composition

type App struct {
	Hub    *hub.Hub
	Server *server.Server
	// contains filtered or unexported fields
}

type Config struct {
	WorkDir   string
	ConfigDir string
	CLIPath   string
	VapidSub  string
	// ToolsDir is the tools engine's install tree root (bin/, opt/,
	// npm/, python/) on the persistent volume.
	ToolsDir string
	// ToolCatalogPath is the compiled tool catalog baked into the
	// image (missing = degraded catalog search). With the runtime
	// refresh below it is only the first-boot/offline fallback.
	ToolCatalogPath string
	// ToolCatalogURL is the published catalog the engine refreshes
	// from at boot and on the ToolCatalogRefresh schedule.
	ToolCatalogURL string
	// ToolCatalogOverlays are display-patch overlay files the engine
	// re-applies to every loaded catalog (the vibekit UI copy for
	// Sources/MCP tool rows). Missing files are dropped at wiring time
	// (bare `go run` outside the image).
	ToolCatalogOverlays []string
	// ToolCatalogRequire lists the tool names a fetched catalog must
	// resolve before it replaces the current one — the embedded
	// required-tools.txt, injected by main.
	ToolCatalogRequire []string
	// TrustedProxies is the set of reverse-proxy networks whose
	// X-Forwarded-For header webhttp.ClientIP is allowed to trust when
	// resolving the real client IP (access log + login/logout audit
	// logs). Parsed once from TRUSTED_PROXIES at startup. Empty/unset =
	// trust nothing = log the unspoofable socket peer (the spoof-safe
	// default for a directly-exposed deployment).
	TrustedProxies []*net.IPNet
	// HostPolicy is the exact-match Host allowlist parsed once from
	// ALLOWED_HOSTS at startup (webhttp.HostPolicy) — the anti-DNS-rebinding
	// gate the security middleware applies before the CSRF check. Unset or
	// blank = an inactive policy = any Host accepted (backward compatible;
	// the server warns at listen time).
	HostPolicy *webhttp.HostPolicy
	// BrowseRoots is the file browser's allow-list: the granted
	// directories the /api/file* surface can see. Always WorkDir +
	// ConfigDir, plus any extra grants from VIBEKIT_BROWSE_ROOTS
	// (colon-separated absolute paths, e.g. "/tmp:/data"). Everything
	// outside the grants is denied by default.
	BrowseRoots []string
	// ToolCatalogRefresh is the engine refresh cadence under toolbelt's
	// canonical policy (default 24h; zero = schedule disabled, keeping
	// the manual UI/API refresh).
	ToolCatalogRefresh time.Duration
	AuthConfig         auth.Config
}