config

type Config struct {
	// ListenAddr is the address the terminal WebSocket proxy listens on.
	// Flag: --listen-addr  Env: WSPROXY_LISTEN_ADDR  Default: :9003
	ListenAddr string

	// InternalAddr is the address the internal management API listens on.
	// Only used when SyncToken is non-empty.
	// Flag: --internal-addr  Env: WSPROXY_INTERNAL_ADDR  Default: :9004
	InternalAddr string

	// ClustersFilePath is the path to clusters.yaml consumed by cluster.Store.
	// Flag: --clusters-config  Env: CLUSTERS_CONFIG_PATH
	ClustersFilePath string

	// SyncToken is the shared secret sent in AGENTBOX-SYNC-TOKEN when dialling
	// Worker /v1/ws/sync endpoints. When empty the sync manager is disabled.
	// Flag: --sync-token  Env: AGENTBOX_SYNC_TOKEN
	SyncToken string

	// ManagerToken gates the legacy /internal/* routes (static token check).
	// Flag: --manager-token  Env: AGENTBOX_MANAGER_TOKEN
	ManagerToken string

	// AdminKey is the shared admin API key used by the internal API auth
	// middleware to recognise admin callers via AGENTBOX-API-KEY header.
	// When empty the internal API runs in dev mode (anonymous admin).
	// Flag: --admin-key  Env: AGENTBOX_ADMIN_KEY
	AdminKey string

	// JWTSecret is the HS256 secret shared with the BFF for Bearer JWT auth.
	// When empty JWT auth is disabled.
	// Flag: --jwt-secret  Env: JWT_SECRET
	JWTSecret string

	// MaxKeysPerUser is the per-(namespace, user) API key count limit.
	// 0 means unlimited.
	// Flag: --max-keys-per-user  Env: AGENTBOX_MAX_KEYS_PER_USER
	MaxKeysPerUser int

	// APIKeyNamespace is the Kubernetes namespace where API key Secrets are stored.
	// Flag: --apikey-namespace  Env: AGENTBOX_APIKEY_NAMESPACE  Default: agentbox-system
	APIKeyNamespace string
}