NativeBashExecutorOptions
Defined in: packages/tools/src/bash/native-executor.ts:14
Properties
Section titled “Properties”allowEnv?
Section titled “allowEnv?”
optionalallowEnv?:AllowEnv
Defined in: packages/tools/src/bash/native-executor.ts:55
Host environment variables to expose inside the sandbox. Omitted / [] → none
(printenv is empty aside from what the command itself sets). true → every
string-valued host var. A list matches names (literal, glob, or RegExp).
allowNetwork?
Section titled “allowNetwork?”
optionalallowNetwork?:boolean
Defined in: packages/tools/src/bash/native-executor.ts:47
Allow network access. Default false (matches ASRT’s “no network unless explicitly
allowed” posture) — but unlike ASRT, this executor can’t filter by domain: it’s all
network access or none.
allowRead?
Section titled “allowRead?”
optionalallowRead?:"**"|string[] |null
Defined in: packages/tools/src/bash/native-executor.ts:41
Confine reads to these paths (plus system paths below). Omitted — escape-hatch
default — confines reads to allowWrite (executors have no cwd). Providers fill
omitted reads with [cwd] via mergePolicy before pooling. Pass
UNBOUNDED_ALLOW_READ for host-wide reads (--ro-bind / /). null / []
mean no user read roots (system paths still mounted so commands can run).
Unlike denyRead, which is a deny-list and therefore only ever as complete as its
author, a list is an allow-list enforced by the kernel: a path outside it is not
“permission denied” but genuinely absent from the mount namespace — ls reports
No such file or directory. That is what makes it suitable as the read boundary for a
recursive reader like rg, where enumerating everything to deny is hopeless.
SYSTEM_READ_PATHS stay bound whenever reads are bounded, since nothing can execute without them; see BashExecutorDescription.allowRead for what that means for the guarantee.
allowWrite
Section titled “allowWrite”allowWrite:
string[]
Defined in: packages/tools/src/bash/native-executor.ts:20
Paths writable inside the sandbox — e.g. the tool’s configured project root. Required,
matching the no-unsandboxed-default rule: pass [] for a
sandbox that can run commands but write nowhere, not an implicit “everything.”
denyRead?
Section titled “denyRead?”
optionaldenyRead?:string[]
Defined in: packages/tools/src/bash/native-executor.ts:23
Paths to hide entirely (not just deny write to), on top of the read-only view of everything else this executor gives by default.
maxOutputBytes?
Section titled “maxOutputBytes?”
optionalmaxOutputBytes?:number
Defined in: packages/tools/src/bash/native-executor.ts:49
Bytes to keep from stdout/stderr each before truncating. Default 1,000,000 (1 MB).