tiny.sandbox.plan

1const sys = @import("sys");2const audit = @import("audit.zig");3const command = @import("command.zig");4const policy_data = @import("policy.zig");56/// One execution request, borrowed for the length of the call: the slices and7/// directory handles in it belong to the caller and have to outlive `execute` .8/// `max_file_bytes` bounds the size of a source file copied into the layer9/// during staging, and a larger file is left out of the copy and recorded as10/// skipped. The same bound applies to nothing else: the child's own output and11/// the hashing that builds the change set are unbounded by it.12pub const Plan = struct {13    scratch: sys.fs.Dir,14    source: ?sys.fs.Dir = null,15    argv: []const []const u8,16    cwd: []const u8 = ".",17    environ_map: ?*const sys.process.Environ.Map = null,18    runner: audit.Runner = .staging,19    policy: policy_data.Policy = .{},20    prefix: []const u8 = "sandbox",21    timeout_ms: u64 = 30_000,22    stdout_limit: usize = 1024 * 1024,23    stderr_limit: usize = 1024 * 1024,24    max_file_bytes: usize = 16 * 1024 * 1024,25    interrupt: command.Interrupt = .{},26};

1pub const plan = @import("plan.zig");