server

type AgentConfig struct {
	HarnessEnv map[string][]string // per-harness KEY=VALUE env vars for runtime instances
	CoreEnv    map[string]string   // server-level KEY=VALUE env vars from [core.env]
	Backends   agent.Backends      // optional agent backend override for smoke/e2e tests
}

type AuthConfig struct {
	// ExternalURL is the public base URL (e.g. https://caic.example.com).
	// "auto" locks the hostname from the first FQDN request.
	ExternalURL string
	// TrustedProxies contains direct reverse-proxy address prefixes whose
	// Forwarded and X-Forwarded-* origin and client-IP headers may be accepted.
	TrustedProxies []string
}

type CacheSizeStore struct {
	// contains filtered or unexported fields
}

type Config struct {
	Dirs    DirsConfig
	Runtime RuntimeConfig
	Agent   AgentConfig
	LLM     LLMConfig
	GitHub  GitHubConfig
	GitLab  GitLabConfig
	Google  GoogleConfig
	Auth    AuthConfig
	Voice   VoiceConfig
	Debug   DebugConfig
	IPGeo   IPGeoConfig

	FakeCI FakeCIHook // optional fake CI simulation hook for smoke/e2e tests

	// UsageFetchers replaces auto-detected provider usage fetchers.
	// When non-nil, provider auto-detection is skipped entirely.
	// App owns these fetchers and closes those that implement io.Closer.
	UsageFetchers []usage.ProviderFetcher
}

type DebugConfig struct {
	Pprof bool // expose /debug/pprof/* endpoints
}

type Dependencies struct {
	// PushCacheDir is the configured application cache root for cloned checkouts.
	PushCacheDir               string
	Checkouts                  *repo.Registry
	CheckoutRoot               string
	RepoStatus                 *ci.RepoStatusStore
	Tailscale                  bool
	Preferences                *preferences.Store
	AuthStore                  *auth.Store
	SessionSecret              []byte
	OAuthPrivateKeyPEM         []byte
	OAuthKeyID                 string
	OAuthIssuer                string
	OAuthRefreshTokenStorePath string
	AuditLogPath               string
	GitHubOAuth                *oauthclient.ProviderConfig
	GitLabOAuth                *oauthclient.ProviderConfig
	GoogleOAuth                *oauthclient.ProviderConfig
	HostState                  *auth.HostState
	UsageFetchers              []usage.ProviderFetcher
	UsageRollup                *usagedb.Store
	VoiceBridge                *voicertc.Bridge
	VoiceGateway               VoiceGatewayConfig
	ForgeMgr                   *forgemgr.Manager
	CICache                    *forgecache.Cache
	Runtimes                   *runtime.Router
	TaskMgr                    *taskmgr.Manager
	Provider                   genai.Provider
	IPGeoChecker               *ipgeo.Checker
	TrustedProxies             []netip.Prefix

	// App-owned automation services, routed to by HTTP handlers and webhooks.
	Bot        *bot.Bot
	CIService  *ci.Service
	TaskClient taskCreator // creates tasks for manual CI repair
	Warnings   *WarningStore
	CacheSizes *CacheSizeStore
	// Metrics aggregates operation duration observations.
	Metrics *metrics.Store
	// HarnessModels refreshes coding-agent model inventories.
	HarnessModels *HarnessModels
	ImageRefresh  *ImageRefresh
	FakeCI        FakeCIHook // optional fake CI simulation hook for smoke/e2e tests

	GitHubAllowedUsers     []string
	GitLabAllowedUsers     []string
	GoogleAllowedUsers     []string
	GitHubWebhookSecret    []byte
	GitLabWebhookSecret    []byte
	GitHubAppAllowedOwners []string
	Pprof                  bool
}

type DirsConfig struct {
	ConfigDir string // persistent server state, e.g. ~/.config/caic
	CacheDir  string // logs and cache files, e.g. ~/.cache/caic
}

type FakeCIHook func(ctx context.Context, t *taskrun.Task)

type GitHubConfig struct {
	Token             string // PAT for GitHub API access
	OAuthClientID     string // OAuth app client ID
	OAuthClientSecret string
	OAuthAllowedUsers []string // if set, restricts login to these users; empty allows any
	WebhookSecret     []byte   // HMAC secret; enables POST /webhooks/github
	AppID             int64    // GitHub App ID; used with AppPrivateKeyPEM
	AppPrivateKeyPEM  []byte   // RSA private key PEM
	AppAllowedOwners  []string // if set, reject installs from other owners
}

type GitLabConfig struct {
	Token             string // PAT; mutually exclusive with OAuthClientID
	OAuthClientID     string // OAuth app client ID; mutually exclusive with Token
	OAuthClientSecret string
	OAuthAllowedUsers []string // if set, restricts login to these users; empty allows any
	URL               string   // default "https://gitlab.com"
	WebhookSecret     []byte   // X-Gitlab-Token secret; enables POST /webhooks/gitlab
}

type GoogleConfig struct {
	OAuthClientID     string   // OAuth client ID
	OAuthClientSecret string   // OAuth client secret
	OAuthAllowedUsers []string // if set, restricts login to these emails; empty allows any
}

type HarnessModels struct {
	// Log records model refresh progress.
	Log *slog.Logger
	// CacheDir stores the harness model inventory cache.
	CacheDir string
	// Router creates temporary runtimes for model discovery.
	Router *runtime.Router
	// TaskManager owns the configured harness backends.
	TaskManager *taskmgr.Manager
	// HarnessEnv supplies environment variables to each harness refresh.
	HarnessEnv map[string][]string
	// contains filtered or unexported fields
}

type IPGeoConfig struct {
	// DB is the path to a MaxMind MMDB file (e.g. GeoLite2-Country.mmdb).
	DB string
	// Allowlist is a comma-separated list of permitted country codes, CIDRs, and
	// named origins: "local", "tailscale", "anthropic", "github", and "openai".
	// When set, requests from IPs that do not resolve to an allowed value are
	// rejected with 403. Requires DB for country-code tokens.
	Allowlist string
}

type ImageRefresh struct {
	Log     *slog.Logger
	Clients map[string]ImageWarmer
	Prefs   *preferences.Store
	// contains filtered or unexported fields
}

type ImageWarmer interface {
	Warmup(ctx context.Context, stdout, stderr io.Writer, opts *md.WarmupOpts) (bool, error)
}

type LLMConfig struct {
	Provider string
	Model    string
	Disable  bool
}

type Router struct {
	// Immutable.
	TaskMCPScoper taskmgr.TaskMCPScoper // Scopes the normal MCP registry for task agents.
	// contains filtered or unexported fields
}

type RuntimeConfig struct {
	TailscaleAPIKey    string               // required for Tailscale networking inside runtime instances
	ImagePruneSchedule *autoupdate.Schedule // nil disables unused md image pruning
	RepoRepackSchedule *autoupdate.Schedule // nil disables nightly large-repository repacking
	System             runtime.System       // optional runtime override for smoke/e2e tests
	Metadata           runtime.Metadata     // optional runtime metadata added to every created instance
	// SkipWarmup skips base-image warmup at startup. Used by e2e fake mode to
	// avoid pulling Docker images that aren't needed for testing.
	SkipWarmup bool
}

type VoiceConfig struct {
	Gateway VoiceGatewayConfig
}

type VoiceGatewayConfig struct {
	Mode       VoiceGatewayMode
	URL        string
	Issuer     string
	InstanceID string
	TokenMode  VoiceTokenMode
	SigningKey ed25519.PrivateKey
	Config     voicegateway.Config
}

type VoiceGatewayMode string

type VoiceTokenMode string

type WarningStore struct {
	// contains filtered or unexported fields
}

type WebhookHandlers struct {
	// contains filtered or unexported fields
}