normalizeContainerPath,

relativePathEscapesContainerRoot,

} from "./path-utils.js";

import { resolveReadOnlyWorkspaceSkillMounts } from "./workspace-mounts.js";

export type SandboxFsMount = {

hostRoot: string;

containerRoot: string;

writable: boolean;

source: "workspace" | "agent" | "bind";

source: "workspace" | "agent" | "bind" | "protectedSkill";

};

export type SandboxResolvedFsPath = {

});

}

for (const mount of resolveReadOnlyWorkspaceSkillMounts({

workspaceDir: sandbox.workspaceDir,

agentWorkspaceDir: sandbox.agentWorkspaceDir,

workdir: sandbox.containerWorkdir,

workspaceAccess: sandbox.workspaceAccess,

})) {

mounts.push({

hostRoot: path.resolve(mount.hostPath),

containerRoot: normalizeContainerPath(mount.containerPath),

writable: false,

source: "protectedSkill",

});

}

for (const bind of sandbox.docker.binds ?? []) {

const parsed = parseSandboxBindMount(bind);

if (!parsed) {

if (byLength !== 0) {

return byLength;

}

// Keep resolver ordering aligned with docker mount precedence: custom binds can

// intentionally shadow default workspace mounts at the same container path.

// Keep resolver ordering aligned with docker mount precedence for default

// workspace mounts, but never let bridge policy classify protected skills

// as writable.

return mountSourcePriority(b.source) - mountSourcePriority(a.source);

}

}

function mountSourcePriority(source: SandboxFsMount["source"]): number {

if (source === "protectedSkill") {

return 3;

}

if (source === "bind") {

return 2;

}