Try and fix sandboxing.

Makefile

@@ -8,17 +8,21 @@ ifeq ($(BUILDTYPE),)
 endif
 export BUILDTYPE
 
+OPTFLAGS = -g -O3
+
 ifeq ($(BUILDTYPE),windows)
 	MINGW = x86_64-w64-mingw32-
 	CC = $(MINGW)gcc
 	CXX = $(MINGW)g++
-	CFLAGS += -g -O3 \
+	CFLAGS += \
+		$(OPTFLAGS) \
 		-ffunction-sections \
 		-fdata-sections \
 		-Wno-attributes \
 		-Wa,-mbig-obj \
 		-static
 	CXXFLAGS += \
+		$(OPTFLAGS) \
 		-std=c++23 \
 		-Wno-deprecated-enum-float-conversion \
 		-Wno-deprecated-enum-enum-conversion \
@@ -35,16 +39,17 @@ ifeq ($(BUILDTYPE),windows)
 	PROTOC_SEPARATOR = ;
 	EXT = .exe
 
-	AB_NO_SANDBOX = yes
+	AB_SANDBOX = no
 else
 	CC = clang
 	CXX = clang++
-	CFLAGS = -g -O3 \
+	CFLAGS = \
+		$(OPTFLAGS) \
 		-I/opt/homebrew/include -I/usr/local/include \
 		-Wno-unknown-warning-option
 	CXXFLAGS = \
+		$(OPTFLAGS) \
 		-std=c++23 \
-		-g -O3 \
 		-fexperimental-library \
 		-I/opt/homebrew/include -I/usr/local/include \
 		-Wformat \

build/ab.py

@@ -55,7 +55,7 @@ class Environment(types.SimpleNamespace):
 
 
 G = Environment()
-G.setdefault("AB_NO_SANDBOX", "")
+G.setdefault("AB_SANDBOX", "yes")
 
 
 class PathFinderImpl(PathFinder):
@@ -559,7 +559,7 @@ def emit_rule(self, ins, outs, cmds=[], label=None):
         os.makedirs(self.dir, exist_ok=True)
         rule = []
 
-        if not G.AB_NO_SANDBOX:
+        if G.AB_SANDBOX == "yes":
             sandbox = join(self.dir, "sandbox")
             emit(f"rm -rf {sandbox}", into=rule)
             emit(