Type Alias: SrtEnforcerOptions

type SrtEnforcerOptions = {
  binShell?: string;
  enableWeakerNestedSandbox?: boolean;
  envAllowList?: readonly string[];
  inheritHostEnv?: boolean;
  policy: SandboxPolicy;
};

Defined in: src/batteries/sandbox/node/srt_enforcer.ts:254

Construction options for srtEnforcer.

Properties

Property	Type	Description	Defined in
binShell?	string	Absolute path to the POSIX shell used to invoke wrapped commands. Defaults to /bin/bash. Remarks Validated at construction in TWO checks, both required: it must be ABSOLUTE (a bare bash passes any basename test while remaining PATH-dependent — the exact hazard the absolute default avoids), and its basename must be on the allow-list (sh, bash, dash, zsh, ksh) — the shells whose quoting the single escaper is correct for. An allow-list rather than a deny-list is deliberate: fish and nu are POSIX-ish enough to look safe and different enough to break single-quote escaping, so an unverified shell must fail closed.	src/batteries/sandbox/node/srt_enforcer.ts:266
enableWeakerNestedSandbox?	boolean	Enable SRT's weaker nested-sandbox mode, for running inside an unprivileged container. Remarks Bubblewrap cannot mount a fresh /proc inside an unprivileged container, so the sandbox fails to start at all — the symptom is apply-seccomp: write /proc/self/uid_map: Operation not permitted with exit 1, an empty stdout and NO diagnostics, which is indistinguishable from a policy denial. This flag makes the inner sandbox bind-mount the container's EXISTING /proc instead. It considerably weakens the boundary, in upstream's own words: the bind-mounted /proc exposes process information a fresh mount would hide. Only enable it when the OUTER container already provides the isolation you need — it trades inner isolation for the sandbox running at all. Session-level: SRT reads it from the config given to initialize(), never per call.	src/batteries/sandbox/node/srt_enforcer.ts:319
envAllowList?	readonly string[]	Host environment variable NAMES a sandboxed child may inherit. Defaults to ['PATH']. Remarks The child inherits NOTHING from the host beyond these names. That default is deliberate: a model that can direct the shell's argv can run env, so anything inherited is readable back into its context — and no filesystem or network policy stops it, because the value arrives in the tool result rather than over the wire. This REPLACES the default, it does not extend it. A caller who needs CARGO_HOME and still wants binaries to resolve must pass BOTH: ['PATH', 'CARGO_HOME']. Passing ['CARGO_HOME'] alone drops PATH, which breaks search_files on any host where rg lives outside /usr/bin. An entry that is not a valid POSIX environment-variable name throws E_INVALID_SANDBOX_CONFIG at construction rather than being skipped, so a typo surfaces as a startup error instead of a variable that silently never arrives.	src/batteries/sandbox/node/srt_enforcer.ts:293
inheritHostEnv?	boolean	Pass the ENTIRE host environment to sandboxed children. Defaults to false. Remarks The escape hatch for a deployment that genuinely needs ambient configuration, and it is worth being blunt about what it re-opens: every secret in the host process becomes readable by the model, because run_shell_command exists precisely to run commands the model chose and env is one of them. Prefer naming what you need in envAllowList.	src/batteries/sandbox/node/srt_enforcer.ts:303
policy	SandboxPolicy	The ADK-owned policy to enforce. Remarks Mapped to SRT's config inside this module and nowhere else. The derived baseline is captured immediately after initialize(), because SandboxManager is a process-global singleton whose SECOND initialize() is a no-op — a later call with a different policy silently keeps the first.	src/batteries/sandbox/node/srt_enforcer.ts:275