/**
 * Docker argument builder for sandbox pool containers.
 *
 * Builds `docker run -d ... sleep infinity` args for detached containers
 * managed by the sandbox pool. All sandbox sessions use pool containers
 * (pre-warmed or created on-demand).
 *
 * Multi-repo layout (Phase 4a):
 *   - `bobbit-workspace-<projectId>` at `/workspace`: single-repo holds the
 *     repo at the volume root; multi-repo holds one subdir per declared
 *     repo (`/workspace/<repo>/`).
 *   - `bobbit-worktrees-<projectId>` at `/workspace-wt/`: single-repo lays
 *     out worktrees as `/workspace-wt/<branchSlug>/`; multi-repo lays them
 *     out as `/workspace-wt/<branchSlug>/<repo>/` side-by-side.
 *
 * Mount args are identical for both shapes — the volume is just a flat
 * filesystem and the layout differences live in the worktree-creation paths
 * (see `ProjectSandbox._runInitSequenceMultiRepo` and `createWorktreeSet`).
 * `toDockerPath` host-path rewriting is unchanged and works for both modes.
 * See docs/design/multi-repo-components.md §7.2.
 */
import type { PreferencesStore } from "./preferences-store.js";
import type { ToolManager } from "./tool-manager.js";
export interface DockerRunConfig {
    image: string;
    /** Host path to mount as /workspace (used for bind-mount mode when projectId is not set). */
    workspaceDir: string;
    /** Label value for the label prefix. */
    label?: string;
    /** Label version string (e.g. "2" for sandbox-pool). */
    labelVersion?: string;
    /** Label prefix — e.g. "bobbit-project" or "bobbit-sandbox". */
    labelPrefix?: string;
    /** Worktree path label for sandbox-pool containers. */
    worktreePath?: string;
    /** Project ID — when set, uses a named Docker volume instead of bind mount for /workspace. */
    projectId?: string;
    /** Host state directory — when set, bind-mounted to /bobbit-state for session logs. */
    stateDir?: string;
    /**
     * Per-session preview mount (WP-A/F).
     *
     * - Per-session containers (sessionId set, projectId unset): the host
     *   directory `<stateDir>/preview/<sessionId>` is bind-mounted at
     *   `/bobbit/preview` so the agent can read back its own preview tree.
     * - Per-project containers (projectId set): `<stateDir>/preview/` is
     *   bind-mounted at `/bobbit/preview-root` so every session sharing the
     *   long-lived container can resolve its own subtree by
     *   `BOBBIT_SESSION_ID`.
     *
     * Note: the gateway runs the actual writes (via `mount.writeInline` /
     * `mount.mountFile`) — the bind-mount mainly exists for symmetry, so
     * tools that read back what they wrote see the same bytes the gateway
     * just persisted. The agent never needs the host path; it always POSTs
     * to `/api/preview/mount` (WP-D).
     */
    sessionId?: string;
    /** Container memory limit (default: "32g"). */
    memoryLimit?: string;
    /** Container CPU limit (default: "12"). */
    cpuLimit?: string;
    /** Container PID limit (default: "512"). */
    pidsLimit?: string;
    sandboxMounts?: string[];
    sandboxCredentials?: Record<string, string>;
    /** Docker network to attach the container to (e.g. "bobbit-sandbox-net"). */
    sandboxNetwork?: string;
    /** Tool manager for resolving builtin tools directory (optional — falls back to TOOLS_DIR only). */
    toolManager?: ToolManager;
    /** Whether sandbox policy permits mounting host OpenAI Codex auth into auth.json. */
    sandboxAgentAuthAllowed?: boolean;
    /** Preferences store used to include preference-backed OpenAI Codex credentials when policy allows. */
    sandboxAgentAuthPrefs?: PreferencesStore | null;
    /** Scope for the generated auth.json file; defaults to projectId when present. */
    sandboxAgentAuthScope?: string;
    /**
     * Extra read-only bind mounts as `{ hostPath, mountPath }` pairs. Used for
     * the remote-less sandbox clone source: the host repo is mounted read-only
     * at a container-internal path so `git clone file://<mountPath>` works
     * without ever passing a raw host path (or Windows drive letter) to git.
     * Host paths are rewritten via `toDockerPath` for Docker Desktop on
     * Windows/macOS.
     */
    extraReadonlyMounts?: Array<{
        hostPath: string;
        mountPath: string;
    }>;
}
export declare function buildDockerRunArgs(config: DockerRunConfig): string[];
//# sourceMappingURL=docker-args.d.ts.map