
# x sb airrun <cmd>
___x_cmd_sb_airrun(){
    [ $# -gt 0 ]    || set -- --help
    case "$1" in
        -h|--help)      ___x_cmd help -m sb airrun "$@" ;;
    esac

    ! ___x_cmd_is_termux || N=sb M="Unsupported system -> termux" log:ret:1

    local x_
    ___x_cmd os name_

    case "$x_" in
        darwin)     ___x_cmd_sb_airrun___sandboxexec    "$@" ;;
        linux)      ___x_cmd_sb_airrun___pledge         "$@" ;;
        *)
                    if [ -z "$___X_CMD_SB_RUN_ANYWAY" ]; then
                        N=sb M="Unsupported system -> $x_" log:ret:1
                    else
                        "$@"
                    fi
                    ;;
    esac
}

___x_cmd_sb_airrun___pledge(){          ___x_cmd pldg -V --no-net "$@" ;    }
___x_cmd_sb_airrun___sandboxexec(){     ___x_cmd_cmds sandbox-exec -p "(version 3) (allow default) (deny network*)" -- "$@" ;   }

