config

type Defaults struct {
	Timeout time.Duration
	// ConsentTimeout bounds the wait for Chrome's browser-modal "Allow remote
	// debugging?" prompt (config key consent_timeout). It is separate from
	// Timeout because it is not a command deadline at all: it is how long a
	// human is given to find and click a dialog that may be behind the window,
	// so it is measured in minutes where Timeout is measured in seconds.
	ConsentTimeout time.Duration
	By             string
	Wait           string
	Target         string
	Port           int
	ProfileDir     string
	NoLaunch       bool
	NoDaemon       bool
	JSON           bool
	NoColor        bool

	// Policy is the optional [policy] table (RFC-0012). No CHROME_CDP_* variable
	// sets any of its keys: a safety boundary whose CONTENTS an inherited
	// environment could rewrite would not be much of a boundary. Override it
	// explicitly with --allow / --policy-off instead.
	//
	// It is not, however, immune to the environment, and pretending otherwise
	// would be the more dangerous claim: XDG_CONFIG_HOME (and HOME) decide WHICH
	// file is read, so an environment that points them elsewhere selects a
	// different policy, or none. Nothing here can prevent that — the config file
	// has to be found somehow — so the disappearance is made visible instead:
	// Note() reports a config file that XDG_CONFIG_HOME pointed at and that does
	// not exist, and an unreadable file becomes a Malformed policy the CLI
	// refuses to run with rather than a policy silently absent.
	Policy Policy

	// Event-capture bounds for the observability verbs. They size the buffers
	// the connection holder retains per tab, so they are read by the daemon (or
	// by a --no-daemon connect) rather than by a command flag.
	ConsoleBuffer   int // retained console messages per tab
	ConsoleMaxEntry int // per-message text cap, in bytes
	NetBuffer       int // retained network records per tab
	NetMaxBody      int // per-body cap, in bytes (request and response)

	// Recording bounds (RFC-0011). A frame dwarfs a console line or a request
	// record, so recording is bounded by BOTH a frame count and a byte ceiling:
	// 600 frames is a modest number on a laptop viewport and a large one on a
	// 4K monitor, and only the second bound knows the difference.
	RecordBuffer   int // retained frames per tab
	RecordMaxBytes int // retained frame bytes per tab
}

type Policy struct {
	// Present reports that a [policy] table exists at all. With no table the
	// whole layer is inert and nothing about the CLI changes.
	Present bool
	// Enabled defaults to true for a present table: a user who wrote the table
	// meant it. Set enabled = false to keep it on file without applying it.
	Enabled bool

	Allow       []string
	Deny        []string
	ReadOnly    []string
	VerbsDenied []string
	UploadRoots []string

	AuditLog    string
	AuditAll    bool
	OnViolation string

	// Malformed carries the reason a policy table could not be read: either the
	// file did not parse at all while mentioning [policy], or the table held a
	// key this build does not know.
	//
	// It exists because the repo's usual "warn and continue" is the wrong answer
	// here. Continuing means running with a policy the user believes is in force
	// and is not, and a policy that fails open is worse than no policy — so the
	// CLI turns this into a refusal (RFC-0012 VS-15).
	Malformed string

	// Source is the config file the table came from, echoed in refusals so the
	// user knows which file to edit.
	Source string
}