#!/usr/bin/env bash

# Test sandbox support for mise run (tasks)

cat >mise.toml <<'TOML'
[tasks.env_test]
run = "echo ${SANDBOX_TASK_SECRET:-empty}"
deny_env = true

[tasks.path_test]
run = 'echo "PATH=${PATH:-unset} HOME=${HOME:-unset}"'
deny_env = true
TOML

export SANDBOX_TASK_SECRET="should_not_see"

# Task with deny_env should not see the var
assert "mise run env_test" "empty"

# deny_env should still let essential vars (PATH, HOME, ...) through
assert_not_contains "mise run path_test" "PATH=unset"
assert_not_contains "mise run path_test" "HOME=unset"
