Help us shape the future of Go! Take the 2026 Go Developer Survey

infrastructure

package
v0.239.0-rc.7 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 31, 2026 License: Apache-2.0 Imports: 40 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	PeerClientKind  = "daemon"
	AttrEnvironment = "environment"
	AttrVersion     = "version"
	AttrStorageID   = "storage_id"
)

The hello and ack fields two daemons exchange: the client kind a peer declares, its environment identity, and what the host answers about itself.

View Source 
const MaxWorkspaceBytes = 256 << 20

MaxWorkspaceBytes caps one checkpoint's workspace payload. A workspace beyond it fails the teleport with a clear message instead of a stalled upload. ponytail: one size cap, resumable uploads when a workspace outgrows it.

Variables

View Source 
var ErrCheckoutDiverged = errors.New("the session's commits do not continue the checkout's HEAD")

ErrCheckoutDiverged is a landing refused because the packed commits do not continue the checkout's HEAD.

Functions

func CheckoutState added in v0.239.0 

func CheckoutState(ctx context.Context, projectDir string, excluded func(abs string) bool) (string, bool, error)

CheckoutState fingerprints a checkout the way PackWorkspace captures it: HEAD, the uncommitted changes and the untracked files excluded lets in. It also reports whether the checkout has none of either.

func NewFileService added in v0.178.1 

func NewFileService() agentdomain.FileService

NewFileService creates a new file service

func OpenEnv added in v0.239.0 

func OpenEnv(key *ecdsa.PrivateKey, sealed []byte, teleportID string) (map[string]string, error)

OpenEnv decrypts a blob SealEnv produced with the private key behind one of the certificates this daemon served.

func PackWorkspace 

func PackWorkspace(ctx context.Context, projectDir string, extra []string, excluded func(abs string) bool) (agentdomain.Workspace, error)

PackWorkspace captures a project's git state: a bundle of HEAD, a binary patch of the uncommitted changes, the untracked files that respect .gitignore and pass excluded, and the explicitly listed extra files.

func SealEnv added in v0.239.0 

func SealEnv(peer *x509.Certificate, env map[string]string, teleportID string) ([]byte, error)

SealEnv encrypts the forwarded environment to the public key of the peer's leaf certificate with HPKE, so only the environment that presented that certificate reads it. Keys that are not P-256 cannot seal.

func UnpackWorkspace 

func UnpackWorkspace(ctx context.Context, ws agentdomain.Workspace, dir string, denied func(rel string) bool) error

UnpackWorkspace restores a packed workspace into dir, which must not exist yet: clone the bundle, check the branch out, apply the patch only when it applies cleanly, then unpack the untracked and extra files. The denied callback keeps a peer-planted entry out, the way the sender's policy does.

Types

type DaemonEnvironment 

type DaemonEnvironment struct {
	// contains filtered or unexported fields
}

DaemonEnvironment is a standalone daemon reachable at a fixed address over TLS with a shared token. Its sessions live wherever that daemon keeps them, so there is nothing to suspend or delete from here.

func NewDaemonEnvironment 

func NewDaemonEnvironment(entry config.EnvironmentEntry, provider *TLSProvider, dial PeerDialer) (*DaemonEnvironment, error)

NewDaemonEnvironment resolves the entry's TLS once and keeps the dialer.

func (*DaemonEnvironment) Delete 

func (e *DaemonEnvironment) Delete(context.Context, agentdomain.Session) error

func (*DaemonEnvironment) Ensure 

func (e *DaemonEnvironment) Ensure(context.Context, agentdomain.Session) (agentdomain.Endpoint, error)

func (*DaemonEnvironment) Kind 

func (e *DaemonEnvironment) Kind() agentdomain.EnvironmentKind

func (*DaemonEnvironment) Name 

func (e *DaemonEnvironment) Name() string

func (*DaemonEnvironment) Probe 

func (e *DaemonEnvironment) Probe(ctx context.Context) agentdomain.EnvironmentStatus

Probe dials the daemon and reports what its ack declared.

func (*DaemonEnvironment) Reach 

func (e *DaemonEnvironment) Reach(ctx context.Context, session agentdomain.Session) (agentdomain.Endpoint, error)

func (*DaemonEnvironment) Suspend 

func (e *DaemonEnvironment) Suspend(context.Context, agentdomain.Session) error

type DirectoryFrameSource added in v0.178.1 

type DirectoryFrameSource struct {
	// contains filtered or unexported fields
}

DirectoryFrameSource serves the newest image file under a configured directory - the integration surface for camera daemons and anything else that drops frames on disk. An optional retention sweep (max_files/max_age) runs after each read; omit retention when the producer manages cleanup.

func NewDirectoryFrameSource added in v0.178.1 

func NewDirectoryFrameSource(name string, cfg config.VisionSourceConfig, images agentdomain.ImageService) *DirectoryFrameSource

NewDirectoryFrameSource creates a frame source over cfg.Path. The retention max_age was validated at config load, so a parse failure here means zero (no age limit).

func (*DirectoryFrameSource) GetLatestFrame added in v0.178.1 

func (d *DirectoryFrameSource) GetLatestFrame() (*agentdomain.Frame, error)

GetLatestFrame returns the newest image file in the directory by mtime.

type FileService added in v0.207.0 

type FileService struct{}

FileService implements agentdomain.FileService

func (*FileService) ListProjectFiles added in v0.207.0 

func (s *FileService) ListProjectFiles() ([]string, error)

ListProjectFiles returns the files under the current directory, followed by the user's ~/.infer files (as "~/.infer/<path>").

func (*FileService) ReadFile added in v0.207.0 

func (s *FileService) ReadFile(path string) (string, error)

ReadFile reads the content of a file

func (*FileService) ValidateFile added in v0.207.0 

func (s *FileService) ValidateFile(path string) error

ValidateFile checks if a file path is valid and accessible

type ImageService added in v0.178.1 

type ImageService struct {
	// contains filtered or unexported fields
}

ImageService handles image operations including file-based image loading and base64 encoding Note: Direct clipboard support requires platform-specific dependencies and is not yet implemented

func NewImageService added in v0.178.1 

func NewImageService(cfg *config.Config, client sdk.Client) *ImageService

NewImageService creates a new image service

func (*ImageService) CreateImageVariation added in v0.178.1 

func (s *ImageService) CreateImageVariation(ctx context.Context, model, imagePath, size string) (string, error)

CreateImageVariation creates a variation of the image at imagePath using model ("provider/name") and returns the path of the saved PNG. A blank size is omitted from the request, leaving the provider's own default.

func (*ImageService) EditImage added in v0.178.1 

func (s *ImageService) EditImage(ctx context.Context, model, prompt, imagePath, quality, size, maskPath string) (string, error)

EditImage edits the image at imagePath using prompt and model ("provider/name") and returns the path of the saved PNG. A blank quality or size is omitted from the request, leaving the provider's own default. A non-empty maskPath points to a PNG whose transparent (alpha=0) areas mark the editable region; all other pixels are preserved exactly.

func (*ImageService) GenerateImage added in v0.178.1 

func (s *ImageService) GenerateImage(ctx context.Context, model, prompt, quality, size string) (string, error)

GenerateImage generates an image from prompt using model ("provider/name") and returns the path of the saved PNG. A blank quality or size is omitted from the request, leaving the provider's own default.

func (*ImageService) IsImageFile added in v0.178.1 

func (s *ImageService) IsImageFile(filePath string) bool

IsImageFile checks if a file is a supported image format

func (*ImageService) ReadImageFromBinary added in v0.178.1 

func (s *ImageService) ReadImageFromBinary(imageData []byte, filename string) (*agentdomain.ImageAttachment, error)

ReadImageFromBinary reads an image from binary data and returns it as a base64 attachment

func (*ImageService) ReadImageFromFile added in v0.178.1 

func (s *ImageService) ReadImageFromFile(filePath string) (*agentdomain.ImageAttachment, error)

ReadImageFromFile reads an image from a file path and returns it as a base64 attachment

func (*ImageService) ReadImageFromURL added in v0.178.1 

func (s *ImageService) ReadImageFromURL(ctx context.Context, imageURL string) (*agentdomain.ImageAttachment, error)

ReadImageFromURL fetches an image from a URL and returns it as a base64 attachment. URLs reach this from untrusted sources (LLM tool arguments), so only http(s) to public addresses is allowed.

type IssuedCert added in v0.239.0 

type IssuedCert struct {
	CertPEM []byte
	KeyPEM  []byte
	CAPEM   []byte
}

IssuedCert is one certificate with its key, PEM encoded for files and Secrets, plus the CA that signed it.

func (IssuedCert) TLSCertificate added in v0.239.0 

func (c IssuedCert) TLSCertificate() (tls.Certificate, error)

TLSCertificate decodes the issued pair for a tls.Config.

type Keyring added in v0.239.0 

type Keyring struct {
	// contains filtered or unexported fields
}

Keyring remembers the private keys of the certificates the binding served most recently, newest first.

func (*Keyring) Open added in v0.239.0 

func (k *Keyring) Open(sealed []byte, teleportID string) (map[string]string, error)

Open tries every remembered key on the blob, newest first.

func (*Keyring) Remember added in v0.239.0 

func (k *Keyring) Remember(cert *tls.Certificate)

Remember records the key of a certificate the binding is about to serve.

type Landing added in v0.239.0 

type Landing struct {
	// contains filtered or unexported fields
}

Landing is a packed workspace applied onto an existing checkout. It stays undoable until Keep: the checkout's own changes wait in a stash, and the untracked files excluded keeps out of a pack are never touched.

func LandWorkspace 

func LandWorkspace(ctx context.Context, ws agentdomain.Workspace, dir string, excluded func(abs string) bool) (*Landing, error)

LandWorkspace moves the checkout at dir onto a packed workspace that continues it: the pack's commits fast-forward its branch, then its patch and files apply. A failure undoes the landing before it returns.

func (*Landing) Keep added in v0.239.0 

func (l *Landing) Keep(ctx context.Context) error

Keep ends the landing, dropping the stash of the checkout's own changes, which the landed workspace continues.

func (*Landing) Undo added in v0.239.0 

func (l *Landing) Undo(ctx context.Context) error

Undo puts the checkout back the way the landing found it: HEAD and the branch it moved, without the files it wrote, and with its own changes popped from the stash.

type LocalEnvironment 

type LocalEnvironment struct {
	// contains filtered or unexported fields
}

LocalEnvironment is this daemon as an environment: sessions it owns run here, so it is never dialed, and it reports the daemon's own facts to list_environments.

func NewLocalEnvironment 

func NewLocalEnvironment(name string, capabilities map[string]string) *LocalEnvironment

NewLocalEnvironment names this daemon and what it reports about itself.

func (*LocalEnvironment) Delete 

func (e *LocalEnvironment) Delete(context.Context, agentdomain.Session) error

func (*LocalEnvironment) Ensure 

func (e *LocalEnvironment) Ensure(context.Context, agentdomain.Session) (agentdomain.Endpoint, error)

func (*LocalEnvironment) Kind 

func (e *LocalEnvironment) Kind() agentdomain.EnvironmentKind

func (*LocalEnvironment) Name 

func (e *LocalEnvironment) Name() string

func (*LocalEnvironment) Probe 

func (e *LocalEnvironment) Probe(context.Context) agentdomain.EnvironmentStatus

func (*LocalEnvironment) Reach 

func (e *LocalEnvironment) Reach(ctx context.Context, session agentdomain.Session) (agentdomain.Endpoint, error)

func (*LocalEnvironment) Suspend 

func (e *LocalEnvironment) Suspend(context.Context, agentdomain.Session) error

type MusicService added in v0.206.0 

type MusicService struct {
	// contains filtered or unexported fields
}

MusicService composes music clips through the gateway's Music API (POST /v1/audio/music), so requests show up in gateway logs and traces. It implements agentdomain.MusicService.

func NewMusicService added in v0.206.0 

func NewMusicService(cfg *config.Config, client sdk.Client) *MusicService

NewMusicService creates a new gateway-backed music service.

func (*MusicService) Compose added in v0.206.0 

func (s *MusicService) Compose(ctx context.Context, prompt, outPath string, seconds *float32, instrumental *bool) error

Compose generates a music clip for prompt using the configured text_to_music.model ("provider/model"), writing MP3 audio to outPath (the gateway music providers serve mp3; WAV is not offered by elevenlabs). A non-nil seconds caps the clip length; a non-nil instrumental requests a clip without vocals. Errors name the configured model so a gateway without the endpoint (or a provider that rejects it) is diagnosable.

type PKI added in v0.239.0 

type PKI struct {
	// contains filtered or unexported fields
}

PKI is the daemon-managed certificate authority: one CA per daemon that issues server certificates for the environments it provisions and a client certificate for itself, so a Kubernetes pod and the laptop authenticate each other with mTLS and no external authority.

func LoadOrCreatePKI added in v0.239.0 

func LoadOrCreatePKI(dir string) (*PKI, error)

LoadOrCreatePKI opens the CA under dir, minting it on first use with files only the user can read.

func (*PKI) CAPEM added in v0.239.0 

func (p *PKI) CAPEM() []byte

CAPEM is the CA certificate peers pin.

func (*PKI) IssueClient added in v0.239.0 

func (p *PKI) IssueClient(name string) (IssuedCert, error)

IssueClient issues a client certificate naming this daemon.

func (*PKI) IssueServer added in v0.239.0 

func (p *PKI) IssueServer(name string, hosts ...string) (IssuedCert, error)

IssueServer issues a server certificate for name, valid for the given DNS names and IPs, loopback included so a port-forward verifies.

func (*PKI) Pool added in v0.239.0 

func (p *PKI) Pool() *x509.CertPool

Pool is the CA as a cert pool for verifying peers.

type PeerDialer added in v0.239.0 

type PeerDialer struct {
	Me        string
	Handshake agui.Handshake
}

PeerDialer dials other daemons as this one, over their binding.

func (PeerDialer) Dial added in v0.239.0 

func (d PeerDialer) Dial(ctx context.Context, endpoint agentdomain.Endpoint, handler agui.Handler) (*agui.Conn, PeerInfo, error)

Dial connects to the binding an endpoint reaches and returns the connection with what the peer declared about itself.

type PeerInfo added in v0.239.0 

type PeerInfo struct {
	Environment string
	Version     string
	StorageID   string
}

PeerInfo is what a peer daemon declared about itself in its ack.

type SFXService added in v0.206.0 

type SFXService struct {
	// contains filtered or unexported fields
}

SFXService generates sound effects through the gateway's SFX API (POST /v1/audio/sfx), so requests show up in gateway logs and traces. It implements agentdomain.SoundEffectService.

func NewSFXService added in v0.206.0 

func NewSFXService(cfg *config.Config, client sdk.Client) *SFXService

NewSFXService creates a new gateway-backed sound-effect service.

func (*SFXService) Generate added in v0.206.0 

func (s *SFXService) Generate(ctx context.Context, prompt, outPath string, seconds *float32, loop *bool) error

Generate produces a sound effect for prompt using the configured text_to_sfx.model ("provider/model"), writing MP3 audio to outPath. A non-nil seconds caps the clip length; a non-nil loop requests a seamless loop. Errors name the configured model so a gateway without the endpoint (or a provider that rejects it) is diagnosable.

type SpeechService added in v0.186.0 

type SpeechService struct {
	// contains filtered or unexported fields
}

SpeechService synthesizes speech through the gateway's Audio API (POST /v1/audio/speech), so requests show up in gateway logs and traces. It implements agentdomain.SpeechService.

func NewSpeechService added in v0.186.0 

func NewSpeechService(cfg *config.Config, client sdk.Client) *SpeechService

NewSpeechService creates a new gateway-backed speech service.

func (*SpeechService) Synthesize added in v0.186.0 

func (s *SpeechService) Synthesize(ctx context.Context, text, voiceSamplePath, outPath string) error

Synthesize generates speech for text using the configured text_to_speech.model ("provider/model") and voice, writing WAV audio to outPath. A non-empty voiceSamplePath is sent as a reference sample for zero-shot voice cloning on providers that support it.

type TLSProvider added in v0.239.0 

type TLSProvider struct {
	// contains filtered or unexported fields
}

TLSProvider builds every tls.Config the daemon needs from daemon.yaml: the binding's server side and the client side for each environment, from certificate files or the daemon-managed CA.

func NewTLSProvider added in v0.239.0 

func NewTLSProvider(identity string, pki *PKI) *TLSProvider

NewTLSProvider wires the provider over the daemon's identity and PKI.

func (*TLSProvider) ClientForBinding added in v0.239.0 

func (p *TLSProvider) ClientForBinding(cfg config.BindingTLSConfig) (*tls.Config, error)

ClientForBinding is how a client on this machine dials this daemon's own binding when it serves TLS: the daemon CA signs it a client certificate, and certificate files are pinned by their CA.

func (*TLSProvider) ClientForDaemon added in v0.239.0 

func (p *TLSProvider) ClientForDaemon(entry config.EnvironmentEntry) (*tls.Config, error)

ClientForDaemon dials a daemon-kind environment: its CA pins the server, else the system roots verify it, such as the certificate `tailscale serve` presents. A client certificate goes along when configured.

func (*TLSProvider) ClientForKubernetes added in v0.239.0 

func (p *TLSProvider) ClientForKubernetes(serverName string) (*tls.Config, error)

ClientForKubernetes dials a pod daemon: it pins the daemon CA and presents a client certificate naming this daemon.

func (*TLSProvider) Keyring added in v0.239.0 

func (p *TLSProvider) Keyring() *Keyring

Keyring holds the keys of the certificates the binding served, for opening credentials sealed to them.

func (*TLSProvider) Server added in v0.239.0 

func (p *TLSProvider) Server(cfg config.BindingTLSConfig) (*tls.Config, error)

Server builds the binding's TLS config for its mode, nil for off.

type VideoService added in v0.206.0 

type VideoService struct {
	// contains filtered or unexported fields
}

VideoService renders video clips through the gateway's Videos API (POST /v1/videos, GET /v1/videos/{id}, GET /v1/videos/{id}/content), so requests show up in gateway logs and traces. It implements agentdomain.VideoService.

func NewVideoService added in v0.206.0 

func NewVideoService(cfg *config.Config, client sdk.Client) *VideoService

NewVideoService creates a new gateway-backed video service.

func (*VideoService) Render added in v0.206.0 

func (s *VideoService) Render(ctx context.Context, request agentdomain.VideoRequest, outPath string) error

Render creates the video job for request, polls it until it completes and writes the downloaded MP4 content to outPath. An avatar request (audio set) is a lip-synced talking clip rendered with text_to_video.avatar_model; any other request is rendered with text_to_video.model. Errors name the configured model so a gateway without the endpoint (or a provider that rejects it) is diagnosable.

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.