internal/

Package approve records the commands a human has agreed to run.

Package bay is the orchestration layer: it turns "make me a bay" into a worktree, a port block, a set of containers, and a hostname, and turns "remove it" back into nothing.

Package broker resolves ${secret:...} references and revokes what it minted.

Package egress enforces the per-service network allowlist.

Package engine brings a bay up and takes it down.

Package introspect works out how a repository runs.

Package lockfile serializes work between devbay processes.

Package manifest parses and validates devbay.yaml.

Package mcp exposes devbay to coding agents.

Package patch repairs a devbay manifest using Claude.

Package ports allocates the host ports a bay publishes on.

Package proxy gives every bay its own browser origin.

Package report turns a test runner's output into typed failures.

Package scrub removes secret values from anything leaving devbay.

Package testutil holds helpers shared by devbay's Docker integration tests.

Package verify boots a proposed manifest and repairs it when it fails.

Package watcher turns file changes on the host into container actions.

Package worktree manages the git worktree behind a bay.