;
+  const containerRuntime = labeledRuntime !== void 0 && labeledRuntime !== "" ? labeledRuntime : hostRuntime !== void 0 && hostRuntime !== "" ? hostRuntime : "default";
   if (networkMode !== "none" && networkMode !== "bridge") invalidInspection("network mode");
   const workspace = workspaceType === "ephemeral" ? { type: "ephemeral" } : workspaceType === "docker-volume" ? { type: "docker-volume", name: volumeName } : invalidInspection("workspace type");
   const runtime = {
@@ -1675,6 +1725,7 @@ function configurationFromInspection(id, containerName, inspection) {
   return {
     id,
     containerName,
+    containerRuntime,
     workdir,
     workspace,
     volumeName,
@@ -1926,6 +1977,22 @@ function isRecord(value) {
 // src/tools.ts
 import { createTool } from "@anvia/core/tool";
 import { z } from "zod";
+
+// src/types.ts
+var shellInterpreters = [
+  "sh",
+  "bash",
+  "zsh",
+  "ksh",
+  "dash",
+  "ash",
+  "busybox",
+  "fish",
+  "csh",
+  "tcsh"
+];
+
+// src/tools.ts
 var allToolNames = [
   "exec_command",
   "read_file",
@@ -2361,7 +2428,8 @@ function snapshotFactoryOptions(options) {
   const toolNames = Object.freeze([...options.tools]);
   const commands = options.exec?.commands === void 0 ? void 0 : Object.freeze({
     mode: options.exec.commands.mode,
-    values: Object.freeze([...options.exec.commands.values])
+    values: Object.freeze([...options.exec.commands.values]),
+    ...options.exec.commands.mode === "allow" && options.exec.commands.allowShellInterpreters !== void 0 ? { allowShellInterpreters: options.exec.commands.allowShellInterpreters } : {}
   });
   let snapshot = {
     sandbox: options.sandbox,
@@ -2389,6 +2457,9 @@ function validateCommandPolicy(policy) {
   if (policy.mode !== "allow" && policy.mode !== "block") {
     throw toolPolicyError("exec.commands must use mode allow or block.");
   }
+  if (policy.mode === "allow" && policy.allowShellInterpreters !== void 0 && typeof policy.allowShellInterpreters !== "boolean") {
+    throw toolPolicyError("exec.commands.allowShellInterpreters must be a boolean.");
+  }
   if (!Array.isArray(policy.values))
     throw toolPolicyError("exec.commands.values must be an array.");
   const seen = /* @__PURE__ */ new Set();
@@ -2407,6 +2478,14 @@ function assertCommandAllowed(command, policy) {
   if (policy.mode === "allow" && !included || policy.mode === "block" && included) {
     throw toolPolicyError(`Command is rejected by sandbox tool policy: ${command}`);
   }
+  if (policy.mode === "allow" && policy.allowShellInterpreters !== true) {
+    const commandBasename = command.split("/").pop() ?? command;
+    if (shellInterpreters.includes(commandBasename)) {
+      throw toolPolicyError(
+        `Command is rejected by sandbox tool policy: ${command} (shell interpreter not allowed)`
+      );
+    }
+  }
 }
 function assertTimeoutAllowed(timeoutMs, maxTimeoutMs) {
   if (timeoutMs !== void 0 && maxTimeoutMs !== void 0 && timeoutMs > maxTimeoutMs) {