Function start_sandbox

packages/cli/src/utils/sandbox.ts:185–815

(
  config: SandboxConfig,
  nodeArgs: string[] = [],
  cliConfig?: Config,
)

}

export async function start_sandbox(
  config: SandboxConfig,
  nodeArgs: string[] = [],
  cliConfig?: Config,
) {
  const patcher = new ConsolePatcher({
    debugMode: cliConfig?.getDebugMode() || !!process.env['DEBUG'],
    stderr: true,
  });
  patcher.patch();

  try {
    if (config.command === 'sandbox-exec') {
      // disallow BUILD_SANDBOX
      if (process.env['BUILD_SANDBOX']) {
        console.error('ERROR: cannot BUILD_SANDBOX when using macOS Seatbelt');
        process.exit(1);
      }
      const profile = (process.env['SEATBELT_PROFILE'] ??= 'permissive-open');
      let profileFile = new URL(`sandbox-macos-${profile}.sb`, import.meta.url)
        .pathname;
      // if profile name is not recognized, then look for file under project settings directory
      if (!BUILTIN_SEATBELT_PROFILES.includes(profile)) {
        profileFile = path.join(
          SETTINGS_DIRECTORY_NAME,
          `sandbox-macos-${profile}.sb`,
        );
      }
      if (!fs.existsSync(profileFile)) {
        console.error(
          `ERROR: missing macos seatbelt profile file '${profileFile}'`,
        );
        process.exit(1);
      }
      // Log on STDERR so it doesn't clutter the output on STDOUT
      console.error(`using macos seatbelt (profile: ${profile}) ...`);
      // if DEBUG is set, convert to --inspect-brk in NODE_OPTIONS
      const nodeOptions = [
        ...(process.env['DEBUG'] ? ['--inspect-brk'] : []),
        ...nodeArgs,
      ].join(' ');

      const args = [
        '-D',
        `TARGET_DIR=${fs.realpathSync(process.cwd())}`,
        '-D',
        `TMP_DIR=${fs.realpathSync(os.tmpdir())}`,
        '-D',
        `HOME_DIR=${fs.realpathSync(os.homedir())}`,
        '-D',
        `CACHE_DIR=${fs.realpathSync(execSync(`getconf DARWIN_USER_CACHE_DIR`).toString().trim())}`,
      ];

      // Add included directories from the workspace context
      // Always add 5 INCLUDE_DIR parameters to ensure .sb files can reference them
      const MAX_INCLUDE_DIRS = 5;
      const targetDir = fs.realpathSync(cliConfig?.getTargetDir() || '');
      const includedDirs: string[] = [];