@cruxy/cli 0.12.0 → 0.14.0

package/dist/render/plain-renderer.d.ts

@@ -1,6 +1,6 @@
 import type { ActionPreview } from "../tools/types.js";
 import { type Theme } from "../theme/index.js";
-import type { RenderCapabilities, RenderStream, StreamRenderer, ToolLifecycleEvent } from "./types.js";
+import type { ProgressState, RenderCapabilities, RenderPhase, RenderStream, StreamRenderer, ToolLifecycleEvent } from "./types.js";
 /**
  * The append-only renderer for pipes, CI, and cursor-less terminals. Emits no
  * cursor-control sequences ever, and no color unless the capabilities say so
@@ -30,8 +30,8 @@ export declare class PlainRenderer implements StreamRenderer {
     note(text: string): void;
     preview(preview: ActionPreview): void;
     status(): void;
-    setPhase(): void;
-    progress(): void;
+    setPhase(phase: RenderPhase | null): void;
+    progress(state: ProgressState | null): void;
     toolLifecycle(event: ToolLifecycleEvent): void;
     promptResolved(): void;
     endTurn(): void;

package/dist/render/plain-renderer.js

@@ -59,12 +59,20 @@ export class PlainRenderer {
     status() {
         // Append-only medium: transient state is dropped by design.
     }
-    setPhase() {
+    // setPhase / progress declare their StreamRenderer params because the
+    // ScreenReaderRenderer subclass overrides them to announce (the override must
+    // be signature-compatible). In the plain medium they are no-ops: there is no
+    // live region to update, so the guard simply returns.
+    setPhase(phase) {
         // Phases are live-region state; there is no live region here (U.4).
+        if (phase !== null)
+            return;
     }
-    progress() {
+    progress(state) {
         // The committed plan trail (C.31, via PromptIO) is the record in this
         // medium; a live [i/n] prefix would just duplicate it line by line.
+        if (state !== null)
+            return;
     }
     toolLifecycle(event) {
         if (event.event === "start") {

package/dist/render/screen-reader-renderer.d.ts

@@ -0,0 +1,45 @@
+import { PlainRenderer } from "./plain-renderer.js";
+import type { ProgressState, RenderCapabilities, RenderPhase, RenderStream, ToolLifecycleEvent } from "./types.js";
+/**
+ * The screen-reader renderer (U.11): {@link PlainRenderer}'s linear,
+ * append-only, zero-cursor-control output — plus two things a screen reader
+ * needs that the plain path drops.
+ *
+ * 1. **Worded status.** Its theme resolves the {@link SCREEN_READER_GLYPHS}
+ *    table (via `caps.screenReader`), so every inherited code path that writes
+ *    `theme.glyph.success` prints `done` instead of `✓`, `failed` for `✗`, etc.
+ *    Nothing here special-cases it — the glyph table does the work.
+ *
+ * 2. **Announced state.** A screen reader cannot see an in-place live region, so
+ *    each state change is emitted as its own committed line (never a redraw):
+ *    a phase becomes `working: read_file src/x.ts`, a tool run brackets as
+ *    `working: …` → `done …`, and plan progress announces `step 2 of 5: title`.
+ *    Announcements are deduped by phase *identity* so token-count updates within
+ *    the same activity don't repeat a line.
+ *
+ * Everything else — text streaming, `endSegment`, `note`, `preview` — is
+ * inherited unchanged. This is the whole of screen-reader mode: no parallel
+ * path, no behavior change to the plain or TTY renderers.
+ */
+export declare class ScreenReaderRenderer extends PlainRenderer {
+    /** Identity of the last phase announced, so we speak each activity once. */
+    private lastPhaseId;
+    /** Text of the last progress line announced, to avoid repeats. */
+    private lastProgress;
+    constructor(caps: RenderCapabilities, out: RenderStream, err: RenderStream);
+    /**
+     * Announce a phase transition as a committed line. `null`, `awaiting-approval`
+     * (the prompt block is its own announcement), and `calling-tool` (announced by
+     * {@link toolLifecycle}) are silent; repeats of the same activity are deduped.
+     */
+    setPhase(phase: RenderPhase | null): void;
+    /** Announce plan-step progress as `step i of n: title`, deduped. */
+    progress(state: ProgressState | null): void;
+    /**
+     * Bracket a tool call with two committed lines — `working: label` on start,
+     * `done/failed label` on end — so a screen-reader user hears both that a call
+     * began (crucial for long ones) and how it resolved. The end note + honest
+     * duration is the inherited plain behavior; only the start line is added.
+     */
+    toolLifecycle(event: ToolLifecycleEvent): void;
+}

package/dist/render/screen-reader-renderer.js

@@ -0,0 +1,75 @@
+import { PlainRenderer } from "./plain-renderer.js";
+import { describePhase, phaseIdentity } from "./state.js";
+/**
+ * The screen-reader renderer (U.11): {@link PlainRenderer}'s linear,
+ * append-only, zero-cursor-control output — plus two things a screen reader
+ * needs that the plain path drops.
+ *
+ * 1. **Worded status.** Its theme resolves the {@link SCREEN_READER_GLYPHS}
+ *    table (via `caps.screenReader`), so every inherited code path that writes
+ *    `theme.glyph.success` prints `done` instead of `✓`, `failed` for `✗`, etc.
+ *    Nothing here special-cases it — the glyph table does the work.
+ *
+ * 2. **Announced state.** A screen reader cannot see an in-place live region, so
+ *    each state change is emitted as its own committed line (never a redraw):
+ *    a phase becomes `working: read_file src/x.ts`, a tool run brackets as
+ *    `working: …` → `done …`, and plan progress announces `step 2 of 5: title`.
+ *    Announcements are deduped by phase *identity* so token-count updates within
+ *    the same activity don't repeat a line.
+ *
+ * Everything else — text streaming, `endSegment`, `note`, `preview` — is
+ * inherited unchanged. This is the whole of screen-reader mode: no parallel
+ * path, no behavior change to the plain or TTY renderers.
+ */
+export class ScreenReaderRenderer extends PlainRenderer {
+    /** Identity of the last phase announced, so we speak each activity once. */
+    lastPhaseId = "";
+    /** Text of the last progress line announced, to avoid repeats. */
+    lastProgress = "";
+    constructor(caps, out, err) {
+        super(caps, out, err);
+    }
+    /**
+     * Announce a phase transition as a committed line. `null`, `awaiting-approval`
+     * (the prompt block is its own announcement), and `calling-tool` (announced by
+     * {@link toolLifecycle}) are silent; repeats of the same activity are deduped.
+     */
+    setPhase(phase) {
+        const id = phaseIdentity(phase);
+        if (id === this.lastPhaseId)
+            return;
+        this.lastPhaseId = id;
+        if (phase === null ||
+            phase.kind === "awaiting-approval" ||
+            phase.kind === "calling-tool") {
+            return;
+        }
+        this.note(describePhase(phase, this.theme.glyph));
+    }
+    /** Announce plan-step progress as `step i of n: title`, deduped. */
+    progress(state) {
+        if (state === null) {
+            this.lastProgress = "";
+            return;
+        }
+        const line = `step ${state.step} of ${state.of}: ${state.title}`;
+        if (line === this.lastProgress)
+            return;
+        this.lastProgress = line;
+        this.note(line);
+    }
+    /**
+     * Bracket a tool call with two committed lines — `working: label` on start,
+     * `done/failed label` on end — so a screen-reader user hears both that a call
+     * began (crucial for long ones) and how it resolved. The end note + honest
+     * duration is the inherited plain behavior; only the start line is added.
+     */
+    toolLifecycle(event) {
+        if (event.event === "start") {
+            super.toolLifecycle(event); // records the start time (silent in plain)
+            this.note(`${this.theme.glyph.running}: ${event.label}`);
+            return;
+        }
+        super.toolLifecycle(event); // commits `done/failed label (duration)`
+    }
+}

package/dist/render/types.d.ts

@@ -20,8 +20,22 @@ export interface RenderCapabilities {
     color: boolean;
     /** Cursor-control sequences are safe (`tty` and not `TERM=dumb`). */
     cursor: boolean;
-    /** Animation is welcome (`cursor` and CRUXY_NO_SPINNER unset). */
+    /** Animation is welcome (`cursor` and motion is not reduced). */
     spinner: boolean;
+    /**
+     * Motion is reduced (U.11): no spinner animation/timer, no in-place
+     * re-animation — state survives as static text, only movement stops. True
+     * under `CRUXY_NO_SPINNER` (alias) / `NO_MOTION` / `CRUXY_REDUCED_MOTION`, and
+     * implied by `screenReader`. The one axis the spinner gate keys off.
+     */
+    reducedMotion: boolean;
+    /**
+     * Screen-reader mode (U.11): plain, linear, announce-friendly output — no
+     * live-region redraws (each state change is a committed line), no spinners,
+     * status glyphs rendered as words. Opt-in via `CRUXY_SCREEN_READER` /
+     * `ACCESSIBLE`; routes rendering to the linear path regardless of `cursor`.
+     */
+    screenReader: boolean;
     /** Unicode glyphs are safe (U.1) — false under `TERM=dumb` / `CRUXY_ASCII`;
      * independent of `color`. Drives the theme's glyph table, not its stylers. */
     unicode: boolean;

package/dist/sandbox/detect.d.ts

@@ -0,0 +1,22 @@
+import type { SandboxCapability } from "./types.js";
+/**
+ * Runtime detection (C.16): a container runtime is a *capability*, not an
+ * assumption. Presence means both that the binary exists AND its daemon
+ * answers — `docker` installed with a dead daemon is NOT available, and the
+ * caller must fail loud rather than pretend a box exists.
+ */
+/** Injectable probe seam — spawns a short command and reports how it exited. */
+export type RuntimeProbe = (bin: string, args: string[]) => Promise<{
+    code: number | null;
+    stdout: string;
+    stderr: string;
+}>;
+/**
+ * Detect the Docker runtime. `docker version --format {{.Server.Version}}`
+ * exits non-zero when the daemon is unreachable (even though the client is
+ * installed), so a zero exit with a server version is the honest "available"
+ * signal. Memoized for the process; pass a probe (tests) to bypass the cache.
+ */
+export declare function detectDocker(probe?: RuntimeProbe): Promise<SandboxCapability>;
+/** Clear the memoized capability (tests). */
+export declare function resetDetectionCache(): void;

package/dist/sandbox/detect.js

@@ -0,0 +1,67 @@
+import { spawn } from "node:child_process";
+/** Default probe: spawn the binary, capture output, treat a spawn error (e.g.
+ * ENOENT — binary missing) as a non-zero exit rather than a throw. */
+const spawnProbe = (bin, args) => new Promise((resolve) => {
+    let child;
+    try {
+        child = spawn(bin, args);
+    }
+    catch (err) {
+        resolve({ code: null, stdout: "", stderr: err.message });
+        return;
+    }
+    let out = "";
+    let errText = "";
+    let settled = false;
+    const done = (code, stderr = errText) => {
+        if (settled)
+            return;
+        settled = true;
+        resolve({ code, stdout: out, stderr });
+    };
+    // The daemon can hang; a probe must never wedge startup.
+    const timer = setTimeout(() => {
+        child.kill("SIGKILL");
+        done(null, "timed out probing the runtime");
+    }, PROBE_TIMEOUT_MS);
+    timer.unref?.();
+    child.stdout?.on("data", (b) => (out += b.toString("utf8")));
+    child.stderr?.on("data", (b) => (errText += b.toString("utf8")));
+    child.on("error", (err) => done(null, err.message));
+    child.on("close", (code) => {
+        clearTimeout(timer);
+        done(code);
+    });
+});
+const PROBE_TIMEOUT_MS = 5000;
+let cached;
+/**
+ * Detect the Docker runtime. `docker version --format {{.Server.Version}}`
+ * exits non-zero when the daemon is unreachable (even though the client is
+ * installed), so a zero exit with a server version is the honest "available"
+ * signal. Memoized for the process; pass a probe (tests) to bypass the cache.
+ */
+export function detectDocker(probe) {
+    if (probe)
+        return probeDocker(probe);
+    cached ??= probeDocker(spawnProbe);
+    return cached;
+}
+/** Clear the memoized capability (tests). */
+export function resetDetectionCache() {
+    cached = undefined;
+}
+async function probeDocker(probe) {
+    const { code, stdout, stderr } = await probe("docker", [
+        "version",
+        "--format",
+        "{{.Server.Version}}",
+    ]);
+    if (code === 0 && stdout.trim().length > 0) {
+        return { available: true, runtime: "docker" };
+    }
+    const detail = code === null
+        ? "the docker binary is not installed or not on PATH"
+        : (stderr.trim().split("\n")[0] ?? "docker daemon is not reachable");
+    return { available: false, runtime: "docker", detail };
+}

package/dist/sandbox/docker-runtime.d.ts

@@ -0,0 +1,32 @@
+import type { ExecOptions, ExecResult, IsolationPolicy, SandboxRuntime } from "./types.js";
+/**
+ * The shipped {@link SandboxRuntime}: shells out to the `docker` CLI (no SDK —
+ * matches the no-vendor-client ethos). {@link buildRunArgs} is a pure function
+ * so the entire isolation posture can be asserted from the argv without a live
+ * daemon; `exec` spawns docker, captures bias-capped output, enforces the
+ * wall-clock timeout by force-killing the container, and maps the result.
+ *
+ * The exit code from `docker run` is the command's own — EXCEPT `125`, which
+ * docker reserves for "the run itself failed" (bad flags, daemon error): that,
+ * and a spawn failure, are the only container-start failures, surfaced as a
+ * coded {@link sandboxExec} error. An ordinary non-zero command exit is a
+ * normal result (exit code is truth), never a thrown error and never a host run.
+ */
+export declare class DockerRuntime implements SandboxRuntime {
+    private readonly bin;
+    readonly name = "docker";
+    constructor(bin?: string);
+    ensureImage(image: string, onPull?: () => void): Promise<void>;
+    /** Run a non-container docker subcommand to completion, capturing output. */
+    private simpleRun;
+    exec(command: string, policy: IsolationPolicy, opts: ExecOptions): Promise<ExecResult>;
+    private run;
+    /** Best-effort container teardown after a timeout kill. */
+    private forceRemove;
+}
+/**
+ * Build the `docker run` argv from a resolved policy. Pure and total — the
+ * single source of truth for the isolation boundary, asserted directly in
+ * tests. Order is stable for readability; docker is order-insensitive for flags.
+ */
+export declare function buildRunArgs(policy: IsolationPolicy, container: string, command: string): string[];

package/dist/sandbox/docker-runtime.js

@@ -0,0 +1,263 @@
+import { spawn } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { sandboxExec, sandboxImage } from "../errors/index.js";
+/**
+ * The shipped {@link SandboxRuntime}: shells out to the `docker` CLI (no SDK —
+ * matches the no-vendor-client ethos). {@link buildRunArgs} is a pure function
+ * so the entire isolation posture can be asserted from the argv without a live
+ * daemon; `exec` spawns docker, captures bias-capped output, enforces the
+ * wall-clock timeout by force-killing the container, and maps the result.
+ *
+ * The exit code from `docker run` is the command's own — EXCEPT `125`, which
+ * docker reserves for "the run itself failed" (bad flags, daemon error): that,
+ * and a spawn failure, are the only container-start failures, surfaced as a
+ * coded {@link sandboxExec} error. An ordinary non-zero command exit is a
+ * normal result (exit code is truth), never a thrown error and never a host run.
+ */
+export class DockerRuntime {
+    bin;
+    name = "docker";
+    constructor(bin = "docker") {
+        this.bin = bin;
+    }
+    async ensureImage(image, onPull) {
+        // Present locally already? `docker image inspect` exits 0 when it is.
+        const inspect = await this.simpleRun(["image", "inspect", image]);
+        if (inspect.code === 0)
+            return;
+        // Not present — pull it (surface once), and fail loud if the pull fails.
+        onPull?.();
+        const pull = await this.simpleRun(["pull", image]);
+        if (pull.code !== 0) {
+            throw sandboxImage(image, pull.stderr.trim() || pull.stdout.trim());
+        }
+    }
+    /** Run a non-container docker subcommand to completion, capturing output. */
+    simpleRun(args) {
+        return new Promise((resolve) => {
+            let child;
+            try {
+                child = spawn(this.bin, args);
+            }
+            catch (err) {
+                resolve({ code: null, stdout: "", stderr: err.message });
+                return;
+            }
+            let out = "";
+            let errText = "";
+            child.stdout?.on("data", (b) => (out += b.toString("utf8")));
+            child.stderr?.on("data", (b) => (errText += b.toString("utf8")));
+            child.on("error", (err) => resolve({ code: null, stdout: out, stderr: err.message }));
+            child.on("close", (code) => resolve({ code, stdout: out, stderr: errText }));
+        });
+    }
+    exec(command, policy, opts) {
+        const container = `cruxy-sbx-${randomUUID()}`;
+        const argv = buildRunArgs(policy, container, command);
+        return this.run(argv, container, opts);
+    }
+    run(argv, container, opts) {
+        const startedAt = Date.now();
+        return new Promise((resolve, reject) => {
+            const capture = new OutputCapture(opts.maxOutputBytes, opts.capture);
+            let child;
+            try {
+                // `detached` groups the docker client so a timeout kills the whole tree.
+                child = spawn(this.bin, argv, { detached: true });
+            }
+            catch (err) {
+                reject(sandboxExec(err));
+                return;
+            }
+            child.stdout?.on("data", (b) => capture.push(b));
+            child.stderr?.on("data", (b) => capture.push(b));
+            let settled = false;
+            const timer = setTimeout(() => {
+                if (settled)
+                    return;
+                settled = true;
+                killTree(child.pid);
+                // Killing the client may orphan the container — force-remove it too.
+                this.forceRemove(container);
+                const { output, truncated } = capture.result();
+                resolve({
+                    exitCode: null,
+                    output,
+                    outputTruncated: truncated,
+                    durationMs: Date.now() - startedAt,
+                    timedOut: true,
+                });
+            }, opts.timeoutMs);
+            child.on("error", (err) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                reject(sandboxExec(err));
+            });
+            child.on("close", (code) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                // 125 = `docker run` itself failed (not the inner command) → the
+                // container never really started. Fail loud, never fabricate a result.
+                if (code === 125) {
+                    const { output } = capture.result();
+                    reject(sandboxExec(output.trim() || "docker run exited 125"));
+                    return;
+                }
+                const { output, truncated } = capture.result();
+                resolve({
+                    exitCode: code,
+                    output,
+                    outputTruncated: truncated,
+                    durationMs: Date.now() - startedAt,
+                    timedOut: false,
+                });
+            });
+        });
+    }
+    /** Best-effort container teardown after a timeout kill. */
+    forceRemove(container) {
+        try {
+            const rm = spawn(this.bin, ["rm", "-f", container], {
+                stdio: "ignore",
+                detached: true,
+            });
+            rm.on("error", () => { });
+            rm.unref();
+        }
+        catch {
+            // Nothing more we can do; the container may already be gone.
+        }
+    }
+}
+/**
+ * Build the `docker run` argv from a resolved policy. Pure and total — the
+ * single source of truth for the isolation boundary, asserted directly in
+ * tests. Order is stable for readability; docker is order-insensitive for flags.
+ */
+export function buildRunArgs(policy, container, command) {
+    return [
+        "run",
+        "--rm", // auto-remove the container when it exits
+        "--name",
+        container, // so a timeout can force-remove it
+        ...networkArgs(policy.network),
+        "--user",
+        policy.user, // non-root
+        "--read-only", // root filesystem is read-only …
+        "--tmpfs",
+        `${policy.tmpfs}:rw,nosuid,nodev,size=64m`, // … except an in-memory tmp
+        "-v",
+        mountSpec(policy.workdir), // ONLY the workdir, read-write
+        ...policy.mounts.flatMap((m) => ["-v", mountSpec(m)]),
+        "-w",
+        policy.workdir.target,
+        "--memory",
+        policy.memory,
+        "--memory-swap",
+        policy.memory, // == memory disables swap (no swap-escape of the cap)
+        "--pids-limit",
+        String(policy.pids),
+        "--cpus",
+        String(policy.cpus),
+        "--security-opt",
+        "no-new-privileges", // no setuid privilege escalation
+        "--cap-drop",
+        "ALL", // drop every Linux capability
+        policy.image,
+        "sh",
+        "-c",
+        command,
+    ];
+}
+/**
+ * Egress flags. `none` denies all network (the default). Widening is a
+ * deliberate act: `full` uses the default bridge; `host-loopback` adds a
+ * host-gateway alias (best-effort — strict loopback-only firewalling is left
+ * for a later build). Anything but `none` can only come from explicit config.
+ */
+function networkArgs(network) {
+    switch (network) {
+        case "none":
+            return ["--network", "none"];
+        case "host-loopback":
+            return [
+                "--network",
+                "bridge",
+                "--add-host",
+                "host.docker.internal:host-gateway",
+            ];
+        case "full":
+            return ["--network", "bridge"];
+    }
+}
+function mountSpec(m) {
+    return `${m.source}:${m.target}:${m.readonly ? "ro" : "rw"}`;
+}
+/**
+ * Bias-capped output capture: `head` keeps the START and stops once the cap is
+ * hit (matches `run_command`); `tail` keeps the END, where failures live
+ * (matches `run_tests`). Bounded memory either way.
+ */
+class OutputCapture {
+    cap;
+    bias;
+    chunks = [];
+    bytes = 0;
+    truncated = false;
+    constructor(cap, bias) {
+        this.cap = cap;
+        this.bias = bias;
+    }
+    push(buf) {
+        if (this.bias === "head") {
+            if (this.truncated)
+                return;
+            const room = this.cap - this.bytes;
+            if (buf.length <= room) {
+                this.chunks.push(buf);
+                this.bytes += buf.length;
+            }
+            else {
+                if (room > 0) {
+                    this.chunks.push(buf.subarray(0, room));
+                    this.bytes += room;
+                }
+                this.truncated = true;
+            }
+            return;
+        }
+        // tail: append, dropping whole head chunks while the remainder still meets
+        // the cap; a final exact trim happens in result().
+        this.chunks.push(buf);
+        this.bytes += buf.length;
+        while (this.chunks.length > 1 &&
+            this.bytes - this.chunks[0].length >= this.cap) {
+            this.bytes -= this.chunks[0].length;
+            this.chunks.shift();
+            this.truncated = true;
+        }
+    }
+    result() {
+        let all = Buffer.concat(this.chunks);
+        if (this.bias === "tail" && all.length > this.cap) {
+            all = all.subarray(all.length - this.cap);
+            this.truncated = true;
+        }
+        return { output: all.toString("utf8"), truncated: this.truncated };
+    }
+}
+/** Kill the docker client's process group (POSIX; matches run_command). */
+function killTree(pid) {
+    if (pid === undefined)
+        return;
+    try {
+        process.kill(-pid, "SIGKILL");
+    }
+    catch {
+        // Already exited, or no group — nothing to kill.
+    }
+}

package/dist/sandbox/index.d.ts

@@ -0,0 +1,7 @@
+export * from "./types.js";
+export { detectDocker, resetDetectionCache } from "./detect.js";
+export type { RuntimeProbe } from "./detect.js";
+export { DockerRuntime, buildRunArgs } from "./docker-runtime.js";
+export { buildPolicy } from "./policy.js";
+export { SandboxService } from "./service.js";
+export type { SandboxReporter, SandboxServiceDeps } from "./service.js";

package/dist/sandbox/index.js

@@ -0,0 +1,5 @@
+export * from "./types.js";
+export { detectDocker, resetDetectionCache } from "./detect.js";
+export { DockerRuntime, buildRunArgs } from "./docker-runtime.js";
+export { buildPolicy } from "./policy.js";
+export { SandboxService } from "./service.js";

package/dist/sandbox/policy.d.ts

@@ -0,0 +1,17 @@
+import type { SandboxConfig } from "../config/index.js";
+import type { IsolationPolicy } from "./types.js";
+/**
+ * Turn a validated {@link SandboxConfig} + the run's cwd into a fully-resolved
+ * {@link IsolationPolicy}. This is where the security posture is decided, and
+ * every default here is deny/minimal:
+ *
+ * - the ONLY read-write mount is the project workdir (at its identical absolute
+ *   path, so paths stay coherent with the host and the C.32 checkpoint);
+ * - extra mounts come solely from `sandbox.mounts` (explicit by construction),
+ *   and a mount of the docker socket, the cruxy home, or the user's home root
+ *   is rejected — those are the escape hatches we refuse to open;
+ * - the container runs as the host's non-root uid:gid so mounted edits are
+ *   writable and never left root-owned;
+ * - network defaults to `none`; any widening can only come from explicit config.
+ */
+export declare function buildPolicy(cfg: SandboxConfig, cwd: string): IsolationPolicy;