policy

type BannedSubcommand struct {
	Command string
	Args    []string // Subcommand arguments (e.g., ["install"])
	Flags   []string // Flags that trigger block (e.g., ["--global", "-g"])
}

type BashCheckResult struct {
	Allowed      bool
	Reason       string
	InputTokens  int
	OutputTokens int
}

type BashChecker struct {
	// AllowedDirs from agent.toml - directories the agent can access
	AllowedDirs []string

	// UserDeniedCommands from agent.toml - additional commands to block
	UserDeniedCommands []string

	// LLMChecker is called for step 2 (semantic check) if step 1 passes
	// Takes: command string, allowed_dirs []string
	// Returns: (*BashCheckResult, error)
	LLMChecker func(ctx context.Context, command string, allowedDirs []string) (*BashCheckResult, error)

	// Workspace is the base working directory
	Workspace string

	// OnDecision is called after each security decision for logging/auditing.
	// step: "deterministic" or "llm"
	// allowed: whether the command was allowed
	// reason: explanation (especially for blocks)
	// durationMs: time taken for the check (0 for deterministic, >0 for LLM)
	// inputTokens, outputTokens: token counts (0 for deterministic)
	OnDecision func(command, step string, allowed bool, reason string, durationMs int64, inputTokens, outputTokens int)
}

type GenerateResult struct {
	Content      string
	InputTokens  int
	OutputTokens int
}

type LLMPolicyChecker interface {
	// CheckBashCommand asks the LLM if a bash command violates directory policy.
	// Returns (*BashCheckResult, error)
	CheckBashCommand(ctx context.Context, command string, allowedDirs []string) (*BashCheckResult, error)
}

type LLMProvider interface {
	// Generate returns the LLM's response to a prompt with token counts.
	Generate(ctx context.Context, prompt string) (*GenerateResult, error)
}

type MCPPolicy struct {
	// DefaultDeny: if true, all MCP tools are blocked unless in AllowedTools.
	// If false, all MCP tools are allowed (dev mode).
	// If not set (nil MCPPolicy), logs a security warning.
	DefaultDeny  bool
	AllowedTools []string // List of "server:tool" patterns to allow
}

type Policy struct {
	DefaultDeny bool
	Workspace   string
	HomeDir     string
	ConfigDir   string // Directory containing agent.toml, policy.toml
	Tools       map[string]*ToolPolicy
	MCP         *MCPPolicy      // MCP tools policy
	Security    *SecurityPolicy // Security patterns and keywords
}

type SecurityPolicy struct {
	// ExtraPatterns are additional regex patterns to detect (on top of built-ins)
	// Format: "name:regex" e.g., "exfil_attempt:send.*to.*external"
	ExtraPatterns []string
	// ExtraKeywords are additional sensitive keywords to detect (on top of built-ins)
	ExtraKeywords []string
}

type SmallLLMChecker struct {
	// contains filtered or unexported fields
}

type ToolPolicy struct {
	Enabled      bool
	Allow        []string
	Deny         []string
	Allowlist    []string // for bash: legacy command allowlist
	Denylist     []string // for bash: additional commands to block
	AllowedDirs  []string // for bash: directories agent can access
	AllowDomains []string // for web tools
	RateLimit    int      // requests per minute
	Sandbox      string   // for bash: "none", "bwrap", "docker" (default: none)
}