CubePolicyEngine constructor

const CubePolicyEngine(
  1. CubeSpec spec, {
  2. String? homeDir,
  3. String? workspaceRoot,
  4. CubeFsProbe? pathProbe,
})

Creates an engine evaluating commands against spec.

homeDir resolves ~ redirection targets; workspaceRoot overrides spec.filesystem.workspace as the base for relative targets (the shell passes the real process cwd — the cube's /workspace is realized as the env cwd). A ~ target with an unknown homeDir is denied. pathProbe enables symlink resolution for redirect targets — the same CubeFsProbe-based resolution the fs guard uses, so a link inside the workspace cannot redirect a write outside either.

Implementation

const CubePolicyEngine(
  this.spec, {
  this.homeDir,
  this.workspaceRoot,
  this.pathProbe,
});