internal/

Package agent implements dotvault's SSH agent surface: a read-only agent.ExtendedAgent backend served over a Unix domain socket (Linux/macOS) or a named pipe (Windows).

Package clipboard puts text on the system clipboard — macOS pasteboard, Windows clipboard, X11/Wayland selection.

Package httpproxy resolves the proxy that outbound HTTP requests should travel through, and constructs *http.Client instances that route through that resolver.

Package loginsuppress implements the marker-file suppression that coordinates `dotvault login-check` invocations across rapidly-launched shells.

Package notify delivers platform-native desktop notifications — Windows toast popups, macOS Notification Center panels, Linux D-Bus notifications — behind a small level vocabulary (info / warning / error / attention).

Package observability wires OpenTelemetry metric instruments and the OTLP exporter for the dotvault daemon.

Package passwd answers one narrow question for `dotvault login-check --no-passwd`: does the current OS user have an entry in the local passwd file? In corporate fleets where human accounts come from a directory service (SSSD, LDAP, AD), an account listed in /etc/passwd is a local machine account — not a human with Vault credentials — so login-check can exit before any token checks or prompts.

Package regfile renders a dotvault configuration as a Windows Registry (.reg) file targeting HKLM\SOFTWARE\Policies\goodtune\dotvault.

Package remoteconfig fetches the partial configuration document served by a dotvault-config service and caches the last-known-good copy beside the sync state, so the overlay degrades to "frozen at last-known-good" rather than "absent" when the service is unreachable.

Package sdnotify implements the small subset of the systemd sd_notify(3) protocol the daemon needs (READY=1, STOPPING=1, WATCHDOG=1) without pulling in a dependency on go-systemd.

Package securestore provides a platform-agnostic seam for holding the private key behind a TLS client certificate.

Package tokenwatch watches the Vault token file for replacement and invokes a callback when it is created or updated, so a running daemon picks up a token freshly written by `dotvault login` (or any other external writer) without waiting for the lifecycle manager's periodic re-read.

Package tray provides an optional Windows system-tray icon for the daemon.

Package uds creates per-user Unix domain socket listeners with dotvault's owner-only permission invariant.

Package urlallow is the single source of truth for the URL allowlist dotvault applies before handing a URL to an OS opener or a notification backend: an absolute http or https URL with a real host and no embedded credentials.