| 167 | // sets the knob and typos it should find out at boot, not by watching a |
| 168 | // runaway execution use the 5-minute default. |
| 169 | const resolveSandboxTimeoutMs = (): number | undefined => { |
| 170 | const raw = process.env.EXECUTOR_SANDBOX_TIMEOUT_MS; |
| 171 | if (!raw) return undefined; |
| 172 | const parsed = Number(raw); |
| 173 | if (!Number.isFinite(parsed) || parsed <= 0) { |
| 174 | // oxlint-disable-next-line executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: refuse to boot on a malformed operator knob |
| 175 | throw new Error( |
| 176 | `EXECUTOR_SANDBOX_TIMEOUT_MS ${JSON.stringify(raw)} is not a positive number of milliseconds`, |
| 177 | ); |
| 178 | } |
| 179 | return Math.floor(parsed); |
| 180 | }; |
| 181 | |
| 182 | // The org slug doubles as a URL segment (`/<slug>/policies`), so an |
| 183 | // operator-set value must fit the shared grammar and avoid reserved root |