openshell

type Config struct {
	// Address is the gateway gRPC address, e.g. "openshell.openshell.svc:8080".
	Address string
	// Workspace is the gateway workspace sandboxes are created in.
	Workspace string
	// SandboxNamespace is the namespace the gateway creates sandbox pods in. The
	// router NetworkPolicy admits the run's supervisor pod from this namespace.
	SandboxNamespace string
	// CertFile, KeyFile and CAFile configure mTLS to the gateway.
	CertFile string
	KeyFile  string
	CAFile   string
	// TokenFile optionally holds a bearer token (OIDC gateways).
	TokenFile string
	// Insecure disables TLS verification. Development only.
	Insecure bool
}

type CredentialKey struct {
	// EnvVar is the workload env var holding the placeholder.
	EnvVar string
	// Header is the HTTP header the value goes in, and Prefix what precedes it.
	Header string
	Prefix string
	// SecretName and SecretKey locate the value in the tool's namespace.
	SecretName string
	SecretKey  string
}

type Gateway interface {
	// Create creates a sandbox. It returns the existing sandbox when one with the
	// same name already exists, so a reconcile retry is idempotent.
	Create(ctx context.Context, name string, spec *osv1.SandboxSpec, labels map[string]string) (*osv1.Sandbox, error)
	// Get returns the sandbox, or an error satisfying osv1.IsNotFound.
	Get(ctx context.Context, name string) (*osv1.Sandbox, error)
	// Delete deletes the sandbox. A missing sandbox is not an error.
	Delete(ctx context.Context, name string) error
	// MainProcessLogs returns the tail of the workload's main-process output.
	MainProcessLogs(ctx context.Context, sb *osv1.Sandbox) (string, error)
	// SandboxNamespace is the Kubernetes namespace the gateway creates sandbox pods in.
	SandboxNamespace() string
	// EnsureProfile creates the provider profile, or updates it when its
	// declared credentials changed.
	EnsureProfile(ctx context.Context, profile *osv1.ProviderProfile) error
	// EnsureProvider creates the provider, or updates its credentials.
	EnsureProvider(ctx context.Context, provider *osv1.Provider) error
	// DeleteProviders deletes every provider carrying all of labels.
	DeleteProviders(ctx context.Context, labels map[string]string) error
}

type Outcome int

type PodLogFunc func(ctx context.Context, namespace, pod, container string) (string, error)

type SDKGateway struct {
	// contains filtered or unexported fields
}

type SpecInput struct {
	Agent *agentorcav1alpha1.Agent
	// RouterHost is the router Service hostname the workload's base URL names.
	RouterHost string
	// Env is the agent process environment, including the router base URL and
	// the per-run router credential.
	Env map[string]string
	// Tools are the tool endpoints the agent may reach directly, already
	// filtered by spec.runtime.sandbox.tools and bound to credential providers.
	Tools []ToolEndpoint
	// Providers are the provider instances to attach to the sandbox.
	Providers []string
}

type ToolCredential struct {
	// Source owns the credential: the MCPServer the tool was generated from, or
	// the tool itself. Tools from one MCPServer share one credential.
	Source string
	// Tool is the first tool (in spec.tools order) that declared the credential.
	Tool string
	// URL is the MCP server URL, and Host/Port its endpoint the credential binds to.
	URL  string
	Host string
	Port uint32
	Keys []CredentialKey
}

type ToolEndpoint struct {
	Tool string
	Host string
	Port uint32
	// CredentialProvider, when set, binds the named provider's static
	// credentials to this endpoint (see BindCredentials).
	CredentialProvider string
}