runner

var (

	// Seccomp options (Linux only) - using pure Go library
	SeccompProfile = flag.String("seccomp-profile", "", "Seccomp profile to use: strict, readonly")
	SeccompAction  = flag.String("seccomp-action", "errno", "Action on restricted syscalls: errno, kill, trap, log")

	// Landlock options (Linux only) - using landlock-go library
	LandlockEnabled = flag.Bool("landlock", false, "Enable landlock filesystem access control")
	LandlockProfile = flag.String("landlock-profile", "readonly", "Landlock profile: readonly, readexec, custom")
	LandlockPaths   = flag.String("landlock-paths", "", "Comma-separated list of paths to allow access to (for custom profile)")

	// HTTP options
	HttpPort = flag.String("http", "", "Start Rye in HTTP REPL mode on specified port (localhost only)")

	// Code signing options
	CodeSigEnforced = flag.Bool("codesig", false, "Enforce code signature verification")

	// Unshare options (Linux only) - namespace isolation via re-exec
	UnshareEnabled = flag.Bool("unshare", false, "Run script in isolated Linux namespaces via re-exec (Linux only)")
	UnshareFs      = flag.Bool("unshare-fs", true, "Isolate filesystem when using --unshare (bind-mounts current dir read-only as /app)")
	UnshareNet     = flag.Bool("unshare-net", true, "Isolate network namespace when using --unshare (no network access)")
	UnsharePid     = flag.Bool("unshare-pid", true, "Isolate PID namespace when using --unshare (hides host processes)")
	UnshareUts     = flag.Bool("unshare-uts", true, "Isolate UTS/hostname namespace when using --unshare")

	// Inspect/debugging options
	NoInspect = flag.Bool("noinspect", false, "Exit immediately on error without showing debugging options")
)

var CurrentScriptDirectory string

var Rye_files embed.FS

var Version = "development"