--- url: >- https://adk.nht.io/api/@nhtio/adk/batteries/sandbox/interfaces/SandboxPolicyEnforcer.md description: >- Policy boundary. `run` resolves on spawn and exposes live streams plus a later completion promise. --- # Interface: SandboxPolicyEnforcer Defined in: [src/batteries/sandbox/contracts/policy\_enforcer.ts:6](https://github.com/NHTIO/ADK/blob/v1.20260824.1/src/src/batteries/sandbox/contracts/policy_enforcer.ts#L6) Policy boundary. `run` resolves on spawn and exposes live streams plus a later completion promise. ## Properties | Property | Modifier | Type | Description | Defined in | | ---------------------------------------- | ---------- | --------- | --------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `adopted?` | `readonly` | `boolean` | Whether this adapter adopted an already-enabled process-global sandbox rather than initializing it. | [src/batteries/sandbox/contracts/policy\_enforcer.ts:10](https://github.com/NHTIO/ADK/blob/v1.20260824.1/src/src/batteries/sandbox/contracts/policy_enforcer.ts#L10) | ## Methods ### checkDependencies() ```ts checkDependencies(): Promise<{ errors: string[]; warnings: string[]; }>; ``` Defined in: [src/batteries/sandbox/contracts/policy\_enforcer.ts:12](https://github.com/NHTIO/ADK/blob/v1.20260824.1/src/src/batteries/sandbox/contracts/policy_enforcer.ts#L12) Probe external prerequisites. A non-empty `errors` throws `E_SANDBOX_DEPENDENCY_MISSING`; `warnings` are surfaced through observability and are NOT fatal. #### Returns `Promise`<{ `errors`: `string`\[]; `warnings`: `string`\[]; }> *** ### diagnosticsFor() ```ts diagnosticsFor(correlationId: string): string[]; ``` Defined in: [src/batteries/sandbox/contracts/policy\_enforcer.ts:39](https://github.com/NHTIO/ADK/blob/v1.20260824.1/src/src/batteries/sandbox/contracts/policy_enforcer.ts#L39) Retrieve diagnostics by correlation id, never by command text. #### Parameters | Parameter | Type | | --------------- | -------- | | `correlationId` | `string` | #### Returns `string`\[] *** ### dispose() ```ts dispose(): Promise; ``` Defined in: [src/batteries/sandbox/contracts/policy\_enforcer.ts:41](https://github.com/NHTIO/ADK/blob/v1.20260824.1/src/src/batteries/sandbox/contracts/policy_enforcer.ts#L41) Release what this enforcer OWNS. A no-op when it adopted a foreign sandbox — tearing down a manager we did not initialize would strip ACEs a host app depends on. #### Returns `Promise`<`void`> *** ### effectivePolicy() ```ts effectivePolicy(): DerivedRules | undefined; ``` Defined in: [src/batteries/sandbox/contracts/policy\_enforcer.ts:37](https://github.com/NHTIO/ADK/blob/v1.20260824.1/src/src/batteries/sandbox/contracts/policy_enforcer.ts#L37) Return the opaque derived snapshot used for drift validation. #### Returns [`DerivedRules`](DerivedRules.md) | `undefined` *** ### isSupported() ```ts isSupported(): boolean; ``` Defined in: [src/batteries/sandbox/contracts/policy\_enforcer.ts:8](https://github.com/NHTIO/ADK/blob/v1.20260824.1/src/src/batteries/sandbox/contracts/policy_enforcer.ts#L8) Whether this enforcer can enforce on the current platform. `false` (a browser tab, where SRT does not exist) raises `E_SANDBOX_UNSUPPORTED_ENV` at construction rather than degrading — a shim that enforces nothing reads as sandboxed. #### Returns `boolean` *** ### run() ```ts run(op: { argv: string[]; correlationId: string; cwd: string; env?: Record; policy: SandboxPolicy; signal?: AbortSignal; }): Promise<{ completed: Promise<{ exitCode: number; failed: boolean; }>; stderr: ReadableStream>; stdout: ReadableStream>; }>; ``` Defined in: [src/batteries/sandbox/contracts/policy\_enforcer.ts:14](https://github.com/NHTIO/ADK/blob/v1.20260824.1/src/src/batteries/sandbox/contracts/policy_enforcer.ts#L14) Spawn under a narrowing policy; a non-zero exit is data, not a rejected promise. #### Parameters | Parameter | Type | Description | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `op` | { `argv`: `string`\[]; `correlationId`: `string`; `cwd`: `string`; `env?`: [`Record`](https://www.typescriptlang.org/docs/handbook/utility-types.html#recordkeys-type)<`string`, `string`>; `policy`: [`SandboxPolicy`](SandboxPolicy.md); `signal?`: `AbortSignal`; } | - | | `op.argv` | `string`\[] | - | | `op.correlationId` | `string` | - | | `op.cwd` | `string` | - | | `op.env?` | [`Record`](https://www.typescriptlang.org/docs/handbook/utility-types.html#recordkeys-type)<`string`, `string`> | An ADDITIVE per-call overlay on the child's environment, applied LAST. **Remarks** NOT the host-inheritance control. What a child inherits from the host is the ADAPTER's decision (the Node/SRT one denies by default and takes an allow-list at construction); this field only adds to whatever that produced, and an adapter MUST NOT let it silently widen what the deployment allowed. Leaving these semantics unstated is how the Node adapter came to spread the entire `process.env` into every child while this field sat unused. | | `op.policy` | [`SandboxPolicy`](SandboxPolicy.md) | - | | `op.signal?` | `AbortSignal` | - | #### Returns `Promise`<{ `completed`: `Promise`<{ `exitCode`: `number`; `failed`: `boolean`; }>; `stderr`: `ReadableStream`<`Uint8Array`<`ArrayBufferLike`>>; `stdout`: `ReadableStream`<`Uint8Array`<`ArrayBufferLike`>>; }>