One project builds a tool, every other project runs it, and each stays

in its sandbox. The tool's sources stay hidden.

Depend on a task, read its outputs

build : { dependsOn : [ ' packages/tools#build ' ], exec : { command : ' cat ../tools/out/bin/greet ../tools/src/greet.sh > greeting.txt ' , sandbox : { allow : { read : [ ' . ' ], write : [ ' greeting.txt ' ] } }, }, inputs : { files : [ ' src/** ' ] }, outputs : { files : [ ' greeting.txt ' ] }, cache : true , }

Enter fullscreen mode

Exit fullscreen mode

The output reads fine. The source does not exist for this task:

┌─ packages/app#build > failed (exit 1)

$ cat ../tools/out/bin/greet ../tools/src/greet.sh > greeting.txt

├─ OUTPUT ────────────────────────────────────────────────────

cat: ../tools/src/greet.sh: No such file or directory

├─ SANDBOX ───────────────────────────────────────────────────

vx: the sandbox hid paths outside the project that exist on this machine, which are not reported as violations:…