Documentation
¶
Overview ¶
nova-sandbox runs ONE command with its filesystem reach cut down by the operating system: the OS and toolchain roots and every --read directory are readable, every --write directory is readable and writable, and everything else on disk is denied to it by the kernel. docs/SPEC-SANDBOX.md is normative and this binary is the darwin half of it; on every other platform the wrap REFUSES, because a sandbox that silently does nothing is the failure the tool exists to close.
Exit codes are env(1)'s, not SPEC.md's 0/1/2, and the reason is in the spec: the exec path's status belongs to the wrapped command. 0-124 the command's own, 125 the tool said NO before it ran, 126 it could not be executed, 127 it was on no PATH entry, 128+N killed by signal N. The probe, check and version verbs are not wrappers and use SPEC.md's grammar unchanged.
Source Files