Function wrapCommandForShuru

src/tools/bash.ts:450–483

(cwd: string, command: string, settings: SandboxSettings = {})

}

export function wrapCommandForShuru(cwd: string, command: string, settings: SandboxSettings = {}): string {
  const parts: string[] = ["shuru", "run"];

  if (settings.cpus) parts.push("--cpus", String(settings.cpus));
  if (settings.memory) parts.push("--memory", String(settings.memory));
  if (settings.diskSize) parts.push("--disk-size", String(settings.diskSize));
  if (settings.allowNet) parts.push("--allow-net");
  if (settings.allowedHosts) {
    for (const host of settings.allowedHosts) parts.push("--allow-host", host);
  }
  if (settings.ports) {
    for (const port of settings.ports) parts.push("-p", port);
  }
  if (settings.secrets) {
    for (const s of settings.secrets) {
      parts.push("--secret", `${s.name}=${s.fromEnv}@${s.hosts.join(",")}`);
    }
  }
  if (settings.from) parts.push("--from", settings.from);

  const mountArg = `${cwd}:/workspace`;
  parts.push("--mount", shellQuote(mountArg));
  const shellInit = buildShellInitScript(settings);
  const guestPrelude = buildGuestWorkspacePrelude(settings);
  const guestSteps = [
    shellInit,
    guestPrelude,
    `cd ${shellPathForScript(settings.guestWorkdir || "/workspace")}`,
    command,
  ].filter(Boolean);
  const guestCommand = guestSteps.join(" && ");
  parts.push("--", "sh", "-lc", shellQuote(guestCommand));
  return parts.join(" ");
}

const HOST_SAFE_SEGMENT_RE =
  /^\s*(?:(?:npx(?:\s+-y)?|bunx)\s+)?agent-browser\b|^\s*mkdir\s|^\s*sleep\s|^\s*echo\s|^\s*true\s*$|^\s*$/;