export const shellSandboxEnforcementDependencyDeclarations = [
    {
        dependencyId: "runtime.execEngine.shellGuard.enforceSandbox",
        kind: "runtime",
        required: true,
        description: "Runtime-owned shell sandbox enforcement port exposed through BaseToolExecutorPort.shell.enforceSandbox",
    },
    {
        dependencyId: "runtime.governancePlane.toolInvocationGrant",
        kind: "permission",
        required: true,
        description: "Runtime governance decision carried in context.guard for real sandbox enforcement dispatch",
    },
];
export function createHostExecutorShellSandboxEnforcementProvider(executor) {
    const run = executor?.shell?.enforceSandbox;
    if (run === undefined) {
        return undefined;
    }
    return async (request, context) => {
        const result = await run({
            command: request.command ?? "",
            workingDirectory: request.workingDirectory ?? "",
            requestedPaths: request.requestedPaths ?? [],
            accessIntents: request.accessIntents ?? [],
            policy: request.policy,
            context: context,
        });
        if (!result.ok) {
            throw Object.assign(new Error(result.error.message), { publicSafe: result.error.publicSafe });
        }
        return result.output;
    };
}
