sandbox

type Decision string

type DecisionInput struct {
	Lease   Lease
	Keyring map[string][]byte
	Now     time.Time
	Static  StaticPolicy
	Mode    ModeContext
	Request RuntimeRequest
}

type DecisionResult struct {
	Decision   Decision
	ReasonCode string
	Message    string
}

type ExecRule struct {
	Command     string   `json:"command"`
	ArgsPattern []string `json:"args_pattern"`
}

type FileAccess string

type Lease struct {
	Version          string        `json:"version"`
	LeaseID          string        `json:"lease_id"`
	RunID            string        `json:"run_id"`
	Scope            string        `json:"scope"`
	IssuedAt         time.Time     `json:"issued_at"`
	ExpiresAt        time.Time     `json:"expires_at"`
	KID              string        `json:"kid"`
	ApprovalMode     string        `json:"approval_mode"`
	AwayPolicy       string        `json:"away_policy"`
	FSRead           []string      `json:"fs_read"`
	FSWrite          []string      `json:"fs_write"`
	ExecAllowlist    []ExecRule    `json:"exec_allowlist"`
	NetworkAllowlist []NetworkRule `json:"network_allowlist"`
	Signature        string        `json:"signature,omitempty"`
}

type LeaseError struct {
	Code    string
	Message string
	Cause   error
}

type ModeContext struct {
	ApprovalMode             string
	AwayPolicy               string
	ApprovalChannelAvailable bool
}

type NetworkRule struct {
	Host   string `json:"host"`
	Port   int    `json:"port"`
	Scheme string `json:"scheme"`
}

type PolicyBroker interface {
	Decide(context.Context, DecisionInput) (DecisionResult, error)
}

type RuntimeRequest struct {
	ToolName         string
	FilePath         string
	FileAccess       FileAccess
	Command          string
	Args             []string
	Network          NetworkRule
	RequiresApproval bool
}

type StaticPolicy struct {
	ApprovalPolicy string
}