nono-ts workflows.
Run from repository root
--experimental-strip-types and are best run on Node 22+.
Scenarios
01-support-check: detect and print sandbox platform support02-build-capabilities: build a capability set and inspect grants03-query-policy: evaluate allowed/denied operations withQueryContext04-state-roundtrip: serialize and restore policy state05-safe-apply-pattern: safe preflight and guardedapply()
Safety
apply(caps) is irreversible for the lifetime of the process.05-safe-apply-pattern only applies the sandbox when NONO_APPLY=1 is set.