config

type AgentConfig struct {
	// MaxParallelTools bounds how many tool calls from one assistant message
	// may run at once. 1 disables parallel execution; 0 means unset.
	MaxParallelTools int `mapstructure:"max_parallel_tools" json:"max_parallel_tools,omitempty" yaml:"max_parallel_tools,omitempty"`
}

type DiscoveredPlugin struct {
	// Dir is the directory name. It is the state key and the only identity a
	// plugin has when its manifest does not parse.
	Dir  string
	Path string

	Manifest plugin.Manifest
	// Findings are this plugin's own problems, including a name collision with
	// another directory, so Loadable can be answered without looking around.
	Findings []plugin.Finding

	State PluginState
	// StateKnown is false when nothing recorded this directory, which is the
	// normal condition of a manual `git clone`.
	StateKnown bool

	// PolicyRefused says the operator's source restriction is what stopped this
	// plugin, so a surface can tell a decision from a defect. The reason is
	// also in Findings, which is what carries it to every surface without each
	// one having to know about policy.
	PolicyRefused bool
}

type EnvVar struct {
	Name        string
	Default     string
	Description string
	// WorkerNeeds marks a variable that a task-run worker reads.
	//
	// A worker executes model-chosen code, so a credential it does not read is
	// exposure with no purpose behind it. Only the marked variables are handed
	// to a worker process or Job pod. internal/bootstrap/worker.go is the
	// authority on what that set is: if a worker starts reading a new variable,
	// mark it here, and it will reach the worker. Nothing else will.
	WorkerNeeds bool
	// DirectLLMOnly narrows WorkerNeeds to deployments whose task runs call a
	// provider themselves. A managed run reaches models through the server and
	// holds no provider credential, so passing one would hand a model-driven
	// process a key it has no use for.
	DirectLLMOnly bool
}

type LLM struct {
	APIKey  string
	BaseURL string
	Model   string
}

type MCPResolution struct {
	// Config is nil when no layer declared a server.
	Config *coremcp.ConfigRoot
	// Shadowed lists plugin servers a higher layer replaced, so a plugin does
	// not appear fully active when part of it never runs.
	Shadowed []plugin.Shadowed
	Findings []plugin.Finding
}

type ModelEntry struct {
	Model         string `mapstructure:"model"`
	Name          string `mapstructure:"name"`
	APIURL        string `mapstructure:"api_url"`
	APIKey        string `mapstructure:"api_key"`
	ContextWindow int    `mapstructure:"context_window"` // 0 = uses DefaultContextWindow
	CallTimeout   int    `mapstructure:"call_timeout"`   // seconds; 0 = uses DefaultCallTimeoutSecs
	// MaxTokens caps one response; 0 = uses the adapter's own default. The
	// Anthropic Messages protocol requires the field, so its adapter substitutes
	// DefaultMaxTokens; the OpenAI protocols send it only when set.
	MaxTokens int `mapstructure:"max_tokens"`
	// Reasoning is how much the model should reason before answering:
	// ReasoningOff (the default), ReasoningLow, ReasoningMedium, or
	// ReasoningHigh. Any level other than off also replays the reasoning on
	// later turns. It has no effect on a protocol that carries none.
	Reasoning string `mapstructure:"reasoning"`
	// Vision says this model accepts image input. When false, an image a tool
	// returns is described in text rather than sent, because a model that
	// cannot read images rejects the request rather than ignoring the image.
	Vision bool `mapstructure:"vision"`
	// PromptCache asks the provider to cache the stable prefix of a request —
	// the tool definitions and system prompt — so later calls in the same run
	// pay less for them.
	PromptCache bool `mapstructure:"prompt_cache"`
	// Provider is the wire protocol a direct entry speaks: LLMProviderOpenAICompatible
	// (the default), LLMProviderOpenAI, or LLMProviderAnthropic. It is ignored by a
	// "buildmax" entry, where the operator's catalog decides.
	Provider string `mapstructure:"provider"`
	// Transport is "direct" (the default) or "buildmax".
	Transport string `mapstructure:"transport"`
	// ServerURL and TeamID apply to a "buildmax" entry. The credential is not
	// copied here: the remote client reads it from the login state in
	// auth.json, and only when it belongs to this server.
	ServerURL string `mapstructure:"server_url"`
	TeamID    string `mapstructure:"team_id"`
}

type PermissionEntry struct {
	// Key is the match key, lowercased. Viper lowercases every map key it
	// loads, so a rule written as "Write" arrives as "write" and matching has
	// to be case-insensitive or no rule would ever fire against a tool name.
	Key string
	// Display is the key as the user wrote it, for output.
	Display string
	Action  string
	Source  string
}

type PermissionResolution struct {
	Entries []PermissionEntry
	// Invalid lists keys whose action was not recognised. They are ignored
	// rather than fatal: a typo in one rule must not stop the agent starting.
	Invalid []string
}

type PluginDiscovery struct {
	Dir     string
	Plugins []DiscoveredPlugin

	// Findings belong to the directory rather than to any one plugin.
	Findings []plugin.Finding

	// StateErr is set when .state.json existed but could not be read. Every
	// valid plugin still loads; what is lost is provenance and the disabled
	// flag, and a caller must say so rather than report a clean scan.
	StateErr error

	// Policy is the source restriction this scan applied, so a surface can say
	// that a plugin is missing by decision rather than by accident.
	Policy PluginPolicy
}

type PluginHooks struct {
	Config   corehook.Config
	Findings []plugin.Finding
}

type PluginPolicy struct {
	// AllowedSources lists the source types that may load. Empty means every
	// source loads, which is the state of a deployment that asserted nothing.
	AllowedSources []string `mapstructure:"allowed_sources" json:"allowed_sources,omitempty" yaml:"allowed_sources,omitempty"`
}

type PluginSource string

type PluginState struct {
	Source   PluginSource `json:"source,omitempty"`
	Disabled bool         `json:"disabled,omitempty"`

	// Repository provenance, when the installer knew it. A manual clone has
	// none until something inspects the checkout.
	RepositoryURL string `json:"repository_url,omitempty"`
	LastCommit    string `json:"last_commit,omitempty"`

	// Marketplace provenance, which identifies the exact bytes installed.
	MarketplaceServer string `json:"marketplace_server,omitempty"`
	CatalogID         string `json:"catalog_id,omitempty"`
	ReleaseVersion    string `json:"release_version,omitempty"`
	Digest            string `json:"digest,omitempty"`

	InstalledAt int64 `json:"installed_at,omitempty"`
	UpdatedAt   int64 `json:"updated_at,omitempty"`
}

type PluginStates struct {
	Version int                    `json:"version"`
	Plugins map[string]PluginState `json:"plugins"`
}

type PolicyFile struct {
	Sandbox SandboxConfig `mapstructure:"sandbox" json:"sandbox,omitempty" yaml:"sandbox,omitempty"`
	Plugins PluginPolicy  `mapstructure:"plugins" json:"plugins,omitempty" yaml:"plugins,omitempty"`
}

type RedactedDBConfig struct {
	Host string `json:"host,omitempty"`
	Port int    `json:"port,omitempty"`
	User string `json:"user,omitempty"`
	Name string `json:"name,omitempty"`
	// TLS is the effective mode, not the raw setting, so an unset value reads
	// as what the connection actually does.
	TLS      string       `json:"tls"`
	Password SecretStatus `json:"password"`
}

type RedactedLLMConfig struct {
	DefaultAlias  string            `json:"default_alias,omitempty"`
	Aliases       map[string]string `json:"aliases,omitempty"`
	ConversationM RedactedModel     `json:"conversation_model"`
}

type RedactedModel struct {
	Name        string       `json:"name,omitempty"`
	Model       string       `json:"model,omitempty"`
	APIURL      string       `json:"api_url,omitempty"`
	ModelTarget string       `json:"model_target,omitempty"`
	APIKey      SecretStatus `json:"api_key"`
}

type RedactedServerConfig struct {
	LogLevel             string `json:"log_level,omitempty"`
	Port                 int    `json:"port"`
	AllowSignup          bool   `json:"allow_signup"`
	CORSOrigin           string `json:"cors_origin,omitempty"`
	WorkspacesDir        string `json:"workspaces_dir,omitempty"`
	DefaultQuotaTier     string `json:"default_quota_tier,omitempty"`
	AccessTokenTTL       string `json:"access_token_ttl,omitempty"`
	RefreshTokenTTL      string `json:"refresh_token_ttl,omitempty"`
	RefreshRotationGrace string `json:"refresh_rotation_grace,omitempty"`

	JWTSecret SecretStatus `json:"jwt_secret"`

	Database RedactedDBConfig      `json:"database"`
	Storage  RedactedStorageConfig `json:"storage"`
	Worker   RedactedWorkerConfig  `json:"worker"`
	LLM      RedactedLLMConfig     `json:"llm"`

	// Warnings are configuration states worth an operator's attention. They are
	// not errors — the server is running — and they are computed rather than
	// stored, so the list reflects the process's own view of itself.
	Warnings []string `json:"warnings"`
}

type RedactedStorageConfig struct {
	PersistBackend  string `json:"persist_backend,omitempty"`
	ArtifactBackend string `json:"artifact_backend,omitempty"`
	// MaxArtifactMB is shown because an operator diagnosing a refused upload
	// needs to see the limit that refused it. Zero means the built-in default.
	MaxArtifactMB  int          `json:"max_artifact_mb,omitempty"`
	MinIOEndpoint  string       `json:"minio_endpoint,omitempty"`
	MinIOBucket    string       `json:"minio_bucket,omitempty"`
	MinIORegion    string       `json:"minio_region,omitempty"`
	MinIOAccessKey SecretStatus `json:"minio_access_key"`
	MinIOSecretKey SecretStatus `json:"minio_secret_key"`
}

type RedactedWorkerConfig struct {
	RunMode      string       `json:"run_mode,omitempty"`
	ServerURL    string       `json:"server_url,omitempty"`
	RunTokenTTL  string       `json:"run_token_ttl,omitempty"`
	RunTimeout   string       `json:"run_timeout,omitempty"`
	LLMTransport string       `json:"llm_transport,omitempty"`
	LLMAlias     string       `json:"llm_alias,omitempty"`
	K8sNamespace string       `json:"k8s_namespace,omitempty"`
	K8sImage     string       `json:"k8s_image,omitempty"`
	SharedToken  SecretStatus `json:"shared_token"`
}

type SandboxConfig struct {
	// Enabled is the master switch.
	Enabled bool `mapstructure:"enabled" json:"enabled,omitempty" yaml:"enabled,omitempty"`

	// FailIfUnavailable: refuse to start (rather than fall back to
	// unsandboxed) when the OS backend cannot run. Intended for managed
	// deployments that require sandboxing as a hard gate.
	FailIfUnavailable bool `mapstructure:"fail_if_unavailable" json:"fail_if_unavailable,omitempty" yaml:"fail_if_unavailable,omitempty"`

	// AutoAllowBashIfSandboxed: when true and the sandbox wraps the bash
	// call, skip the approval prompt. When false ("regular permissions
	// mode"), sandboxed bash still goes through the regular approval
	// flow.
	AutoAllowBashIfSandboxed *bool `` /* 135-byte string literal not displayed */

	// AllowUnsandboxedCommands: honor the per-call
	// dangerously_disable_sandbox arg. When false ("strict sandbox
	// mode") the arg is ignored.
	AllowUnsandboxedCommands *bool `` /* 129-byte string literal not displayed */

	// ExcludedCommands lists bash patterns that should run outside the
	// sandbox (convenience, not a security boundary).
	ExcludedCommands []string `mapstructure:"excluded_commands" json:"excluded_commands,omitempty" yaml:"excluded_commands,omitempty"`

	Filesystem SandboxFSConfig  `mapstructure:"filesystem" json:"filesystem,omitempty" yaml:"filesystem,omitempty"`
	Network    SandboxNetConfig `mapstructure:"network"    json:"network,omitempty"    yaml:"network,omitempty"`

	// IgnoreViolations: per-tool list of violation kinds to hide from
	// status/trace. Internal counts are still kept.
	IgnoreViolations map[string][]string `mapstructure:"ignore_violations" json:"ignore_violations,omitempty" yaml:"ignore_violations,omitempty"`

	// EnableWeakerNestedSandbox: allow running inside Docker without
	// privileged namespaces by bind-mounting the container's existing
	// /proc instead of mounting a fresh one. Documented as weaker.
	EnableWeakerNestedSandbox bool `` /* 135-byte string literal not displayed */

	// EnableWeakerNetworkIsolation: macOS only; allow access to
	// com.apple.trustd.agent so Go-based CLIs can verify TLS through a
	// MITM proxy. Documented as weaker.
	EnableWeakerNetworkIsolation bool `` /* 144-byte string literal not displayed */
}

type SandboxFSConfig struct {
	AllowWrite []string `mapstructure:"allow_write" json:"allow_write,omitempty" yaml:"allow_write,omitempty"`
	DenyWrite  []string `mapstructure:"deny_write"  json:"deny_write,omitempty"  yaml:"deny_write,omitempty"`
	AllowRead  []string `mapstructure:"allow_read"  json:"allow_read,omitempty"  yaml:"allow_read,omitempty"`
	DenyRead   []string `mapstructure:"deny_read"   json:"deny_read,omitempty"   yaml:"deny_read,omitempty"`

	// AllowManagedReadPathsOnly: policy-only knob. When set in
	// policy.yaml, lower sources' allow_read entries are ignored;
	// deny_read still merges from every source.
	AllowManagedReadPathsOnly bool `` /* 138-byte string literal not displayed */
}

type SandboxNetConfig struct {
	AllowedDomains      []string `mapstructure:"allowed_domains"        json:"allowed_domains,omitempty"        yaml:"allowed_domains,omitempty"`
	DeniedDomains       []string `mapstructure:"denied_domains"         json:"denied_domains,omitempty"         yaml:"denied_domains,omitempty"`
	AllowUnixSockets    []string `mapstructure:"allow_unix_sockets"     json:"allow_unix_sockets,omitempty"     yaml:"allow_unix_sockets,omitempty"`
	AllowAllUnixSockets bool     `mapstructure:"allow_all_unix_sockets" json:"allow_all_unix_sockets,omitempty" yaml:"allow_all_unix_sockets,omitempty"`
	AllowLocalBinding   bool     `mapstructure:"allow_local_binding"    json:"allow_local_binding,omitempty"    yaml:"allow_local_binding,omitempty"`
	HTTPProxyPort       int      `mapstructure:"http_proxy_port"        json:"http_proxy_port,omitempty"        yaml:"http_proxy_port,omitempty"`
	SOCKSProxyPort      int      `mapstructure:"socks_proxy_port"       json:"socks_proxy_port,omitempty"       yaml:"socks_proxy_port,omitempty"`

	// AllowManagedDomainsOnly: policy-only knob. When set in
	// policy.yaml, lower sources' allowed_domains are ignored;
	// denied_domains still merges from every source.
	AllowManagedDomainsOnly bool `` /* 129-byte string literal not displayed */
}

type SandboxResolution struct {
	Config SandboxConfig

	// Sources lists every layer that contributed a non-default value, in
	// resolution order: "default", "settings", "policy", "env".
	Sources []string
}

type SandboxSurface string

type SecretStatus struct {
	Set bool `json:"set"`
}

type ServerAuditConfig struct {
	// RetentionDays expires audit events older than the window. Zero, the
	// default, keeps them forever.
	//
	// Keeping is the default because the trail is evidence, and a deployment
	// that never chose a retention policy has not decided to discard anything.
	// Setting this is a deliberate act with a cost, which is why the sweep
	// records what it removed: a trail that begins partway through then says
	// that policy shortened it, rather than leaving a reader to guess between
	// policy and loss.
	RetentionDays int `mapstructure:"retention_days"`
}

type ServerConfig struct {
	LogLevel  string `mapstructure:"log_level"`
	Port      int    `mapstructure:"port"`
	JWTSecret string `mapstructure:"jwt_secret"`
	// AccessTokenTTL is how long a signed access token stays valid. It is not
	// stored anywhere, so this is also the window in which a leaked one still
	// works — shortening it costs nothing but refresh traffic.
	AccessTokenTTL time.Duration `mapstructure:"access_token_ttl"`
	// RefreshTokenTTL is how long a login can be renewed without a new login
	// code. Every rotation restarts it, so an active session lives on and an
	// abandoned one expires.
	RefreshTokenTTL time.Duration `mapstructure:"refresh_token_ttl"`
	// RefreshRotationGrace is how long a just-rotated refresh token may be
	// exchanged again before the server treats it as reuse and revokes the
	// session. It absorbs concurrent refreshes from processes sharing one
	// credentials file; it is not a security setting to raise casually.
	RefreshRotationGrace time.Duration `mapstructure:"refresh_rotation_grace"`
	// AllowSignup opens POST /api/otp/request to self-registration. It defaults
	// to false, and the zero value is the safe one on purpose: a server that
	// forgets to configure this is closed, not open.
	AllowSignup      bool                `mapstructure:"allow_signup"`
	CORSOrigin       string              `mapstructure:"cors_origin"`
	WorkspacesDir    string              `mapstructure:"workspaces_dir"`
	DefaultQuotaTier string              `mapstructure:"default_quota_tier"`
	Conversation     ServerConvConfig    `mapstructure:"conversation"`
	LLM              ServerLLMConfig     `mapstructure:"llm"`
	Database         ServerDBConfig      `mapstructure:"database"`
	Webhook          ServerWebhookConfig `mapstructure:"webhook"`
	Worker           ServerWorkerConfig  `mapstructure:"worker"`
	Storage          ServerStorageConfig `mapstructure:"storage"`
	Audit            ServerAuditConfig   `mapstructure:"audit"`
}

type ServerConvConfig struct {
	Model ServerModelEntry `mapstructure:"model"`
	// ModelTarget names a catalog model (an llm_model row) to use for Tier 1
	// inference instead of the model above. It is a catalog ID, not a team
	// alias: the server picks its own model rather than being granted one.
	ModelTarget string `mapstructure:"model_target"`
}

type ServerDBConfig struct {
	Host     string `mapstructure:"host"`
	Port     int    `mapstructure:"port"`
	User     string `mapstructure:"user"`
	Password string `mapstructure:"password"`
	Name     string `mapstructure:"name"`
	// TLS is the go-sql-driver tls parameter. Empty means DefaultDBTLSMode.
	//
	// A deployment pointing at a database it already runs — RDS, Aurora, Cloud
	// SQL — is the case this exists for: most managed MySQL either requires TLS
	// or is reached over a network where the credentials should not travel in
	// the clear.
	//
	// Values: "preferred" (TLS when the server offers it, certificate not
	// verified), "true" (require TLS and verify the certificate against the
	// system roots), "skip-verify" (require TLS, accept any certificate), or
	// "false" (never).
	TLS string `mapstructure:"tls"`
}

type ServerK8sConfig struct {
	Namespace string `mapstructure:"namespace"`
	Image     string `mapstructure:"image"`
	// ConfigMap names a ConfigMap holding a server.yaml key. It is mounted into
	// every worker pod so the worker reads the same configuration the server does.
	// Empty means no config file is mounted and the worker relies on inherited
	// environment variables alone, which is rarely enough.
	ConfigMap string `mapstructure:"config_map"`
	// HomeDir is BUILDMAX_HOME inside a worker pod; server.yaml is mounted there.
	HomeDir string `mapstructure:"home_dir"`
	// RunAsUser is the uid a worker pod runs as. Zero uses BuildMax's default.
	// Set it on clusters that assign their own uid ranges, OpenShift most
	// commonly. The worker never needs a uid the image knows about — it writes
	// only into mounted volumes.
	RunAsUser int64 `mapstructure:"run_as_user"`
	// Resources bounds a worker pod. Empty leaves the matching request or limit
	// unset, so an existing deployment keeps running unbounded until an
	// operator chooses values.
	Resources ServerK8sResources `mapstructure:"resources"`
}

type ServerK8sResources struct {
	CPURequest    string `mapstructure:"cpu_request"`
	CPULimit      string `mapstructure:"cpu_limit"`
	MemoryRequest string `mapstructure:"memory_request"`
	MemoryLimit   string `mapstructure:"memory_limit"`
}

type ServerLLMConfig struct {
	// DefaultAlias is the alias used when a managed caller names none.
	DefaultAlias string `mapstructure:"default_alias"`
	// Aliases maps a stable alias such as "fast" to a target id in Targets.
	// Leaving it empty means no team may call the gateway.
	Aliases map[string]string `mapstructure:"aliases"`
}

type ServerMinIOConfig struct {
	Endpoint  string `mapstructure:"endpoint"`
	Region    string `mapstructure:"region"`
	AccessKey string `mapstructure:"access_key"`
	SecretKey string `mapstructure:"secret_key"`
	Bucket    string `mapstructure:"bucket"`
	Prefix    string `mapstructure:"prefix"`
	// PathStyle forces bucket-in-path addressing. Unset derives it from
	// endpoint: set means an S3-compatible store such as MinIO, which needs
	// path style; empty means real AWS S3, which does not. Set it explicitly
	// for a compatible store that uses virtual-host addressing.
	PathStyle *bool `mapstructure:"path_style"`
}

type ServerModelEntry struct {
	Model         string `mapstructure:"model"`
	Name          string `mapstructure:"name"`
	APIURL        string `mapstructure:"api_url"`
	APIKey        string `mapstructure:"api_key"`
	ContextWindow int    `mapstructure:"context_window"`
	CallTimeout   int    `mapstructure:"call_timeout"` // seconds; 0 = uses DefaultCallTimeoutSecs
	MaxTokens     int    `mapstructure:"max_tokens"`   // 0 = the adapter's own default
	// Provider is the wire protocol this model speaks. Empty means
	// LLMProviderOpenAICompatible.
	Provider string `mapstructure:"provider"`
	// Reasoning is the effort level: off (the default), low, medium, or high.
	Reasoning string `mapstructure:"reasoning"`
	// PromptCache caches the stable prefix of a request.
	PromptCache bool `mapstructure:"prompt_cache"`
	// Vision says this model accepts image input.
	Vision bool `mapstructure:"vision"`
}

type ServerStorageConfig struct {
	PersistBackend  string            `mapstructure:"persist_backend"`
	ArtifactBackend string            `mapstructure:"artifact_backend"`
	MinIO           ServerMinIOConfig `mapstructure:"minio"`
	// MaxArtifactMB caps one artifact upload. Zero uses the built-in default.
	//
	// It is a per-file limit and deliberately not a team storage allowance: a
	// stock of bytes held is a different measurement from the rates the quota
	// model records, and it waits for its own decision. What this already
	// settles is that one request cannot cost the deployment unbounded disk.
	MaxArtifactMB int `mapstructure:"max_artifact_mb"`
}

type ServerWebhookConfig struct {
	MessagePath string `mapstructure:"message_path"`
	UserID      string `mapstructure:"user_id"`
}

type ServerWorkerConfig struct {
	Binary    string                `mapstructure:"binary"`
	RunMode   string                `mapstructure:"run_mode"`
	Token     string                `mapstructure:"token"`
	ServerURL string                `mapstructure:"server_url"`
	LLM       ServerWorkerLLMConfig `mapstructure:"llm"`
	K8s       ServerK8sConfig       `mapstructure:"k8s"`
	// RunTokenTTL bounds a run token. Zero uses authtoken's default. It has to
	// outlast the longest run: the token is not renewable, so a run that outlives
	// it can no longer report anything, including its own result.
	RunTokenTTL time.Duration `mapstructure:"run_token_ttl"`
	// RunTimeout is how long a run may stay SCHEDULED or RUNNING before the
	// server records it as abandoned. Zero uses the scheduler's default.
	//
	// Only the worker moves a run out of those states, so without this a run
	// whose worker died stays there forever. Keep it at or below RunTokenTTL: a
	// run that outlived its credential cannot report an outcome, so nothing else
	// will ever close it.
	RunTimeout time.Duration `mapstructure:"run_timeout"`
}

type ServerWorkerLLMConfig struct {
	// Transport is TransportDirect or TransportBuildMax. Empty means direct,
	// which is what every existing deployment gets.
	Transport string `mapstructure:"transport"`
	// Alias is the team model alias a managed run calls. Empty uses the team's
	// default alias.
	Alias string `mapstructure:"alias"`
	// ContextWindow and CallTimeout describe the alias to the run. The protocol
	// does not report them per call, so they come from configuration or stay
	// unset.
	ContextWindow int `mapstructure:"context_window"`
	CallTimeout   int `mapstructure:"call_timeout"`
}

type Settings struct {
	LogLevel  string          `mapstructure:"log_level"`
	ServerURL string          `mapstructure:"server_url"`
	Models    []ModelEntry    `mapstructure:"models"`
	Hooks     corehook.Config `mapstructure:"hooks"`
	Sandbox   SandboxConfig   `mapstructure:"sandbox"`
	Tools     ToolsConfig     `mapstructure:"tools"`
	Agent     AgentConfig     `mapstructure:"agent"`
}

type ToolsConfig struct {
	// Permissions maps a tool key to allow, ask, or deny. A key is a tool name
	// ("Write") or a tool name plus the target it dispatches to
	// ("CallMcpTool:github/create_issue"), optionally with a trailing "*".
	Permissions map[string]string `mapstructure:"permissions" json:"permissions,omitempty" yaml:"permissions,omitempty"`
}

type WorkspaceStorageConfig struct {
	PersistProvider  string
	ArtifactProvider string
	Endpoint         string
	Region           string
	AccessKey        string
	SecretKey        string
	Bucket           string
	Prefix           string
	// PathStyle forces bucket-in-path addressing on or off. Nil derives it
	// from Endpoint, which is the right answer for both of the cases that
	// actually occur — see bootstrap.BuildS3Client.
	PathStyle *bool
}