harness

type APIServer struct {
	Name   string            `yaml:"name"`
	Script string            `yaml:"script"`
	Port   int               `yaml:"port"`
	Env    map[string]string `yaml:"env,omitempty"`
}

type AgentInfo struct {
	Role     string // from the harness role: field
	Slug     string // from the harness slug: field
	Filename string // e.g. "triage.yaml"
	Path     string // absolute path to the harness file
}

type ComposeOpts struct {
	// WorkspaceRoot is the root directory for cache paths (typically the repo root).
	WorkspaceRoot string

	// FetchPolicy controls SSRF protection, offline mode, and size limits.
	FetchPolicy fetch.FetchPolicy

	// TraceID is a correlation ID for audit log entries.
	TraceID string

	// AuditLogPath is the path to the fetch audit log (JSONL).
	// If empty, audit logging is skipped.
	AuditLogPath string

	// ForgePlatform is the platform to resolve after base merging (e.g., "github").
	// If empty, ResolveForge is a no-op.
	ForgePlatform string

	// OrgAllowlist is the allowed_remote_resources from config.yaml (org-level
	// or per-repo-level). Base URLs and agent source URLs must match a prefix
	// in this list. Callers should merge org and per-repo allowlists when both
	// are available.
	OrgAllowlist []string

	// TreeFetcher fetches all files under a path in a remote repository.
	// When nil, defaults to gitfetch.FetchTree (git sparse checkout).
	TreeFetcher gitfetch.TreeFetchFunc

	// GitToken is an optional token for authenticating git fetches.
	// Empty means unauthenticated (sufficient for public repos).
	GitToken string

	// SourceURL is the URL from which the harness was fetched (e.g., via
	// FetchAgentHarness for config-registered agents). When set and the harness
	// has no base: field, LoadWithBase resolves relative resource paths (agent,
	// policy, skills, scripts) against this URL using the same infrastructure
	// as base composition (ADR-0045). If empty, no URL resolution is performed
	// for no-base harnesses.
	SourceURL string
	// contains filtered or unexported fields
}

type Dependency struct {
	Field     string
	URL       string
	LocalPath string
	SHA256    string
	FetchedAt time.Time
	CacheHit  bool
	Type      string // "file" for base harnesses
	Warning   string // non-fatal warning about this dependency (e.g., partial skill fetch)
}

type Diagnostic struct {
	Severity DiagnosticSeverity
	Field    string
	Message  string
}

type DiagnosticSeverity int

type DiffResult struct {
	// Child is the minimal harness containing only fields that differ from
	// the base. Nil if base and child are identical and no customized files
	// require field overrides.
	Child *Harness

	// Warnings lists non-fatal issues (e.g., slice items removed from base
	// that cannot be expressed with base: composition).
	Warnings []string
}

type EnvConfig struct {
	Runner  map[string]string `yaml:"runner,omitempty"`
	Sandbox map[string]string `yaml:"sandbox,omitempty"`
}

type EscalationConfig struct {
	OnCritical  string `yaml:"on_critical,omitempty"`  // "halt" or "review". Default: "halt"
	ReviewLabel string `yaml:"review_label,omitempty"` // Default: "requires-manual-review"
}

type ForgeConfig struct {
	PreScript      string            `yaml:"pre_script,omitempty"`
	PostScript     string            `yaml:"post_script,omitempty"`
	Skills         []string          `yaml:"skills,omitempty"`
	ValidationLoop *ValidationLoop   `yaml:"validation_loop,omitempty"`
	RunnerEnv      map[string]string `yaml:"runner_env,omitempty"`
	Env            *EnvConfig        `yaml:"env,omitempty"`
}

type Harness struct {
	Agent                  string                  `yaml:"agent"`
	Doc                    string                  `yaml:"doc,omitempty"` // source-repo-only; not resolved at runtime, used by lint-agent-docs
	Description            string                  `yaml:"description,omitempty"`
	Role                   string                  `yaml:"role,omitempty"`
	Slug                   string                  `yaml:"slug,omitempty"`
	Base                   string                  `yaml:"base,omitempty"`
	Image                  string                  `yaml:"image,omitempty"`
	Policy                 string                  `yaml:"policy,omitempty"`
	Skills                 []string                `yaml:"skills,omitempty"`
	Plugins                []string                `yaml:"plugins,omitempty"`
	Providers              []string                `yaml:"providers,omitempty"`
	OpenShell              *OpenShellConfig        `yaml:"openshell,omitempty"`
	HostFiles              []HostFile              `yaml:"host_files,omitempty"`
	APIServers             []APIServer             `yaml:"api_servers,omitempty"`
	Model                  string                  `yaml:"model,omitempty"`
	PreScript              string                  `yaml:"pre_script,omitempty"`
	PostScript             string                  `yaml:"post_script,omitempty"`
	AgentInput             string                  `yaml:"agent_input,omitempty"`
	ValidationLoop         *ValidationLoop         `yaml:"validation_loop,omitempty"`
	RunnerEnv              map[string]string       `yaml:"runner_env,omitempty"`
	Env                    *EnvConfig              `yaml:"env,omitempty"`
	TimeoutMinutes         int                     `yaml:"timeout_minutes,omitempty"`
	ReadonlyRepo           bool                    `yaml:"readonly_repo,omitempty"`
	SandboxTimeoutSeconds  int                     `yaml:"sandbox_timeout_seconds,omitempty"`
	Security               *SecurityConfig         `yaml:"security,omitempty"`
	AllowedRemoteResources []string                `yaml:"allowed_remote_resources,omitempty"`
	AllowRuntimeFetch      bool                    `yaml:"allow_runtime_fetch,omitempty"` // opt-in to runtime skill fetching (default: false)
	MaxRuntimeFetches      *int                    `yaml:"max_runtime_fetches,omitempty"` // per-run fetch cap; nil = default (10), valid range 1-1000
	Forge                  map[string]*ForgeConfig `yaml:"forge,omitempty"`
	Trigger                string                  `yaml:"trigger,omitempty"` // optional CEL boolean over normevent (ADR 0061)
}

type HostFile struct {
	Src      string `yaml:"src"`                // host path (may use ${VAR} expansion)
	Dest     string `yaml:"dest"`               // destination path inside the sandbox
	Expand   bool   `yaml:"expand,omitempty"`   // expand ${VAR} in file content before copying
	Optional bool   `yaml:"optional,omitempty"` // skip if src path is missing or expands to empty
}

type HostScanners struct {
	UnicodeNormalizer *bool           `yaml:"unicode_normalizer,omitempty"` // default: true
	ContextInjection  *bool           `yaml:"context_injection,omitempty"`  // default: true
	SSRFValidator     *bool           `yaml:"ssrf_validator,omitempty"`     // default: true
	SecretRedactor    *bool           `yaml:"secret_redactor,omitempty"`    // default: true
	LLMGuard          *LLMGuardConfig `yaml:"llm_guard,omitempty"`
}

type LLMGuardConfig struct {
	Enabled   *bool   `yaml:"enabled,omitempty"`    // default: true
	Threshold float64 `yaml:"threshold,omitempty"`  // default: 0.92
	MatchType string  `yaml:"match_type,omitempty"` // "sentence" or "full". Default: "sentence"
}

type LoadOpts struct {
	ForgePlatform string
}

type OpenShellConfig struct {
	Profiles []string `yaml:"profiles,omitempty"`
}

type ProviderDef struct {
	Name        string            `yaml:"name"`
	Type        string            `yaml:"type"`
	Credentials map[string]string `yaml:"credentials"`      // KEY: VALUE or KEY: ${HOST_VAR}
	Config      map[string]string `yaml:"config,omitempty"` // e.g. OPENAI_BASE_URL
}

type RegisteredAgent struct {
	Entry  config.AgentEntry
	Name   string
	Source string
}

type ResolvedPath struct {
	Path string
	Dep  Dependency
}

type SandboxHooks struct {
	Tirith                  *TirithConfig        `yaml:"tirith,omitempty"`
	SSRFPreTool             *bool                `yaml:"ssrf_pretool,omitempty"`              // default: true
	SecretRedactPostTool    *bool                `yaml:"secret_redact_posttool,omitempty"`    // default: true
	UnicodePostTool         *bool                `yaml:"unicode_posttool,omitempty"`          // default: true
	ContextSuppressPostTool *bool                `yaml:"context_suppress_posttool,omitempty"` // default: true
	CanaryPreTool           *bool                `yaml:"canary_pretool,omitempty"`            // default: true
	CanaryPostTool          *bool                `yaml:"canary_posttool,omitempty"`           // default: true
	ToolAllowlistPreTool    *ToolAllowlistConfig `yaml:"tool_allowlist_pretool,omitempty"`
}

type SecurityConfig struct {
	Enabled      *bool             `yaml:"enabled,omitempty"`   // nil = true (secure by default)
	FailMode     string            `yaml:"fail_mode,omitempty"` // "closed" or "open". Default: "closed"
	HostScanners *HostScanners     `yaml:"host_scanners,omitempty"`
	SandboxHooks *SandboxHooks     `yaml:"sandbox_hooks,omitempty"`
	Escalation   *EscalationConfig `yaml:"escalation,omitempty"`
	Trace        *TraceConfig      `yaml:"trace,omitempty"`
}

type TirithConfig struct {
	Enabled *bool  `yaml:"enabled,omitempty"` // default: true
	FailOn  string `yaml:"fail_on,omitempty"` // "critical", "high", "medium". Default: "high"
}

type ToolAllowlistConfig struct {
	Enabled *bool `yaml:"enabled,omitempty"` // default: false (opt-in)
}

type TraceConfig struct {
	Enabled *bool `yaml:"enabled,omitempty"` // default: true
}

type ValidationLoop struct {
	Script        string `yaml:"script"`
	Schema        string `yaml:"schema,omitempty"`
	MaxIterations int    `yaml:"max_iterations"`
	FeedbackMode  string `yaml:"feedback_mode,omitempty"`
}