Safe Code Execution

use laminae::glassbox::{Glassbox, GlassboxConfig};
use laminae::ironclad::{
    validate_binary, validate_command_deep,
    sandboxed_command, spawn_watchdog, WatchdogConfig,
};

// Step 1: Configure containment
let gb = Glassbox::new(
    GlassboxConfig::default()
        .with_immutable_zone("/etc")
        .with_immutable_zone("/usr")
        .with_immutable_zone(&home_dir)
        .with_blocked_command("rm -rf")
        .with_blocked_command("sudo"),
);

// Step 2: Validate the command BEFORE execution
let command = "git status";
gb.validate_command(command)?;
validate_command_deep(command)?;

// Step 3: Run inside platform-native sandbox
let mut cmd = sandboxed_command("git", &["status"], "/path/to/project")?;
let child = cmd.spawn()?;

// Step 4: Monitor resource usage
let cancel = spawn_watchdog(
    child.id().unwrap(),
    WatchdogConfig {
        cpu_threshold: 80.0,
        memory_threshold_mb: 2048,
        max_wall_time: Duration::from_secs(300),
        ..Default::default()
    },
    "code-executor".into(),
);

// Step 5: Wait and clean up
let output = child.wait_with_output().await?;
cancel.store(true, Ordering::Relaxed);

// Step 6: Validate output
gb.validate_output(&String::from_utf8_lossy(&output.stdout))?;