sandbox

type AvailabilityErrorProvider interface {
	AvailabilityError() error
}

type BwrapCapabilities struct {
	UnshareUser   bool
	UnsharePID    bool
	UnshareIPC    bool
	UnshareUTS    bool
	NewSession    bool
	DieWithParent bool
	MountProc     bool
	MountDev      bool
	MountTmpfs    bool
	TmpfsSize     bool
	MountBind     bool
	ChangeDir     bool
	Hostname      bool
}

type BwrapSandbox struct {
	// contains filtered or unexported fields
}

type CommandCleanupProvider interface {
	CleanupCommand(*exec.Cmd)
}

type ExecOpts struct {
	WritablePaths []string          // Additional writable paths
	ReadOnlyPaths []string          // Additional read-only paths (for standard mode)
	NetworkAccess bool              // Deprecated: sandbox preserves host network access
	EnvVars       map[string]string // Additional environment variables
	WorkDir       string            // Working directory
	Timeout       time.Duration     // Command timeout
}

type GitAccessSandbox interface {
	WrapCommandWithGitAccess(ctx context.Context, shell, cmd string, opts ExecOpts) *exec.Cmd
}

type Level int

type Manager struct {
	// contains filtered or unexported fields
}

type NoneSandbox struct{}

type Options struct {
	BwrapPath    string
	AllowNetwork bool // Deprecated: sandbox always preserves host network access
	AllowedRead  []string
	AllowedWrite []string
	DeniedPaths  []string
	PassEnv      []string
	TmpSize      string
	ProtectGit   bool
}

type Sandbox interface {
	// WrapCommand wraps a command for execution inside the sandbox.
	WrapCommand(ctx context.Context, shell, cmd string, opts ExecOpts) *exec.Cmd

	// IsAvailable checks if the sandbox can be used on this system.
	IsAvailable() bool

	// Name returns the sandbox implementation name.
	Name() string

	// Level returns the sandbox level.
	Level() Level
}