Functions

function apply(caps: CapabilitySet): void

import { CapabilitySet, AccessMode, apply, isSupported } from 'nono-ts';

if (!isSupported()) {
  console.error('Sandboxing not available');
  process.exit(1);
}

const caps = new CapabilitySet();
caps.allowPath('/tmp', AccessMode.ReadWrite);
caps.allowPath('/usr/lib', AccessMode.Read);
caps.blockNetwork();

try {
  apply(caps);
  console.log('Sandbox applied successfully');
} catch (error) {
  console.error('Failed to apply sandbox:', error.message);
  process.exit(1);
}

// Process is now sandboxed

function isSupported(): boolean

import { isSupported } from 'nono-ts';

if (isSupported()) {
  console.log('Sandboxing is available');
} else {
  console.log('Sandboxing is not available on this platform');
}

function supportInfo(): SupportInfoResult

import { supportInfo } from 'nono-ts';

const info = supportInfo();

console.log(`Supported: ${info.isSupported}`);
console.log(`Platform: ${info.platform}`);
console.log(`Details: ${info.details}`);

// Example output on macOS:
// Supported: true
// Platform: macos
// Details: macOS Seatbelt sandbox available

// Example output on Linux:
// Supported: true
// Platform: linux
// Details: Landlock ABI v4 available

import { supportInfo, apply } from 'nono-ts';

function initSandbox(caps: CapabilitySet) {
  const info = supportInfo();

  if (!info.isSupported) {
    // Decide how to handle unsupported platforms
    if (process.env.REQUIRE_SANDBOX === 'true') {
      throw new Error(`Sandbox required but not available: ${info.details}`);
    }
    console.warn(`Warning: Running without sandbox (${info.details})`);
    return;
  }

  console.log(`Applying ${info.platform} sandbox: ${info.details}`);
  apply(caps);
}

import {
  CapabilitySet,
  AccessMode,
  apply,
  isSupported,
  supportInfo,
} from 'nono-ts';

function setupApplication() {
  // 1. Check support
  const info = supportInfo();
  if (!info.isSupported) {
    console.warn(`Sandbox unavailable: ${info.details}`);
    return;
  }

  // 2. Build capabilities
  const caps = new CapabilitySet();

  // Application data
  caps.allowPath('/var/app/data', AccessMode.ReadWrite);

  // Configuration (read-only)
  caps.allowFile('/etc/app/config.json', AccessMode.Read);

  // Runtime libraries
  caps.allowPath('/usr/lib', AccessMode.Read);
  caps.allowPath('/lib', AccessMode.Read);

  // Temp directory
  caps.allowPath('/tmp', AccessMode.ReadWrite);

  // Block network if not needed
  if (!process.env.NEEDS_NETWORK) {
    caps.blockNetwork();
  }

  // 3. Apply sandbox
  try {
    apply(caps);
    console.log(`Sandbox active (${info.platform})`);
  } catch (error) {
    console.error('Sandbox failed:', error.message);
    process.exit(1);
  }
}

setupApplication();