platform

type BubblewrapSandbox struct{}

type EditorAdapter interface {
	Name() string
	Open(ctx context.Context, dir, editor string) error
}

type FSEvent struct {
	Kind FSEventKind
	Path string
	At   time.Time
}

type FSEventKind string

type Keychain interface {
	Name() string
	Store(ctx context.Context, service, account string, secret []byte) error
	Load(ctx context.Context, service, account string) ([]byte, error)
	Delete(ctx context.Context, service, account string) error
}

type LandlockSandbox struct{}

type LinuxSandbox struct{}

type NativeWatcher struct {
	Debounce   time.Duration
	MaxLatency time.Duration
}

type NetworkEnforcement int

type PollWatcher struct {
	Interval time.Duration
}

type ReadConfineEnforcement int

type RuntimeInfo struct {
	OS   string
	Arch string
}

type Sandbox interface {
	Name() string
	// Available reports whether the sandbox can be used on this host; the
	// returned error explains why not (wrapped in ErrUnsupported).
	Available() error
	// Command returns the argv wrapped in the sandbox launcher, any extra file
	// descriptors the launcher references, and a cleanup function.
	Command(ctx context.Context, spec SandboxSpec, argv []string) (SandboxCommand, error)
}

type SandboxCapabilities interface {
	// Limitations returns human-readable degrade notes for the selected
	// backend; callers print them as one notice line.
	Limitations() []string
	// NetworkDenyEnforcement reports how completely SandboxSpec.DenyNetwork
	// will be kernel-enforced for the selected backend.
	NetworkDenyEnforcement() NetworkEnforcement
}

type SandboxCommand struct {
	// Argv is the fully wrapped command to exec.
	Argv []string
	// ExtraFiles are wired to exec.Cmd.ExtraFiles: entry i is inherited by the
	// launcher as fd 3+i, and Argv may reference those fd numbers (bubblewrap's
	// --seccomp <fd> reads the compiled filter this way). Nil when the backend
	// needs no inherited fds.
	ExtraFiles []*os.File
	// Cleanup is always non-nil-safe to call once the command has completed: it
	// closes ExtraFiles and removes any generated profile file.
	Cleanup func()
}

type SandboxReadConfinement interface {
	ReadConfineEnforcement() ReadConfineEnforcement
}

type SandboxSpec struct {
	// WorktreeDir is the agent worktree — the only project location the
	// child may write.
	WorktreeDir string
	// TmpDir is the child's temp directory (writable).
	TmpDir string
	// LogDir is where the generated profile file lives. It is NOT granted to
	// the child: the agent log is written by the parent process, so the child
	// only ever sees inherited pipes — keeping LogDir read-only for the child
	// prevents it from tampering with its own 0600 log or the profile.
	LogDir string
	// UserHome is the REAL user home. The agent child env repoints HOME to
	// the worktree (SECU-02), but the filesystem still contains the user's
	// dotfiles — sensitive-read denies are anchored here.
	UserHome string
	// DevstrapHome is the DevStrap home (~/.devstrap); its keys directory is
	// read-denied.
	DevstrapHome string
	// DenyNetwork blocks all network access for the child.
	DenyNetwork bool
	// DenySensitiveReads blocks reads of credential-bearing paths under
	// UserHome (.ssh, .aws, .gnupg, .config/gh, .kube, .docker) and
	// DevstrapHome/keys.
	DenySensitiveReads bool
	// DenyDangerousSyscalls installs the seccomp syscall denylist (mount,
	// ptrace, kernel-module, keyring, io_uring, and other escape-primitive
	// syscalls return EPERM). Unconditional hardening on both Linux backends
	// when the sandbox is enabled; a kernel without seccomp-filter support
	// degrades to a limitation, not an error. macOS ignores it (Seatbelt has
	// no seccomp analogue).
	DenyDangerousSyscalls bool
	// ViolationTag, when set, macOS SBPL deny rules embed `(with message
	// <tag>)` so post-run log correlation can attribute denials to this run;
	// empty disables tagging.
	ViolationTag string
	// ReadConfine restricts the child's reads to ReadConfineRoots (the
	// worktree/tmp, the OS toolchain/system roots, the $HOME build caches, and
	// ReadAllowExtra) instead of the allow-default / read-only-root model, so
	// the rest of $HOME and other projects become unreadable. Opt-in — the CLI
	// turns it on by default only for the readonly policy. Credential denies
	// still stack on top (defense in depth).
	ReadConfine bool
	// ReadAllowExtra are additional absolute read roots (repeatable
	// --read-allow) folded into the read-confinement allow-list.
	ReadAllowExtra []string
	// GitDirs are absolute git storage paths a linked agent worktree must be
	// able to WRITE for `git add`/`git commit` to succeed: the shared object
	// store, refs, and reflogs in the clone's git-common-dir, plus the
	// per-worktree admin dir (index/HEAD/COMMIT_EDITMSG). A DevStrap agent
	// worktree is a git *linked* worktree whose .git lives in the parent clone,
	// so without these the child's commit is EPERM'd and `agent pr` has nothing
	// to push (P7-SANDBOX-01). The common dir's hooks/ and config are
	// deliberately EXCLUDED — granting them would let the child plant a hook or
	// config that executes UNSANDBOXED on a later git operation. Also folded
	// into the read-confinement allow-list so git reads work under --read-confine.
	GitDirs []string
}

type SandboxViolation struct {
	Operation string
	Path      string
	Detail    string // the raw (unscrubbed) log line; caller scrubs before persist
}

type SandboxViolationReporter interface {
	CollectViolations(ctx context.Context, tag string, since time.Time) ([]SandboxViolation, error)
}

type ServiceManager interface {
	Name() string
	// DefaultLabel is the OS-idiomatic label used when the caller does not pass
	// one (a reverse-DNS launchd label, a bare systemd unit name).
	DefaultLabel() string
	// Install returns OS-idiomatic advisory notes (e.g. the Linux linger note)
	// alongside any error, so the CLI never has to branch on the OS.
	Install(ctx context.Context, spec ServiceSpec) (notes []string, err error)
	// Uninstall returns OS-idiomatic advisory notes (mirroring Install) so the
	// CLI never has to branch on the OS; the unit/plist file is always removed
	// even when the OS manager is unreachable (the headless/SSH case).
	Uninstall(ctx context.Context, label string) (notes []string, err error)
	Status(ctx context.Context, label string) (ServiceStatus, error)
}

type ServiceSpec struct {
	Label       string
	Description string
	ExecPath    string
	Args        []string
	Env         map[string]string
	// WorkingDir, when set, is the service's working directory.
	WorkingDir string
	// StdoutPath/StderrPath are launchd-only log destinations; systemd routes to
	// journald and ignores them.
	StdoutPath string
	StderrPath string
	// RestartOnFailure asks the supervisor to relaunch the service when it exits
	// with a failure; RestartDelaySeconds throttles the relaunch (0 → adapter
	// default of 30s).
	RestartOnFailure    bool
	RestartDelaySeconds int
}

type ServiceStatus struct {
	Installed bool
	Running   bool
	Detail    string
	// UnitPath is the on-disk plist/unit file backing the service.
	UnitPath string
	// ExecPath is the binary the installed unit/plist launches (best-effort
	// parse of our own rendered file; empty when unparseable).
	ExecPath string
	// ExecPathMissing is true when ExecPath is non-empty and no longer exists
	// on disk — the brew-upgrade / deleted-binary case (P7-XP-05).
	ExecPathMissing bool
}

type Set struct {
	OS       string
	Watcher  Watcher
	Service  ServiceManager
	Keychain Keychain
	Editor   EditorAdapter
	Sandbox  Sandbox
}

type SystemEditor struct{}

type SystemKeychain struct {
	Platform string
	Target   string
}

type SystemdUserManager struct {
	UnitDir string
}

type UnsupportedKeychain struct {
	Platform string
	Target   string
}

type UnsupportedSandbox struct {
	Platform string
}

type UnsupportedServiceManager struct {
	Platform string
	Target   string
}

type Watcher interface {
	Name() string
	Watch(ctx context.Context, root string, events chan<- FSEvent) error
}