tiny.sandbox.execute

1/// Executes a run plan within a disposable layer directory, returning a2/// `Result` that owns captured standard streams, the detected change set, an3/// `Audit` record, and the layer directory handle.4///5/// Before launching the child process, `execute` checks the selected runner6/// capabilities against the policy requested in `plan`, returning an error if a7/// required setting is unsupported. A child process that exits with a nonzero8/// status code produces a successful `Result` carrying that status. The error9/// union instead covers refused policies along with host setup, execution, and10/// data collection failures.11///12/// Callers inspect changes to the layer through the change set. Each entry can13/// describe a file, directory, or symbolic link, recording either a path to14/// create or replace using the `put` operation or a path to remove using the15/// `delete` operation. The library reads the source to prepare the layer and16/// reports changes, but it does not automatically apply changes back to the17/// source. An unconfined child may independently write external paths on the18/// host.19pub fn execute(allocator: Allocator, plan: plan_data.Plan) !Result {20    try plan.policy.validate(expectedAudit(plan));21    return switch (plan.runner) {22        .staging => executeStaging(allocator, plan),23        .bubblewrap_overlay => bwrap.execute(allocator, plan),24        .macos_staging => macos.execute(allocator, plan),25        .windows_staging => windows.execute(allocator, plan),26    };27}

1pub const execute = run.execute;