sandbox_mode

Builtin index · REPL & diagnostics

sandbox_mode(on)

Input: on · Output: no output

What it is

Takes one argument, on (a boolean). Refuses file and network access for the rest of the session and returns none. One way only — passing sandbox_mode(false) does not turn it back off, which is the point; e.g. after sandbox_mode(true), a subsequent fopen(path, "w") raises a catchable error instead of opening the file.

Overloads

One call shape — this function is not overloaded.

Examples

From the documentation, and run by the build -- the output and the figure below are what the engine actually produced. Simplest first.

function load_and_process(path)
    profiling_mode(true)
    data = read_csv(path, headers=true)
    result = data.sort_by("value")
    profiling_mode(false)
    print(profile_stats())     # a real Table: function / calls / seconds


    sandbox_mode(true)
    try
        touch("audit.log")     # denied -- sandboxed for this section only

    catch err
        print("blocked: {err.message}")
    end
    sandbox_mode(false)

    return result
end function

from quickstart

How it works

sandbox_mode(on)/profiling_mode(on)/profile_stats() (§ in-program resource controls, 2026-09-01): qu run --sandbox/--profile were CLI-only — set once, before the script starts, by qu-cli's cmd_run calling Interp::set_sandboxed/set_profiling directly. Those two methods' own doc comments already state flipping them mid-run is safe and takes effect on the very next builtin call; there was just no Qu-level way to reach them. These three builtins expose that existing capability as "a part of the program" (Ahmed's own framing) rather than an external invocation detail — a script can now sandbox or profile just ONE section of itself (turn on, do the risky/hot part, turn back off and query profile_stats() immediately) rather than only all-or-nothing for the whole process. Deliberately returns a Table (not a CLI-style printed report) from profile_stats so the script decides what to do with its own data — print it, filter it, save it — rather than being handed qu-cli's external report string.

From the note above this builtin in the interpreter, where the reasoning was written down as it was built.