/**
 * Public types for the shell sandbox runtime.
 *
 * SandboxConfig is what callers provide.
 * SandboxState is the resolved, ready-to-use internal state.
 * WrappedCommand is what wrapCommand() returns.
 */
/** Caller-facing configuration. All fields optional with sensible defaults. */
export interface SandboxConfig {
    /** WSL distro name. Default: 'shortcutxl' */
    distro?: string;
    /** Windows paths mounted read-only inside the sandbox. */
    readPaths?: string[];
    /** Windows paths mounted read-write inside the sandbox. */
    writePaths?: string[];
    /** Network isolation mode. Default: 'none' */
    networkMode?: 'none' | 'proxy' | 'full';
    /** Extra environment variables set inside the sandbox via --setenv. */
    env?: Record<string, string>;
    /**
     * Paths always write-protected, even within writable regions.
     * Relative paths are expanded against each write mount.
     * Set to [] to disable. Default: MANDATORY_DENY_PATHS.
     */
    denyPaths?: string[];
    /**
     * Apply seccomp BPF filter to block AF_UNIX socket creation.
     * Prevents IPC escape via Unix domain sockets.
     * Default: true. Set to false to disable (e.g. for debugging).
     */
    seccomp?: boolean;
}
/**
 * Resolved sandbox state — all paths converted to Linux, WSL probed.
 *
 * Created by resolveSandboxConfig(). Treat as ephemeral — the agent-side
 * manager creates a fresh instance on every wrapCommand() call so that
 * settings changes take effect immediately.
 * Passed to buildBwrapArgs() and wrapCommand().
 */
export interface SandboxState {
    distro: string;
    /** Linux paths mounted read-only. */
    readMounts: string[];
    /** Linux paths mounted read-write. */
    writeMounts: string[];
    /** Linux path of default cwd inside sandbox. */
    workdir: string;
    networkMode: 'none' | 'proxy' | 'full';
    /** Extra env vars for --setenv. */
    env: Record<string, string>;
    /** Absolute Linux paths to overlay as read-only within writable regions. */
    denyMounts: string[];
    /**
     * Path to the seccomp BPF filter inside WSL (e.g. /etc/seccomp/unix-block.bpf).
     * null if seccomp is disabled or the filter/binary is missing in the rootfs.
     * wrapCommand() uses this to decide whether to wrap with apply-seccomp.
     */
    seccompFilterPath: string | null;
    hasLib64: boolean;
    resolvedResolvConf: string | null;
    existingEtcEntries: string[];
}
/** Runtime options for wrapCommand(), separate from resolved state. */
export interface WrapOptions {
    /** Override workdir (Linux path). Used when exec() receives a different cwd. */
    cwd?: string;
    /** HTTP proxy Unix socket path (undefined if proxy not started). */
    httpSocketPath?: string;
    /** SOCKS5 proxy Unix socket path (undefined if proxy not started). */
    socksSocketPath?: string;
}
/** A spawn-ready command returned by wrapCommand(). */
export interface WrappedCommand {
    /** Executable to spawn (always 'wsl' on Windows). */
    file: string;
    /** Arguments array for child_process.spawn(). */
    args: string[];
}
//# sourceMappingURL=types.d.ts.map