Module process 

Running a check: argv only, no stdin, scrubbed environment, a deadline for the whole process group, capped output.

CommandRunner is the seam the sandbox wraps and tests replace.

Structs

Captured

Captured output of one stream.

Invocation

What to run.

LocalRunner

Runs processes on this machine.

Outcome

What happened.

Constants

OUTPUT_CAP

Default cap per output stream.

Traits

CommandRunner

Runs invocations. The verifier depends only on this trait.

Functions

is_secret

Whether a variable name looks like a credential.

scrubbed_env

The child environment: everything except secret-looking variables, plus CI=1 and GIT_TERMINAL_PROMPT=0. Not a security boundary — that is the OS sandbox (crate::sandbox).