-- Test that dangerous globals are nil
-- This script should run successfully if sandbox is properly configured
-- Note: 'require' is intentionally NOT in this list because the sandbox
-- provides a safe version when app_path is configured

local dangerous = {
    "os", "io", "debug", "package", "ffi", "jit",
    "dofile", "loadfile", "load", "loadstring",
    "rawget", "rawset", "rawequal", "rawlen",
    "collectgarbage", "newproxy"
}

local failed = {}

for _, name in ipairs(dangerous) do
    local value = _G[name]
    if value ~= nil then
        table.insert(failed, name .. " (is " .. type(value) .. ")")
    end
end

if #failed > 0 then
    error("FAIL: These globals should be nil: " .. table.concat(failed, ", "))
end

print("PASS: All dangerous globals removed")