// core/src/sandbox/resource.rs
pub struct ResourceLimiter {
    limits: ResourceLimits,
    usage: ResourceUsageTracker,
}

pub struct ResourceLimits {
    // Time limits
    pub command_timeout_seconds: u64,
    pub file_operation_timeout_seconds: u64,
    pub web_request_timeout_seconds: u64,
    
    // Size limits
    pub max_command_output_bytes: usize,
    pub max_file_read_bytes: usize,
    pub max_web_response_bytes: usize,
    
    // Rate limits
    pub max_commands_per_minute: u32,
    pub max_file_ops_per_minute: u32,
    pub max_web_requests_per_minute: u32,
    
    // Concurrency limits
    pub max_concurrent_commands: u32,
    pub max_concurrent_subagents: u32,
}

pub struct ResourceUsageTracker {
    // Per-user tracking
    user_usage: HashMap<UserId, UserUsage>,
    
    // Global tracking
    global_usage: GlobalUsage,
}

pub struct UserUsage {
    commands_this_minute: u32,
    file_ops_this_minute: u32,
    web_requests_this_minute: u32,
    active_commands: u32,
    active_subagents: u32,
    last_reset: Instant,
}

impl ResourceLimiter {
    pub fn check_rate_limit(&self, user: &UserId, operation: Operation) -> Result<(), RateLimitError> {
        let usage = self.usage.get_or_create_user(user);
        usage.reset_if_minute_elapsed();
        
        match operation {
            Operation::Command => {
                if usage.commands_this_minute >= self.limits.max_commands_per_minute {
                    return Err(RateLimitError::CommandLimitExceeded {
                        limit: self.limits.max_commands_per_minute,
                        reset_in: usage.seconds_until_reset(),
                    });
                }
            }
            Operation::FileOp => {
                if usage.file_ops_this_minute >= self.limits.max_file_ops_per_minute {
                    return Err(RateLimitError::FileOpLimitExceeded);
                }
            }
            // ... other operations
        }
        
        Ok(())
    }
    
    pub fn increment_usage(&self, user: &UserId, operation: Operation) {
        let usage = self.usage.get_or_create_user(user);
        match operation {
            Operation::Command => usage.commands_this_minute += 1,
            Operation::FileOp => usage.file_ops_this_minute += 1,
            // ... other operations
        }
    }
}

impl ResourceLimiter {
    pub fn truncate_output(&self, output: &[u8], operation: Operation) -> Cow<[u8]> {
        let max_size = match operation {
            Operation::Command => self.limits.max_command_output_bytes,
            Operation::FileRead => self.limits.max_file_read_bytes,
            Operation::WebRequest => self.limits.max_web_response_bytes,
        };
        
        if output.len() <= max_size {
            Cow::Borrowed(output)
        } else {
            let truncated = &output[..max_size];
            let message = format!("\n\n[TRUNCATED: Output exceeded {} bytes]", max_size);
            Cow::Owned([truncated, message.as_bytes()].concat())
        }
    }
}

impl ResourceLimiter {
    pub async fn acquire_slot(&self, user: &UserId, operation: Operation) -> Result<ResourceSlot, ResourceError> {
        let usage = self.usage.get_or_create_user(user);
        
        match operation {
            Operation::Command => {
                if usage.active_commands >= self.limits.max_concurrent_commands {
                    return Err(ResourceError::ConcurrencyLimitExceeded);
                }
                usage.active_commands += 1;
            }
            Operation::SpawnSubagent => {
                if usage.active_subagents >= self.limits.max_concurrent_subagents {
                    return Err(ResourceError::SubagentLimitExceeded);
                }
                usage.active_subagents += 1;
            }
        }
        
        Ok(ResourceSlot { user: user.clone(), operation })
    }
}

impl Drop for ResourceSlot {
    fn drop(&mut self) {
        // Automatically release slot when dropped
    }
}