internal/

Package extplugin spawns and proxies clawpatrol's Terraform-style external plugins.

Package wire holds the small set of protocol constants shared between the gateway-side plugin manager (extplugin) and the plugin SDK (pluginsdk): the go-plugin handshake, the dispensed plugin name, the host-services broker stream id, and the per-call session metadata key.

Package facet is the registry for protocol-family plugins.

Package hostmatch parses and matches the host entries that appear in an endpoint's `hosts = [...]` list.

Package match holds the runtime types the request handler walks when dispatching against the compiled policy: the Matcher interface every rule's compiled predicate satisfies and the family-tagged Request snapshot the matcher reads.

Package all blank-imports every built-in plugin so a single import from main / tests pulls the entire registry into the binary.

Package approvers registers every built-in approver kind.

Package credentials implements clawpatrol credentials support.

Package endpoints registers every built-in endpoint plugin.

Package https is the HTTPS protocol-family facet.

Package k8s is the Kubernetes protocol-family facet.

Package sql is the SQL protocol-family facet.

Package ssh is the SSH protocol-family facet.

Package rules registers the single `rule` block kind.

Package sshproto holds the protocol-specific contract that bridges the SSH endpoint plugin and the SSH credential plugin.

Package tailscaleproto holds the protocol-specific contract that bridges the tailscale credential and the tailscale tunnel (plus the dashboard Connect modal).

Package tunnels hosts the built-in tunnel plugins.

Package runtime hosts the request-time dispatcher and the plugin runtime interfaces.

Package sandboxtest holds test helpers for code that spawns sandboxed plugin subprocesses.

Command docgen generates site/doc/config-reference.md from the clawpatrol HCL config plugin registry.