Function: srtEnforcer()

function srtEnforcer(
  options: SrtEnforcerOptions,
): Promise<SandboxPolicyEnforcer>;

Defined in: src/batteries/sandbox/node/srt_enforcer.ts:340

Construct the SRT-backed policy enforcer — the OS boundary.

Parameters

Parameter	Type	Description
options	SrtEnforcerOptions	Shell and policy configuration.

Returns

Promise<SandboxPolicyEnforcer>

An enforcer whose derived baseline is already captured.

Remarks

REFUSES rather than degrades on an unsupported platform: native win32 throws E_SANDBOX_UNSUPPORTED_ENV naming WSL2, because Windows folds all four filesystem-policy lists case-insensitively and throws on per-exec allows. A half-built branch there would be a DIVERGENT boundary rather than a limited one, so there is deliberately no native-Windows evaluator.

run() resolves on SPAWN with live streams plus a separate completed promise, never a settled exit code. That split is not stylistic: one promise cannot both hand over unread child streams AND carry an exit code, because settling requires the streams to have ended and they cannot end before someone drains them. A caller MUST drain both concurrently — pipe buffers are per-fd, so draining one to completion first can block the other and hang the child.