@cabane/companion 0.6.125 → 0.6.126

package/dist/pairing-config.js

@@ -227,6 +227,10 @@ var companionConfigSchema = z2.object({
   // wraps the runner in an OS sandbox where the host supports one; `'none'`
   // (the default) runs it as a plain child beside this process, a supported
   // configuration in its own right rather than a degraded one.
+  // CT1684: `policy` is what the OS sandbox lets a turn reach, read and hold
+  // (`runner/sandbox-policy.ts`). It is validated there rather than here, so a
+  // bad policy refuses the turns it governs, with the field named, instead of
+  // keeping the companion from starting at all.
   runners: z2.object({
     enabled: z2.boolean().optional(),
     provider: z2.enum(["local-process", "docker"]).optional(),
@@ -260,7 +264,8 @@ var companionConfigSchema = z2.object({
       // container's git for an allowed host, e.g. `!gh auth git-credential`.
       // Absent: git's own configured helpers on this device.
       gitCredentialHelper: z2.string().min(1).optional()
-    }).strict().optional()
+    }).strict().optional(),
+    policy: z2.unknown().optional()
   }).strict().optional()
 });
 function loadConfig() {