sandbox

type BaseExecutor struct {
	// contains filtered or unexported fields
}

type CodexBinaryManager struct {
	// contains filtered or unexported fields
}

type CodexBinaryManagerOptions struct {
	HTTPClient      *http.Client
	LookPath        func(string) (string, error)
	UserCacheDir    func() (string, error)
	GOOS            string
	GOARCH          string
	DownloadSources []string
}

type CodexSandboxExecutor struct {
	*BaseExecutor
	// contains filtered or unexported fields
}

type CodexSandboxExecutorOptions struct {
	Binary         string
	BinaryResolver codexBinaryResolver
	Subcommand     string
	ProbeTimeout   time.Duration
	LookPath       func(file string) (string, error)
	CommandContext func(ctx context.Context, name string, args ...string) *exec.Cmd
}

type Config struct {
	// DefaultTimeout is the default execution timeout.
	DefaultTimeout time.Duration
	// MaxTimeout is the maximum allowed timeout.
	MaxTimeout time.Duration
	// MemoryLimit is the memory limit in bytes.
	MemoryLimit int64
	// CPULimit is the CPU limit (1.0 = 1 core).
	CPULimit float64
	// ProcessLimit is the maximum number of processes.
	ProcessLimit int
	// NetworkEnabled allows network access.
	NetworkEnabled bool
	// LinuxLXCExecutable is the LXC CLI used for Linux strong isolation.
	LinuxLXCExecutable string
	// LinuxLXCInstance is the LXC instance name used for Linux strong isolation.
	LinuxLXCInstance string
	// WindowsCodexExecutable is the Codex CLI used for Windows strong isolation.
	WindowsCodexExecutable string
	// WindowsCodexAutoDownload controls whether Blue downloads a managed Codex
	// binary when no local executable is ready.
	WindowsCodexAutoDownload bool
	// WindowsCodexDownloadTimeout bounds background Windows Codex downloads.
	WindowsCodexDownloadTimeout time.Duration
	// WorkDir is the working directory for executions.
	WorkDir string
	// AllowedPaths are paths that can be accessed.
	AllowedPaths []string
	// DeniedPaths are paths that cannot be accessed.
	DeniedPaths []string

	// macOS Hypervisor.framework specific options
	// DarwinExecutorMode specifies which executor to use on macOS.
	// Valid values: "auto", "hypervisor", "sandbox-exec"
	// Default: "auto" (automatically selects the best available option)
	DarwinExecutorMode string
	// HypervisorVMImagePath is the path to the VM disk image for Hypervisor mode.
	HypervisorVMImagePath string
	// HypervisorMemoryMB is the VM memory in megabytes for Hypervisor mode.
	HypervisorMemoryMB int
	// HypervisorCPUCount is the number of virtual CPUs for Hypervisor mode.
	HypervisorCPUCount int
}

type ExecuteRequest struct {
	Command     string            `json:"command" validate:"required"`
	Args        []string          `json:"args,omitempty"`
	Env         map[string]string `json:"env,omitempty"`
	WorkDir     string            `json:"work_dir,omitempty"`
	Stdin       string            `json:"stdin,omitempty"`
	TimeoutSecs int               `json:"timeout_secs,omitempty"`
	MemoryMB    int               `json:"memory_mb,omitempty"`
}

type ExecutionRequest struct {
	// ID is the unique execution identifier.
	ID string
	// Tier selects the sandbox isolation tier. Empty defaults to light.
	Tier Tier
	// Command is the command to execute.
	Command string
	// Args are the command arguments.
	Args []string
	// Env are environment variables.
	Env map[string]string
	// WorkDir is the working directory.
	WorkDir string
	// Timeout is the execution timeout.
	Timeout time.Duration
	// Stdin is the standard input.
	Stdin string
	// MemoryLimit overrides the default memory limit.
	MemoryLimit int64
	// CPULimit overrides the default CPU limit.
	CPULimit float64
}

type ExecutionResult struct {
	// ID is the execution identifier.
	ID string `json:"id"`
	// Status is the execution status.
	Status ExecutionStatus `json:"status"`
	// ExitCode is the process exit code.
	ExitCode int `json:"exit_code"`
	// Stdout is the standard output.
	Stdout string `json:"stdout"`
	// Stderr is the standard error.
	Stderr string `json:"stderr"`
	// StartTime is when the execution started.
	StartTime time.Time `json:"start_time"`
	// EndTime is when the execution ended.
	EndTime time.Time `json:"end_time"`
	// Duration is the execution duration.
	Duration time.Duration `json:"duration"`
	// ResourceUsage contains resource usage statistics.
	ResourceUsage *ResourceUsage `json:"resource_usage,omitempty"`
	// Error contains any error message.
	Error string `json:"error,omitempty"`
}

type ExecutionStatus string

type Executor interface {
	// Execute executes a command in the sandbox.
	Execute(ctx context.Context, req *ExecutionRequest) (*ExecutionResult, error)
	// GetStatus returns the status of an execution.
	GetStatus(id string) (*ExecutionResult, error)
	// Kill kills a running execution.
	Kill(id string) error
	// Cleanup cleans up resources.
	Cleanup() error
	// IsSupported returns true if the executor is supported on this platform.
	IsSupported() bool
}

type Handler struct {
	// contains filtered or unexported fields
}

type LinuxExecutor struct {
	*BaseExecutor
	// contains filtered or unexported fields
}

type Manager struct {
	// contains filtered or unexported fields
}

type ResourceUsage struct {
	// CPUTime is the CPU time used in nanoseconds.
	CPUTime int64 `json:"cpu_time_ns"`
	// MemoryPeak is the peak memory usage in bytes.
	MemoryPeak int64 `json:"memory_peak_bytes"`
	// IORead is the number of bytes read.
	IORead int64 `json:"io_read_bytes"`
	// IOWrite is the number of bytes written.
	IOWrite int64 `json:"io_write_bytes"`
}

type SeccompProfile struct {
	DefaultAction string
	Syscalls      []SyscallRule
}

type SyscallRule struct {
	Names  []string
	Action string
}

type Tier string

type UpdateConfigRequest struct {
	NetworkEnabled *bool `json:"network_enabled,omitempty"`
}