sandboxv1

type EffectiveSetting struct {
	Value *SettingValue `protobuf:"bytes,1,opt,name=value,proto3" json:"value,omitempty"`
	Scope SettingScope  `protobuf:"varint,2,opt,name=scope,proto3,enum=openshell.sandbox.v1.SettingScope" json:"scope,omitempty"`
	// contains filtered or unexported fields
}

type FilesystemPolicy struct {

	// Automatically include the workdir as read-write.
	IncludeWorkdir bool `protobuf:"varint,1,opt,name=include_workdir,json=includeWorkdir,proto3" json:"include_workdir,omitempty"`
	// Read-only directory allow list.
	ReadOnly []string `protobuf:"bytes,2,rep,name=read_only,json=readOnly,proto3" json:"read_only,omitempty"`
	// Read-write directory allow list.
	ReadWrite []string `protobuf:"bytes,3,rep,name=read_write,json=readWrite,proto3" json:"read_write,omitempty"`
	// contains filtered or unexported fields
}

type GetGatewayConfigRequest struct {
	// contains filtered or unexported fields
}

type GetGatewayConfigResponse struct {

	// Gateway-global settings map excluding the reserved policy key.
	// Registered keys without a configured value are returned with an empty SettingValue.
	Settings map[string]*SettingValue `` /* 143-byte string literal not displayed */
	// Monotonically increasing revision for gateway-global settings.
	SettingsRevision uint64 `protobuf:"varint,2,opt,name=settings_revision,json=settingsRevision,proto3" json:"settings_revision,omitempty"`
	// contains filtered or unexported fields
}

type GetSandboxConfigRequest struct {

	// Workspace scope. Select one named workspace; authenticated sandbox callers may omit it during bootstrap.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,3,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	Name           string                         `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type GetSandboxConfigResponse struct {

	// The sandbox policy configuration.
	Policy *SandboxPolicy `protobuf:"bytes,1,opt,name=policy,proto3" json:"policy,omitempty"`
	// Current policy version (monotonically increasing per sandbox).
	Version uint32 `protobuf:"varint,2,opt,name=version,proto3" json:"version,omitempty"`
	// SHA-256 hash of the serialized policy payload.
	PolicyHash string `protobuf:"bytes,3,opt,name=policy_hash,json=policyHash,proto3" json:"policy_hash,omitempty"`
	// Effective settings resolved for this sandbox, excluding the reserved policy key.
	// Registered keys without a configured value are returned with an empty EffectiveSetting.value.
	Settings map[string]*EffectiveSetting `` /* 143-byte string literal not displayed */
	// Fingerprint for effective config (policy + settings). Changes when any effective input changes.
	ConfigRevision uint64 `protobuf:"varint,5,opt,name=config_revision,json=configRevision,proto3" json:"config_revision,omitempty"`
	// Source of the policy payload for this response.
	PolicySource PolicySource `` /* 137-byte string literal not displayed */
	// When policy_source is GLOBAL, the version of the global policy revision.
	// Zero when no global policy is active or when policy_source is SANDBOX.
	GlobalPolicyVersion uint32 `protobuf:"varint,7,opt,name=global_policy_version,json=globalPolicyVersion,proto3" json:"global_policy_version,omitempty"`
	// Fingerprint for provider credential inputs attached to this sandbox.
	// Changes when attached provider names or attached provider records change.
	ProviderEnvRevision uint64 `protobuf:"varint,8,opt,name=provider_env_revision,json=providerEnvRevision,proto3" json:"provider_env_revision,omitempty"`
	// Operator-registered supervisor middleware services required by the
	// effective policy. Built-in middleware is not included.
	SupervisorMiddlewareServices []*SupervisorMiddlewareService `` /* 147-byte string literal not displayed */
	// Workspace the sandbox belongs to. Allows the supervisor to learn its
	// workspace context for subsequent workspace-scoped RPCs.
	Workspace string `protobuf:"bytes,10,opt,name=workspace,proto3" json:"workspace,omitempty"`
	// Gateway-configured posture for rejected policy generations. Valid values
	// are "fail_closed" and "retain_last_valid". Unknown or empty values must
	// be treated as fail_closed by the supervisor.
	PolicyValidationFailureMode string `` /* 147-byte string literal not displayed */
	// Whether this gateway can mint authenticated extension credentials.
	// False also covers older gateways that do not advertise this capability;
	// supervisors preserve their legacy unauthenticated connection behavior.
	ExtensionAuthenticationEnabled bool `` /* 155-byte string literal not displayed */
	// Gateway-owned attachment identity captured with this desired configuration.
	// Compare for equality; reattachment invalidates previous installation evidence.
	ProviderAttachmentEpoch string `` /* 133-byte string literal not displayed */
	// True only after validating this complete policy/provider composition.
	// Missing (older gateway) is deliberately not admission.
	ConfigurationAdmitted bool `` /* 126-byte string literal not displayed */
	// Bounded, credential-free admission diagnostic. Empty for admitted policy.
	ConfigurationError string `protobuf:"bytes,16,opt,name=configuration_error,json=configurationError,proto3" json:"configuration_error,omitempty"`
	// Registration fence for a new supervisor; capture once and retain on retry.
	ConfigurationInstanceId string `` /* 133-byte string literal not displayed */
	// Monotonic revision of the sandbox-scoped settings row.
	SettingsRevision uint64                 `protobuf:"varint,17,opt,name=settings_revision,json=settingsRevision,proto3" json:"settings_revision,omitempty"`
	ServiceRoutes    []*SandboxServiceRoute `protobuf:"bytes,18,rep,name=service_routes,json=serviceRoutes,proto3" json:"service_routes,omitempty"`
	// contains filtered or unexported fields
}

type GraphqlOperation struct {

	// Operation type: "query", "mutation", or "subscription".
	OperationType string `protobuf:"bytes,1,opt,name=operation_type,json=operationType,proto3" json:"operation_type,omitempty"`
	// Operation name, if known.
	OperationName string `protobuf:"bytes,2,opt,name=operation_name,json=operationName,proto3" json:"operation_name,omitempty"`
	// Root field names selected by the operation.
	Fields []string `protobuf:"bytes,3,rep,name=fields,proto3" json:"fields,omitempty"`
	// contains filtered or unexported fields
}

type L7Allow struct {

	// Protocol method: HTTP method (REST/WebSocket), JSON-RPC method name, or
	// "*" for any when supported by the protocol.
	Method string `protobuf:"bytes,1,opt,name=method,proto3" json:"method,omitempty"`
	// URL path glob pattern (REST): "/repos/**", "**" for any.
	Path string `protobuf:"bytes,2,opt,name=path,proto3" json:"path,omitempty"`
	// SQL command (SQL): SELECT, INSERT, etc. or "*" for any.
	Command string `protobuf:"bytes,3,opt,name=command,proto3" json:"command,omitempty"`
	// Query parameter matcher map (REST).
	// Key is the decoded query parameter name (case-sensitive).
	// Value supports either a single glob (`glob`) or a list (`any`).
	Query map[string]*L7QueryMatcher `` /* 137-byte string literal not displayed */
	// GraphQL operation type: "query", "mutation", "subscription", or "*" for any.
	OperationType string `protobuf:"bytes,5,opt,name=operation_type,json=operationType,proto3" json:"operation_type,omitempty"`
	// GraphQL operation name glob. "*" matches any operation name.
	OperationName string `protobuf:"bytes,6,opt,name=operation_name,json=operationName,proto3" json:"operation_name,omitempty"`
	// GraphQL root field globs. Allow rules match only when every selected root
	// field matches one of the configured globs. Omit to match all fields.
	Fields []string `protobuf:"bytes,7,rep,name=fields,proto3" json:"fields,omitempty"`
	// MCP params matcher map. Currently only params.name is supported for
	// tools/call filtering. Generic protocol "json-rpc" rejects params matchers.
	Params map[string]*L7QueryMatcher `` /* 139-byte string literal not displayed */
	// contains filtered or unexported fields
}

type L7DenyRule struct {

	// Protocol method: HTTP method (REST/WebSocket), JSON-RPC method name, or
	// "*" for any when supported by the protocol.
	Method string `protobuf:"bytes,1,opt,name=method,proto3" json:"method,omitempty"`
	// URL path glob pattern (REST): "/repos/*/pulls/*/reviews", "**" for any.
	Path string `protobuf:"bytes,2,opt,name=path,proto3" json:"path,omitempty"`
	// SQL command (SQL): SELECT, INSERT, etc. or "*" for any.
	Command string `protobuf:"bytes,3,opt,name=command,proto3" json:"command,omitempty"`
	// Query parameter matcher map (REST).
	// Same semantics as L7Allow.query.
	Query map[string]*L7QueryMatcher `` /* 137-byte string literal not displayed */
	// GraphQL operation type: "query", "mutation", "subscription", or "*" for any.
	OperationType string `protobuf:"bytes,5,opt,name=operation_type,json=operationType,proto3" json:"operation_type,omitempty"`
	// GraphQL operation name glob. "*" matches any operation name.
	OperationName string `protobuf:"bytes,6,opt,name=operation_name,json=operationName,proto3" json:"operation_name,omitempty"`
	// GraphQL root field globs. Deny rules match when any selected root field
	// matches any configured glob.
	Fields []string `protobuf:"bytes,7,rep,name=fields,proto3" json:"fields,omitempty"`
	// MCP params matcher map. Currently only params.name is supported for
	// tools/call filtering. Generic protocol "json-rpc" rejects params matchers.
	Params map[string]*L7QueryMatcher `` /* 139-byte string literal not displayed */
	// contains filtered or unexported fields
}

type L7QueryMatcher struct {

	// Single glob pattern.
	Glob string `protobuf:"bytes,1,opt,name=glob,proto3" json:"glob,omitempty"`
	// Any-of glob patterns.
	Any []string `protobuf:"bytes,2,rep,name=any,proto3" json:"any,omitempty"`
	// contains filtered or unexported fields
}

type L7Rule struct {
	Allow *L7Allow `protobuf:"bytes,1,opt,name=allow,proto3" json:"allow,omitempty"`
	// contains filtered or unexported fields
}

type LandlockPolicy struct {

	// Compatibility mode (e.g. "best_effort", "hard_requirement").
	Compatibility string `protobuf:"bytes,1,opt,name=compatibility,proto3" json:"compatibility,omitempty"`
	// contains filtered or unexported fields
}

type McpOptions struct {

	// Hardening boundary for tools/call params.name. When unset or true, the
	// supervisor enforces the MCP recommended tool-name syntax
	// ^[A-Za-z0-9_.-]{1,128}$ before policy evaluation. Set false only for
	// compatibility with servers that intentionally use non-recommended names.
	//
	// Source:
	// - https://modelcontextprotocol.io/specification/2025-11-25/server/tools#tool-names
	StrictToolNames *bool `protobuf:"varint,1,opt,name=strict_tool_names,json=strictToolNames,proto3,oneof" json:"strict_tool_names,omitempty"`
	// Method-layer default for MCP endpoints. When true, OpenShell allows parsed
	// MCP-family methods at the method layer unless a tool-name policy narrows
	// tools/call. When unset or false, explicit method rules are required.
	AllowAllKnownMcpMethods *bool `` /* 143-byte string literal not displayed */
	// Exact MCP protocol revisions accepted by the endpoint's policy schema.
	// Authors may omit this field. Because proto3 repeated fields do not retain
	// presence, omission reaches protobuf ingress as an empty list. Checked
	// normalization materializes OpenShell's pinned default revision
	// "2025-11-25" before producing canonical downstream state, which is always
	// nonempty.
	//
	// An explicit nonempty list remains an exact allowlist. Duplicates, moving
	// aliases such as "draft" and "latest", and unknown dates are invalid.
	// Normalization stores valid values in canonical semantic order. These
	// values identify core revisions; they do not enable separate SEP overlays
	// or select runtime parsing and forwarding behavior.
	Versions []string `protobuf:"bytes,3,rep,name=versions,proto3" json:"versions,omitempty"`
	// contains filtered or unexported fields
}

type MiddlewareEndpointSelector struct {

	// Exact host or DNS glob patterns included in the selection. Include and
	// exclude accept at most 32 combined patterns.
	Include []string `protobuf:"bytes,1,rep,name=include,proto3" json:"include,omitempty"`
	// Exact host or DNS glob patterns removed from the selection.
	// Exclusions take precedence over inclusions.
	Exclude []string `protobuf:"bytes,2,rep,name=exclude,proto3" json:"exclude,omitempty"`
	// contains filtered or unexported fields
}

type NetworkAccessPreset int32

type NetworkBinary struct {
	Path string `protobuf:"bytes,1,opt,name=path,proto3" json:"path,omitempty"`
	// contains filtered or unexported fields
}

type NetworkCredentialBinding struct {

	// Name of the provider attached to this sandbox whose static credentials
	// may be resolved for requests admitted by this endpoint.
	Provider string `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"`
	// contains filtered or unexported fields
}

type NetworkEndpoint struct {

	// Hostname or host glob pattern. Exact match is case-insensitive.
	// Glob patterns use "." as delimiter: "*.example.com" matches a single
	// subdomain label, "**.example.com" matches across labels.
	Host string `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"`
	// Single port (backwards compat). Use `ports` for multiple ports.
	// Mutually exclusive with `ports` — if both are set, `ports` takes precedence.
	Port uint32 `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`
	// Endpoint protocol. "tcp" and "" select L4-only handling; "rest",
	// "websocket", "graphql", "sql", "json-rpc", and "mcp" select L7 inspection.
	Protocol string `protobuf:"bytes,3,opt,name=protocol,proto3" json:"protocol,omitempty"`
	// TLS handling. Unspecified enables automatic detection and termination.
	Tls NetworkTlsMode `protobuf:"varint,4,opt,name=tls,proto3,enum=openshell.sandbox.v1.NetworkTlsMode" json:"tls,omitempty"`
	// Enforcement mode. Unspecified preserves the audit default.
	Enforcement NetworkEnforcementMode `protobuf:"varint,5,opt,name=enforcement,proto3,enum=openshell.sandbox.v1.NetworkEnforcementMode" json:"enforcement,omitempty"`
	// Access preset shorthand. Unspecified means no preset.
	// Mutually exclusive with rules.
	Access NetworkAccessPreset `protobuf:"varint,6,opt,name=access,proto3,enum=openshell.sandbox.v1.NetworkAccessPreset" json:"access,omitempty"`
	// Explicit L7 rules (mutually exclusive with access).
	Rules []*L7Rule `protobuf:"bytes,7,rep,name=rules,proto3" json:"rules,omitempty"`
	// Allowed resolved IP addresses or CIDR ranges for this endpoint.
	// When non-empty, the SSRF internal-IP check is replaced by an allowlist check:
	//   - If host is also set: domain must resolve to an IP in this list.
	//   - If host is empty: any domain is allowed as long as it resolves to an IP in this list.
	//
	// Supports exact IPs ("10.0.5.20") and CIDR notation ("10.0.5.0/24").
	// Loopback (127.0.0.0/8) and link-local (169.254.0.0/16) are always blocked
	// regardless of this field.
	AllowedIps []string `protobuf:"bytes,8,rep,name=allowed_ips,json=allowedIps,proto3" json:"allowed_ips,omitempty"`
	// Multiple ports. When non-empty, this endpoint covers all listed ports.
	// If `port` is set and `ports` is empty, `port` is normalized to `ports: [port]`.
	// If both are set, `ports` takes precedence.
	Ports []uint32 `protobuf:"varint,9,rep,packed,name=ports,proto3" json:"ports,omitempty"`
	// Explicit L7 deny rules. When present, requests matching any deny rule
	// are blocked even if they match an allow rule or access preset.
	// Deny rules take precedence over allow rules.
	DenyRules []*L7DenyRule `protobuf:"bytes,10,rep,name=deny_rules,json=denyRules,proto3" json:"deny_rules,omitempty"`
	// When true, percent-encoded '/' (%2F) is preserved in path segments
	// rather than rejected by the L7 path canonicalizer. Required for
	// upstreams like GitLab that embed %2F in namespaced resource paths.
	// Defaults to false (strict).
	AllowEncodedSlash bool `protobuf:"varint,11,opt,name=allow_encoded_slash,json=allowEncodedSlash,proto3" json:"allow_encoded_slash,omitempty"`
	// GraphQL persisted-query behavior for hash-only/saved-query requests:
	// "deny" (default) or "allow_registered".
	PersistedQueries string `protobuf:"bytes,12,opt,name=persisted_queries,json=persistedQueries,proto3" json:"persisted_queries,omitempty"`
	// Trusted GraphQL persisted-query registry keyed by hash or service-specific ID.
	// Only used when persisted_queries is "allow_registered".
	GraphqlPersistedQueries map[string]*GraphqlOperation `` /* 207-byte string literal not displayed */
	// Maximum GraphQL request body bytes to buffer for inspection.
	// Defaults to 65536 when unset.
	GraphqlMaxBodyBytes uint32 `protobuf:"varint,14,opt,name=graphql_max_body_bytes,json=graphqlMaxBodyBytes,proto3" json:"graphql_max_body_bytes,omitempty"`
	// Optional HTTP path glob that scopes this L7 endpoint on shared host:port APIs.
	// Example: use path "/graphql" for protocol "graphql" and "/repos/**" for
	// protocol "rest" when both surfaces live under api.example.com:443.
	// Empty means all paths.
	Path string `protobuf:"bytes,15,opt,name=path,proto3" json:"path,omitempty"`
	// When true on a "rest" endpoint, OpenShell rewrites credential placeholders
	// inside client-to-server WebSocket text messages after an allowed HTTP 101
	// upgrade. Defaults to false.
	WebsocketCredentialRewrite bool `` /* 143-byte string literal not displayed */
	// When true on a "rest" endpoint, OpenShell rewrites credential placeholders
	// inside supported textual HTTP request bodies before forwarding upstream.
	// Defaults to false.
	RequestBodyCredentialRewrite bool `` /* 151-byte string literal not displayed */
	// Internal provenance marker for policy-advisor generated endpoints.
	// Advisor-proposed endpoints must not satisfy exact-host SSRF trust unless
	// they are converted through an explicit user-authored policy path.
	AdvisorProposed bool `protobuf:"varint,18,opt,name=advisor_proposed,json=advisorProposed,proto3" json:"advisor_proposed,omitempty"`
	// Proxy-side credential signing mode: "sigv4" for AWS SigV4 re-signing.
	// When set, the proxy strips the client's Authorization header and computes
	// a fresh SigV4 signature using real credentials from the provider.
	CredentialSigning string `protobuf:"bytes,19,opt,name=credential_signing,json=credentialSigning,proto3" json:"credential_signing,omitempty"`
	// AWS signing service name override. Required when credential_signing is
	// "sigv4" — e.g. "bedrock" for bedrock-runtime endpoints.
	SigningService string `protobuf:"bytes,20,opt,name=signing_service,json=signingService,proto3" json:"signing_service,omitempty"`
	// AWS region override for SigV4 signing. When set, takes precedence over
	// hostname-based region extraction. Required for non-standard endpoints.
	SigningRegion string `protobuf:"bytes,21,opt,name=signing_region,json=signingRegion,proto3" json:"signing_region,omitempty"`
	// Maximum JSON-RPC-over-HTTP request body bytes to buffer for inspection.
	// Defaults to 65536 when unset.
	JsonRpcMaxBodyBytes uint32 `` /* 126-byte string literal not displayed */
	// MCP-only policy and inspection options. Only used when protocol is "mcp".
	Mcp *McpOptions `protobuf:"bytes,23,opt,name=mcp,proto3" json:"mcp,omitempty"`
	// Explicit binding authority for static credentials from an attached
	// endpointless provider profile. Profiles that already define endpoints
	// continue to use those profile endpoints as their credential boundary.
	CredentialBinding *NetworkCredentialBinding `protobuf:"bytes,24,opt,name=credential_binding,json=credentialBinding,proto3" json:"credential_binding,omitempty"`
	// Explicitly permits credential-bearing traffic to use paths that OpenShell
	// cannot inspect or rewrite. Defaults to false. This is a security-sensitive
	// escape hatch and must be explicitly approved.
	AllowUninspectedCredentials bool `` /* 146-byte string literal not displayed */
	// Internal gateway-derived marker indicating that this endpoint belongs to
	// an attached credentialed provider. User-authored values are ignored.
	ProviderCredentialed bool `protobuf:"varint,26,opt,name=provider_credentialed,json=providerCredentialed,proto3" json:"provider_credentialed,omitempty"`
	// Internal gateway-derived identity of this endpoint's token-grant authority.
	// It binds the provider record and complete profile policy, or the active
	// global policy, to this endpoint. User-authored values are ignored.
	TokenGrantOwner string `protobuf:"bytes,27,opt,name=token_grant_owner,json=tokenGrantOwner,proto3" json:"token_grant_owner,omitempty"`
	// contains filtered or unexported fields
}

type NetworkEnforcementMode int32

type NetworkMiddlewareConfig struct {

	// Human-readable name for this middleware config.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Built-in middleware name or operator-owned registration name.
	Middleware string `protobuf:"bytes,2,opt,name=middleware,proto3" json:"middleware,omitempty"`
	// Service-specific configuration.
	Config *structpb.Struct `protobuf:"bytes,3,opt,name=config,proto3" json:"config,omitempty"`
	// Failure behavior: "fail_closed" (default) or "fail_open".
	OnError string `protobuf:"bytes,4,opt,name=on_error,json=onError,proto3" json:"on_error,omitempty"`
	// Host selector controlling which admitted destinations use this config.
	Endpoints *MiddlewareEndpointSelector `protobuf:"bytes,5,opt,name=endpoints,proto3" json:"endpoints,omitempty"`
	// Execution order. Values must be unique within a policy; lower values run first.
	Order int32 `protobuf:"varint,6,opt,name=order,proto3" json:"order,omitempty"`
	// contains filtered or unexported fields
}

type NetworkPolicyRule struct {

	// Human-readable name for this policy rule.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Allowed endpoint (host:port) pairs.
	Endpoints []*NetworkEndpoint `protobuf:"bytes,2,rep,name=endpoints,proto3" json:"endpoints,omitempty"`
	// Allowed binary identities.
	Binaries []*NetworkBinary `protobuf:"bytes,3,rep,name=binaries,proto3" json:"binaries,omitempty"`
	// contains filtered or unexported fields
}

type NetworkTlsMode int32

type PolicySource int32

type ProcessPolicy struct {

	// User name to run the sandboxed process as.
	RunAsUser string `protobuf:"bytes,1,opt,name=run_as_user,json=runAsUser,proto3" json:"run_as_user,omitempty"`
	// Group name to run the sandboxed process as.
	RunAsGroup string `protobuf:"bytes,2,opt,name=run_as_group,json=runAsGroup,proto3" json:"run_as_group,omitempty"`
	// contains filtered or unexported fields
}

type SandboxConfigSnapshot struct {
	Policy                         *SandboxPolicy                 `protobuf:"bytes,1,opt,name=policy,proto3" json:"policy,omitempty"`
	Version                        uint32                         `protobuf:"varint,2,opt,name=version,proto3" json:"version,omitempty"`
	PolicyHash                     string                         `protobuf:"bytes,3,opt,name=policy_hash,json=policyHash,proto3" json:"policy_hash,omitempty"`
	Settings                       map[string]*EffectiveSetting   `` /* 143-byte string literal not displayed */
	ConfigRevision                 uint64                         `protobuf:"varint,5,opt,name=config_revision,json=configRevision,proto3" json:"config_revision,omitempty"`
	PolicySource                   PolicySource                   `` /* 137-byte string literal not displayed */
	GlobalPolicyVersion            uint32                         `protobuf:"varint,7,opt,name=global_policy_version,json=globalPolicyVersion,proto3" json:"global_policy_version,omitempty"`
	ProviderEnvRevision            uint64                         `protobuf:"varint,8,opt,name=provider_env_revision,json=providerEnvRevision,proto3" json:"provider_env_revision,omitempty"`
	SupervisorMiddlewareServices   []*SupervisorMiddlewareService `` /* 147-byte string literal not displayed */
	Workspace                      string                         `protobuf:"bytes,10,opt,name=workspace,proto3" json:"workspace,omitempty"`
	PolicyValidationFailureMode    string                         `` /* 147-byte string literal not displayed */
	ExtensionAuthenticationEnabled bool                           `` /* 155-byte string literal not displayed */
	ConfigurationAdmitted          bool                           `` /* 126-byte string literal not displayed */
	ProviderAttachmentEpoch        string                         `` /* 133-byte string literal not displayed */
	ConfigurationInstanceId        string                         `` /* 133-byte string literal not displayed */
	ConfigurationError             string                         `protobuf:"bytes,16,opt,name=configuration_error,json=configurationError,proto3" json:"configuration_error,omitempty"`
	SettingsRevision               uint64                         `protobuf:"varint,17,opt,name=settings_revision,json=settingsRevision,proto3" json:"settings_revision,omitempty"`
	// Explicit application ingress allowlist. Absent means no app routes.
	ServiceRoutes []*SandboxServiceRoute `protobuf:"bytes,18,rep,name=service_routes,json=serviceRoutes,proto3" json:"service_routes,omitempty"`
	// contains filtered or unexported fields
}

type SandboxPolicy struct {

	// Policy version.
	Version uint32 `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"`
	// Filesystem access policy.
	Filesystem *FilesystemPolicy `protobuf:"bytes,2,opt,name=filesystem,proto3" json:"filesystem,omitempty"`
	// Landlock configuration.
	Landlock *LandlockPolicy `protobuf:"bytes,3,opt,name=landlock,proto3" json:"landlock,omitempty"`
	// Process execution policy.
	Process *ProcessPolicy `protobuf:"bytes,4,opt,name=process,proto3" json:"process,omitempty"`
	// Network access policies keyed by name (e.g. "claude_code", "gitlab").
	NetworkPolicies map[string]*NetworkPolicyRule `` /* 180-byte string literal not displayed */
	// Reusable supervisor middleware configs for network egress, keyed by their
	// policy-local names. At most 10 configs are accepted, and at most 10 stages
	// can be selected per request.
	NetworkMiddlewares map[string]*NetworkMiddlewareConfig `` /* 189-byte string literal not displayed */
	// contains filtered or unexported fields
}

type SandboxServiceRoute struct {
	EndpointId        string `protobuf:"bytes,1,opt,name=endpoint_id,json=endpointId,proto3" json:"endpoint_id,omitempty"`
	Name              string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
	TargetPort        uint32 `protobuf:"varint,3,opt,name=target_port,json=targetPort,proto3" json:"target_port,omitempty"`
	AuthorizationMode int32  `protobuf:"varint,4,opt,name=authorization_mode,json=authorizationMode,proto3" json:"authorization_mode,omitempty"`
	ResourceVersion   uint64 `protobuf:"varint,5,opt,name=resource_version,json=resourceVersion,proto3" json:"resource_version,omitempty"`
	// contains filtered or unexported fields
}

type SettingScope int32

type SettingValue struct {

	// Types that are valid to be assigned to Value:
	//
	//	*SettingValue_StringValue
	//	*SettingValue_BoolValue
	//	*SettingValue_IntValue
	//	*SettingValue_BytesValue
	Value isSettingValue_Value `protobuf_oneof:"value"`
	// contains filtered or unexported fields
}

type SettingValue_BoolValue struct {
	BoolValue bool `protobuf:"varint,2,opt,name=bool_value,json=boolValue,proto3,oneof"`
}

type SettingValue_BytesValue struct {
	BytesValue []byte `protobuf:"bytes,4,opt,name=bytes_value,json=bytesValue,proto3,oneof"`
}

type SettingValue_IntValue struct {
	IntValue int64 `protobuf:"varint,3,opt,name=int_value,json=intValue,proto3,oneof"`
}

type SettingValue_StringValue struct {
	StringValue string `protobuf:"bytes,1,opt,name=string_value,json=stringValue,proto3,oneof"`
}

type SupervisorMiddlewareBinding int32

type SupervisorMiddlewareBindingPolicy int32

type SupervisorMiddlewareService struct {

	// Operator-owned registration name used by policy attachments and diagnostics.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// gRPC endpoint reachable from the sandbox supervisor.
	GrpcEndpoint string `protobuf:"bytes,2,opt,name=grpc_endpoint,json=grpcEndpoint,proto3" json:"grpc_endpoint,omitempty"`
	// Operator-owned logical payload limit applied to every binding exposed by
	// the service. This caps HTTP bodies and complete WebSocket messages.
	MaxPayloadBytes uint64 `protobuf:"varint,3,opt,name=max_payload_bytes,json=maxPayloadBytes,proto3" json:"max_payload_bytes,omitempty"`
	// Default RPC timeout for this service. Absence uses the platform default of
	// 500ms. Values must be between 10ms and 30s.
	RequestTimeout *durationpb.Duration `protobuf:"bytes,104,opt,name=request_timeout,json=requestTimeout,proto3" json:"request_timeout,omitempty"`
	// PEM-encoded trust roots loaded by the gateway from the operator-configured
	// tls_ca_cert_path. Empty uses the platform trust store.
	TlsCaCertPem []byte `protobuf:"bytes,5,opt,name=tls_ca_cert_pem,json=tlsCaCertPem,proto3" json:"tls_ca_cert_pem,omitempty"`
	// Exact JWT audience for this service. The gateway resolves an omitted
	// operator value to a kind-scoped audience derived from the registration
	// name before sending sandbox config.
	Audience string `protobuf:"bytes,6,opt,name=audience,proto3" json:"audience,omitempty"`
	// Operator opt-out from extension authentication for this registration.
	// When true the service may use a plaintext endpoint and OpenShell attaches
	// no bearer credential; supervisors must not request one. Intended only for
	// trusted-network development deployments.
	AllowInsecureTransport bool `` /* 130-byte string literal not displayed */
	// How the gateway and supervisor authorize the bindings returned by Describe.
	// Absence preserves dynamic discovery. A supervisor predating this field
	// cannot enforce a binding policy; upgrade supervisors before requiring one.
	BindingPolicy SupervisorMiddlewareBindingPolicy `` /* 161-byte string literal not displayed */
	// Operation/phase pairs required by an allowlist or exact policy. Every
	// listed binding must be advertised, and only listed bindings may run.
	Bindings []SupervisorMiddlewareBinding `` /* 131-byte string literal not displayed */
	// contains filtered or unexported fields
}