runctx

type AllowedHost struct {
	Host  string
	Rules []string // human-readable rule summaries, e.g. "allow GET /repos/*"
}

type AnthropicAPI struct {
	// KeyEnv is the environment variable holding the (placeholder) API key.
	KeyEnv string
}

type BuildOptions struct {
	// WorkspaceMode is the resolved workspace mode ("bind"/"volume"). Empty is
	// treated as bind. Sourced from the resolved run options, not cfg, because a
	// --workspace-mode CLI flag can override the moat.yaml value.
	WorkspaceMode config.WorkspaceMode
	// DockerMode is the resolved Docker mode ("host"/"dind"). Empty means Docker
	// is not enabled for this run.
	DockerMode deps.DockerMode
	// AnthropicKeyEnv is the environment variable holding the shell-scoped
	// Anthropic API key. Set only when the key is exported via BASH_ENV rather
	// than container-wide (both "claude" and "anthropic" grants active). Empty
	// means there is nothing special to explain.
	AnthropicKeyEnv string
	// OpenAIKeyEnv is the environment variable holding the shell-scoped OpenAI
	// API key. Set only when the key is exported via BASH_ENV rather than
	// container-wide (both "codex" and "openai" grants active). Empty means
	// there is nothing special to explain.
	OpenAIKeyEnv string
}

type Docker struct {
	Mode string // "dind" (Docker-in-Docker) or "host" (mounted host socket)
}

type Grant struct {
	Name        string
	Description string
}

type MCPServer struct {
	Name        string
	Description string
}

type NetworkPolicy struct {
	Policy       string
	AllowedHosts []AllowedHost
}

type OpenAIAPI struct {
	// KeyEnv is the environment variable holding the (placeholder) API key.
	KeyEnv string
}

type Port struct {
	Name          string
	ContainerPort int
	EnvHostPort   string
}

type RuntimeContext struct {
	RunID           string
	Agent           string
	Workspace       string
	WorkspaceMode   string // "bind" or "volume"; empty is treated as bind
	Grants          []Grant
	Services        []Service
	Tools           []string // installed non-service, non-docker dependencies
	Docker          *Docker  // non-nil when Docker access is available
	Ports           []Port
	NetworkPolicy   *NetworkPolicy
	MCPServers      []MCPServer
	HasDependencies bool // true when the config declares any dependencies

	// AnthropicAPI is non-nil when an Anthropic API key is available to shell
	// commands but deliberately absent from the container environment.
	AnthropicAPI *AnthropicAPI

	// OpenAIAPI is non-nil when an OpenAI API key is available to shell
	// commands but deliberately absent from the container environment.
	OpenAIAPI *OpenAIAPI
}

type Service struct {
	Name    string
	Version string
	EnvURL  string
}