sandbox

type Config struct {
	// Runtime selects the sandbox backend (docker or kern). Empty defaults to docker.
	Runtime string
	// SecurityProfile sets kern --security-profile when Runtime is kern.
	SecurityProfile string
	// Image is the container image used for Exec.
	Image string
	// Network is the Docker network mode.
	Network string
	// Memory limits container memory (e.g. "512m").
	Memory string
	// Workspace is the host workspace path bind-mounted at the same path inside the container.
	Workspace string
	// ServerURL is the Flowbot API URL injected for the flowbot CLI inside the container.
	ServerURL string
	// AccessToken is the Hub access token injected for the flowbot CLI inside the container.
	AccessToken string
	// CLIPath is an optional configured host path to a linux/amd64 flowbot CLI binary.
	// Absolute paths are used as-is; relative paths are resolved beside the server executable.
	// When empty, New looks for flowbot-cli_linux_amd64 beside the server executable.
	CLIPath string
}

type DockerRunner struct{}

type Env struct {
	// contains filtered or unexported fields
}

type KernRunner struct {
	Client          *kern.Client
	SecurityProfile string
}

type RunOptions struct {
	Image       string
	Network     string
	Memory      string
	Workspace   string
	WorkDir     string
	Command     string
	Argv        []string
	ServerURL   string
	AccessToken string
	// Env is appended to the container environment (KEY=VALUE).
	Env []string
	// Stdin is process input; non-empty values are written to .flowbot-stdin under the host workdir.
	Stdin []byte
	// CLIConfigDir is a host directory bind-mounted read-only at containerCLIConfigPath.
	// When empty and AccessToken is set, DockerRunner materializes a temporary directory.
	CLIConfigDir string
	// CLIBinary is a host path to a linux/amd64 flowbot CLI file. DockerRunner copies it
	// into a temporary directory (as "flowbot") and bind-mounts that directory.
	CLIBinary string
	// CLIBinaryDir is a host directory bind-mounted read-only at containerCLIDirPath.
	// When empty and CLIBinary is set, DockerRunner materializes a temporary directory.
	CLIBinaryDir string
}

type Runner interface {
	Run(ctx context.Context, opts RunOptions) (env.Capture, error)
}