run

type BuildKitConfig struct {
	Enabled      bool
	NetworkName  string
	NetworkID    string
	SidecarName  string
	SidecarImage string
}

type DockerDependencyConfig struct {
	// Mode is the docker access mode: "host" (socket mount) or "dind" (privileged).
	Mode deps.DockerMode

	// SocketMount is the mount configuration for the Docker socket.
	// Only set for host mode.
	SocketMount container.MountConfig

	// GroupID is the GID of the docker socket, as a string for GroupAdd.
	// Only set for host mode. Example: "999"
	GroupID string

	// Privileged indicates the container needs privileged mode.
	// Only set for dind mode.
	Privileged bool
}

type ErrDockerDindRequiresDockerRuntime struct{}

type ErrDockerHostRequiresDockerRuntime struct{}

type ErrDockerRequiresDockerRuntime = ErrDockerHostRequiresDockerRuntime

type Manager struct {
	// contains filtered or unexported fields
}

type ManagerOptions struct {
	// NoSandbox disables gVisor sandbox for Docker containers.
	// If nil, uses platform-aware defaults (gVisor on Linux, standard on macOS/Windows).
	NoSandbox *bool
}

type Options struct {
	Name          string // Optional explicit name (--name flag or from config)
	Workspace     string
	Grants        []string
	Cmd           []string       // Command to run (default: /bin/bash)
	Config        *config.Config // Optional agent.yaml config
	Env           []string       // Additional environment variables (KEY=VALUE)
	Rebuild       bool           // Force rebuild of container image (ignores cache)
	KeepContainer bool           // If true, don't auto-remove container after run
	Interactive   bool           // Keep stdin open for interactive input
	TTY           bool           // Allocate a pseudo-TTY
}

type Run struct {
	ID             string
	Name           string // Human-friendly name (e.g., "myapp" or "fluffy-chicken")
	Workspace      string
	Grants         []string
	Agent          string         // Agent type from config (e.g., "claude-code", "codex")
	Image          string         // Container image used for this run
	Ports          map[string]int // endpoint name -> container port
	HostPorts      map[string]int // endpoint name -> host port (after binding)
	State          State
	ContainerID    string
	ProxyServer    *proxy.Server     // Auth proxy for credential injection
	SSHAgentServer *sshagent.Server  // SSH agent proxy for SSH key access
	Store          *storage.RunStore // Run data storage

	AuditStore    *audit.Store     // Tamper-proof audit log
	SnapEngine    *snapshot.Engine // Snapshot engine for workspace protection
	KeepContainer bool             // If true, don't auto-remove container after run
	Interactive   bool             // If true, run was started in interactive mode
	CreatedAt     time.Time
	StartedAt     time.Time
	StoppedAt     time.Time
	Error         string

	// Firewall settings (set when network.policy is strict)
	FirewallEnabled bool
	ProxyHost       string // Host address for proxy (for firewall rules)
	ProxyPort       int    // Port number for proxy (for firewall rules)
	ProxyAuthToken  string // Auth token for proxy (Apple containers only, empty for Docker)

	// ProviderCleanupPaths tracks paths to clean up for each provider when the run ends.
	// Keys are provider names, values are cleanup paths returned by ProviderSetup.ContainerMounts.
	ProviderCleanupPaths map[string]string

	// Snapshot settings
	DisablePreRunSnapshot bool // If true, skip pre-run snapshot creation

	// AWS credential provider (set when using aws grant)
	AWSCredentialProvider *proxy.AWSCredentialProvider

	// ClaudeConfigTempDir is the temporary directory containing Claude configuration files
	// (settings.json, .mcp.json) that are mounted into the container. This should be
	// cleaned up when the run is stopped or destroyed.
	ClaudeConfigTempDir string

	// CodexConfigTempDir is the temporary directory containing Codex configuration files
	// (config.toml, auth.json) that are mounted into the container. This should be
	// cleaned up when the run is stopped or destroyed.
	CodexConfigTempDir string

	// GeminiConfigTempDir is the temporary directory containing Gemini configuration files
	// (settings.json, oauth_creds.json) that are mounted into the container. This should be
	// cleaned up when the run is stopped or destroyed.
	GeminiConfigTempDir string

	// BuildKit sidecar fields (docker:dind only)
	BuildkitContainerID string
	NetworkID           string

	// ServiceContainers maps service name to container ID (e.g., "postgres" -> "abc123").
	ServiceContainers map[string]string
	// contains filtered or unexported fields
}

type StartOptions struct {
	// StreamLogs controls whether container logs are streamed to stdout.
	// Set to false for interactive mode where attach handles I/O.
	StreamLogs bool
}

type State string