// engine/sandbox/index.ts — Public API for sandbox runner (SPEC-742)
import { detectRunner } from './runner-detect.js';
import { runWithBwrap } from './runner-bwrap.js';
import { runWithSandboxExec } from './runner-sandbox-exec.js';
import { runWithDocker } from './runner-docker.js';
export { detectRunner } from './runner-detect.js';
export { sanitizeEnv, hasDangerousEnvVars } from './env-sanitizer.js';
/**
 * Run a command inside the best available OS-level sandbox.
 * Runner selection order: bwrap > sandbox-exec > docker.
 *
 * If no sandbox runner is available:
 * - Throws an error with code SANDBOX_UNAVAILABLE.
 *
 * @param command    - Binary to execute (e.g. 'pnpm')
 * @param args       - Arguments to pass (e.g. ['test'])
 * @param options    - Sandbox configuration (projectRoot, level, network)
 */
export async function runInSandbox(command, args, options) {
    const runner = await detectRunner();
    if (runner === null) {
        const err = new Error('SANDBOX_UNAVAILABLE: No sandbox runner found. ' +
            'Install bwrap on Linux, ensure sandbox-exec on macOS, or run inside Docker.');
        err.code = 'SANDBOX_UNAVAILABLE';
        throw err;
    }
    switch (runner) {
        case 'bwrap':
            return runWithBwrap(command, args, options);
        case 'sandbox-exec':
            return runWithSandboxExec(command, args, options);
        case 'docker':
            return runWithDocker(command, args, options);
    }
}
//# sourceMappingURL=index.js.map