Documentation
¶
Overview ¶
Package setup provides host-environment detection for the first-run setup surface: resident coding-agent CLIs, and the OS/WSL posture the environment-step copy keys off. Leaf package (stdlib only).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func HostProxySeeded ¶ added in v0.4.1
func HostProxySeeded() bool
HostProxySeeded reports whether a host-side detection was seeded in, so the setup check can tell "ran blind in a container" apart from "ran on the host's behalf and genuinely found nothing".
func VaultKVMDetail ¶ added in v0.3.1
func VaultKVMDetail() string
VaultKVMDetail is the operator-facing Vault (Kata) availability explanation — a containerized host missing /dev/kvm gets "mount the device", not "no hardware".
Types ¶
type CLIProvider ¶
CLIProvider is a coding-agent CLI on the wardynd host's PATH. Whether it is signed in is not read: a host login credentials no run (0.8.2 retired the host ~/.claude lane; a run's model access is its model provider's).
func DetectCLIProviders ¶
func DetectCLIProviders() []CLIProvider
DetectCLIProviders reports the coding-agent CLIs (claude, codex) on PATH.
type HostProxyDetection ¶
type HostProxyDetection struct {
HTTPProxy *HostProxySetting `json:"http_proxy,omitempty"`
HTTPSProxy *HostProxySetting `json:"https_proxy,omitempty"`
AllProxy *HostProxySetting `json:"all_proxy,omitempty"`
NoProxy *HostProxySetting `json:"no_proxy,omitempty"`
// EnvCaseMismatch lists "UPPER/lower" pairs whose values disagree (httpoxy
// hygiene warning) — the lowercase value is still what wins the merge.
EnvCaseMismatch []string `json:"env_case_mismatch,omitempty"`
GitProxy *HostProxyGitConfig `json:"git_proxy,omitempty"`
ToolConfigs []HostProxyToolConfig `json:"tool_configs,omitempty"`
PAC *HostProxyPAC `json:"pac,omitempty"`
// HasCredentials is true when ANY of the above carried a masked
// credential — a single convenience flag the UI can check without
// walking every sub-field.
HasCredentials bool `json:"has_credentials"`
}
HostProxyDetection is the aggregate, masked-safe host-proxy detection result. Every field is best-effort: absence of a mechanism (no env var, no git config, powershell.exe unavailable, ...) is not an error.
func DetectHostProxy ¶
func DetectHostProxy() HostProxyDetection
DetectHostProxy runs every detector in the R4 catalog and merges the generic HTTP_PROXY/HTTPS_PROXY/ALL_PROXY/NO_PROXY signal by precedence (env > shell profile > OS). It never fails: every detector tolerates the absence of its mechanism (missing file, missing binary, non-zero exit).
A host-side seed (hostProxySeedEnv) wins outright: produced by this same code running natively, where every tier this process can't reach is live.
func (HostProxyDetection) LoopbackBound ¶ added in v0.4.2
func (d HostProxyDetection) LoopbackBound() []string
LoopbackBound returns the labels of any detected generic proxy setting bound to loopback (127.0.0.0/8, localhost, ::1). Such a proxy is reachable from host processes but nothing else: a sandbox's own 127.0.0.1 is its own, and on a VM-backed Docker host the runtime VM can't reach the host's loopback either, so chaining sandbox egress through it can't work — without this check the failure lands late, at the first approved request.
Values arrive already credential-masked, and a masked value keeps its host:port, so this is a pure string test that never parses or dials anything.
type HostProxyGitConfig ¶
type HostProxyGitConfig struct {
HTTPProxy *HostProxySetting `json:"http_proxy,omitempty"`
HTTPSProxy *HostProxySetting `json:"https_proxy,omitempty"`
}
HostProxyGitConfig is `git config --global http.proxy` / `https.proxy` — kept separate from the generic HTTP(S)_PROXY resolution because git honors its own config over the environment.
type HostProxyPAC ¶
type HostProxyPAC struct {
URL string `json:"url"`
Source HostProxySource `json:"source"`
Detail string `json:"detail,omitempty"`
}
HostProxyPAC flags a discovered PAC/WPAD auto-config URL. It is never fetched or executed (it's arbitrary JS) — presence alone is surfaced so the operator can resolve the effective proxy manually.
type HostProxySetting ¶
type HostProxySetting struct {
Value string `json:"value"`
Source HostProxySource `json:"source"`
Detail string `json:"detail,omitempty"`
HasCredentials bool `json:"has_credentials"`
}
HostProxySetting is one detected proxy value, safe to render directly: any embedded credential has already been masked (see maskProxyURL) — the raw value is never retained. HasCredentials flags that a credential WAS present in the raw value, so the UI can prompt to store it as a secret.
type HostProxySource ¶
type HostProxySource string
HostProxySource is where a detected proxy setting came from.
const ( ProxySourceEnv HostProxySource = "env" ProxySourceShell HostProxySource = "shell_profile" ProxySourceGit HostProxySource = "git_config" ProxySourceTool HostProxySource = "tool_config" ProxySourceOS HostProxySource = "os" )
type HostProxyToolConfig ¶
type HostProxyToolConfig struct {
Tool string `json:"tool"`
Path string `json:"path"`
Setting HostProxySetting `json:"setting"`
}
HostProxyToolConfig is one per-tool proxy directive found in a config file that does NOT honor HTTP_PROXY/HTTPS_PROXY env vars (npm/pip/cargo honor env already and are skipped; this covers git-adjacent tools that need explicit config: maven, cargo's own config file, apt). Informational only — nothing here is ever written to.
type Platform ¶
Platform is the wardynd host's OS, WSL/KVM/containerized posture. KVM separates "Vault incompatible" from "just needs setup"; Containerized changes what a missing /dev/kvm means (mount the device vs no hardware).
func DetectPlatform ¶
func DetectPlatform() Platform
DetectPlatform reports the host OS, WSL, /dev/kvm, and containerized status.
type SCMPosture ¶ added in v0.2.0
type SCMPosture struct {
// GhCLI: a gh CLI login, i.e. a broad whole-account oauth session (ladder rung 4).
GhCLI bool `json:"gh_cli"`
// CredentialHelper is the git credential.helper name ("" if unset); "store"/"cache" mean plaintext-ish creds on disk.
CredentialHelper string `json:"credential_helper"`
// GitCredentialsFile: ~/.git-credentials exists (plaintext credentials).
GitCredentialsFile bool `json:"git_credentials_file"`
// Netrc: ~/.netrc (or .netrc.gpg) exists — legacy plaintext credentials.
Netrc bool `json:"netrc"`
}
SCMPosture is a presence-only snapshot of the host's git-credential habits, used to recommend a safer credential-ladder rung — never to import anything. Best-effort: a CONTAINERIZED wardynd can't see $HOME.
func DetectSCMPosture ¶ added in v0.2.0
func DetectSCMPosture() SCMPosture
DetectSCMPosture reports the host git-credential posture (presence only).
Source Files