logconsole

type AgentRuler interface {
	// CheckAgentRule checks a pii.add pattern against what the engine
	// showed and returns the rule's canonical form: its keyed digest and
	// mode, never a field name (a name shown masked must never reach the
	// console's audit, terminal or approved policy). A refusal's text
	// quotes nothing of the pattern.
	CheckAgentRule(pattern string) (canonical string, refused *Refusal)
	// AddAgentRule stores a rule CheckAgentRule returned, in the
	// console's PII directory only (never in .locklog/pii.toml), checking
	// the caps again.
	AddAgentRule(canonical string) (refused *Refusal, err error)
	// PIIRules are the rules in force, as the agent may see them: the
	// human's mask rules, the agent's (by mode and time, never by field)
	// and the approved allow rules.
	PIIRules() (mask, allow []string)
}

type Approve func(ctx context.Context, s console.Screen) console.Approval

type Backend struct {
	// contains filtered or unexported fields
}

type Caller struct{ UID, PID int }

type ClearView struct {
	On   bool
	Kept any
}

type Declined struct {
	Resp ipc.Response
}

type Engine interface {
	Handle(ctx context.Context, method string, params json.RawMessage, c Caller) (result any, refused *Refusal, err error)
	// Status is the engine's part of log.status and :status.
	Status(ctx context.Context) any
	Close() error
}

type ExposedRecord struct {
	Key        string
	Pseudonyms []string
}

type Exposer interface {
	Exposed(result any) (epoch string, recs []ExposedRecord)
}

type Exposure struct {
	// contains filtered or unexported fields
}

type HubCall struct {
	// contains filtered or unexported fields
}

type HubRequest struct {
	Risk   ticket.Risk
	Header string
	// Note is the agent's reason, masked.
	Note string
	// Body is the console's screen (masked by the engine), HubBody the
	// hub's when it differs (nil: Body).
	Body, HubBody []string
	Warnings      []string
	// Clear is the clear view of the screen's record (secrets redacted):
	// sealed to the pinned devices only, in the clear screen.
	Clear []string
	// PlanHash is the engine's keyed plan hash, Inputs its keyed input
	// digests (base64url HMAC-SHA256), Moving the inputs a renewal cannot
	// check without the record.
	PlanHash string
	Inputs   map[string]string
	Moving   []string
	// Production flags the ticket. Whether it is never-auto is the
	// profile's auto rule's (HubCall), not the request's.
	Production bool
}

type HubStatus struct {
	Mode     string `json:"mode"`
	Instance string `json:"instance"`
}

type OpenOptions struct {
	// Policy is the approved policy in force: the engine reads only the
	// sources it names.
	Policy config.Policy
	// Credentials are the secret of the profile's remote source (zero for
	// local sources).
	Credentials egress.Credentials
	// StateDir is the console's state directory (home volume).
	StateDir string
	// Roots are the mount roots of the policy's local sources, checked
	// against the launcher's (PlanRoots): the only directories the
	// sources may be given.
	Roots Roots
	// Project is the project root ("" for none): its .locklog holds the
	// human's PII rules.
	Project string
}

type Opener func(ctx context.Context, o OpenOptions) (Engine, error)

type Options struct {
	Profile string
	// Root is the project root ("" for none).
	Root string
	// StateDir is the console's state base.
	StateDir string
	// Network and ExtraRoots are LOCKLOG_NETWORK and LOCKLOG_EXTRA_ROOTS
	// as the launcher passed them: they are part of the policy.
	Network    string
	ExtraRoots []string
	// ExpectDir and ExpectRoots are LOCKLOG_EXPECT_DIR and
	// LOCKLOG_EXPECT_ROOTS: the device and inode of .locklog and of each
	// mount root, as the launcher checked them on the host.
	ExpectDir   string
	ExpectRoots string
	// DockerRoot is LOCKLOG_DOCKER_ROOT: the containers root the launcher
	// bound for a docker source.
	DockerRoot string
	// InContainer is true in locklog's image (InImage): LOCKLOG_EXPECT_DIR
	// is then required, and Root must be the directory the launcher
	// started the console in.
	InContainer bool
	// SysClassNet is /sys/class/net (tests replace it).
	SysClassNet string
	Open        Opener
	// Now is the clock of hub tickets: the console's (console.Options.Now;
	// nil is time.Now).
	Now func() time.Time
}

type PIIRecord struct {
	audit.Base
	Method  string `json:"method"`
	Pattern string `json:"pattern"`
}

type Policy struct {
	config.Policy
}

type Record struct {
	audit.Base
	Method  string   `json:"method"`
	Sources []string `json:"sources,omitempty"`
	From    string   `json:"from,omitempty"`
	To      string   `json:"to,omitempty"`
	// Last is a relative range (the last duration up to the call), and
	// Baseline a patterns call's offset: it also reads the same window
	// that much earlier. Both in Go's canonical form ("2h0m0s"), parsed
	// from the call, never the agent's text.
	Last     string `json:"last,omitempty"`
	Baseline string `json:"baseline,omitempty"`
	// Tool is the tool an approved scan runs (log.scan).
	Tool string `json:"tool,omitempty"`
	// Pseudonyms name what an unmask revealed or a lookup resolved, by
	// pseudonym only (never the clear values).
	Pseudonyms []string `json:"pseudonyms,omitempty"`
	// ShownClear counts the records shown in clear on the console's
	// terminal (results on, Ctrl-O), never to the agent.
	ShownClear int `json:"shown_clear,omitempty"`
	// AutoRule is the profile's auto rule for the call's action
	// ("auto.read = ask", #126): what made its ticket asked or left to
	// lox run's auto mode, or what refused a denied call. DecidedBy is
	// what decided its ticket, from the hub's version-2 decision:
	// "human" or "auto:<rule id>".
	AutoRule  string `json:"auto_rule,omitempty"`
	DecidedBy string `json:"decided_by,omitempty"`
}

type Refusal struct {
	Message string
	Info    refusal.Info
}

type Revealer interface {
	Reveal(ctx context.Context, result any) []string
}

type Roots struct {
	// Dirs are the directories of the file sources' globs
	// (mountplan.Dir), sorted.
	Dirs []string
	// Journal are the journal directories bound (JournalDirs that
	// exist on the host).
	Journal []string
	// Docker is the containers root (LOCKLOG_DOCKER_ROOT), "" without a
	// docker source.
	Docker string
	// DockerChecked is set when the launcher could stat the containers
	// root from the host and passed its device:inode; usually it cannot
	// (/var/lib/docker is 0710 root), and the root is then the launcher's
	// "not checked from the host" case: the console pins its device:inode
	// at its first connection and checks it on every call (Backend).
	DockerChecked bool
}