mounts.env

# Single source of truth for sandbox mount + run flags.
# Sourced by bin/sandbox.sh; mirrored (with a lint check) in
# .devcontainer/devcontainer.json.
#
# Identity & layout are AUTO-DETECTED so this repo works for any fork:
#   - SANDBOX_LOGIN     ← gh api user .login   (fallback: git config user.name,
#                         then $USER, then "user")
#   - SANDBOX_WORKSPACE ← parent dir of this repo (so cloning into
#                         ~/work/sandbox makes ~/work the workspace bind mount;
#                         override via SANDBOX_WORKSPACE env if you want
#                         something else)
#
# Do NOT put secrets here — this file is committed.

# --- Auto-detect login (used in volume names, image tag, container name) ---
SANDBOX_LOGIN="${SANDBOX_LOGIN:-$(
  gh api user --jq .login 2>/dev/null \
    || git config --global user.name 2>/dev/null \
    || echo "${USER:-user}"
)}"

# --- Workspace path (host dir bind-mounted into the container) ---
# Default: the directory CONTAINING this sandbox repo. So a checkout at
# ~/oss/sandbox/ makes ~/oss/ the workspace; checkout at ~/work/sandbox/
# makes ~/work/ the workspace. Override via SANDBOX_WORKSPACE.
SANDBOX_REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
SANDBOX_WORKSPACE="${SANDBOX_WORKSPACE:-$(dirname "$SANDBOX_REPO_DIR")}"
# Sibling work tree (Ideogram-internal repos). Mounted read/write for verify
# dogfood only — sandbox identity stays personal-OSS; commit from host with
# projects/.envrc identity.
SANDBOX_PROJECTS_DIR="${SANDBOX_PROJECTS_DIR:-$(dirname "$SANDBOX_WORKSPACE")/projects}"
SANDBOX_HOME_DIR="$SANDBOX_WORKSPACE/.sandbox-home"
SANDBOX_INBOX_DIR="$SANDBOX_WORKSPACE/learnings-inbox"

# --- Named volumes (survive `docker rm`) ---
VOL_TOOLCHAINS="${SANDBOX_LOGIN}-toolchains"
VOL_GH="${SANDBOX_LOGIN}-gh"
VOL_CLAUDE="${SANDBOX_LOGIN}-claude"
VOL_CODEX="${SANDBOX_LOGIN}-codex"

# --- Image + container identity ---
IMAGE_NAME="${SANDBOX_LOGIN}/sandbox"
IMAGE_TAG="v1"
CONTAINER_NAME="${SANDBOX_LOGIN}-sandbox"

# --- Mount declarations (mirrored in devcontainer.json) ---
SANDBOX_MOUNTS=(
  --mount "type=bind,source=$SANDBOX_WORKSPACE,target=/workspace/oss"
  --mount "type=bind,source=$SANDBOX_PROJECTS_DIR,target=/workspace/projects"
  --mount "type=bind,source=$SANDBOX_HOME_DIR,target=/workspace/home"
  --mount "type=bind,source=$SANDBOX_INBOX_DIR,target=/workspace/inbox"
  --mount "type=volume,source=$VOL_TOOLCHAINS,target=/workspace/home/.cache/toolchains"
  --mount "type=volume,source=$VOL_GH,target=/workspace/home/.config/gh"
  --mount "type=volume,source=$VOL_CLAUDE,target=/workspace/home/.claude"
  --mount "type=volume,source=$VOL_CODEX,target=/workspace/home/.codex"
  --mount "type=tmpfs,target=/run/secrets,tmpfs-size=65536"
)

# --- Runtime flags ---
SANDBOX_RUNFLAGS=(
  --hostname "$CONTAINER_NAME"
  --stop-timeout "60"
  --network "bridge"
  --user "dev"
  --workdir "/workspace/oss"
  # NOTE: --cap-drop=ALL intentionally omitted in v1.
  # NOTE: --security-opt=no-new-privileges removed after dogfood:
  # it blocked `sudo apt install` (the standard install-as-needed flow
  # the user explicitly chose over baking toolchains). Single-user
  # container + identity-isolation = no real escalation surface this
  # flag was defending against. Re-add only with a concrete threat
  # model that justifies the workflow cost.
)

# --- Env-var allowlist passed at runtime ---
# Only the two that tests actually exercise; expand when a real caller needs more.
# GH_TOKEN is piped via tmpfs, not env, so it's NOT in this list.
SANDBOX_ENV_ALLOWLIST=(
  GIT_AUTHOR_NAME
  GIT_AUTHOR_EMAIL
)