Sandboxing

┌─────────────────────────────────────────────────────────────┐
│                    Sandbox Execution Flow                     │
│                                                               │
│  Tool Declaration                                             │
│  ┌────────────────────────────────────────────┐              │
│  │ RequiredCapabilities {                      │              │
│  │   base_preset: "file_processor",            │              │
│  │   overrides: { network: AllowAll },         │              │
│  │   parameter_bindings: { path → fs.rw }      │              │
│  │ }                                           │              │
│  └────────────────────┬───────────────────────┘              │
│                       │                                       │
│                       ▼                                       │
│  ┌────────────────────────────────────────────┐              │
│  │ Capability Resolver                         │              │
│  │   Preset + Overrides + Bindings → Caps      │              │
│  └────────────────────┬───────────────────────┘              │
│                       │                                       │
│                       ▼                                       │
│  ┌────────────────────────────────────────────┐              │
│  │ Trust Check (Draft → Trial → Verified)      │              │
│  │   Escalation on scope violations            │              │
│  └────────────────────┬───────────────────────┘              │
│                       │                                       │
│                       ▼                                       │
│  ┌────────────────────────────────────────────┐              │
│  │ Platform Adapter (macOS sandbox-exec)       │              │
│  │   Generate .sb profile → Execute → Cleanup  │              │
│  └────────────────────┬───────────────────────┘              │
│                       │                                       │
│                       ▼                                       │
│  ┌────────────────────────────────────────────┐              │
│  │ Audit Log                                   │              │
│  └────────────────────────────────────────────┘              │
└─────────────────────────────────────────────────────────────┘

pub struct Capabilities {
    pub filesystem: Vec<FileSystemCapability>,
    pub network: NetworkCapability,
    pub process: ProcessCapability,
    pub environment: EnvironmentCapability,
}

pub enum FileSystemCapability {
    ReadOnly { path: PathBuf },   // Read-only access to a path tree
    ReadWrite { path: PathBuf },  // Full read/write access to a path tree
    TempWorkspace,                // Auto-created temporary directory
}

pub enum NetworkCapability {
    Deny,                        // No network access
    AllowDomains(Vec<String>),   // Allow specific domains only
    AllowAll,                    // Unrestricted network access
}

(deny network*)
(allow network-outbound (remote tcp "api.github.com:*"))
(allow network-outbound (remote tcp "registry.npmjs.org:*"))

pub struct ProcessCapability {
    pub no_fork: bool,            // Prevent spawning child processes
    pub max_execution_time: u64,  // Timeout in seconds
    pub max_memory_mb: Option<u64>,  // Memory limit
}

pub enum EnvironmentCapability {
    None,        // No environment variables
    Restricted,  // Only safe variables (PATH, HOME, USER)
    Full,        // Full environment passthrough
}

impl Default for Capabilities {
    fn default() -> Self {
        Self {
            filesystem: vec![FileSystemCapability::TempWorkspace],
            network: NetworkCapability::Deny,
            process: ProcessCapability {
                no_fork: true,
                max_execution_time: 300,  // 5 minutes
                max_memory_mb: Some(512),
            },
            environment: EnvironmentCapability::Restricted,
        }
    }
}

pub struct ParameterBinding {
    pub capability: String,      // "filesystem.read_only" or "filesystem.read_write"
    pub validation: ValidationRule,  // is_file, is_directory, is_path
    pub mapping: MappingType,    // single or each_element (for arrays)
}

RequiredCapabilities {
    base_preset: "file_processor",
    description: "Convert image formats",
    overrides: CapabilityOverrides::default(),
    parameter_bindings: {
        "input_path" => ParameterBinding {
            capability: "filesystem.read_only",
            validation: ValidationRule::IsFile,
            mapping: MappingType::Single,
        },
        "output_dir" => ParameterBinding {
            capability: "filesystem.read_write",
            validation: ValidationRule::IsDirectory,
            mapping: MappingType::Single,
        },
    },
}

pub enum TrustStage {
    Draft,     // Newly generated tool, awaiting first approval
    Trial,     // Approved, awaiting first execution confirmation
    Verified,  // Executed multiple times, enters silent mode
}

Draft ──[owner approves capabilities]──► Trial ──[N successful executions]──► Verified

pub enum EscalationReason {
    PathOutOfScope,       // Parameter path outside approved range
    SensitiveDirectory,   // Accessing ~/.ssh, ~/.gnupg, ~/.aws, etc.
    UndeclaredBinding,    // Using parameter not declared in bindings
    FirstExecution,       // Initial run of a Trial-stage tool
}

pub struct EscalationTrigger {
    pub reason: EscalationReason,
    pub requested_path: Option<PathBuf>,
    pub approved_paths: Vec<String>,
}

(version 1)
(allow default)

;; Filesystem restrictions
(deny file-write* (subpath "/Users/alice/project"))

;; Network restrictions
(deny network*)

sandbox-exec -f /tmp/aleph-profile-Xk9m.sb echo "hello"

fn cleanup(&self, profile: &SandboxProfile) -> Result<()> {
    if profile.path.exists() {
        std::fs::remove_file(&profile.path)?;
    }
    if let Some(ref workspace) = profile.temp_workspace {
        if workspace.exists() {
            std::fs::remove_dir_all(workspace)?;
        }
    }
    Ok(())
}

pub enum FallbackPolicy {
    Deny,              // Refuse to execute (default)
    RequestApproval,   // Ask user before unsandboxed execution
    WarnAndExecute,    // Log warning and execute without sandbox
}

const DEFAULT_BLOCKED: &[&str] = &[
    r"rm\s+-rf\s+/\s*$",             // rm -rf /
    r"sudo\s+",                      // any sudo command
    r"chmod\s+777\s+/",              // chmod 777 /
    r":\(\)\s*\{\s*:\|:&\s*\}\s*;:", // fork bomb
    r">\s*/dev/sd[a-z]",             // overwrite disk
    r"mkfs\.",                       // format filesystem
    r"dd\s+if=.*of=/dev/",           // dd to device
];

pub struct PathPermissionChecker {
    allowed_patterns: Vec<Pattern>,   // Allowed path globs
    denied_patterns: Vec<Pattern>,    // Denied path globs (checked first)
    max_file_size: u64,              // Size limit for file operations
}

fn has_path_traversal(&self, path: &Path) -> bool {
    let path_str = path.to_string_lossy();
    path_str.contains("..") || path_str.contains("./")
}

pub struct CodeExecutor {
    allowed_runtimes: Vec<String>,  // Empty = all allowed
    timeout_seconds: u64,           // Execution timeout
    // ...
}

pub struct SandboxAuditLog {
    pub skill_id: String,
    pub capabilities: Capabilities,
    pub status: ExecutionStatus,
    pub platform: String,
    pub timestamp: DateTime<Utc>,
}

pub enum ExecutionStatus {
    Success { exit_code: i32, duration_ms: u64 },
    Timeout { duration_ms: u64 },
    Error { error: String },
}