feat: add --tty flag for interactive terminal applications

README.md

@@ -168,8 +168,14 @@ srt --debug curl https://example.com
 
 # Specify custom settings file
 srt --settings /path/to/srt-settings.json npm install
+
+# Enable TTY/PTY passthrough for interactive terminal applications (macOS only)
+srt --tty vim file.txt
+srt -t htop
 ```
 
+> **Note:** The `--tty` flag enables pseudo-terminal (PTY) operations, which are required for interactive terminal applications like `vim`, `htop`, or any TUI (Text User Interface) application. This flag only affects macOS; on Linux, PTY access is handled differently.
+
 ### As a library
 
 ```typescript
@@ -331,6 +337,7 @@ Examples:
 
 - `ignoreViolations` - Object mapping command patterns to arrays of paths where violations should be ignored
 - `enableWeakerNestedSandbox` - Enable weaker sandbox mode for Docker environments (boolean, default: false)
+- `allowPty` - Allow pseudo-terminal (PTY) operations for interactive terminal applications (boolean, default: false, macOS only). Can also be enabled via `--tty` CLI flag.
 
 ### Common Configuration Recipes
 

src/cli.ts

@@ -97,11 +97,20 @@ async function main(): Promise<void> {
       '-c <command>',
       'run command string directly (like sh -c), no escaping applied',
     )
+    .option(
+      '-t, --tty',
+      'enable TTY/PTY passthrough for interactive terminal applications (macOS only)',
+    )
     .allowUnknownOption()
     .action(
       async (
         commandArgs: string[],
-        options: { debug?: boolean; settings?: string; c?: string },
+        options: {
+          debug?: boolean
+          settings?: string
+          c?: string
+          tty?: boolean
+        },
       ) => {
         try {
           // Enable debug logging if requested
@@ -149,8 +158,20 @@ async function main(): Promise<void> {
             ),
           )
 
+          // Merge CLI options with config file settings
+          // CLI --tty flag takes precedence over config file allowPty
+          const effectiveConfig: Partial<SandboxRuntimeConfig> = {}
+          if (options.tty) {
+            effectiveConfig.allowPty = true
+            logForDebugging('TTY/PTY passthrough enabled via --tty flag')
+          }
+
           // Wrap the command with sandbox restrictions
-          const sandboxedCommand = await SandboxManager.wrapWithSandbox(command)
+          const sandboxedCommand = await SandboxManager.wrapWithSandbox(
+            command,
+            undefined, // binShell - use default
+            effectiveConfig,
+          )
 
           // Execute the sandboxed command
           const child = spawn(sandboxedCommand, {