feat(config): add typed execution profiles

Author: chaliy

crates/bashkit-capi/README.md

@@ -166,6 +166,7 @@ x86-64 application cannot load an ARM64 Bashkit library.
 ```json
 {
   "schema_version": 1,
+  "profile": "standard",
   "cwd": "/workspace",
   "env": {"CI": "true"},
   "files": {"/workspace/input.txt": "hello\n"},
@@ -187,6 +188,9 @@ Unknown fields and schema versions are rejected. Text files may be initialized
 through `files`; use `bashkit_write_file()` for arbitrary bytes. Configuration
 input is capped at `BASHKIT_MAX_CONFIG_BYTES` (10 MB).
 
+`profile` is a closed enum: `"hardened"`, `"standard"`, or `"interactive"`.
+It defaults to `"standard"`; fields under `limits` are explicit overrides.
+
 ## Contract
 
 - Inputs are borrowed only for the duration of a call.

crates/bashkit-capi/src/lib.rs

@@ -5,7 +5,7 @@
 // boundary and reports a generic error so unwinding cannot enter the foreign
 // caller and the returned error does not include panic details.
 
-use bashkit::{Bash, Error as BashError, ExecutionLimits, FileSystem};
+use bashkit::{Bash, Error as BashError, FileSystem};
 use serde::Deserialize;
 use std::collections::{BTreeMap, HashMap};
 use std::panic::{AssertUnwindSafe, catch_unwind};
@@ -121,6 +121,8 @@ impl ApiFailure {
 struct ConfigV1 {
     schema_version: u32,
     #[serde(default)]
+    profile: ProfileConfigV1,
+    #[serde(default)]
     cwd: Option<String>,
     #[serde(default)]
     env: BTreeMap<String, String>,
@@ -138,6 +140,25 @@ struct ConfigV1 {
     capture_final_env: bool,
 }
 
+#[derive(Clone, Copy, Default, Deserialize)]
+#[serde(rename_all = "snake_case")]
+enum ProfileConfigV1 {
+    Hardened,
+    #[default]
+    Standard,
+    Interactive,
+}
+
+impl From<ProfileConfigV1> for bashkit::ExecutionProfileName {
+    fn from(value: ProfileConfigV1) -> Self {
+        match value {
+            ProfileConfigV1::Hardened => Self::Hardened,
+            ProfileConfigV1::Standard => Self::Standard,
+            ProfileConfigV1::Interactive => Self::Interactive,
+        }
+    }
+}
+
 #[derive(Default, Deserialize)]
 #[serde(deny_unknown_fields)]
 struct LimitsConfigV1 {
@@ -180,7 +201,8 @@ fn build_from_config(config: ConfigV1) -> Result<Bash, ApiFailure> {
         ));
     }
 
-    let mut limits = ExecutionLimits::default();
+    let profile = bashkit::ExecutionProfile::named(config.profile.into());
+    let mut limits = profile.execution_limits().clone();
     if let Some(value) = config.limits.timeout_ms {
         limits.timeout = Duration::from_millis(value);
     }
@@ -201,6 +223,7 @@ fn build_from_config(config: ConfigV1) -> Result<Bash, ApiFailure> {
     limits.capture_final_env = config.capture_final_env;
 
     let mut builder = Bash::builder()
+        .profile(profile)
         .limits(limits)
         .readonly_filesystem(config.readonly_filesystem);
     if let Some(cwd) = config.cwd {

crates/bashkit-capi/tests/abi.rs

@@ -212,6 +212,10 @@ fn rejects_unknown_config_fields_and_versions() {
                 br#"{"schema_version":2}"#.as_slice(),
                 "unsupported configuration schema version 2",
             ),
+            (
+                br#"{"schema_version":1,"profile":"permissive"}"#.as_slice(),
+                "unknown variant",
+            ),
         ] {
             let mut bash = ptr::null_mut();
             let mut error = ptr::null_mut();

crates/bashkit-cli/src/interactive.rs

@@ -417,8 +417,9 @@ fn test_bash() -> bashkit::Bash {
         .tty(0, true)
         .tty(1, true)
         .tty(2, true)
-        .limits(bashkit::ExecutionLimits::cli())
-        .session_limits(bashkit::SessionLimits::unlimited())
+        .profile(bashkit::ExecutionProfile::named(
+            bashkit::ExecutionProfileName::Interactive,
+        ))
         .build()
 }
 
@@ -836,8 +837,9 @@ mod tests {
             .tty(0, true)
             .tty(1, true)
             .tty(2, true)
-            .limits(bashkit::ExecutionLimits::cli())
-            .session_limits(bashkit::SessionLimits::unlimited())
+            .profile(bashkit::ExecutionProfile::named(
+                bashkit::ExecutionProfileName::Interactive,
+            ))
             .on_exit(Box::new(move |event| {
                 c.store(event.code, Ordering::Relaxed);
                 bashkit::hooks::HookAction::Continue(event)

crates/bashkit-cli/src/main.rs

@@ -2,7 +2,7 @@
 // opt-in for trusted scripts only; --no-http remains for symmetry with other
 // feature toggles.
 // Decision: keep one-shot CLI on a current-thread runtime for lower cold-start.
-// Decision: interactive mode uses relaxed execution limits (ExecutionLimits::cli())
+// Decision: interactive mode uses the typed Interactive execution profile
 // because users have terminal control (Ctrl-C) and expect long-running sessions.
 // One-shot command/script mode uses sandboxed defaults unless explicitly overridden
 // by flags to avoid unbounded hangs for wrapper/automation usage.
@@ -23,7 +23,7 @@
 mod interactive;
 
 use anyhow::{Context, Result, bail};
-use clap::Parser;
+use clap::{Parser, ValueEnum};
 use std::{
     ffi::OsStr,
     io::{IsTerminal, Write},
@@ -48,6 +48,10 @@ const REMOVED_MCP_COMMAND: &str = "mcp";
 #[command(name = "bashkit")]
 #[command(author, version, about, long_about = None)]
 struct Args {
+    /// Resource-policy profile (defaults to standard, or interactive in REPL mode)
+    #[arg(long, value_enum)]
+    profile: Option<CliProfile>,
+
     /// Execute the given command string
     #[arg(short = 'c')]
     command: Option<String>,
@@ -126,6 +130,23 @@ struct Args {
     no_stdin: bool,
 }
 
+#[derive(Debug, Clone, Copy, ValueEnum)]
+enum CliProfile {
+    Hardened,
+    Standard,
+    Interactive,
+}
+
+impl From<CliProfile> for bashkit::ExecutionProfileName {
+    fn from(value: CliProfile) -> Self {
+        match value {
+            CliProfile::Hardened => Self::Hardened,
+            CliProfile::Standard => Self::Standard,
+            CliProfile::Interactive => Self::Interactive,
+        }
+    }
+}
+
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 enum CliMode {
     Command,
@@ -138,7 +159,16 @@ fn build_bash(args: &Args, mode: CliMode) -> bashkit::Bash {
 }
 
 fn configure_bash(args: &Args, mode: CliMode) -> bashkit::BashBuilder {
-    let mut builder = bashkit::Bash::builder();
+    let profile_name = args.profile.map(Into::into).unwrap_or_else(|| {
+        if mode == CliMode::Interactive {
+            bashkit::ExecutionProfileName::Interactive
+        } else {
+            bashkit::ExecutionProfileName::Standard
+        }
+    });
+    let profile = bashkit::ExecutionProfile::named(profile_name);
+    let mut limits = profile.execution_limits().clone();
+    let mut builder = bashkit::Bash::builder().profile(profile);
 
     if args.http_allow_all && !args.no_http {
         builder = builder.network(bashkit::NetworkAllowlist::allow_all());
@@ -165,12 +195,7 @@ fn configure_bash(args: &Args, mode: CliMode) -> bashkit::BashBuilder {
         builder = apply_real_mounts(builder, &args.mount_ro, &args.mount_rw);
     }
 
-    // Interactive mode uses relaxed limits; one-shot keeps sandboxed defaults.
-    let mut limits = if mode == CliMode::Interactive {
-        bashkit::ExecutionLimits::cli()
-    } else {
-        bashkit::ExecutionLimits::new()
-    };
+    // Flags are explicit per-field overrides on the selected profile.
     if let Some(v) = args.max_commands {
         limits = limits.max_commands(v);
     }
@@ -185,10 +210,6 @@ fn configure_bash(args: &Args, mode: CliMode) -> bashkit::BashBuilder {
     }
     builder = builder.limits(limits);
 
-    if mode == CliMode::Interactive {
-        builder = builder.session_limits(bashkit::SessionLimits::unlimited());
-    }
-
     #[cfg(feature = "interactive")]
     if mode == CliMode::Interactive {
         builder = builder.tty(0, true).tty(1, true).tty(2, true);

crates/bashkit-js/__test__/basic.spec.ts

@@ -1,5 +1,11 @@
 import test from "ava";
-import { Bash, BashTool, getVersion, BashError } from "../wrapper.js";
+import {
+  Bash,
+  BashTool,
+  ExecutionProfile,
+  getVersion,
+  BashError,
+} from "../wrapper.js";
 
 // ============================================================================
 // Version
@@ -36,6 +42,15 @@ test("Bash: constructor with all options", (t) => {
   t.is(r.stdout.trim(), "u");
 });
 
+test("Bash: hardened profile preserves isolated filesystem writes", (t) => {
+  const bash = new Bash({ profile: ExecutionProfile.Hardened });
+  const result = bash.executeSync(
+    "printf profile > /tmp/profile; cat /tmp/profile",
+  );
+  t.is(result.exitCode, 0);
+  t.is(result.stdout, "profile");
+});
+
 // ============================================================================
 // Bash — basic execution
 // ============================================================================

crates/bashkit-js/src/lib.rs

@@ -21,7 +21,7 @@ use bashkit::{
     Bash as RustBash, BashTool as RustBashTool, Builtin, BuiltinContext, BuiltinRegistry,
     Credential, ExecResult as RustExecResult, ExecutionLimits, ExtFunctionResult,
     FileSystem as BashFileSystem, FileType, InMemoryFs, Metadata, MontyObject, NetworkAllowlist,
-    OutputCallback, PosixFs, PythonExternalFnHandler, PythonLimits, RealFs, RealFsMode,
+    OutputCallback, PosixFs, PythonExternalFnHandler, RealFs, RealFsMode,
     ScriptedTool as RustScriptedTool, SnapshotOptions as RustSnapshotOptions, Tool, ToolArgs,
     ToolDef, ToolRequest, async_trait,
 };
@@ -1283,6 +1283,8 @@ fn apply_network_options(
 /// Options for creating a Bash or BashTool instance.
 #[napi(object)]
 pub struct BashOptions {
+    /// Named resource-policy baseline. Individual options override its fields.
+    pub profile: Option<ExecutionProfileName>,
     pub username: Option<String>,
     pub hostname: Option<String>,
     /// Initial working directory for the shell (mirrors `Bash::builder().cwd()`).
@@ -1337,6 +1339,25 @@ pub struct BashOptions {
     pub network: Option<NetworkOptions>,
 }
 
+/// Typed named execution-profile selector.
+#[napi(string_enum)]
+#[derive(Debug, Clone, Copy)]
+pub enum ExecutionProfileName {
+    Hardened,
+    Standard,
+    Interactive,
+}
+
+impl From<ExecutionProfileName> for bashkit::ExecutionProfileName {
+    fn from(value: ExecutionProfileName) -> Self {
+        match value {
+            ExecutionProfileName::Hardened => Self::Hardened,
+            ExecutionProfileName::Standard => Self::Standard,
+            ExecutionProfileName::Interactive => Self::Interactive,
+        }
+    }
+}
+
 /// One simple command found by `analyze()`.
 ///
 /// `name` and each entry of `args` are `null` when the word is not fully
@@ -1448,6 +1469,7 @@ pub struct SnapshotOptions {
 fn default_opts() -> BashOptions {
     BashOptions {
         username: None,
+        profile: None,
         hostname: None,
         cwd: None,
         env: None,
@@ -1519,6 +1541,7 @@ struct SharedState {
     in_sync_execute_depth: Arc<AtomicUsize>,
     async_execute_semaphore: Arc<Semaphore>,
     username: Option<String>,
+    profile: Option<ExecutionProfileName>,
     hostname: Option<String>,
     cwd: Option<String>,
     env: Option<HashMap<String, String>>,
@@ -3410,7 +3433,7 @@ impl ScriptedTool {
 
 /// Build `ExecutionLimits` from the limit fields stored in `SharedState`.
 fn build_limits(state: &SharedState) -> ExecutionLimits {
-    let mut limits = ExecutionLimits::new();
+    let mut limits = core_profile(state).execution_limits().clone();
     if let Some(v) = state.max_commands {
         limits = limits.max_commands(v as usize);
     }
@@ -3451,7 +3474,7 @@ fn build_limits(state: &SharedState) -> ExecutionLimits {
 }
 
 fn derive_sqlite_limits(state: &SharedState) -> bashkit::SqliteLimits {
-    let mut limits = bashkit::SqliteLimits::default();
+    let mut limits = core_profile(state).sqlite_limits().clone();
     if let Some(ms) = state.timeout_ms {
         limits = limits.max_duration(std::time::Duration::from_millis(u64::from(ms)));
     }
@@ -3464,8 +3487,18 @@ fn derive_sqlite_limits(state: &SharedState) -> bashkit::SqliteLimits {
     limits
 }
 
+fn core_profile(state: &SharedState) -> bashkit::ExecutionProfile {
+    bashkit::ExecutionProfile::named(
+        state
+            .profile
+            .map(Into::into)
+            .unwrap_or(bashkit::ExecutionProfileName::Standard),
+    )
+}
+
 fn build_bash_from_state(state: &SharedState) -> RustBash {
-    let mut builder = RustBash::builder();
+    let profile = core_profile(state);
+    let mut builder = RustBash::builder().profile(profile.clone());
 
     if let Some(ref u) = state.username {
         builder = builder.username(u);
@@ -3525,7 +3558,7 @@ fn build_bash_from_state(state: &SharedState) -> RustBash {
                 Box::pin(async move { h(name, args, kwargs).await })
             });
             builder = builder.python_with_external_handler(
-                PythonLimits::default(),
+                profile.python_limits().clone(),
                 fn_names,
                 python_handler,
             );
@@ -3587,6 +3620,7 @@ fn shared_state_from_opts(
         in_sync_execute_depth: Arc::new(AtomicUsize::new(0)),
         async_execute_semaphore: Arc::new(Semaphore::new(MAX_PENDING_ASYNC_EXECUTIONS)),
         username: opts.username.clone(),
+        profile: opts.profile,
         hostname: opts.hostname.clone(),
         cwd: opts.cwd.clone(),
         env: opts.env.clone(),
@@ -3640,6 +3674,7 @@ fn shared_state_from_opts(
         in_sync_execute_depth: tmp.in_sync_execute_depth,
         async_execute_semaphore: Arc::new(Semaphore::new(MAX_PENDING_ASYNC_EXECUTIONS)),
         username: opts.username,
+        profile: opts.profile,
         hostname: opts.hostname,
         cwd: opts.cwd,
         env: opts.env,