harnesses

const (
	// PermissionsReadOnly is the default. The agent may read and inspect the
	// workspace but may not modify it.
	//
	// Enforcement differs by backend and is intentionally documented here:
	//   - Claude Code has no filesystem sandbox, so we gate by tool: the write
	//     and shell tools are hard-disallowed, leaving only read tools. That
	//     means a read_only Claude agent cannot run shell commands at all.
	//   - Codex read-only sandbox blocks filesystem writes and network but still
	//     lets commands run, so a read_only Codex agent CAN run read-only probes
	//     (grep, and builds/tests that don't need to write). Both honor the core
	//     guarantee "cannot modify the workspace or reach the network".
	PermissionsReadOnly Permissions = "read_only"

	// PermissionsExec lets the agent modify the workspace and run shell commands
	// scoped to it (tests, builds, formatters).
	//
	// Codex enforces this as a real sandbox: workspace writes and shell, no
	// network, no writes outside the workspace. Claude Code has no network
	// sandbox, so once shell is allowed it can also reach the network — on
	// Claude, exec and dangerously-exec are therefore nearly identical in
	// practice. The tier means "as locked-down as this backend can express".
	PermissionsExec Permissions = "exec"

	// PermissionsDangerouslyExec removes all guardrails: network access, writes
	// anywhere, and no approvals. Use only for trusted, disposable environments.
	PermissionsDangerouslyExec Permissions = "dangerously-exec"
)