sandbox

type DirEntry struct {
	Name  string
	IsDir bool
	Size  int64
}

type Edit struct {
	OldText string
	NewText string
}

type EditResult struct {
	AppliedEdits int
}

type ExecOptions struct {
	Cwd     string
	Env     map[string]string
	Timeout time.Duration
}

type ExecResult struct {
	Stdout   string
	Stderr   string
	ExitCode int
}

type Factory interface {
	CreateSession(ctx context.Context, policy Policy) (Session, error)
	Supported(policy Policy) error
	Name() string
	Available() bool
}

type FilesystemPolicy struct {
	// WorkspaceRoot is the host path mounted as the sandbox root. When empty,
	// WorkingDir is used for backwards compatibility.
	WorkspaceRoot string

	// WorkingDir is the logical working directory inside the sandbox root.
	WorkingDir string

	// ReadOnlyPaths are paths mounted read-only into the sandbox.
	ReadOnlyPaths []string

	// ReadWritePaths are paths allowed for read-write access.
	// If empty, WorkingDir is used.
	ReadWritePaths []string

	// AllowEscapes permits paths outside WorkingDir when true.
	// This is an explicit relaxation that should be used with care.
	AllowEscapes bool
}

type HTTPOptions struct {
	Method  string
	URL     string
	Header  map[string]string
	Body    []byte
	Timeout time.Duration
}

type HTTPResult struct {
	StatusCode int
	Header     map[string][]string
	Body       []byte
}

type HTTPStream interface {
	Header() map[string][]string
	Reader() io.ReadCloser
	Close() error
}

type Host interface {
	ReadFile(ctx context.Context, path string, offset, limit int) (ReadResult, error)
	WriteFile(ctx context.Context, path string, content []byte) (WriteResult, error)
	EditFile(ctx context.Context, path string, edits []Edit) (EditResult, error)
	Stat(ctx context.Context, path string) (StatResult, error)
	ListDir(ctx context.Context, path string) ([]DirEntry, error)
	MkdirAll(ctx context.Context, path string, perm uint32) error
	Remove(ctx context.Context, path string, recursive bool) error
	Rename(ctx context.Context, oldPath, newPath string) error
	CreateTemp(ctx context.Context, dir, pattern string) (TempFile, error)
	Exec(ctx context.Context, command string, opts ExecOptions) (ExecResult, error)
	StartProcess(ctx context.Context, req ProcessRequest) (ProcessHandle, error)
	HTTPRequest(ctx context.Context, opts HTTPOptions) (HTTPResult, error)
	OpenHTTPStream(ctx context.Context, opts HTTPOptions) (HTTPStream, error)
	ResolvePath(path string) (string, error)
	WorkingDir() string
}

type NetworkMode string

type NetworkPolicy struct {
	// Mode is the network access mode.
	Mode NetworkMode

	// Allowlist contains CIDRs/hosts allowed in whitelist mode.
	Allowlist []string

	// Timeout for network operations. Zero means no timeout.
	Timeout time.Duration
}

type Policy struct {
	// Backend selects a specific backend when non-empty. Empty means auto-select.
	Backend string

	// Relaxed explicitly allows reduced enforcement on partially compatible backends.
	// It is never implied by fallback and must be explicitly set.
	Relaxed bool

	// Filesystem policy
	Filesystem FilesystemPolicy

	// Network policy
	Network NetworkPolicy

	// Process policy
	Process ProcessPolicy
}

type PolicyCompatibilityError struct {
	Backend          string
	Policy           Policy
	Reason           string
	RelaxedWouldHelp bool
}

type ProcessHandle interface {
	PID() int
	Wait(ctx context.Context) (ExecResult, error)
	Stdin() io.WriteCloser
	Stdout() io.ReadCloser
	Stderr() io.ReadCloser
	Close() error
}

type ProcessPolicy struct {
	// MaxConcurrent limits concurrent processes. Zero means unlimited.
	MaxConcurrent int

	// Timeout for process execution. Zero means no timeout.
	Timeout time.Duration

	// Environment variables to set for processes.
	Environment map[string]string

	// InheritEnv includes system environment variables when true.
	InheritEnv bool
}

type ProcessRequest struct {
	Path    string
	Args    []string
	Cwd     string
	Env     map[string]string
	Timeout time.Duration
}

type ReadResult struct {
	Content    []byte
	Truncated  bool
	NextOffset int
}

type Registry struct {
	// contains filtered or unexported fields
}

type Session interface {
	Host() Host
	Policy() Policy
	Close() error
	Alive() bool
	Done() <-chan struct{}
}

type StatResult struct {
	Exists  bool
	IsDir   bool
	Size    int64
	Mode    uint32
	ModTime time.Time
}

type TempFile interface {
	Path() string
	Write([]byte) (int, error)
	Close() error
}

type WriteResult struct {
	BytesWritten int
}