Documentation
¶
Index ¶
Constants ¶
const ( Version = "managed-install-v1" // Mode is the default posture; ModeEnforce turns daemon decisions into // real denies at every hook edge (Claude Code and Cowork alike). Mode = "observe" ModeEnforce = "enforce" Agent = "claude" DefaultPath = "/Library/Application Support/Kontext/managed.json" EnvPath = "KONTEXT_MANAGED_CONFIG" EnvAllowHTTP = "KONTEXT_MANAGED_ALLOW_HTTP_LOCALHOST" DeploymentVersionPath = "/Library/Application Support/Kontext/deployment-version" EnvDeploymentVersionPath = "KONTEXT_DEPLOYMENT_VERSION_PATH" )
Variables ¶
var ErrNotManaged = errors.New("managed config not found")
Functions ¶
func DeploymentVersion ¶ added in v0.9.0
func DeploymentVersion() string
DeploymentVersion returns the installed package version recorded in the deployment marker, or "" if the marker is missing or unreadable.
func ResolveInstallToken ¶ added in v0.9.0
func UserPath ¶ added in v0.9.0
func UserPath() string
UserPath is the self-serve managed config location, or "" when the home directory cannot be resolved.
func ValidateCloudURL ¶ added in v0.9.0
ValidateCloudURL enforces the managed.json cloud_url shape (https with host only; loopback http behind EnvAllowHTTP). Exported so `kontext setup` can fail a bad --cloud-url before any state is written, with exactly the rules the daemon's parser will apply later.
Types ¶
type Config ¶
type Config struct {
Version string `json:"version"`
OrganizationID string `json:"organization_id"`
CloudURL string `json:"cloud_url"`
Mode string `json:"mode"`
Agent string `json:"agent"`
Credentials Credentials `json:"credentials"`
Device Device `json:"device,omitempty"`
// CoworkEnabled turns on Claude Cowork observation/enforcement in the
// managed-observe daemon (the posture follows Mode). A managed.json field
// so MDM-deployed installs control it through config rather than launchd
// environment plumbing.
CoworkEnabled bool `json:"cowork_enabled,omitempty"`
}
type Credentials ¶
type Credentials struct {
InstallTokenRef TokenRef `json:"install_token_ref"`
}
type LoadedConfig ¶
type LoadedConfig struct {
Config Config
Path string
Checksum string
// Scope reflects how the path was resolved (env/system/user). LoadFile
// callers that bypass ResolvePath get an empty Scope.
Scope Scope
}
func Load ¶
func Load() (LoadedConfig, error)
func LoadFile ¶
func LoadFile(path string) (LoadedConfig, error)
type Scope ¶ added in v0.9.0
type Scope string
Scope identifies which managed config a process resolved: an explicit env override, the system-wide MDM install under /Library, or a per-user self-serve install written by `kontext setup`.
func ResolvePath ¶ added in v0.9.0
ResolvePath picks the managed config path for this process. Precedence is security-relevant: an existing SYSTEM (MDM) config always wins over the user-level one, so an org-managed Mac cannot be re-pointed by a self-serve setup. The system path is selected whenever it exists OR whenever its existence cannot be determined (any stat error other than not-exist), so a broken/unreadable MDM config surfaces as an error instead of silently falling through to user config.
Source Files