leviath_sys/lib.rs
1//! Platform/OS-specific system calls for Leviath, isolated behind one
2//! cross-platform API.
3//!
4//! Every `#[cfg(unix)]`/`#[cfg(windows)]` branch and platform
5//! permission/signal/TTY primitive used anywhere in the workspace lives here -
6//! nowhere else. The unavoidable OS-level `unsafe` is delegated to audited
7//! crates (`nix`) and safe std APIs, so this crate itself contains no `unsafe`.
8//! Callers use the plain functions re-exported at the crate root and never
9//! write a `#[cfg]` of their own.
10//!
11//! ## Why this crate exists
12//!
13//! 1. **De-duplication.** The `process_group` detach and
14//! `Permissions::from_mode(0o600)` logic each has exactly one implementation
15//! here, rather than being spread across call sites in `leviath-cli`.
16//! 2. **Per-OS coverage correctness.** Because all platform code is gathered
17//! into cfg-gated submodules (`platform`), the non-target
18//! implementations (`#[cfg(windows)]` on a Linux CI run) are simply not
19//! compiled, so the coverage tool never sees them as gaps. The
20//! Linux-visible code paths are all reachable from real unit tests.
21//! 3. **Testability.** Every function in this crate is exercised by real unit
22//! tests - the syscalls here are either safe to call under test (`chmod` on a
23//! tempfile) or split behind an
24//! injected seam ([`tty::osc52_write_via`]
25//! takes the tty opener + sink; `perms`' hardening op is a `fn` pointer). The
26//! only genuinely-untestable real-I/O leaves (opening `/dev/tty`, writing the
27//! real `stdout()`) are composed in the CLI binary, not here - so this crate
28//! contains no `#[cfg(not(test))]`.
29
30mod platform;
31
32pub mod browser;
33pub mod keychain;
34pub mod perms;
35pub mod process;
36pub mod sandbox;
37pub mod tty;
38
39pub use browser::open_url;
40pub use perms::{ensure_file_private, secure_dir_perms, secure_file_perms, write_private};
41#[cfg(unix)]
42pub use process::peer_uid;
43pub use process::{configure_detached, current_uid, kill_process_group};
44pub use sandbox::{
45 ContainerRunSpec, container_exec_argv, container_rm_argv, container_run_argv,
46 detect_container_engine, namespace_argv, namespace_supported,
47};
48pub use tty::osc52_write_via;