zerobox 0.1.4 → 0.1.6

package/README.md

@@ -1,5 +1,5 @@
 <div align="center">
-  <h1>🫙 zerobox</h1>
+  <h1>zerobox</h1>
   <p><strong>Run any command in a sandbox. Control what it can read, write, and connect to.</strong></p>
   <p>
     <a href="https://www.npmjs.com/package/zerobox" target="_blank">
@@ -18,11 +18,13 @@
 
 Cross-platform process sandboxing powered by [OpenAI Codex](https://github.com/openai/codex)'s production sandbox runtime. Uses seatbelt on macOS and bubblewrap + seccomp on Linux.
 
-- 🔒 **Deny by default.** Writes and network are blocked unless you allow them.
+- 🔒 **Deny by default.** Writes, network, and environment variables are blocked unless you allow them.
 - 📁 **File access control.** Allow or deny reads and writes to specific paths.
 - 🌐 **Network filtering.** Allow or deny by domain, powered by a real HTTP/SOCKS proxy.
+- 🔑 **Secret management.** Pass API keys to specific hosts without exposing them to the sandboxed process.
+- 🧹 **Clean environment.** Only essential env vars (PATH, HOME, etc.) are inherited by default.
 - 🧩 **TypeScript SDK.** `import { Sandbox } from "zerobox"` with a Deno-style API.
-- 🖥️ **Cross-platform.** macOS, Linux, and Windows.
+- 🖥️ **Cross-platform.** macOS and Linux. Windows support planned.
 - 📦 **Single binary.** No runtime dependencies, no Docker, no VMs.
 
 <p align="center">
@@ -31,45 +33,193 @@ Cross-platform process sandboxing powered by [OpenAI Codex](https://github.com/o
 
 ## Install
 
+### Shell (macOS / Linux)
+
 ```bash
-# Shell (macOS / Linux)
 curl -fsSL https://raw.githubusercontent.com/afshinm/zerobox/main/install.sh | sh
+```
+
+### npm
 
-# npm
+```bash
 npm install -g zerobox
+```
 
-# From source
+### From source
+
+```bash
 git clone https://github.com/afshinm/zerobox && cd zerobox
 ./scripts/sync.sh && cargo build --release -p zerobox
 ```
 
 ## Quick start
 
+Run a command with no writes and no network (the default):
+
 ```bash
-# Writes and network are blocked by default
 zerobox -- node -e "console.log('hello')"
+```
 
-# Allow writes to a directory
+Allow writes to a directory:
+
+```bash
 zerobox --allow-write=. -- node script.js
+```
+
+Allow network to specific domains:
 
-# Allow network to specific domains
+```bash
 zerobox --allow-net=api.openai.com -- node agent.js
 ```
 
+Pass a secret to a specific host (the process never sees the real value):
+
+```bash
+zerobox --secret OPENAI_API_KEY=sk-proj-123 --secret-host OPENAI_API_KEY=api.openai.com -- node agent.js
+```
+
+Same thing with the TypeScript SDK:
+
+```ts
+import { Sandbox } from "zerobox";
+
+const sandbox = Sandbox.create({
+  secrets: {
+    OPENAI_API_KEY: {
+      value: process.env.OPENAI_API_KEY,
+      hosts: ["api.openai.com"],
+    },
+  },
+});
+
+const output = await sandbox.sh`node agent.js`.text();
+```
+
+## Secrets
+
+Secrets are API keys, tokens, or credentials that should never be visible inside the sandbox. The sandboxed process sees a random placeholder in the environment variable. The real value is substituted at the network proxy level, only for approved hosts.
+
+```
+sandbox process: echo $OPENAI_API_KEY
+  -> ZEROBOX_SECRET_a1b2c3d4e5...  (placeholder)
+
+sandbox process: curl -H "Authorization: Bearer $OPENAI_API_KEY" https://api.openai.com/...
+  -> proxy intercepts, replaces placeholder with real key
+  -> server receives: Authorization: Bearer sk-proj-123
+```
+
+### CLI
+
+Pass a secret with `--secret` and restrict it to specific hosts with `--secret-host`:
+
+```bash
+zerobox --secret OPENAI_API_KEY=sk-proj-123 --secret-host OPENAI_API_KEY=api.openai.com -- node app.js
+```
+
+Without `--secret-host`, the secret is substituted for all hosts:
+
+```bash
+zerobox --secret TOKEN=abc123 -- node app.js
+```
+
+Multiple secrets with different hosts:
+
+```bash
+zerobox \
+  --secret OPENAI_API_KEY=sk-proj-123 --secret-host OPENAI_API_KEY=api.openai.com \
+  --secret GITHUB_TOKEN=ghp-456 --secret-host GITHUB_TOKEN=api.github.com \
+  -- node app.js
+```
+
+### Node.js proxy support
+
+Node.js `fetch` does not respect `HTTPS_PROXY` by default. When running Node.js inside a sandbox with secrets, add `--use-env-proxy`:
+
+```bash
+zerobox --secret API_KEY=sk-123 --secret-host API_KEY=api.openai.com \
+  -- node --use-env-proxy app.js
+```
+
+Programs that use `curl`, Python `requests`, or other HTTP clients that respect proxy env vars work without this flag.
+
+### TypeScript SDK
+
+```ts
+import { Sandbox } from "zerobox";
+
+const sandbox = Sandbox.create({
+  secrets: {
+    OPENAI_API_KEY: {
+      value: process.env.OPENAI_API_KEY,
+      hosts: ["api.openai.com"],
+    },
+    GITHUB_TOKEN: {
+      value: process.env.GITHUB_TOKEN,
+      hosts: ["api.github.com"],
+    },
+  },
+});
+
+await sandbox.sh`node agent.js`.text();
+```
+
+## Environment variables
+
+By default, only essential variables are inherited: `PATH`, `HOME`, `USER`, `SHELL`, `TERM`, `LANG`. Everything else is blocked.
+
+### Inherit all parent env vars
+
+```bash
+zerobox --allow-env -- node app.js
+```
+
+### Inherit specific vars only
+
+```bash
+zerobox --allow-env=PATH,HOME,DATABASE_URL -- node app.js
+```
+
+### Block specific vars
+
+```bash
+zerobox --allow-env --deny-env=AWS_SECRET_ACCESS_KEY -- node app.js
+```
+
+### Set explicit env vars
+
+```bash
+zerobox --env NODE_ENV=production --env DEBUG=false -- node app.js
+```
+
+### TypeScript SDK
+
+```ts
+const sandbox = Sandbox.create({
+  env: { NODE_ENV: "production" },
+  allowEnv: ["PATH", "HOME"],
+  denyEnv: ["AWS_SECRET_ACCESS_KEY"],
+});
+```
+
 ## Examples
 
 ### Run AI-generated code safely
 
-An LLM generates code. You need to execute it without risking file corruption, data exfiltration, or network abuse.
+An LLM generates code. Run it without risking file corruption or data exfiltration.
 
 ```bash
-# LLM writes code to /tmp/task.py. Run it with no writes, no network.
 zerobox -- python3 /tmp/task.py
+```
 
-# Allow writes only to an output directory
+Allow writes only to an output directory:
+
+```bash
 zerobox --allow-write=/tmp/output -- python3 /tmp/task.py
+```
+
+Allow the script to call a specific API:
 
-# Allow the script to call a specific API
+```bash
 zerobox --allow-write=/tmp/output --allow-net=api.openai.com -- python3 /tmp/task.py
 ```
 
@@ -87,20 +237,6 @@ const result = await sandbox.sh`python3 /tmp/task.py`.output();
 console.log(result.code, result.stdout);
 ```
 
-### Sandbox a browser agent
-
-Use [LightPanda](https://lightpanda.io), a headless browser, for fully sandboxed web browsing. The agent can only reach the domains you allow.
-
-```bash
-# Fetch a page as markdown (only example.com is reachable)
-zerobox --allow-net=example.com -- lightpanda fetch --dump markdown https://example.com
-
-# Allow write access for saving results
-zerobox --allow-net=example.com --allow-write=/tmp -- lightpanda fetch --dump html https://example.com
-```
-
-> **Note:** GUI browsers like Chrome and Firefox cannot run inside the sandbox. They require macOS WindowServer access and Unix socket IPC that the sandbox blocks by design. Use a headless engine like LightPanda, or run the browser outside the sandbox and connect via CDP.
-
 ### Restrict LLM tool calls
 
 Each tool call can be sandboxed individually. The agent runs normally. Only the dangerous operations are sandboxed.
@@ -108,24 +244,20 @@ Each tool call can be sandboxed individually. The agent runs normally. Only the
 ```ts
 import { Sandbox } from "zerobox";
 
-// Each tool gets its own sandbox with minimum permissions.
-const reader = Sandbox.create();                               // read-only
-const writer = Sandbox.create({ allowWrite: ["/tmp"] });       // writes to /tmp
-const fetcher = Sandbox.create({ allowNet: ["example.com"] }); // one domain
+const reader = Sandbox.create();
+const writer = Sandbox.create({ allowWrite: ["/tmp"] });
+const fetcher = Sandbox.create({ allowNet: ["example.com"] });
 
-// Read a file inside the sandbox
 const data = await reader.js`
   const content = require("fs").readFileSync("/tmp/input.txt", "utf8");
   console.log(JSON.stringify({ content }));
 `.json();
 
-// Write a file (only /tmp is writable)
 await writer.js`
   require("fs").writeFileSync("/tmp/output.txt", "result");
   console.log("ok");
 `.text();
 
-// Fetch a URL (only example.com is reachable)
 const result = await fetcher.js`
   const res = await fetch("https://example.com");
   console.log(JSON.stringify({ status: res.status }));
@@ -133,7 +265,8 @@ const result = await fetcher.js`
 ```
 
 Full working examples:
-- [`examples/ai-agent`](examples/ai-agent) -- Vercel AI SDK with sandboxed tools
+- [`examples/ai-agent-sandboxed`](examples/ai-agent-sandboxed) -- Entire agent process sandboxed with secrets (API key never visible)
+- [`examples/ai-agent`](examples/ai-agent) -- Vercel AI SDK with per-tool sandboxing and secrets
 - [`examples/workflow`](examples/workflow) -- [Vercel Workflow](https://useworkflow.dev/) with sandboxed durable steps
 
 ### Protect your repo during builds
@@ -141,48 +274,65 @@ Full working examples:
 Run package installs and build scripts without risking your `.git` history or config files.
 
 ```bash
-# npm install can write to node_modules but not .git or .env
 zerobox --allow-write=./node_modules,./package-lock.json --deny-write=./.git,./.env -- npm install
+```
+
+Run a build script with network access:
 
-# Run a build script with network access for downloading deps
+```bash
 zerobox --allow-write=./dist --allow-net -- npm run build
+```
 
-# Run tests with no network (catch accidental external calls)
+Run tests with no network (catch accidental external calls):
+
+```bash
 zerobox --allow-write=/tmp -- npm test
 ```
 
-## SDK (TypeScript)
+## SDK reference
 
 ```bash
 npm install zerobox
 ```
 
+### Shell commands
+
 ```ts
 import { Sandbox } from "zerobox";
 
-const sandbox = Sandbox.create({
-  allowWrite: ["/tmp"],
-  allowNet: ["example.com"],
-});
-
-// Shell commands via tagged template
+const sandbox = Sandbox.create({ allowWrite: ["/tmp"] });
 const output = await sandbox.sh`echo hello`.text();
+```
+
+### JSON output
 
-// Parse JSON output
+```ts
 const data = await sandbox.sh`cat data.json`.json();
+```
 
-// Raw output (doesn't throw on non-zero exit)
+### Raw output (doesn't throw on non-zero exit)
+
+```ts
 const result = await sandbox.sh`exit 42`.output();
 // { code: 42, stdout: "", stderr: "" }
+```
+
+### Explicit command + args
 
-// Explicit command + args
+```ts
 await sandbox.exec("node", ["-e", "console.log('hi')"]).text();
+```
 
-// Cancellation
-const controller = new AbortController();
-await sandbox.sh`sleep 60`.text({ signal: controller.signal });
+### Inline JavaScript
+
+```ts
+const data = await sandbox.js`
+  console.log(JSON.stringify({ sum: 1 + 2 }));
+`.json();
 ```
 
+### Error handling
+
 Non-zero exit codes throw `SandboxCommandError`:
 
 ```ts
@@ -194,11 +344,18 @@ try {
 } catch (e) {
   if (e instanceof SandboxCommandError) {
     console.log(e.code);   // 1
-    console.log(e.stderr);  // error output
+    console.log(e.stderr);
   }
 }
 ```
 
+### Cancellation
+
+```ts
+const controller = new AbortController();
+await sandbox.sh`sleep 60`.text({ signal: controller.signal });
+```
+
 ## Performance
 
 Sandbox overhead is minimal, typically ~10ms and ~7MB:
@@ -219,7 +376,7 @@ Sandbox overhead is minimal, typically ~10ms and ~7MB:
 |----------|---------|--------|
 | macOS | Seatbelt (`sandbox-exec`) | Fully supported |
 | Linux | Bubblewrap + Seccomp + Namespaces | Fully supported |
-| Windows | Restricted Tokens + ACLs + Firewall | Supported (not yet tested in CI) |
+| Windows | Restricted Tokens + ACLs + Firewall | Planned |
 
 ## CLI reference
 
@@ -231,7 +388,12 @@ Sandbox overhead is minimal, typically ~10ms and ~7MB:
 | `--deny-write <paths>` | `--deny-write=./.git` | Block writing to these paths. Takes precedence over `--allow-write`. |
 | `--allow-net [domains]` | `--allow-net=example.com` | Allow outbound network. Without a value, allows all domains. Default: no network. |
 | `--deny-net <domains>` | `--deny-net=evil.com` | Block network to these domains. Takes precedence over `--allow-net`. |
-| `-A`, `--allow-all` | `-A` | Grant all permissions. No sandbox enforcement. |
+| `--env <KEY=VALUE>` | `--env NODE_ENV=prod` | Set env var in the sandbox. Can be repeated. |
+| `--allow-env [keys]` | `--allow-env=PATH,HOME` | Inherit parent env vars. Without a value, inherits all. Default: only PATH, HOME, USER, SHELL, TERM, LANG. |
+| `--deny-env <keys>` | `--deny-env=SECRET` | Drop these parent env vars. Takes precedence over `--allow-env`. |
+| `--secret <KEY=VALUE>` | `--secret API_KEY=sk-123` | Pass a secret. The process sees a placeholder; the real value is injected at the proxy for approved hosts. |
+| `--secret-host <KEY=HOSTS>` | `--secret-host API_KEY=api.openai.com` | Restrict a secret to specific hosts. Without this, the secret is substituted for all hosts. |
+| `-A`, `--allow-all` | `-A` | Grant all filesystem and network permissions. Env and secrets still apply. |
 | `--no-sandbox` | `--no-sandbox` | Disable the sandbox entirely. |
 | `-C <dir>` | `-C /workspace` | Set working directory for the sandboxed command. |
 | `-V`, `--version` | `--version` | Print version. |

package/dist/flags.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"flags.d.ts","sourceRoot":"","sources":["../src/flags.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,2CAA2C;AAC3C,wBAAgB,UAAU,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,EAAE,CAwC5D"}
+{"version":3,"file":"flags.d.ts","sourceRoot":"","sources":["../src/flags.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,2CAA2C;AAC3C,wBAAgB,UAAU,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,EAAE,CA+E5D"}

package/dist/flags.js

@@ -1,34 +1,76 @@
 /** Build CLI flags from SandboxOptions. */
 export function buildFlags(options) {
     const flags = [];
+    // Collect secret hosts for network permission merging.
+    const secretHosts = [];
+    if (options.secrets) {
+        for (const [key, config] of Object.entries(options.secrets)) {
+            flags.push("--secret", `${key}=${config.value}`);
+            if (config.hosts.length > 0) {
+                flags.push("--secret-host", `${key}=${config.hosts.join(",")}`);
+                secretHosts.push(...config.hosts);
+            }
+        }
+    }
     if (options.allowAll) {
         flags.push("--allow-all");
-        return flags;
+        // Still emit env/secret flags — allowAll controls fs/net, not env.
     }
-    if (options.noSandbox) {
+    else if (options.noSandbox) {
         flags.push("--no-sandbox");
-        return flags;
-    }
-    if (options.allowRead?.length) {
-        flags.push(`--allow-read=${options.allowRead.join(",")}`);
-    }
-    if (options.denyRead?.length) {
-        flags.push(`--deny-read=${options.denyRead.join(",")}`);
     }
-    if (options.allowWrite?.length) {
-        flags.push(`--allow-write=${options.allowWrite.join(",")}`);
+    else {
+        if (options.allowRead?.length) {
+            flags.push(`--allow-read=${options.allowRead.join(",")}`);
+        }
+        if (options.denyRead?.length) {
+            flags.push(`--deny-read=${options.denyRead.join(",")}`);
+        }
+        if (options.allowWrite?.length) {
+            flags.push(`--allow-write=${options.allowWrite.join(",")}`);
+        }
+        if (options.denyWrite?.length) {
+            flags.push(`--deny-write=${options.denyWrite.join(",")}`);
+        }
+        // Merge secret hosts into allowNet (secrets auto-enable network for their hosts).
+        // The CLI also does this, but we emit it here so --allow-net reflects the full picture.
+        let effectiveAllowNet = options.allowNet;
+        if (secretHosts.length > 0) {
+            if (effectiveAllowNet === true) {
+                // Already allowing all network.
+            }
+            else if (Array.isArray(effectiveAllowNet)) {
+                effectiveAllowNet = [...effectiveAllowNet, ...secretHosts];
+            }
+            else {
+                // Network was not explicitly enabled; secrets handle it via --secret-host.
+                // Don't emit --allow-net here — the CLI enables network implicitly for secret hosts.
+            }
+        }
+        if (effectiveAllowNet === true) {
+            flags.push("--allow-net");
+        }
+        else if (Array.isArray(effectiveAllowNet) && effectiveAllowNet.length > 0) {
+            flags.push(`--allow-net=${effectiveAllowNet.join(",")}`);
+        }
+        if (options.denyNet?.length) {
+            flags.push(`--deny-net=${options.denyNet.join(",")}`);
+        }
     }
-    if (options.denyWrite?.length) {
-        flags.push(`--deny-write=${options.denyWrite.join(",")}`);
+    // Env flags — emitted for all modes (including allowAll).
+    if (options.allowEnv === true) {
+        flags.push("--allow-env");
     }
-    if (options.allowNet === true) {
-        flags.push("--allow-net");
+    else if (Array.isArray(options.allowEnv) && options.allowEnv.length > 0) {
+        flags.push(`--allow-env=${options.allowEnv.join(",")}`);
     }
-    else if (Array.isArray(options.allowNet) && options.allowNet.length > 0) {
-        flags.push(`--allow-net=${options.allowNet.join(",")}`);
+    if (options.denyEnv?.length) {
+        flags.push(`--deny-env=${options.denyEnv.join(",")}`);
     }
-    if (options.denyNet?.length) {
-        flags.push(`--deny-net=${options.denyNet.join(",")}`);
+    if (options.env) {
+        for (const [key, value] of Object.entries(options.env)) {
+            flags.push("--env", `${key}=${value}`);
+        }
     }
     if (options.cwd) {
         flags.push("-C", options.cwd);

package/dist/flags.js.map

@@ -1 +1 @@
-{"version":3,"file":"flags.js","sourceRoot":"","sources":["../src/flags.ts"],"names":[],"mappings":"AAEA,2CAA2C;AAC3C,MAAM,UAAU,UAAU,CAAC,OAAuB;IAChD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,gBAAgB,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,eAAe,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,iBAAiB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,gBAAgB,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC5B,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1E,KAAK,CAAC,IAAI,CAAC,eAAe,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,cAAc,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"flags.js","sourceRoot":"","sources":["../src/flags.ts"],"names":[],"mappings":"AAEA,2CAA2C;AAC3C,MAAM,UAAU,UAAU,CAAC,OAAuB;IAChD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,uDAAuD;IACvD,MAAM,WAAW,GAAa,EAAE,CAAC;IAEjC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5D,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,GAAG,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;YACjD,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,KAAK,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAChE,WAAW,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1B,mEAAmE;IACrE,CAAC;SAAM,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC7B,CAAC;SAAM,CAAC;QACN,IAAI,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,gBAAgB,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,eAAe,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,iBAAiB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,gBAAgB,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,kFAAkF;QAClF,wFAAwF;QACxF,IAAI,iBAAiB,GAAG,OAAO,CAAC,QAAQ,CAAC;QACzC,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;gBAC/B,gCAAgC;YAClC,CAAC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBAC5C,iBAAiB,GAAG,CAAC,GAAG,iBAAiB,EAAE,GAAG,WAAW,CAAC,CAAC;YAC7D,CAAC;iBAAM,CAAC;gBACN,2EAA2E;gBAC3E,qFAAqF;YACvF,CAAC;QACH,CAAC;QAED,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC5B,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5E,KAAK,CAAC,IAAI,CAAC,eAAe,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,cAAc,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,0DAA0D;IAC1D,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC5B,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1E,KAAK,CAAC,IAAI,CAAC,eAAe,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,cAAc,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvD,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/flags.test.js

@@ -4,7 +4,7 @@ describe("buildFlags", () => {
     it("returns empty array for default options", () => {
         expect(buildFlags({})).toEqual([]);
     });
-    it("returns --allow-all and nothing else", () => {
+    it("returns --allow-all without fs/net flags", () => {
         expect(buildFlags({ allowAll: true, allowWrite: ["/tmp"] })).toEqual(["--allow-all"]);
     });
     it("returns --no-sandbox and nothing else", () => {
@@ -66,5 +66,116 @@ describe("buildFlags", () => {
     it("skips empty arrays", () => {
         expect(buildFlags({ allowRead: [], denyRead: [], allowWrite: [], denyWrite: [] })).toEqual([]);
     });
+    // ── env ──
+    it("builds --env flags", () => {
+        expect(buildFlags({ env: { FOO: "bar" } })).toEqual(["--env", "FOO=bar"]);
+    });
+    it("builds multiple --env flags", () => {
+        const flags = buildFlags({ env: { A: "1", B: "2" } });
+        expect(flags).toContain("--env");
+        expect(flags).toContain("A=1");
+        expect(flags).toContain("B=2");
+    });
+    it("builds --allow-env as boolean", () => {
+        expect(buildFlags({ allowEnv: true })).toEqual(["--allow-env"]);
+    });
+    it("builds --allow-env with keys", () => {
+        expect(buildFlags({ allowEnv: ["PATH", "HOME"] })).toEqual(["--allow-env=PATH,HOME"]);
+    });
+    it("builds --deny-env", () => {
+        expect(buildFlags({ denyEnv: ["SECRET"] })).toEqual(["--deny-env=SECRET"]);
+    });
+    // ── secrets ──
+    it("emits --secret and --secret-host flags", () => {
+        const flags = buildFlags({
+            secrets: { API_KEY: { value: "sk-123", hosts: ["api.example.com"] } },
+        });
+        expect(flags).toContain("--secret");
+        expect(flags).toContain("API_KEY=sk-123");
+        expect(flags).toContain("--secret-host");
+        expect(flags).toContain("API_KEY=api.example.com");
+    });
+    it("secret without hosts emits only --secret", () => {
+        const flags = buildFlags({
+            secrets: { TOKEN: { value: "abc", hosts: [] } },
+        });
+        expect(flags).toContain("--secret");
+        expect(flags).toContain("TOKEN=abc");
+        expect(flags).not.toContain("--secret-host");
+    });
+    it("merges secret hosts with existing allowNet domains", () => {
+        const flags = buildFlags({
+            allowNet: ["other.com"],
+            secrets: { KEY: { value: "v", hosts: ["api.com"] } },
+        });
+        expect(flags).toContain("--allow-net=other.com,api.com");
+    });
+    it("secrets with allowNet: true do not duplicate net flag", () => {
+        const flags = buildFlags({
+            allowNet: true,
+            secrets: { KEY: { value: "v", hosts: ["api.com"] } },
+        });
+        expect(flags).toContain("--allow-net");
+        expect(flags.filter((f) => f.startsWith("--allow-net")).length).toBe(1);
+    });
+    it("multiple secrets produce multiple --secret flags", () => {
+        const flags = buildFlags({
+            secrets: {
+                A: { value: "v1", hosts: ["h1.com"] },
+                B: { value: "v2", hosts: ["h2.com"] },
+            },
+        });
+        expect(flags.filter((f) => f === "--secret").length).toBe(2);
+        expect(flags).toContain("A=v1");
+        expect(flags).toContain("B=v2");
+    });
+    it("env flags are emitted even with allowAll", () => {
+        const flags = buildFlags({ allowAll: true, env: { FOO: "bar" } });
+        expect(flags).toContain("--allow-all");
+        expect(flags).toContain("--env");
+        expect(flags).toContain("FOO=bar");
+    });
+    it("secrets are emitted even with allowAll", () => {
+        const flags = buildFlags({
+            allowAll: true,
+            secrets: { KEY: { value: "v", hosts: ["h.com"] } },
+        });
+        expect(flags).toContain("--allow-all");
+        expect(flags).toContain("--secret");
+        expect(flags).toContain("KEY=v");
+    });
+    it("denyEnv combined with secrets", () => {
+        const flags = buildFlags({
+            denyEnv: ["HOME"],
+            secrets: { KEY: { value: "v", hosts: ["h.com"] } },
+        });
+        expect(flags).toContain("--deny-env=HOME");
+        expect(flags).toContain("--secret");
+        expect(flags).toContain("KEY=v");
+    });
+    it("noSandbox still emits secret flags", () => {
+        const flags = buildFlags({
+            noSandbox: true,
+            secrets: { KEY: { value: "v", hosts: ["h.com"] } },
+        });
+        expect(flags).toContain("--no-sandbox");
+        expect(flags).toContain("--secret");
+        expect(flags).toContain("KEY=v");
+    });
+    it("secrets without allowNet do not emit --allow-net", () => {
+        const flags = buildFlags({
+            secrets: { KEY: { value: "v", hosts: ["h.com"] } },
+        });
+        expect(flags).toContain("--secret");
+        expect(flags).toContain("--secret-host");
+        // No --allow-net — CLI handles network implicitly for secret hosts.
+        expect(flags.filter((f) => f.startsWith("--allow-net")).length).toBe(0);
+    });
+    it("allowEnv: false does not emit flag", () => {
+        expect(buildFlags({ allowEnv: false })).toEqual([]);
+    });
+    it("allowEnv: [] does not emit flag", () => {
+        expect(buildFlags({ allowEnv: [] })).toEqual([]);
+    });
 });
 //# sourceMappingURL=flags.test.js.map

package/dist/flags.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"flags.test.js","sourceRoot":"","sources":["../src/flags.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAC5B,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qBAAqB,EAAE,GAAG,EAAE;QAC7B,MAAM,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,aAAa,EAAE,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YAC3E,yCAAyC;SAC1C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mBAAmB,EAAE,GAAG,EAAE;QAC3B,MAAM,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mBAAmB,EAAE,GAAG,EAAE;QAC3B,MAAM,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,KAAK,GAAG,UAAU,CAAC;YACvB,SAAS,EAAE,CAAC,MAAM,CAAC;YACnB,QAAQ,EAAE,CAAC,aAAa,CAAC;YACzB,UAAU,EAAE,CAAC,MAAM,CAAC;YACpB,SAAS,EAAE,CAAC,WAAW,CAAC;YACxB,QAAQ,EAAE,CAAC,aAAa,CAAC;YACzB,OAAO,EAAE,CAAC,UAAU,CAAC;YACrB,GAAG,EAAE,YAAY;SAClB,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;YACpB,mBAAmB;YACnB,yBAAyB;YACzB,oBAAoB;YACpB,wBAAwB;YACxB,yBAAyB;YACzB,qBAAqB;YACrB,IAAI;YACJ,YAAY;SACb,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAC5B,MAAM,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACjG,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"flags.test.js","sourceRoot":"","sources":["../src/flags.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAC5B,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qBAAqB,EAAE,GAAG,EAAE;QAC7B,MAAM,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,aAAa,EAAE,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YAC3E,yCAAyC;SAC1C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mBAAmB,EAAE,GAAG,EAAE;QAC3B,MAAM,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mBAAmB,EAAE,GAAG,EAAE;QAC3B,MAAM,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,KAAK,GAAG,UAAU,CAAC;YACvB,SAAS,EAAE,CAAC,MAAM,CAAC;YACnB,QAAQ,EAAE,CAAC,aAAa,CAAC;YACzB,UAAU,EAAE,CAAC,MAAM,CAAC;YACpB,SAAS,EAAE,CAAC,WAAW,CAAC;YACxB,QAAQ,EAAE,CAAC,aAAa,CAAC;YACzB,OAAO,EAAE,CAAC,UAAU,CAAC;YACrB,GAAG,EAAE,YAAY;SAClB,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;YACpB,mBAAmB;YACnB,yBAAyB;YACzB,oBAAoB;YACpB,wBAAwB;YACxB,yBAAyB;YACzB,qBAAqB;YACrB,IAAI;YACJ,YAAY;SACb,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAC5B,MAAM,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACjG,CAAC,CAAC,CAAC;IAEH,YAAY;IAEZ,EAAE,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAC5B,MAAM,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,KAAK,GAAG,UAAU,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACtD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mBAAmB,EAAE,GAAG,EAAE;QAC3B,MAAM,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,gBAAgB;IAEhB,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,KAAK,GAAG,UAAU,CAAC;YACvB,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE;SACtE,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,KAAK,GAAG,UAAU,CAAC;YACvB,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;SAChD,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,KAAK,GAAG,UAAU,CAAC;YACvB,QAAQ,EAAE,CAAC,WAAW,CAAC;YACvB,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE;SACrD,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,+BAA+B,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,KAAK,GAAG,UAAU,CAAC;YACvB,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE;SACrD,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,KAAK,GAAG,UAAU,CAAC;YACvB,OAAO,EAAE;gBACP,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE;gBACrC,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE;aACtC;SACF,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,KAAK,GAAG,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAClE,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,KAAK,GAAG,UAAU,CAAC;YACvB,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE;SACnD,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,KAAK,GAAG,UAAU,CAAC;YACvB,OAAO,EAAE,CAAC,MAAM,CAAC;YACjB,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE;SACnD,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,KAAK,GAAG,UAAU,CAAC;YACvB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE;SACnD,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACxC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,KAAK,GAAG,UAAU,CAAC;YACvB,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE;SACnD,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QACzC,oEAAoE;QACpE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/index.d.ts

@@ -3,5 +3,5 @@ export { ShellCommand } from "./command.js";
 export { SandboxCommandError } from "./errors.js";
 export { buildFlags } from "./flags.js";
 export { resolveBinary } from "./binary.js";
-export type { SandboxOptions, CommandOutput, CommandOptions } from "./types.js";
+export type { SandboxOptions, SecretConfig, CommandOutput, CommandOptions } from "./types.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC"}

package/dist/sandbox.test.js

@@ -174,5 +174,143 @@ console.log(r.join(','))`,
         expect(existsSync("/tmp/zerobox-sdk-aa")).toBe(true);
         expect(readFileSync("/tmp/zerobox-sdk-aa", "utf8").trim()).toBe("ok");
     }));
+    // ── env vars ──
+    it("default env excludes custom parent vars", async () => {
+        const sandbox = Sandbox.create();
+        const output = await sandbox.sh `echo $ZEROBOX_TEST_CUSTOM`.text();
+        expect(output.trim()).toBe("");
+    });
+    it("default env includes PATH", async () => {
+        const sandbox = Sandbox.create();
+        const output = await sandbox.sh `echo $PATH`.text();
+        expect(output.trim()).not.toBe("");
+    });
+    it("env option sets explicit vars", async () => {
+        const sandbox = Sandbox.create({ env: { MY_VAR: "hello" } });
+        const output = await sandbox.sh `echo $MY_VAR`.text();
+        expect(output.trim()).toBe("hello");
+    });
+    it("env option with multiple vars", async () => {
+        const sandbox = Sandbox.create({ env: { A: "1", B: "2" } });
+        const output = await sandbox.sh `echo $A $B`.text();
+        expect(output.trim()).toBe("1 2");
+    });
+    it("allowEnv: true inherits all parent vars", async () => {
+        const sandbox = Sandbox.create({ allowEnv: true });
+        const output = await sandbox.sh `env`.text();
+        const count = output.trim().split("\n").length;
+        expect(count).toBeGreaterThan(10);
+    });
+    it("allowEnv with specific keys inherits only those", async () => {
+        const sandbox = Sandbox.create({ allowEnv: ["PATH"] });
+        const output = await sandbox.sh `env`.text();
+        const lines = output.trim().split("\n");
+        expect(lines.some((l) => l.startsWith("PATH="))).toBe(true);
+        // HOME should not be its own env var (CODEX_HOME is different and OK).
+        expect(lines.some((l) => l.startsWith("HOME="))).toBe(false);
+    });
+    it("denyEnv removes vars", async () => {
+        const sandbox = Sandbox.create({ allowEnv: true, denyEnv: ["HOME"] });
+        const output = await sandbox.sh `echo "HOME=$HOME"`.text();
+        expect(output.trim()).toBe("HOME=");
+    });
+    it("denyEnv does not block explicit env", async () => {
+        const sandbox = Sandbox.create({ denyEnv: ["FOO"], env: { FOO: "override" } });
+        const output = await sandbox.sh `echo $FOO`.text();
+        expect(output.trim()).toBe("override");
+    });
+    it("env value with equals sign", async () => {
+        const sandbox = Sandbox.create({ env: { DATA: "a=b=c" } });
+        const output = await sandbox.sh `echo $DATA`.text();
+        expect(output.trim()).toBe("a=b=c");
+    });
+    // ── secrets ──
+    it("secret env var contains placeholder, not real value", async () => {
+        const sandbox = Sandbox.create({
+            secrets: {
+                API_KEY: { value: "sk-test-123", hosts: ["example.com"] },
+            },
+        });
+        const output = await sandbox.sh `echo $API_KEY`.text();
+        expect(output.trim()).toMatch(/^ZEROBOX_SECRET_[0-9a-f]{64}$/);
+        expect(output.trim()).not.toBe("sk-test-123");
+    });
+    it("secrets auto-enable network for their hosts", async () => {
+        const sandbox = Sandbox.create({
+            secrets: {
+                TOKEN: { value: "t", hosts: ["httpbin.org"] },
+            },
+        });
+        // -k: accept MITM proxy cert (secrets enable MITM for header substitution)
+        const result = await sandbox
+            .exec("curl", ["-sk", "-o", "/dev/null", "-w", "%{http_code}", "https://httpbin.org/get"])
+            .text();
+        expect(result.trim()).toBe("200");
+    });
+    it("secret header substituted for matching host", async () => {
+        const sandbox = Sandbox.create({
+            secrets: {
+                MY_SECRET: { value: "real-value", hosts: ["httpbin.org"] },
+            },
+        });
+        const output = await sandbox.sh `curl -sk -H "X-Test: $MY_SECRET" https://httpbin.org/headers`.json();
+        expect(output.headers["X-Test"]).toBe("real-value");
+    });
+    it("secret NOT substituted for wrong host", async () => {
+        const sandbox = Sandbox.create({
+            allowNet: true,
+            secrets: {
+                MY_SECRET: { value: "real-value", hosts: ["other.com"] },
+            },
+        });
+        const output = await sandbox.sh `curl -sk -H "X-Test: $MY_SECRET" https://httpbin.org/headers`.json();
+        expect(output.headers["X-Test"]).toMatch(/^ZEROBOX_SECRET_/);
+    });
+    it("multiple secrets with different hosts", async () => {
+        const sandbox = Sandbox.create({
+            secrets: {
+                SECRET_A: { value: "value-a", hosts: ["httpbin.org"] },
+                SECRET_B: { value: "value-b", hosts: ["other.com"] },
+            },
+            allowNet: true,
+        });
+        const output = await sandbox.sh `curl -sk -H "X-A: $SECRET_A" -H "X-B: $SECRET_B" https://httpbin.org/headers`.json();
+        // A is for httpbin.org → substituted. B is for other.com → placeholder.
+        expect(output.headers["X-A"]).toBe("value-a");
+        expect(output.headers["X-B"]).toMatch(/^ZEROBOX_SECRET_/);
+    });
+    it("secret host restriction blocks other hosts", async () => {
+        const sandbox = Sandbox.create({
+            secrets: {
+                TOKEN: { value: "t", hosts: ["httpbin.org"] },
+            },
+        });
+        // httpbin.org should work (secret host), but example.com should be blocked.
+        const result = await sandbox
+            .exec("curl", [
+            "-sk",
+            "--max-time",
+            "3",
+            "-o",
+            "/dev/null",
+            "-w",
+            "%{http_code}",
+            "https://example.com",
+        ])
+            .output();
+        expect(result.stdout.trim()).not.toBe("200");
+    });
+    it("env and secrets work together", async () => {
+        const sandbox = Sandbox.create({
+            env: { MY_VAR: "env-val" },
+            secrets: {
+                MY_SECRET: { value: "secret-val", hosts: ["httpbin.org"] },
+            },
+        });
+        const envOut = await sandbox.sh `echo $MY_VAR`.text();
+        expect(envOut.trim()).toBe("env-val");
+        const secretOut = await sandbox.sh `echo $MY_SECRET`.text();
+        expect(secretOut.trim()).toMatch(/^ZEROBOX_SECRET_/);
+    });
 });
 //# sourceMappingURL=sandbox.test.js.map

package/dist/sandbox.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.test.js","sourceRoot":"","sources":["../src/sandbox.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;AAEtC,6CAA6C;AAC7C,SAAS,WAAW,CAAC,IAAY,EAAE,EAAuB;IACxD,OAAO,KAAK,IAAI,EAAE;QAChB,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,EAAE,EAAE,CAAC;QACb,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,GAAG,EAAE;IAC1C,iBAAiB;IAEjB,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,CAAA,YAAY,CAAC,IAAI,EAAE,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,EAAE,CAAA,SAAS,CAAC,IAAI,EAAE,CAAC;YACjC,MAAM,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC;YAC9C,MAAM,CAAE,CAAyB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,iBAAiB;IAEjB,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,EAAE,CAAA,wBAAwB,CAAC,IAAI,EAAmB,CAAC;QAC9E,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,mBAAmB;IAEnB,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,CAAA,SAAS,CAAC,MAAM,EAAE,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,CAAA,0BAA0B,CAAC,MAAM,EAAE,CAAC;QACnE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,0BAA0B;IAE1B,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,OAAO,CAAC;QACrB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,CAAA,cAAc,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QAC3D,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,WAAW;IAEX,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,CAAA,oBAAoB,CAAC,IAAI,EAAE,CAAC;QAC3D,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;QAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,CAAA,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC9D,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,EAAE,CAAA;;KAE5B,CAAC,IAAI,EAAmB,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,aAAa;IAEb,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5D,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,0BAA0B;IAE1B,EAAE,CACA,0BAA0B,EAC1B,WAAW,CAAC,qBAAqB,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,CAAA,mDAAmD,CAAC,MAAM,EAAE,CAAC;QAC5F,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAC3C,8DAA8D,CAC/D,CAAC;QACF,MAAM,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC,CAAC,CACH,CAAC;IAEF,EAAE,CACA,+BAA+B,EAC/B,WAAW,CAAC,qBAAqB,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzD,MAAM,OAAO,CAAC,EAAE,CAAA,+BAA+B,CAAC,MAAM,EAAE,CAAC;QACzD,MAAM,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,CAAC,YAAY,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxE,CAAC,CAAC,CACH,CAAC;IAEF,EAAE,CACA,+CAA+C,EAC/C,WAAW,CAAC,qBAAqB,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,GAAG,GAAG,qBAAqB,CAAC;QAClC,SAAS,CAAC,GAAG,GAAG,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE9C,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;YAC7B,UAAU,EAAE,CAAC,GAAG,CAAC;YACjB,SAAS,EAAE,CAAC,GAAG,GAAG,OAAO,CAAC;SAC3B,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,OAAO;aACzB,IAAI,CAAC,MAAM,EAAE;YACZ,IAAI;YACJ;;wBAEc,GAAG;wBACH,GAAG;yBACF;SAChB,CAAC;aACD,IAAI,EAAE,CAAC;QAEV,mCAAmC;QACnC,MAAM,CAAC,UAAU,CAAC,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC,CAAC,CACH,CAAC;IAEF,6BAA6B;IAE7B,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,OAAO;aACzB,IAAI,CAAC,MAAM,EAAE;YACZ,IAAI;YACJ,4FAA4F;SAC7F,CAAC;aACD,IAAI,EAAE,CAAC;QACV,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,MAAM,OAAO;aACzB,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,qBAAqB,CAAC,CAAC;aACpF,IAAI,EAAE,CAAC;QACV,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,MAAM,OAAO;aACzB,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,qBAAqB,CAAC,CAAC;aACpF,IAAI,EAAE,CAAC;QACV,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wBAAwB,EAAE,KAAK,IAAI,EAAE;QACtC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,MAAM,OAAO;aACzB,IAAI,CAAC,MAAM,EAAE;YACZ,IAAI;YACJ,YAAY;YACZ,GAAG;YACH,IAAI;YACJ,WAAW;YACX,IAAI;YACJ,cAAc;YACd,oBAAoB;SACrB,CAAC;aACD,MAAM,EAAE,CAAC;QACZ,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,qBAAqB;IAErB,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,UAAU,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,CAAA,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACpF,SAAS,CACV,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,kBAAkB;IAElB,EAAE,CACA,iCAAiC,EACjC,WAAW,CAAC,qBAAqB,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,OAAO,CAAC,EAAE,CAAA,+BAA+B,CAAC,MAAM,EAAE,CAAC;QACzD,MAAM,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,CAAC,YAAY,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxE,CAAC,CAAC,CACH,CAAC;AACJ,CAAC,CAAC,CAAC"}
+{"version":3,"file":"sandbox.test.js","sourceRoot":"","sources":["../src/sandbox.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;AAEtC,6CAA6C;AAC7C,SAAS,WAAW,CAAC,IAAY,EAAE,EAAuB;IACxD,OAAO,KAAK,IAAI,EAAE;QAChB,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,EAAE,EAAE,CAAC;QACb,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,GAAG,EAAE;IAC1C,iBAAiB;IAEjB,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,CAAA,YAAY,CAAC,IAAI,EAAE,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,EAAE,CAAA,SAAS,CAAC,IAAI,EAAE,CAAC;YACjC,MAAM,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC;YAC9C,MAAM,CAAE,CAAyB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,iBAAiB;IAEjB,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,EAAE,CAAA,wBAAwB,CAAC,IAAI,EAAmB,CAAC;QAC9E,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,mBAAmB;IAEnB,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,CAAA,SAAS,CAAC,MAAM,EAAE,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,CAAA,0BAA0B,CAAC,MAAM,EAAE,CAAC;QACnE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,0BAA0B;IAE1B,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,OAAO,CAAC;QACrB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,CAAA,cAAc,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QAC3D,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,WAAW;IAEX,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,CAAA,oBAAoB,CAAC,IAAI,EAAE,CAAC;QAC3D,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;QAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,CAAA,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC9D,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,EAAE,CAAA;;KAE5B,CAAC,IAAI,EAAmB,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,aAAa;IAEb,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5D,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,0BAA0B;IAE1B,EAAE,CACA,0BAA0B,EAC1B,WAAW,CAAC,qBAAqB,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,CAAA,mDAAmD,CAAC,MAAM,EAAE,CAAC;QAC5F,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAC3C,8DAA8D,CAC/D,CAAC;QACF,MAAM,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC,CAAC,CACH,CAAC;IAEF,EAAE,CACA,+BAA+B,EAC/B,WAAW,CAAC,qBAAqB,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzD,MAAM,OAAO,CAAC,EAAE,CAAA,+BAA+B,CAAC,MAAM,EAAE,CAAC;QACzD,MAAM,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,CAAC,YAAY,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxE,CAAC,CAAC,CACH,CAAC;IAEF,EAAE,CACA,+CAA+C,EAC/C,WAAW,CAAC,qBAAqB,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,GAAG,GAAG,qBAAqB,CAAC;QAClC,SAAS,CAAC,GAAG,GAAG,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE9C,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;YAC7B,UAAU,EAAE,CAAC,GAAG,CAAC;YACjB,SAAS,EAAE,CAAC,GAAG,GAAG,OAAO,CAAC;SAC3B,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,OAAO;aACzB,IAAI,CAAC,MAAM,EAAE;YACZ,IAAI;YACJ;;wBAEc,GAAG;wBACH,GAAG;yBACF;SAChB,CAAC;aACD,IAAI,EAAE,CAAC;QAEV,mCAAmC;QACnC,MAAM,CAAC,UAAU,CAAC,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC,CAAC,CACH,CAAC;IAEF,6BAA6B;IAE7B,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,OAAO;aACzB,IAAI,CAAC,MAAM,EAAE;YACZ,IAAI;YACJ,4FAA4F;SAC7F,CAAC;aACD,IAAI,EAAE,CAAC;QACV,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,MAAM,OAAO;aACzB,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,qBAAqB,CAAC,CAAC;aACpF,IAAI,EAAE,CAAC;QACV,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,MAAM,OAAO;aACzB,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,qBAAqB,CAAC,CAAC;aACpF,IAAI,EAAE,CAAC;QACV,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wBAAwB,EAAE,KAAK,IAAI,EAAE;QACtC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,MAAM,OAAO;aACzB,IAAI,CAAC,MAAM,EAAE;YACZ,IAAI;YACJ,YAAY;YACZ,GAAG;YACH,IAAI;YACJ,WAAW;YACX,IAAI;YACJ,cAAc;YACd,oBAAoB;SACrB,CAAC;aACD,MAAM,EAAE,CAAC;QACZ,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,qBAAqB;IAErB,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,UAAU,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,CAAA,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACpF,SAAS,CACV,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,kBAAkB;IAElB,EAAE,CACA,iCAAiC,EACjC,WAAW,CAAC,qBAAqB,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,OAAO,CAAC,EAAE,CAAA,+BAA+B,CAAC,MAAM,EAAE,CAAC;QACzD,MAAM,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,CAAC,YAAY,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxE,CAAC,CAAC,CACH,CAAC;IAEF,iBAAiB;IAEjB,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,CAAA,2BAA2B,CAAC,IAAI,EAAE,CAAC;QAClE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,CAAA,YAAY,CAAC,IAAI,EAAE,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,CAAA,cAAc,CAAC,IAAI,EAAE,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,CAAA,YAAY,CAAC,IAAI,EAAE,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,CAAA,KAAK,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;QAC/C,MAAM,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,CAAA,KAAK,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,uEAAuE;QACvE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;QACpC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,CAAA,mBAAmB,CAAC,IAAI,EAAE,CAAC;QAC1D,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,CAAA,WAAW,CAAC,IAAI,EAAE,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,CAAA,YAAY,CAAC,IAAI,EAAE,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,gBAAgB;IAEhB,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;YAC7B,OAAO,EAAE;gBACP,OAAO,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,aAAa,CAAC,EAAE;aAC1D;SACF,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,CAAA,eAAe,CAAC,IAAI,EAAE,CAAC;QACtD,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC;QAC/D,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;YAC7B,OAAO,EAAE;gBACP,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,aAAa,CAAC,EAAE;aAC9C;SACF,CAAC,CAAC;QACH,2EAA2E;QAC3E,MAAM,MAAM,GAAG,MAAM,OAAO;aACzB,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,yBAAyB,CAAC,CAAC;aACzF,IAAI,EAAE,CAAC;QACV,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;YAC7B,OAAO,EAAE;gBACP,SAAS,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,aAAa,CAAC,EAAE;aAC3D;SACF,CAAC,CAAC;QACH,MAAM,MAAM,GACV,MAAM,OAAO,CAAC,EAAE,CAAA,8DAA8D,CAAC,IAAI,EAE/E,CAAC;QACP,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;YAC7B,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE;gBACP,SAAS,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,EAAE;aACzD;SACF,CAAC,CAAC;QACH,MAAM,MAAM,GACV,MAAM,OAAO,CAAC,EAAE,CAAA,8DAA8D,CAAC,IAAI,EAE/E,CAAC;QACP,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;YAC7B,OAAO,EAAE;gBACP,QAAQ,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,aAAa,CAAC,EAAE;gBACtD,QAAQ,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,EAAE;aACrD;YACD,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,MAAM,MAAM,GACV,MAAM,OAAO,CAAC,EAAE,CAAA,8EAA8E,CAAC,IAAI,EAE/F,CAAC;QACP,wEAAwE;QACxE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;YAC7B,OAAO,EAAE;gBACP,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,aAAa,CAAC,EAAE;aAC9C;SACF,CAAC,CAAC;QACH,4EAA4E;QAC5E,MAAM,MAAM,GAAG,MAAM,OAAO;aACzB,IAAI,CAAC,MAAM,EAAE;YACZ,KAAK;YACL,YAAY;YACZ,GAAG;YACH,IAAI;YACJ,WAAW;YACX,IAAI;YACJ,cAAc;YACd,qBAAqB;SACtB,CAAC;aACD,MAAM,EAAE,CAAC;QACZ,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;YAC7B,GAAG,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;YAC1B,OAAO,EAAE;gBACP,SAAS,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,aAAa,CAAC,EAAE;aAC3D;SACF,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,CAAA,cAAc,CAAC,IAAI,EAAE,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,EAAE,CAAA,iBAAiB,CAAC,IAAI,EAAE,CAAC;QAC3D,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/types.d.ts

@@ -18,6 +18,24 @@ export interface SandboxOptions {
     cwd?: string;
     /** Disable the sandbox entirely. */
     noSandbox?: boolean;
+    /** Explicit environment variables for the sandbox. */
+    env?: Record<string, string>;
+    /** Inherit parent env vars. true = all (default), string[] = only listed keys. */
+    allowEnv?: boolean | string[];
+    /** Drop these parent env vars. Takes precedence over allowEnv. */
+    denyEnv?: string[];
+    /**
+     * Secrets with host-scoped network access. Each key becomes an env var
+     * in the sandbox. The hosts are merged into network permissions.
+     */
+    secrets?: Record<string, SecretConfig>;
+}
+/** Configuration for a secret passed to the sandbox. */
+export interface SecretConfig {
+    /** The secret value (e.g., an API key). */
+    value: string;
+    /** Domains where this secret is needed. Merged into allowNet. */
+    hosts: string[];
 }
 /** Raw output from a sandboxed command. */
 export interface CommandOutput {

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,MAAM,WAAW,cAAc;IAC7B,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,oEAAoE;IACpE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,EAAE,CAAC;IAC9B,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gDAAgD;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,2CAA2C;AAC3C,MAAM,WAAW,aAAa;IAC5B,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qCAAqC;AACrC,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,MAAM,WAAW,cAAc;IAC7B,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,oEAAoE;IACpE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,EAAE,CAAC;IAC9B,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gDAAgD;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,sDAAsD;IACtD,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,kFAAkF;IAClF,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,EAAE,CAAC;IAC9B,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;CACxC;AAED,wDAAwD;AACxD,MAAM,WAAW,YAAY;IAC3B,2CAA2C;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,2CAA2C;AAC3C,MAAM,WAAW,aAAa;IAC5B,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qCAAqC;AACrC,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zerobox",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "Run any command in a sandbox with file and network restrictions.",
   "license": "Apache-2.0",
   "repository": {
@@ -32,12 +32,12 @@
     "dist/"
   ],
   "optionalDependencies": {
-    "@zerobox/cli-darwin-arm64": "0.1.4",
-    "@zerobox/cli-linux-arm64": "0.1.4",
-    "@zerobox/cli-linux-arm64-musl": "0.1.4",
-    "@zerobox/cli-linux-x64": "0.1.4",
-    "@zerobox/cli-darwin-x64": "0.1.4",
-    "@zerobox/cli-linux-x64-musl": "0.1.4"
+    "@zerobox/cli-darwin-arm64": "0.1.6",
+    "@zerobox/cli-darwin-x64": "0.1.6",
+    "@zerobox/cli-linux-arm64": "0.1.6",
+    "@zerobox/cli-linux-x64": "0.1.6",
+    "@zerobox/cli-linux-arm64-musl": "0.1.6",
+    "@zerobox/cli-linux-x64-musl": "0.1.6"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",