Struct PreparedBackendRequest 

pub struct PreparedBackendRequest<'a, B: SandboxBackend> { /* private fields */ }

A request that passed backend capability preflight.

This type is still portable and contains no process handle. Native backend code may lower it to an OS-specific launch request after applying the filesystem, network, environment, and lifecycle contracts.

The B type parameter is a type-level binding to the backend whose capabilities were checked during preparation. The handoff also stores a runtime BackendIdentity, so every accessor verifies the exact backend instance that was checked. Native lowering should accept PreparedBackendRequest<'_, Self> and pass the same backend instance to its accessors.

use cageforge_backend_api::{
    BackendCapabilities, BackendIdentity, PreparedBackendRequest, SandboxBackend,
};

struct LinuxBackend(BackendIdentity);
struct WindowsBackend(BackendIdentity);

impl SandboxBackend for LinuxBackend {
    fn identity(&self) -> &BackendIdentity {
        &self.0
    }

    fn capabilities(&self) -> BackendCapabilities {
        BackendCapabilities::new()
    }
}

impl SandboxBackend for WindowsBackend {
    fn identity(&self) -> &BackendIdentity {
        &self.0
    }

    fn capabilities(&self) -> BackendCapabilities {
        BackendCapabilities::new()
    }
}

fn take_linux<'a>(_: PreparedBackendRequest<'a, LinuxBackend>) {}

fn pass_windows_to_linux<'a>(prepared: PreparedBackendRequest<'a, WindowsBackend>) {
    take_linux(prepared);
}

Implementations

impl<'a, B: SandboxBackend> PreparedBackendRequest<'a, B>

pub fn command_spec( &self, backend: &B, ) -> Result<&'a CommandSpec, BackendContractError>

Returns the validated executable and argv values.

The working directory is intentionally exposed separately through Self::working_directory. A backend must not recover or inherit the original optional cwd from a raw CommandRequest after preflight.

pub fn sandbox( &self, backend: &B, ) -> Result<&'a EffectiveSandbox, BackendContractError>

Returns the validated effective sandbox.

pub fn filesystem_lowering( &self, backend: &B, ) -> Result<EffectiveFilesystemLowering<'_>, BackendContractError>

Returns all filesystem constraint layers required for native lowering.

The backend must enforce every layer in the returned view. This is distinct from the combined decision helpers: a native sandbox builder needs the concrete rules, protected paths, and glob settings, while the view prevents it from selecting only the requested or ceiling side.

pub fn network_lowering( &self, backend: &B, ) -> Result<EffectiveNetworkLowering<'_>, BackendContractError>

Returns all network constraint layers required for native lowering.

These rules configure enforcement only. Actual connections must still use Self::authorize_connection with a resolved target and exact socket address.

pub fn path_context( &self, backend: &B, ) -> Result<&EffectivePathContext, BackendContractError>

Returns the runtime path context that was narrowed and checked during BackendRequest::prepare_for.

pub fn working_directory( &self, backend: &B, ) -> Result<&Path, BackendContractError>

Returns the effective working directory resolved during preflight.

This is always present. When the command did not specify an explicit directory, it is the runtime current directory supplied in the path context and checked against the effective filesystem policy.

pub fn stdio(&self, backend: &B) -> Result<StdioSpec, BackendContractError>

Returns the validated standard-stream routing.

pub fn timeout_policy( &self, backend: &B, ) -> Result<TimeoutPolicy, BackendContractError>

Returns the validated timeout intent.

pub fn apply_environment( &self, backend: &B, input: EnvironmentInput, ) -> Result<BTreeMap<OsString, OsString>, BackendContractError>

Applies the effective environment to a backend-selected input base.

A backend must construct EnvironmentInput::core only after it has selected the platform’s conservative core environment.

pub fn filesystem_access_for_path( &self, backend: &B, path: &Path, ) -> Result<FilesystemDecision, BackendContractError>

Evaluates one absolute path against both effective filesystem policies.

pub fn filesystem_access_for( &self, backend: &B, selector: &PathSelector, ) -> Result<FilesystemDecision, BackendContractError>

Evaluates one symbolic filesystem selector against both effective policies and the narrowed runtime context.

The context must come from Self::path_context. A selector that has no effective runtime paths is denied, so a backend cannot accidentally replace a workspace-root ceiling with a broader context.

pub fn network_decision_for_domain_with_resolved_ips( &self, backend: &B, domain: &str, resolved_ips: &[IpAddr], ) -> Result<NetworkDecision, BackendContractError>

Evaluates a resolved hostname and all addresses captured for it.

This is a policy query, not connection authorization. A backend must call Self::authorize_connection immediately before connecting.

pub fn authorize_connection( &self, backend: &B, target: &ResolvedNetworkTarget, connected: SocketAddr, ) -> Result<ConnectionAuthorization, BackendContractError>

Authorizes the exact socket address the backend is about to connect to.

pub fn network_decision_for_unix_socket( &self, backend: &B, socket: &Path, ) -> Result<NetworkDecision, BackendContractError>

Evaluates one Unix socket path against both effective network policies.

Trait Implementations

impl<'a, B: SandboxBackend> Clone for PreparedBackendRequest<'a, B>

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<'a, B: SandboxBackend> Debug for PreparedBackendRequest<'a, B>

fn fmt(&self, formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.