internal/

Package actions wires concrete Docker/Colima operations into the generic tool Registry and supplies the entity resolver.

Package colima wraps the `colima` CLI, which has no API.

Package discovery finds Docker Compose projects on disk under user-configured roots, so the UI can offer "available but not yet deployed" stacks alongside the label-derived running ones.

Package docker talks to the Docker Engine API exposed by Colima's unix socket.

Package execstream runs a command and streams its combined output line by line, used for long-running CLI operations (colima lifecycle, docker compose) that the UI displays as live progress.

Package grant implements the time-boxed "destructive actions" window that unlocks Destructive tools for non-interactive callers (the MCP server, a future in-app assistant).

Package mcp exposes Oriel's validated tool Registry as a Model Context Protocol server over stdio.

Package secrets masks sensitive environment-variable values so they don't leak from the inspect panel (screenshots, screen-shares) or to an AI model over MCP.

Package server wires the HTTP router for Oriel: a small JSON REST surface for actions, SSE channels for live data, and the embedded frontend.

Package service installs Oriel as a background service so it starts automatically and stays running: a launchd LaunchAgent on macOS, and a systemd service on Linux (a per-user unit, or a system unit with --system / when run as root).

Package settings owns the user's persisted configuration (settings.json): base path, allowed hosts, auth token, masking policy, and compose-discovery config.

Package tools is the canonical action layer.

Package userdata resolves Oriel's per-user data directory.