NativeBashExecutorOptions
Defined in: bash/native-executor.ts:11
Properties
Section titled “Properties”allowNetwork?
Section titled “allowNetwork?”
optionalallowNetwork?:boolean
Defined in: bash/native-executor.ts:42
Allow network access. Default false (matches ASRT’s “no network unless explicitly
allowed” posture) — but unlike ASRT, this executor can’t filter by domain: it’s all
network access or none.
allowRead?
Section titled “allowRead?”
optionalallowRead?:string[]
Defined in: bash/native-executor.ts:36
Confine reads to these paths (plus allowWrite, plus the system paths below).
Omitted — the default — keeps this executor’s historical behaviour of ro-binding all of
/, i.e. reads are not bounded at all.
Unlike denyRead, which is a deny-list and therefore only ever as complete as its
author, this is an allow-list enforced by the kernel: a path outside it is not
“permission denied” but genuinely absent from the mount namespace — ls reports
No such file or directory. That is what makes it suitable as the read boundary for a
recursive reader like rg, where enumerating everything to deny is hopeless.
SYSTEM_READ_PATHS stay bound regardless, since nothing can execute without them; see BashExecutorDescription.allowRead for what that means for the guarantee.
allowWrite
Section titled “allowWrite”allowWrite:
string[]
Defined in: bash/native-executor.ts:17
Paths writable inside the sandbox — e.g. the tool’s configured project root. Required,
matching the no-unsandboxed-default rule: pass [] for a
sandbox that can run commands but write nowhere, not an implicit “everything.”
denyRead?
Section titled “denyRead?”
optionaldenyRead?:string[]
Defined in: bash/native-executor.ts:20
Paths to hide entirely (not just deny write to), on top of the read-only view of everything else this executor gives by default.
optionalenv?:Record<string,string>
Defined in: bash/native-executor.ts:51
Environment variables available inside the sandbox. Default: a minimal safe subset of
this process’s own env (PATH, HOME, LANG, LC_ALL, TERM, TMPDIR) — not the
full process.env, which may hold secrets ADL’s own .env loading put there (this
avoids leaking secrets that .env loading put on process.env).
maxOutputBytes?
Section titled “maxOutputBytes?”
optionalmaxOutputBytes?:number
Defined in: bash/native-executor.ts:44
Bytes to keep from stdout/stderr each before truncating. Default 1,000,000 (1 MB).