Derive sandbox permissions from a granted capability set.
Every flag defaults to false unless at least one capability in the
set unlocks it. Anything not gated by a SandboxPermissions flag
(storage, network, command, ui) is the caller's responsibility — the
runtime handles those via the ctx object, not the sandbox.
Derive sandbox permissions from a granted capability set.
Every flag defaults to false unless at least one capability in the set unlocks it. Anything not gated by a SandboxPermissions flag (storage, network, command, ui) is the caller's responsibility — the runtime handles those via the
ctxobject, not the sandbox.