Limiting sandbox

limit.sb

; run `sandbox-exec -f limit.sb $program`
(version 1)
(debug deny)
(deny default)
(import "/System/Library/Sandbox/Profiles/bsd.sb")
(allow network-outbound)
(deny network-outbound (remote tcp "localhost:*"))
(allow process-fork)
(allow process-exec*
       (subpath "/opt/homebrew/")
       (subpath "/usr/bin/")
       (subpath "/bin/")
       (subpath "/Volumes/Work/nitwit2gitwit/node_modules/")
       )
(allow file-read*
       (subpath "/Volumes/Work/nitwit2gitwit/")
       (subpath "/opt/homebrew/")
       )
(allow file-write*
       (subpath "/Volumes/Work/nitwit2gitwit/node_modules/")
       (subpath "/Volumes/Work/nitwit2gitwit/.node-cache/")
       (literal "/Volumes/Work/nitwit2gitwit/package-lock.json")
       (literal "/Volumes/Work/nitwit2gitwit/package.json")
       (subpath "/Volumes/Work/nitwit2gitwit/")
       )

(allow network-inbound)
(allow network-inbound (remote tcp "localhost:*"))
(allow file-ioctl (regex "^/dev/tty"))