feat: Add Sandbox Inspection and Debugging Commands (#261)

* feat: add sandbox DX commands

* fix: Linter errors

* fix: Sandbox deny log parsing

* fix: Sandbox docs

* refactor: Maintain SSOT across pkg dependencies

* fix: Linter errors

sandbox/util/variables.go

@@ -6,42 +6,65 @@ import (
 	"strings"
 )
 
-// ExpandVariables expands known variables in a path or pattern.
-// Supported variables:
-// - ${HOME}: User home directory
-// - ${CWD}: Current working directory
-// - ${TMPDIR}: Temporary directory
+// Variable names recognised by ExpandVariablesWith. SupportedVariables is the
+// authoritative list — callers that need to validate variable usage (e.g. the
+// linter) should consume it rather than maintaining their own copy.
+const (
+	VarHome   = "${HOME}"
+	VarCWD    = "${CWD}"
+	VarTMPDir = "${TMPDIR}"
+)
+
+var SupportedVariables = []string{VarHome, VarCWD, VarTMPDir}
+
+// IsSupportedVariable reports whether tok is one of the variables that
+// ExpandVariablesWith will expand.
+func IsSupportedVariable(tok string) bool {
+	for _, v := range SupportedVariables {
+		if v == tok {
+			return true
+		}
+	}
+	return false
+}
+
+// ExpandVariables expands known variables in a path or pattern using process
+// environment values. See ExpandVariablesWith for supported variables.
 func ExpandVariables(pattern string) (string, error) {
-	result := pattern
+	return ExpandVariablesWith(pattern, "", "", "")
+}
 
-	// Get home directory
-	home, err := os.UserHomeDir()
-	if err != nil {
-		return "", err
+// ExpandVariablesWith expands known variables in a path or pattern. Any of
+// cwd, home, tmpDir left empty falls back to the corresponding process value.
+// The set of recognised tokens is SupportedVariables.
+func ExpandVariablesWith(pattern, cwd, home, tmpDir string) (string, error) {
+	if home == "" {
+		h, err := os.UserHomeDir()
+		if err != nil {
+			return "", err
+		}
+		home = h
 	}
 
-	// Get current working directory
-	cwd, err := os.Getwd()
-	if err != nil {
-		return "", err
+	if cwd == "" {
+		c, err := os.Getwd()
+		if err != nil {
+			return "", err
+		}
+		cwd = c
 	}
 
-	// Get temp directory
-	tmpDir := os.TempDir()
+	if tmpDir == "" {
+		tmpDir = os.TempDir()
+	}
 
-	// Replace variables
 	replacer := strings.NewReplacer(
-		"${HOME}", home,
-		"${CWD}", cwd,
-		"${TMPDIR}", tmpDir,
+		VarHome, home,
+		VarCWD, cwd,
+		VarTMPDir, tmpDir,
 	)
 
-	result = replacer.Replace(result)
-
-	// Clean up path (resolve .., ., etc.)
-	result = filepath.Clean(result)
-
-	return result, nil
+	return filepath.Clean(replacer.Replace(pattern)), nil
 }
 
 // ContainsGlob returns true if the pattern contains glob wildcards.