--- url: >- https://adk.nht.io/api/batteries/sandbox/node/type-aliases/SrtEnforcerOptions.md description: 'Construction options for [`srtEnforcer`](https://adk.nht.io/api/batteries/sandbox/node/functions/srtEnforcer).' --- # Type Alias: SrtEnforcerOptions ```ts type SrtEnforcerOptions = { binShell?: string; enableWeakerNestedSandbox?: boolean; envAllowList?: readonly string[]; inheritHostEnv?: boolean; policy: SandboxPolicy; }; ``` Defined in: [src/batteries/sandbox/node/srt\_enforcer.ts:254](https://github.com/NHTIO/ADK/blob/v1.20260824.1/src/src/batteries/sandbox/node/srt_enforcer.ts#L254) Construction options for [srtEnforcer](../functions/srtEnforcer.md). ## Properties | Property | Type | Description | Defined in | | ---------------------------------------------------------------------------- | --------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | | `binShell?` | `string` | Absolute path to the POSIX shell used to invoke wrapped commands. Defaults to `/bin/bash`. **Remarks** Validated at construction in TWO checks, both required: it must be ABSOLUTE (a bare `bash` passes any basename test while remaining `PATH`-dependent — the exact hazard the absolute default avoids), and its basename must be on the allow-list (`sh`, `bash`, `dash`, `zsh`, `ksh`) — the shells whose quoting the single escaper is correct for. An allow-list rather than a deny-list is deliberate: `fish` and `nu` are POSIX-ish enough to look safe and different enough to break single-quote escaping, so an unverified shell must fail closed. | [src/batteries/sandbox/node/srt\_enforcer.ts:266](https://github.com/NHTIO/ADK/blob/v1.20260824.1/src/src/batteries/sandbox/node/srt_enforcer.ts#L266) | | `enableWeakerNestedSandbox?` | `boolean` | Enable SRT's weaker nested-sandbox mode, for running inside an unprivileged container. **Remarks** Bubblewrap cannot mount a fresh `/proc` inside an unprivileged container, so the sandbox fails to start at all — the symptom is `apply-seccomp: write /proc/self/uid_map: Operation not permitted` with exit 1, an empty stdout and NO diagnostics, which is indistinguishable from a policy denial. This flag makes the inner sandbox bind-mount the container's EXISTING `/proc` instead. **It considerably weakens the boundary**, in upstream's own words: the bind-mounted `/proc` exposes process information a fresh mount would hide. Only enable it when the OUTER container already provides the isolation you need — it trades inner isolation for the sandbox running at all. Session-level: SRT reads it from the config given to `initialize()`, never per call. | [src/batteries/sandbox/node/srt\_enforcer.ts:319](https://github.com/NHTIO/ADK/blob/v1.20260824.1/src/src/batteries/sandbox/node/srt_enforcer.ts#L319) | | `envAllowList?` | readonly `string`\[] | Host environment variable NAMES a sandboxed child may inherit. Defaults to `['PATH']`. **Remarks** The child inherits NOTHING from the host beyond these names. That default is deliberate: a model that can direct the shell's argv can run `env`, so anything inherited is readable back into its context — and no filesystem or network policy stops it, because the value arrives in the tool result rather than over the wire. **This REPLACES the default, it does not extend it.** A caller who needs `CARGO_HOME` and still wants binaries to resolve must pass BOTH: `['PATH', 'CARGO_HOME']`. Passing `['CARGO_HOME']` alone drops `PATH`, which breaks `search_files` on any host where `rg` lives outside `/usr/bin`. An entry that is not a valid POSIX environment-variable name throws `E_INVALID_SANDBOX_CONFIG` at construction rather than being skipped, so a typo surfaces as a startup error instead of a variable that silently never arrives. | [src/batteries/sandbox/node/srt\_enforcer.ts:293](https://github.com/NHTIO/ADK/blob/v1.20260824.1/src/src/batteries/sandbox/node/srt_enforcer.ts#L293) | | `inheritHostEnv?` | `boolean` | Pass the ENTIRE host environment to sandboxed children. Defaults to `false`. **Remarks** The escape hatch for a deployment that genuinely needs ambient configuration, and it is worth being blunt about what it re-opens: **every secret in the host process becomes readable by the model**, because `run_shell_command` exists precisely to run commands the model chose and `env` is one of them. Prefer naming what you need in `envAllowList`. | [src/batteries/sandbox/node/srt\_enforcer.ts:303](https://github.com/NHTIO/ADK/blob/v1.20260824.1/src/src/batteries/sandbox/node/srt_enforcer.ts#L303) | | `policy` | [`SandboxPolicy`](../../../../@nhtio/adk/batteries/sandbox/interfaces/SandboxPolicy.md) | The ADK-owned policy to enforce. **Remarks** Mapped to SRT's config inside this module and nowhere else. The derived baseline is captured immediately after `initialize()`, because `SandboxManager` is a process-global singleton whose SECOND `initialize()` is a no-op — a later call with a different policy silently keeps the first. | [src/batteries/sandbox/node/srt\_enforcer.ts:275](https://github.com/NHTIO/ADK/blob/v1.20260824.1/src/src/batteries/sandbox/node/srt_enforcer.ts#L275) |