config

type AIConfig struct {
	// Providers is the provider registry available to the runtime and UI.
	//
	// Notes:
	// - Providers own their allowed model list (provider + model are always configured together).
	Providers []AIProvider `json:"providers,omitempty"`

	// CurrentModelID points to the model used by default for new chats.
	//
	// Format: <provider_id>/<model_name>
	CurrentModelID string `json:"current_model_id"`

	// PermissionType controls the Flower tool surface and approval behavior.
	//
	// Supported values:
	// - "readonly": safe readonly tools only
	// - "approval_required": standard tools with shell/mutation approval
	// - "full_access": standard tools without per-tool approval
	PermissionType string `json:"permission_type,omitempty"`

	// ToolRecoveryEnabled controls runtime-level recovery orchestration.
	//
	// When enabled, the Go runtime can continue attempts after recoverable tool failures
	// instead of ending the turn immediately.
	ToolRecoveryEnabled *bool `json:"tool_recovery_enabled,omitempty"`

	// ToolRecoveryAllowPathRewrite controls deterministic path normalization/rewrite strategies.
	ToolRecoveryAllowPathRewrite *bool `json:"tool_recovery_allow_path_rewrite,omitempty"`

	// ToolRecoveryAllowProbeTools is reserved for strategy diversification retries in runtime recovery.
	ToolRecoveryAllowProbeTools *bool `json:"tool_recovery_allow_probe_tools,omitempty"`

	// ToolRecoveryFailOnRepeatedSignature controls fail-fast behavior when the same failure signature
	// repeats across recovery attempts.
	ToolRecoveryFailOnRepeatedSignature *bool `json:"tool_recovery_fail_on_repeated_signature,omitempty"`
}

type AIProvider struct {
	// ID is a stable internal id (primary key). It must not change once used for secrets/model routing.
	ID string `json:"id"`

	// Name is a human-friendly display name (safe to rename at any time).
	Name string `json:"name,omitempty"`

	// Type is one of:
	// - "openai"
	// - "anthropic"
	// - "moonshot"
	// - "chatglm"
	// - "deepseek"
	// - "qwen"
	// - "openrouter"
	// - "xai"
	// - "groq"
	// - "ollama"
	// - "openai_compatible"
	Type string `json:"type"`

	// BaseURL overrides the provider endpoint (example: "https://api.openai.com/v1").
	// When empty, provider defaults apply.
	//
	// Required provider types:
	// - moonshot
	// - chatglm
	// - deepseek
	// - qwen
	// - openrouter
	// - xai
	// - groq
	// - ollama
	// - openai_compatible
	BaseURL string `json:"base_url,omitempty"`

	// StrictToolSchema overrides provider tool schema strictness.
	//
	// When unset, runtime falls back to built-in policy:
	// - openai official endpoints: strict
	// - openai custom endpoints: non-strict
	// - openai_compatible: non-strict
	// - moonshot/chatglm/deepseek/qwen: non-strict
	StrictToolSchema *bool `json:"strict_tool_schema,omitempty"`

	// WebSearch configures optional web search behavior for generic OpenAI-compatible providers.
	//
	// Native providers (OpenAI, Moonshot, ChatGLM/GLM, DeepSeek, and Qwen) derive their web-search
	// behavior from the provider type and explicit model allow-list, so this field is ignored for them.
	WebSearch *AIProviderWebSearch `json:"web_search,omitempty"`

	// Models is the allowed model list for this provider (shown in the Chat UI).
	Models []AIProviderModel `json:"models,omitempty"`
}

type AIProviderModel struct {
	ModelName                     string                `json:"model_name"`
	WireModelName                 string                `json:"wire_model_name,omitempty"`
	ContextWindow                 int                   `json:"context_window,omitempty"`
	MaxOutputTokens               int                   `json:"max_output_tokens,omitempty"`
	EffectiveContextWindowPercent int                   `json:"effective_context_window_percent,omitempty"`
	InputModalities               []string              `json:"input_modalities,omitempty"`
	ReasoningCapability           AIReasoningCapability `json:"reasoning_capability,omitempty"`
	DefaultReasoningSelection     AIReasoningSelection  `json:"default_reasoning_selection,omitempty"`
}

type AIProviderWebSearch struct {
	// Mode is only honored for openai_compatible providers.
	//
	// Supported values:
	// - "disabled": do not expose any web-search capability
	// - "openai_builtin": attach OpenAI Responses-style hosted web search
	// - "brave": expose Flower's external Brave-backed web.search tool
	Mode string `json:"mode,omitempty"`
}

type AIReasoningCapability struct {
	Kind                      string   `json:"kind"`
	SupportedLevels           []string `json:"supported_levels,omitempty"`
	DefaultLevel              string   `json:"default_level,omitempty"`
	DisableSupported          bool     `json:"disable_supported,omitempty"`
	DefaultEnabled            *bool    `json:"default_enabled,omitempty"`
	WireShape                 string   `json:"wire_shape"`
	DisableShape              string   `json:"disable_shape,omitempty"`
	BudgetShape               string   `json:"budget_shape,omitempty"`
	MinBudgetTokens           int      `json:"min_budget_tokens,omitempty"`
	MaxBudgetTokens           int      `json:"max_budget_tokens,omitempty"`
	DynamicProviderMetadata   bool     `json:"dynamic_provider_metadata,omitempty"`
	ResponseReasoningFields   []string `json:"response_reasoning_fields,omitempty"`
	HistoryReplayRequirements []string `json:"history_replay_requirements,omitempty"`
	SourceURLs                []string `json:"source_urls"`
	SourceCheckedAt           string   `json:"source_checked_at"`
	Fixture                   string   `json:"fixture"`
}

type AIReasoningLevel = flconfig.ReasoningLevel

type AIReasoningSelection = flconfig.ReasoningSelection

type BootstrapArgs struct {
	ProviderOrigin         string
	ControlplaneBaseURL    string
	ControlplaneProviderID string
	EnvironmentID          string
	BootstrapTicket        string
	RuntimeVersion         string

	StateRoot string

	AgentHomeDir string
	Shell        string
	LogFormat    string
	LogLevel     string
	// HTTPClient optionally supplies custom TLS trust roots while HTTPS and redirect policy remain enforced.
	HTTPClient *http.Client

	// PermissionPolicyPreset is an optional preset used to write permission_policy into the config.
	// If empty, bootstrap preserves the existing permission_policy when possible, otherwise uses defaults.
	PermissionPolicyPreset string
}

type Config struct {
	ProviderOrigin           string                      `json:"provider_origin"`
	ControlplaneBaseURL      string                      `json:"controlplane_base_url"`
	ControlplaneProviderID   string                      `json:"controlplane_provider_id,omitempty"`
	EnvironmentID            string                      `json:"environment_id"`
	LocalEnvironmentPublicID string                      `json:"local_environment_public_id"`
	BindingGeneration        int64                       `json:"binding_generation,omitempty"`
	AgentInstanceID          string                      `json:"agent_instance_id"`
	Direct                   *directv1.DirectConnectInfo `json:"direct"`

	// AI config controls optional Flower AI assistant features.
	AI *AIConfig `json:"ai,omitempty"`

	// PermissionPolicy is the local permission cap applied on the endpoint.
	// It is designed to limit the effective permissions even if the control-plane grants more.
	PermissionPolicy *PermissionPolicy `json:"permission_policy,omitempty"`

	// AgentHomeDir is the default home/working directory and the target of "~".
	// If empty, the runtime picks a safe default (the current user home dir).
	// Filesystem access boundaries are defined by FilesystemScope.
	AgentHomeDir string `json:"agent_home_dir,omitempty"`

	// FilesystemScope defines the endpoint-local filesystem roots exposed to
	// runtime capabilities. When omitted, the runtime derives a Home root from
	// AgentHomeDir and a read-only Computer root at the OS filesystem root.
	FilesystemScope *FilesystemScope `json:"filesystem_scope,omitempty"`

	// Shell is the shell command used for terminal sessions.
	// If empty, the runtime picks a default (SHELL or /bin/bash).
	Shell string `json:"shell,omitempty"`

	// LogFormat is "json" or "text".
	LogFormat string `json:"log_format,omitempty"`
	// LogLevel is "debug|info|warn|error".
	LogLevel string `json:"log_level,omitempty"`

	// CodeServerPortMin/Max configures the dynamic port range used for code-server processes.
	// If unset/invalid, the runtime uses a safe default range.
	CodeServerPortMin int `json:"code_server_port_min,omitempty"`
	CodeServerPortMax int `json:"code_server_port_max,omitempty"`
	// contains filtered or unexported fields
}

type FilesystemPermissionSet struct {
	Read  bool `json:"read"`
	Write bool `json:"write"`
}

type FilesystemRootKind string

type FilesystemRootPolicy struct {
	ID          string                  `json:"id"`
	Label       string                  `json:"label"`
	Path        string                  `json:"path"`
	Kind        FilesystemRootKind      `json:"kind"`
	Permissions FilesystemPermissionSet `json:"permissions"`
	Hidden      bool                    `json:"hidden,omitempty"`
	System      bool                    `json:"system,omitempty"`
}

type FilesystemScope struct {
	SchemaVersion int                    `json:"schema_version"`
	DefaultRootID string                 `json:"default_root_id,omitempty"`
	Roots         []FilesystemRootPolicy `json:"roots"`
}

type LocalEnvironmentBinding struct {
	LocalEnvironmentPublicID string `json:"local_environment_public_id"`
	UserPublicID             string `json:"user_public_id,omitempty"`
	EnvPublicID              string `json:"env_public_id"`
	Generation               int64  `json:"generation"`
	Hostname                 string `json:"hostname,omitempty"`
	OS                       string `json:"os,omitempty"`
	Arch                     string `json:"arch,omitempty"`
	RuntimeVersion           string `json:"runtime_version,omitempty"`
	LastSeenAtUnixMS         int64  `json:"last_seen_at_unix_ms,omitempty"`
}

type PermissionPolicy struct {
	SchemaVersion int `json:"schema_version"`

	// LocalMax is the global cap. It must be present for schema_version=1.
	LocalMax *PermissionSet `json:"local_max"`

	// ByUser and ByApp are optional additional caps. They can only further reduce LocalMax.
	ByUser map[string]*PermissionSet `json:"by_user,omitempty"`
	ByApp  map[string]*PermissionSet `json:"by_app,omitempty"`
}

type PermissionSet struct {
	Read    bool `json:"read"`
	Write   bool `json:"write"`
	Execute bool `json:"execute"`
}

type ProviderLinkBootstrapArgs struct {
	ConfigPath string

	ProviderOrigin         string
	ControlplaneBaseURL    string
	ControlplaneProviderID string
	EnvironmentID          string
	BootstrapTicket        string
	RuntimeVersion         string
	PermissionPolicyPreset string
	AgentHomeDir           string
	Shell                  string
	LogFormat              string
	LogLevel               string
	// HTTPClient optionally supplies custom TLS trust roots while HTTPS and redirect policy remain enforced.
	HTTPClient *http.Client

	RuntimeHostname string
	RuntimeGOOS     string
	RuntimeGOARCH   string

	PreservePermissionPolicy bool
}

type StateLayout struct {
	StateRoot                string
	ConfigPath               string
	SecretsPath              string
	LockPath                 string
	StateDir                 string
	RuntimeControlSocketPath string
	RuntimeMaintenancePath   string
	DiagnosticsDir           string
	AuditDir                 string
	AppsDir                  string
}