internal

type AdminServer struct {
	Session    *api.GetSessionResponse
	ClientRepo *ClientRepo

	// LaunchID is the launch this server speaks for, from the record the
	// session claimed. StopSession refuses a request that names any other
	// launch, so that a client whose session ended between reading the
	// record and dialling the socket does not stop the session that took
	// the name over. Empty means no name was claimed -- a caller that
	// supplied its own admin socket -- and then no stop can be bound to a
	// launch, so none is accepted.
	LaunchID string

	// OnListening, if set, is called once the socket is bound. It is the other
	// half of readiness: a caller told "ready" must be able to connect, which
	// registering the actor does not establish and binding does.
	OnListening func()

	// OnStop is called when a client asks the session to end. The daemon
	// wires it to an explicit stop cause; the RPC returns at
	// once and the teardown follows.
	OnStop func()

	sync.Mutex
	// contains filtered or unexported fields
}

type ClientRepo struct {
	// contains filtered or unexported fields
}

type CommandResult struct {
	// Exited is true when the command terminated under its own control.
	Exited bool
	// Code is its status; meaningful only when Exited.
	Code int
	// Signal names the signal that killed it, when it was killed.
	Signal string
	// SignalNumber is the originating Unix terminating signal, when available.
	SignalNumber *int
}

type ExitError struct {
	// Code is the status GetExitCodeProcess reported, kept unsigned because
	// that is what Windows produces and what SSH puts on the wire. On a
	// 32-bit build, narrowing it to int would make every status with the high
	// bit set negative -- an unhandled exception such as 0xC0000005, or a
	// deliberate "exit -1" -- and exitCode would then read it as a process
	// that never exited under its own control.
	Code uint32
}

type PTY interface {
	io.ReadWriteCloser

	// Setsize changes the terminal dimensions.
	// On Unix, this sends a SIGWINCH to the slave process.
	// On Windows, this resizes the ConPTY buffer.
	Setsize(h, w int) error

	// Redraw asks the process on the pty to repaint without changing its
	// geometry: a replay repaints what the ring holds, and a full-screen
	// program redraws the rest on SIGWINCH. On Windows there is no SIGWINCH,
	// so the nudge is a resize, and unavailable under a pinned size.
	Redraw() error

	// Wait waits for the process associated with this PTY to exit.
	// On Unix, this delegates to exec.Cmd.Wait().
	// On Windows, this waits on the process handle.
	Wait() error

	// Kill terminates the process associated with this PTY.
	// On Unix, this delegates to exec.Cmd.Process.Kill().
	// On Windows, this calls TerminateProcess on the handle.
	Kill() error

	// Signal sends sig to the command's process group, so that a shell's
	// hangup reaches its jobs. Unsupported on Windows, which returns
	// errors.ErrUnsupported and lets the caller go straight to Kill.
	Signal(sig syscall.Signal) error
}

type PermissionDeniedError struct {
	// contains filtered or unexported fields
}

type ReverseTunnel struct {
	*ssh.Client

	Host    *url.URL
	Signers []ssh.Signer
	// HostKey is the key the embedded sshd presents. Its public half is what
	// the relay is told to expect on every guest's upstream hop; Signers
	// authenticate this tunnel and are used for nothing else.
	HostKey           ssh.Signer
	AuthorizedKeys    []ssh.PublicKey
	KeepAliveDuration time.Duration
	// ProxyURL, when non-nil, is the HTTP proxy to connect to Host through.
	ProxyURL        *url.URL
	HostKeyCallback ssh.HostKeyCallback
	Logger          *slog.Logger
	// contains filtered or unexported fields
}

type SFTPSession struct {
	// contains filtered or unexported fields
}

type Server struct {
	Command      []string
	CommandEnv   []string
	ForceCommand []string
	// HostKey is the key both doors present. A session's key, not the
	// operator's identity: a key exchange signs with whatever is here, on
	// every join, attach and rekey, and an identity held by a confirming
	// agent would be asked each time.
	HostKey                 ssh.Signer
	AuthorizedKeys          []ssh.PublicKey
	EventEmitter            *emitter.Emitter
	KeepAliveDuration       time.Duration
	Logger                  *slog.Logger
	ReadOnly                bool
	AllowLocalTCPForwarding bool
	PtySize                 termsize.Size
	PinPtySize              bool
	Term                    string

	// AwaitInitialClient defers starting the command until the first host
	// client's output subscription is installed, and defers serving guests
	// until the command has started. Foreground use sets it: a command that
	// exits at once — `upterm host -- false` — would otherwise race the local
	// terminal's attach, and lose. Headless use leaves it off.
	AwaitInitialClient bool
	// InitialClientTimeout bounds that wait; zero means
	// DefaultInitialClientTimeout.
	InitialClientTimeout time.Duration

	// StopGrace bounds each step of the command's teardown; zero means
	// DefaultStopGrace.
	StopGrace time.Duration

	// OnCommandStarted, if set, is called once the hosted command is running.
	// Readiness is a claim about facts, and this is one of the two facts it
	// rests on: until this fires, "ready" would mean a command that may still
	// fail to start.
	OnCommandStarted func()

	// OnGuestServerStopped is called when the guest listener stops serving,
	// which in practice means the reverse tunnel is gone. The session does not
	// end: the command keeps running and keeps its pty. Reporting it is the
	// caller's job, because internal must not know about on-disk state.
	OnGuestServerStopped func(error)

	// SFTP configuration
	SFTPDisabled          bool                   // Disable SFTP subsystem entirely
	SFTPPermissionChecker sftp.PermissionChecker // Optional: prompts user for SFTP permissions (nil = auto-allow)
	// contains filtered or unexported fields
}