# EvoScientist Native Sandbox Runtime

The canonical, packaged runtime assets live in:

```text
EvoScientist/native_sandbox_runtime/package.json
EvoScientist/native_sandbox_runtime/package-lock.json
EvoScientist/native_sandbox_runtime/patch_merged_usr.py
```

Standalone Python installations copy those assets from the wheel into the user data directory, run the pinned `npm ci --ignore-scripts --omit=dev`, apply the fail-closed patch, verify the installation, and atomically promote it on first sandbox use.

Production Docker images install and patch the same assets during image build and set `EVOSCIENTIST_NATIVE_SANDBOX_ROOT` to the image-local runtime, so container startup never downloads dependencies.

Required platform tools:

- macOS: Node 20.11+, npm, `bash`, `rg`, `python3`, `pandoc`, and `/usr/bin/sandbox-exec`
- Linux: Node 20.11+, npm for standalone first install, `bash`, `rg`, `python3`, `pandoc`, `bwrap`, and `socat`

Run the host-specific black-box suite after installation:

```bash
EVOSCIENTIST_RUN_NATIVE_SANDBOX_TESTS=1 uv run pytest -q tests/test_native_sandbox_integration.py
```