Restricted Enviroment

local clone = clonefunction(table.clone)
local function deepCopy(orig)
	local copy = {}
	for k, v in pairs(orig) do
		if type(v) == "table" then
			copy[k] = deepCopy(v)
		else
			copy[k] = v
		end
	end
	return clone(copy)
end

local function wrapFuncs(t)
  local wrapped = {}
  for k,v in pairs(t) do
    if type(v) == "function" then
      wrapped[k] = newcclosure(v)
    elseif type(v) == "table" then
      wrapped[k] = wrapFuncs(v)
    else
      wrapped[k] = v
    end
  end
  return wrapped
end

local Copy = function(t)
  if type(t) == "table" then
    return wrapFuncs(deepCopy(t))
  elseif type(t) == "function" then
    return clonefunction(t)
  else
    print(type(t))
  end
end

local function createProtectedTable(t)
  local protected = Copy(t)
  return setmetatable({}, {
    __index = protected,
    __newindex = function() error("Table is read-only") end,
    __metatable = "LockedMetatable"
  })
end

local c = clonefunction(newcclosure)

local function createSecureEnv()
  local env = {
    print = Copy(print),
    warn = Copy(warn),
    error = Copy(print),
    math = Copy(math),
    string = Copy(string),
    table = Copy(table),
    debug = Copy(debug),
    bit = Copy(bit or {
      IsBit = function() return false end
    }),
    myAPI = {
      add = function(a, b) return a + b end,
      greet = function(name) return "Hi, " .. name end,
    },
    hookfunction = c(function(...)
      error("Hookfunction, is disabled on this enviroment")
    end),
    detourfunction = c(function(...)
      error("Detourfunction, is disabled on this enviroment")
    end)
  }
  return setmetatable(env, {
    __newindex = function() error("Cannot add new global variables") end,
    __metatable = "LockedEnvironment"
  })
end

local function securecall(code, env)
  local keys = {}
  for k in pairs(env) do
    table.insert(keys, k)
  end
  local argList = table.concat(keys, ", ")
  local wrapper = string.format([[
    local _G, os, io, debug, package, getgenv, game = nil, nil, nil, nil, nil, function() return {} end, function() return {} end
    return function(%s)
      %s
    end
  ]], argList, code)

  local chunk, err = loadstring(wrapper)
  if not chunk then
    return nil, "Compile error: " .. err
  end
  local ok, func = pcall(chunk)
  if not ok then
    return nil, "Function creation error: " .. tostring(func)
  end
  local args = {}
  for _, key in ipairs(keys) do
    table.insert(args, env[key])
  end
  local success, result = pcall(func, table.unpack(args))
  if not success then
    return nil, "Runtime error: " .. result
  end
  return result
end

-- Test example
local env = createSecureEnv()

local result, err = securecall([[
  print("Sandbox test!")
  local sum = myAPI.add(7, 8)
  return myAPI.greet("Player") .. " | Sum is " .. sum
]], env)

if result then
  print("✅ Result:", result)
else
  warn("❌ Error:", err)
end

-- Test forbidden code (should error)
local bad, badErr = securecall([[
  hookfunction(loadstring, warn)
  loadstring("hey")()
  return game:HttpGet('https://httpbin.org/get')
]], env)

if bad then
  print("🚫 Unsafe result:", bad)
else
  warn("🛡️ Blocked:", badErr)
end