sandbox

type ExecutionResult struct {
	Stdout     string
	Stderr     string
	ExitCode   int
	Syscalls   []string // captured system calls (requires gVisor seccomp tracing)
	FileWrites []string // file paths written during execution
	NetConns   []string // outbound network connections observed
}

type Sandbox interface {
	// Execute runs the given tool with the provided arguments inside the sandbox
	// and returns an observation of its runtime behaviour.
	Execute(ctx context.Context, tool model.UnifiedTool, args map[string]any) (ExecutionResult, error)

	// Available reports whether the sandbox backend is reachable and ready.
	Available(ctx context.Context) bool
}