Module command 

Sandboxed Command Execution

Provides a trait and implementation for executing commands with sandboxing.

Structs

BasicSandbox

Basic sandboxed command wrapper

CommandResult

Result of a sandboxed command execution

PreparedProcess

ProcessPolicy

Auditable process policy. Network and filesystem authority are separate; neither is inferred from a command name.

ProcessSandbox

Process runner backed by the host’s OS sandbox (sandbox-exec on macOS, bwrap on Linux). It fails closed when isolation is required but absent.

Enums

FilesystemAccess

Filesystem authority granted to a process.

IsolationMode

Whether absence of an OS isolation backend is a hard error.

Traits

SandboxedCommand

Trait for sandboxed command execution