Support custom flags for sandbox and app layers
Add app pre-install hook
Improve naming
Add PROTECT_SANDBOX