sandbox

type Config struct {
	// DefaultIsolation is the isolation level for skills that don't
	// specify one. Defaults to IsolationRestricted.
	DefaultIsolation IsolationLevel `yaml:"default_isolation"`

	// Timeout is the maximum execution time for a single script run.
	// Defaults to 60s.
	Timeout time.Duration `yaml:"timeout"`

	// MaxOutputBytes limits stdout+stderr capture size.
	// Defaults to 1MB.
	MaxOutputBytes int64 `yaml:"max_output_bytes"`

	// MaxMemoryMB limits memory usage (restricted/container modes).
	// Defaults to 256MB.
	MaxMemoryMB int `yaml:"max_memory_mb"`

	// MaxCPUPercent limits CPU usage as percentage (0-100).
	// Defaults to 50.
	MaxCPUPercent int `yaml:"max_cpu_percent"`

	// WorkDir is the working directory for script execution.
	// Scripts get read-only access to this directory.
	WorkDir string `yaml:"work_dir"`

	// TempDir is the writable temporary directory for scripts.
	// Each execution gets its own subdirectory.
	TempDir string `yaml:"temp_dir"`

	// Docker contains container-specific settings.
	Docker DockerConfig `yaml:"docker"`

	// AllowedEnv is a list of environment variable names that scripts
	// are allowed to access. If empty, uses the default safe list.
	AllowedEnv []string `yaml:"allowed_env"`

	// BlockedEnv is a list of environment variable names that are
	// always stripped. Takes precedence over AllowedEnv.
	BlockedEnv []string `yaml:"blocked_env"`

	// AllowNetwork controls whether scripts can make network requests.
	// Defaults to false for restricted, true for none.
	AllowNetwork *bool `yaml:"allow_network"`

	// Runtimes maps Runtime to interpreter paths.
	// Defaults: python→python3, node→node, shell→/bin/sh
	Runtimes map[Runtime]string `yaml:"runtimes"`
}

type DirectExecutor struct {
	// contains filtered or unexported fields
}

type DockerConfig struct {
	// Image is the Docker image to use for sandboxed execution.
	// Defaults to "devclaw-sandbox:latest".
	Image string `yaml:"image"`

	// BuildOnStart builds the sandbox image on startup if missing.
	BuildOnStart bool `yaml:"build_on_start"`

	// Network is the Docker network mode.
	// Defaults to "none" (no network access).
	Network string `yaml:"network"`

	// ExtraVolumes are additional volume mounts (host:container:mode).
	ExtraVolumes []string `yaml:"extra_volumes"`
}

type DockerExecutor struct {
	// contains filtered or unexported fields
}

type ExecRequest struct {
	// Runtime is the script interpreter to use.
	Runtime Runtime

	// Isolation overrides the default isolation level.
	// If empty, uses Config.DefaultIsolation.
	Isolation IsolationLevel

	// Script is the path to the script file to execute.
	Script string

	// Args are command-line arguments passed to the script.
	Args []string

	// Stdin provides data to the script's standard input.
	Stdin string

	// Env are additional environment variables for this execution.
	// Subject to filtering by the security policy.
	Env map[string]string

	// WorkDir overrides the working directory for this execution.
	WorkDir string

	// Timeout overrides the default timeout for this execution.
	Timeout time.Duration

	// SkillDir is the skill's base directory (replaces {baseDir}).
	SkillDir string
}

type ExecResult struct {
	// Stdout is the captured standard output.
	Stdout string

	// Stderr is the captured standard error.
	Stderr string

	// ExitCode is the process exit code.
	ExitCode int

	// Duration is how long the execution took.
	Duration time.Duration

	// Killed is true if the process was killed (timeout, OOM, etc.).
	Killed bool

	// KillReason explains why the process was killed.
	KillReason string

	// OutputFiles lists files created in the temp directory.
	OutputFiles []string
}

type Executor interface {
	// Execute runs a script with the given request.
	Execute(ctx context.Context, req *ExecRequest) (*ExecResult, error)

	// Available reports whether this executor is usable on the system.
	Available() bool

	// Name returns the executor name for logging.
	Name() string

	// Close releases resources held by the executor.
	Close() error
}

type IsolationLevel string

type Policy struct {
	// contains filtered or unexported fields
}

type RestrictedExecutor struct {
	// contains filtered or unexported fields
}

type Runner struct {
	// contains filtered or unexported fields
}

type Runtime string

type ScanResult struct {
	Rule     string
	Severity string
	Message  string
	Line     int
	Content  string
}

type ScanRule struct {
	Name     string
	Severity string // "critical", "warn"
	Pattern  *regexp.Regexp
	Message  string
}