A Zone-based filesystem and process sandbox for Dart, built on IOOverrides. Confines all dart:io filesystem access to a configured root directory, blocks path-traversal and symlink escapes, enforces read-only / allow / deny policies, and gates process execution behind an allowlist. Includes a dart_io_sandbox CLI to run dart tests in sandbox mode.