Custom sandbox binary paths

Point sandbox isolation at custom bubblewrap and socat binaries on Linux/WSL2 (managed settings only).

json

{
  "sandbox": {
    "bwrapPath": "/usr/local/bin/bwrap",
    "socatPath": "/usr/local/bin/socat"
  }
}