sandbox

type Config struct {
	Mounts       []Mount
	Deny         []string      // paths to mask (e.g. ~/.ssh) — deny read+write
	DenyRename   []string      // pin directory entries without denying writes to descendants
	DenyWrite    []string      // paths to deny writes only (e.g. ./egg.yaml) — read allowed
	NetworkNeed  NetworkNeed   // granular network access required by the agent
	NetworkMode  string        // ""/"enforce" or "observe" for domain decisions
	Domains      []string      // domain allowlist for proxy filtering
	ProxyPort    int           // local domain-filtering proxy port (0 = no proxy)
	LocalPorts   []int         // host loopback ports forwarded into a Linux network namespace
	CPULimit     time.Duration // RLIMIT_CPU (0 = backend default)
	MemLimit     uint64        // RLIMIT_AS in bytes (0 = backend default)
	MaxFDs       uint32        // RLIMIT_NOFILE (0 = backend default)
	PidLimit     uint32        // cgroup pids.max (0 = no limit)
	SessionID    string        // unique ID for cgroup naming
	UserHome     string        // per-user home override (empty = os.UserHomeDir)
	Trace        bool          // wrap command with strace (Linux only)
	AllowSockets []string      // Unix socket paths to allow outbound connections (macOS Seatbelt)
	// ProtectedWriteTargets are host-owned absolute paths (e.g. controller
	// state) that no effective writable rule may reach. The final policy is
	// refused with ProtectedWriteTargetError on any overlap, and backends that
	// cannot verify their final policy refuse a nonempty set. Empty = no contract.
	ProtectedWriteTargets []string

	// RoostPolicyPaths lists configured policy files whose absence must be checked.
	RoostPolicyPaths []string
}

type DomainProxy struct {
	// contains filtered or unexported fields
}

type EgressEvent struct {
	Host    string // as requested, including port
	Matched bool   // matched the domain allowlist
	Blocked bool   // actually refused (false in observe mode even when unmatched)
}

type EnforcementError struct {
	Gaps     []string
	Platform string
}

type Level int

type Mount struct {
	Source   string
	Target   string
	ReadOnly bool
	UseRegex bool // macOS: emit regex rule instead of subpath (covers adjacent files like ~/.claude.json)
}

type NetworkNeed int

type ProtectedWriteTargetError struct {
	Target string // protected target as resolved for the emitted policy ("" when not target-specific)
	Rule   string // exact emitted policy rule that conflicts ("" when not rule-specific)
	Reason string
}

type ProxyOptions struct {
	Domains []string
	// Observe records what enforce mode would have refused without refusing it.
	// This is the migration path for tightening egress on existing deployments.
	Observe bool
	// MaxConnections bounds simultaneous CONNECT tunnels. Zero uses the safe
	// default; negative values are rejected.
	MaxConnections int
}

type Sandbox interface {
	Exec(ctx context.Context, name string, args []string) (*exec.Cmd, error)
	PostStart(pid int) error // attach parent-managed resources after process starts
	Destroy() error
	DiagLog() string  // path to sandbox diagnostic log, or ""
	TraceLog() string // path to strace output log, or ""
}