runner

var (

	// Seccomp options (Linux only) - using pure Go library
	SeccompProfile = flag.String("seccomp-profile", "", "Seccomp profile to use: strict, readonly")
	SeccompAction  = flag.String("seccomp-action", "errno", "Action on restricted syscalls: errno, kill, trap, log")

	// Landlock options (Linux only) - using landlock-go library
	LandlockEnabled = flag.Bool("landlock", false, "Enable landlock filesystem access control")
	LandlockProfile = flag.String("landlock-profile", "readonly", "Landlock profile: readonly, readexec, custom")
	LandlockPaths   = flag.String("landlock-paths", "", "Comma-separated list of paths to allow access to (for custom profile)")

	// Code signing options
	CodeSigEnforced = flag.Bool("codesig", false, "Enforce code signature verification")

	// Inspect/debugging options
	NoInspect = flag.Bool("noinspect", false, "Exit immediately on error without showing debugging options")
)

var CurrentScriptDirectory string

var Rye_files embed.FS

var Version = "development"