Function build_sandboxed_command 

pub fn build_sandboxed_command(
    script: &str,
    env: &[(String, String)],
    cwd: Option<&str>,
    sandbox: &ResolvedBashSandbox,
) -> Result<Command>

Build a Command that will execute script inside a sandbox.

On Linux the command uses bwrap with targeted read-only mounts, isolated network, PID, IPC, and UTS namespaces, a tmpfs /tmp, and real /dev + /proc.

On macOS the command uses sandbox-exec with a dynamically generated Seatbelt profile that scopes file-read* and mach-lookup to required paths.