sbox plan
phase: 2
config: $ROOT/sbox.yaml

command: npm install
argv:
  - npm
  - install

audit:
  install_style: false
  strict_security: false
  trusted_image_required: false
  sensitive_pass_through: <none>
  lockfile: not-applicable
  pre_run: <none>

resolution:
  profile: default
  profile source: default profile
  mode: sandbox
  mode source: profile

runtime:
  backend: podman
  image: ref:ghcr.io/astral-sh/uv:python3.13-bookworm-slim@sha256:847b5e690018bc6b9d97a0848da65f721b785f1e78d9c7067b8947c7010b2718
  image_trust: pinned-digest
  verify_signature: not requested
  user mapping: keep-id

workspace:
  root: $ROOT
  invocation cwd: $ROOT
  effective host dir: $ROOT
  mount: /workspace
  sandbox cwd: /workspace
  cwd mapping: mapped from invocation cwd

policy:
  network: off
  network_allow: <none>
  writable: true
  no_new_privileges: true
  read_only_rootfs: false
  reuse_container: false
  reusable_session: <none>
  cap_drop: <none>
  cap_add: <none>
  ports: <none>
  pull_policy: <default>

environment:
  - APP_MODE=sandbox-test (set)
  - UV_CACHE_DIR=/var/tmp/sbox/uv-cache (set)
  - UV_PROJECT_ENVIRONMENT=/var/tmp/sbox/uv-env (set)
  denied: SECRET_TOKEN

mounts:
  - bind $ROOT -> /workspace (ro, workspace)

caches:
  - uv-cache -> /var/tmp/sbox/uv-cache (rw, source: <default>)
  - uv-env -> /var/tmp/sbox/uv-env (rw, source: <default>)

secrets:
  <none>
