daemon

type AWSConfig struct {
	RoleARN         string        `json:"role_arn"`
	Region          string        `json:"region"`
	SessionDuration time.Duration `json:"session_duration"`
	ExternalID      string        `json:"external_id,omitempty"`
	Profile         string        `json:"profile,omitempty"`
}

type Client struct {
	// contains filtered or unexported fields
}

type CommandContainerChecker struct {
	// contains filtered or unexported fields
}

type ContainerChecker interface {
	IsContainerRunning(ctx context.Context, id string) (alive bool, err error)
}

type CredentialEntry struct {
	Name  string `json:"name"`  // Header name (e.g., "Authorization", "x-api-key")
	Value string `json:"value"` // Header value
	Grant string `json:"grant"` // Grant name for logging
}

type CredentialSpec struct {
	Host   string `json:"host"`
	Header string `json:"header"`
	Value  string `json:"value"`
	Grant  string `json:"grant,omitempty"`
}

type ExtraHeaderEntry struct {
	Name  string `json:"name"`
	Value string `json:"value"`
}

type ExtraHeaderSpec struct {
	Host       string `json:"host"`
	HeaderName string `json:"header_name"`
	Value      string `json:"value"`
}

type HealthResponse struct {
	PID          int      `json:"pid"`
	ProxyPort    int      `json:"proxy_port"`
	RunCount     int      `json:"run_count"`
	StartedAt    string   `json:"started_at"`
	Commit       string   `json:"commit,omitempty"`       // Git commit hash of the daemon binary
	Capabilities []string `json:"capabilities,omitempty"` // Feature capabilities supported by this daemon
}

type IdleTimer struct {
	// contains filtered or unexported fields
}

type LivenessChecker struct {
	// contains filtered or unexported fields
}

type LockInfo struct {
	PID       int       `json:"pid"`
	ProxyPort int       `json:"proxy_port"`
	SockPath  string    `json:"sock_path"`
	StartedAt time.Time `json:"started_at"`
	Commit    string    `json:"commit,omitempty"` // Git commit hash of the daemon binary
}

type PersistedRun struct {
	// Older daemons did not save policy inputs. Never silently restore a
	// GitHub credential when its previous restrictions are unknown.
	PolicyStateKnown  bool                     `json:"policy_state_known,omitempty"`
	PolicyYAML        map[string][]byte        `json:"policy_yaml,omitempty"`
	PolicyRuleSets    []PolicyRuleSetSpec      `json:"policy_rule_sets,omitempty"`
	PolicyRequired    bool                     `json:"policy_required,omitempty"`
	AuthToken         string                   `json:"auth_token"`
	RunID             string                   `json:"run_id"`
	ContainerID       string                   `json:"container_id,omitempty"`
	Grants            []string                 `json:"grants,omitempty"`
	MCPServers        []config.MCPServerConfig `json:"mcp_servers,omitempty"`
	NetworkPolicy     string                   `json:"network_policy,omitempty"`
	NetworkAllow      []string                 `json:"network_allow,omitempty"`
	AWSConfig         *AWSConfig               `json:"aws_config,omitempty"`
	TransformerSpecs  []TransformerSpec        `json:"transformer_specs,omitempty"`
	CopilotGitHubAuth bool                     `json:"copilot_github_auth,omitempty"`
	CredProfile       string                   `json:"cred_profile,omitempty"`

	// Serial state. The container's MOAT_SERIAL_*_URL froze the device's
	// host:port at container create, so a daemon restart must re-open the
	// listeners on the same port numbers — a fresh ephemeral port would be
	// unreachable from inside the container for the rest of the run.
	SerialDevices  []SerialDeviceSpec `json:"serial_devices,omitempty"`
	SerialBindAddr string             `json:"serial_bind_addr,omitempty"`
	SerialAddrs    map[string]string  `json:"serial_addrs,omitempty"`

	// AllowedHostPorts are the run's serial-listener host ports, the only ones
	// the firewall lets the container reach directly — network.host and
	// base_url ports stay proxy-mediated, and a rule here would grant them raw
	// egress. Restore re-populates them so a restarted daemon still enforces
	// the run's network policy.
	AllowedHostPorts []int `json:"allowed_host_ports,omitempty"`
}

type PolicyRuleSetSpec struct {
	Scope string   `json:"scope"`
	Mode  string   `json:"mode"`
	Deny  []string `json:"deny"`
}

type RegisterRequest struct {
	RunID       string           `json:"run_id"`
	AuthToken   string           `json:"auth_token,omitempty"` // Re-registration: use existing token
	Credentials []CredentialSpec `json:"credentials,omitempty"`
	// CredentialRefs are grant names the daemon must resolve from the encrypted
	// store. Unlike Credentials, they are safe for clients to retain and replay.
	CredentialRefs       []string                 `json:"credential_refs,omitempty"`
	ExtraHeaders         []ExtraHeaderSpec        `json:"extra_headers,omitempty"`
	RemoveHeaders        []RemoveHeaderSpec       `json:"remove_headers,omitempty"`
	TokenSubstitutions   []TokenSubstitutionSpec  `json:"token_substitutions,omitempty"`
	MCPServers           []config.MCPServerConfig `json:"mcp_servers,omitempty"`
	NetworkPolicy        string                   `json:"network_policy,omitempty"`
	NetworkAllow         []string                 `json:"network_allow,omitempty"`
	NetworkRules         []netrules.HostRules     `json:"network_rules,omitempty"`
	Grants               []string                 `json:"grants,omitempty"`
	CopilotGitHubAuth    bool                     `json:"copilot_github_auth,omitempty"`
	AWSConfig            *AWSConfig               `json:"aws_config,omitempty"`
	ResponseTransformers []TransformerSpec        `json:"response_transformers,omitempty"`
	// CredProfile is the credential profile the run was created under. The
	// daemon scopes token refresh to it. Additive/optional: an older CLI omits
	// it and the daemon falls back to the default profile (prior behavior).
	// Named to match RunContext/PersistedRun and avoid confusion with
	// AWSConfig.Profile (an AWS shared-config profile).
	CredProfile      string              `json:"cred_profile,omitempty"`
	PolicyYAML       map[string][]byte   `json:"policy_yaml,omitempty"`
	PolicyRuleSets   []PolicyRuleSetSpec `json:"policy_rule_sets,omitempty"`
	HostGateway      string              `json:"host_gateway,omitempty"`
	HostGatewayIP    string              `json:"host_gateway_ip,omitempty"`
	AllowedHostPorts []int               `json:"allowed_host_ports,omitempty"`

	// SerialDevices are host serial devices this run may use. The daemon opens
	// one RFC2217 listener per device and returns their addresses.
	SerialDevices []SerialDeviceSpec `json:"serial_devices,omitempty"`

	// SerialBindAddr is the address serial listeners bind to — the
	// container-facing address of this run's network (loopback for host-net,
	// the network gateway for bridge and Apple containers). RFC2217 has no
	// authentication, so scoping the bind is the reachability control: a
	// listener bound here is reachable from the container and from this
	// machine, not from the network at large. Additive/optional: an older CLI
	// omits it and the daemon falls back to the broker's configured BindAddr.
	SerialBindAddr string `json:"serial_bind_addr,omitempty"`

	// SerialPins names the exact port each device must come back on, keyed by
	// device name. Sent on re-registration and restore: the container's
	// MOAT_SERIAL_*_URL froze these ports at create, so the listeners must
	// re-bind the same numbers — a fresh ephemeral port would be unreachable
	// and the run's devices would silently die. A pinned port that is taken
	// fails the registration rather than moving the device. Additive/optional.
	SerialPins map[string]int `json:"serial_pins,omitempty"`
}

type RegisterResponse struct {
	AuthToken string `json:"auth_token"`
	ProxyPort int    `json:"proxy_port"`
	Error     string `json:"error,omitempty"`

	// SerialAddrs maps each approved device name to the host:port of its
	// RFC2217 listener. Empty when the run requested no devices.
	SerialAddrs map[string]string `json:"serial_addrs,omitempty"`
}

type Registry struct {
	// contains filtered or unexported fields
}

type RemoveHeaderSpec struct {
	Host       string `json:"host"`
	HeaderName string `json:"header_name"`
}

type RouteRegistration struct {
	Services map[string]string `json:"services"`
}

type RunContext struct {
	RunID       string `json:"run_id"`
	ContainerID string `json:"container_id,omitempty"`
	AuthToken   string `json:"auth_token"`

	Credentials          map[string][]CredentialEntry                `json:"credentials"`
	CredentialBundles    map[string][]credential.Bundle              `json:"-"` // contains secrets; never serialize
	ExtraHeaders         map[string][]ExtraHeaderEntry               `json:"extra_headers"`
	RemoveHeaders        map[string][]string                         `json:"remove_headers"`
	TokenSubstitutions   map[string]TokenSubstitutionEntry           `json:"token_substitutions"`
	ResponseTransformers map[string][]credential.ResponseTransformer `json:"-"` // not serialized

	MCPServers    []config.MCPServerConfig `json:"mcp_servers,omitempty"`
	NetworkPolicy string                   `json:"network_policy,omitempty"`
	NetworkAllow  []string                 `json:"network_allow,omitempty"`
	NetworkRules  []netrules.HostRules     `json:"network_rules,omitempty"`

	AWSConfig         *AWSConfig        `json:"aws_config,omitempty"`
	TransformerSpecs  []TransformerSpec `json:"transformer_specs,omitempty"`
	Grants            []string          `json:"grants,omitempty"`
	CopilotGitHubAuth bool              `json:"copilot_github_auth,omitempty"`
	HostGateway       string            `json:"host_gateway,omitempty"`
	HostGatewayIP     string            `json:"host_gateway_ip,omitempty"` // actual IP for forwarding allowed host traffic
	AllowedHostPorts  []int             `json:"allowed_host_ports,omitempty"`

	// Serial state, for persistence across daemon restarts. SerialDevices and
	// SerialBindAddr are the registration request's; SerialAddrs is what the
	// container's frozen MOAT_SERIAL_*_URL points at, so a restore must
	// re-open each listener on the same port.
	SerialDevices  []SerialDeviceSpec `json:"serial_devices,omitempty"`
	SerialBindAddr string             `json:"serial_bind_addr,omitempty"`
	SerialAddrs    map[string]string  `json:"serial_addrs,omitempty"`

	// CredProfile is the credential profile this run was created under (from
	// the CLI's --profile/MOAT_PROFILE). The daemon is shared across profiles,
	// so token refresh must scope to this value rather than the daemon
	// process's own credential.ActiveProfile. Empty means the default profile.
	CredProfile string `json:"cred_profile,omitempty"`

	RegisteredAt time.Time `json:"registered_at"`

	// Persist the exact registered policy, never reload it from the workspace.
	PolicyYAML     map[string][]byte          `json:"policy_yaml,omitempty"`
	PolicyRuleSets []PolicyRuleSetSpec        `json:"policy_rule_sets,omitempty"`
	KeepEngines    map[string]*keeplib.Engine `json:"-"` // compiled Keep policy engines per scope
	// contains filtered or unexported fields
}

type RunInfo struct {
	RunID        string `json:"run_id"`
	ContainerID  string `json:"container_id,omitempty"`
	RegisteredAt string `json:"registered_at"`
}

type RunPersister struct {
	// contains filtered or unexported fields
}

type SerialDeviceSpec struct {
	Name      string `json:"name"`                // config name, e.g. "esp32"
	Path      string `json:"path"`                // host device node
	VID       string `json:"vid,omitempty"`       // for audit entries
	PID       string `json:"pid,omitempty"`       // for audit entries
	Serial    string `json:"serial,omitempty"`    // for audit entries
	PortPath  string `json:"port_path,omitempty"` // for audit entries
	Interface string `json:"interface,omitempty"` // for audit entries
	Record    string `json:"record,omitempty"`    // "events" (default) or "full"
	// Baud is the initial line rate from moat.yaml's `baud:`. Zero means the
	// port opens at whatever rate the driver default is and the client's
	// SET-BAUDRATE governs. Applied at session open; an RFC2217 client that
	// sends its own SET-BAUDRATE overrides it.
	Baud int `json:"baud,omitempty"`
}

type Server struct {
	// contains filtered or unexported fields
}

type TokenSubstitutionEntry struct {
	Placeholder string `json:"placeholder"`
	RealToken   string `json:"real_token"`
}

type TokenSubstitutionSpec struct {
	Host        string `json:"host"`
	Placeholder string `json:"placeholder"`
	RealToken   string `json:"real_token"`
}

type TransformerSpec struct {
	Host string `json:"host"`
	Kind string `json:"kind"` // "oauth-endpoint-workaround" or "response-scrub"
}

type UpdateRunRequest struct {
	ContainerID string `json:"container_id"`
}