Function allow

src/tools/shell/code-run.ts:109–109

(cond: string)

  // sandbox-exec profile (SBPL — a Scheme dialect). Allows reads everywhere
  // (most interpreters need to read libs from /usr), restricts writes to tempDir,
  // and conditionally allows network outbound.
  const allow = (cond: string): string => `(allow ${cond})`;
  const networkLines = allowNetwork
    ? [