//! Sandboxed execution environment for CAR agents.
//!
//! Provides `SandboxExecutor`, a `ToolExecutor` implementation that runs
//! tool commands inside an isolated Docker container. The container has:
//!
//! - Full filesystem access to a mounted working directory
//! - No safety policy restrictions (the isolation IS the safety)
//! - Ability to run tests, install deps, and iterate freely
//! - Automatic cleanup on drop
//!
//! Usage from Tokhn:
//! ```ignore
//! let sandbox = SandboxExecutor::new(working_dir, image).await?;
//! let runtime = Runtime::new().with_executor(Arc::new(sandbox));
//! ```

mod executor;
pub mod preflight;

pub use executor::{
    reap_orphaned_sandboxes, SandboxConfig, SandboxError, SandboxExecutor, SANDBOX_OWNER_LABEL,
};
pub use preflight::{
    filter_sensitive_env, preflight, PreflightResult, SandboxPolicy, SENSITIVE_ENV_VARS,
};
