composition

Documentation

Overview

Package composition wires all vibekit services together and manages application lifecycle.

Index

• type App
  • func Build(ctx context.Context, cfg *Config, staticFS fs.FS) (*App, error)
  • func (a *App) Run() error
  • func (a *App) Shutdown()
• type Config
  • func ConfigFromEnv() Config

Types

type App

type App struct {
	Hub    *hub.Hub
	Server *server.Server
	// contains filtered or unexported fields
}

App holds all wired-up services for the vibekit server.

func Build

func Build(ctx context.Context, cfg *Config, staticFS fs.FS) (*App, error)

Build constructs all services and wires them together. staticFS is the embedded filesystem containing the compiled web UI. cfg is passed by pointer to avoid copying the Config struct at every invocation (it's only ever built once from the environment, then mutated is forbidden — callers must treat it as read-only).

func (*App) Run

func (a *App) Run() error

Run starts the HTTP server and blocks until shutdown. The server handles signal-based graceful shutdown internally.

func (*App) Shutdown

func (a *App) Shutdown()

Shutdown stops background services in reverse order.

Every member is treated as optional. One already is (tools is nil on the root-integrity degraded boot, and Close is not nil-receiver safe), and the rest share the reason: a shutdown that panics on a service which was never started takes the ordered teardown of the ones that WERE started down with it. It is also what lets the lifecycle be asserted through this function rather than through a cancel a test made up.

type Config

type Config struct {
	WorkDir   string
	ConfigDir string
	VapidSub  string
	// KiroCLIVersion and the two digests are the Renovate-pinned literals
	// entrypoint.sh declares and exports. They are the manager's whole input:
	// no version means no managed install (bare `go run`), and a malformed
	// digest fails manager construction rather than a 528 MB download.
	KiroCLIVersion     string
	KiroCLISHA256      string
	KiroCLISHA256ARM64 string
	// ToolsDir is the tools engine's install tree root (bin/, opt/,
	// npm/, python/) on the persistent volume.
	ToolsDir string
	// ToolCatalogPath is the compiled tool catalog baked into the
	// image (missing = degraded catalog search). With the runtime
	// refresh below it is only the first-boot/offline fallback.
	ToolCatalogPath string
	// ToolCatalogURL is the published catalog the engine refreshes
	// from at boot and on the ToolCatalogRefresh schedule.
	ToolCatalogURL string
	// ToolCatalogOverlays are display-patch overlay files the engine
	// re-applies to every loaded catalog (the vibekit UI copy for
	// Sources/MCP tool rows). Missing files are dropped at wiring time
	// (bare `go run` outside the image).
	ToolCatalogOverlays []string
	// ToolCatalogRequire lists the tool names a fetched catalog must
	// resolve before it replaces the current one — the embedded
	// required-tools.txt, injected by main.
	ToolCatalogRequire []string
	// TrustedProxies is the set of reverse-proxy networks whose
	// X-Forwarded-For header webhttp.ClientIP is allowed to trust when
	// resolving the real client IP (access log + login/logout audit
	// logs). Parsed once from WT_TRUSTED_PROXIES at startup. Empty/unset =
	// trust nothing = log the unspoofable socket peer (the spoof-safe
	// default for a directly-exposed deployment).
	TrustedProxies []*net.IPNet
	// TrustedInstallUIDs names identities whose write access to the kiro-cli
	// install tree does not invalidate custody, parsed from
	// WT_TRUSTED_INSTALL_UIDS. Empty is the default and the right setting for
	// almost every deployment: pinstall then refuses to install into a tree any
	// other identity can write, which is what stops a planted binary being run
	// as this container's user. It is deliberately NOT a compiled-in value —
	// only the deployment knows which account on its volume is already at least
	// as privileged as this process, and baking one in would make that claim on
	// behalf of every deployment that pulled the image.
	TrustedInstallUIDs []int
	// HostPolicy is the exact-match Host allowlist parsed once from
	// WT_ALLOWED_HOSTS at startup (webhttp.HostPolicy) — the anti-DNS-rebinding
	// gate the security middleware applies before the CSRF check. Unset or
	// blank = an inactive policy = any Host accepted (backward compatible;
	// the server warns at listen time).
	HostPolicy *webhttp.HostPolicy
	// BridgeEnvAllow re-permits names the bridge's credential screen would
	// otherwise drop on its way down to kiro-cli, parsed from
	// bridge.EnvAllowVar. Nil is the shipped configuration and the right one:
	// nothing in the image puts a credential in this environment, so the
	// override exists for the operator who has a legitimate variable whose name
	// merely reads like one.
	BridgeEnvAllow map[string]struct{}
	// BrowseRoots is the file browser's allow-list: the granted
	// directories the /api/file* surface can see. Always WorkDir +
	// ConfigDir, plus any extra grants from VIBEKIT_BROWSE_ROOTS
	// (colon-separated absolute paths, e.g. "/tmp:/data"). Everything
	// outside the grants is denied by default.
	BrowseRoots []string
	// ACPArgs are operator-supplied kiro-cli launch flags from
	// VIBEKIT_KIRO_ACP_ARGS, already filtered by bridge.ParseACPArgs (which
	// refuses --agent-engine and the two inert trust flags). Appended to every
	// CHAT bridge's argv, never to the utility bridge's. An escape hatch for a
	// flag upstream adds, not a capability switch: vibekit already pins v3 and
	// already emits --model / --effort.
	ACPArgs []string
	// ToolCatalogRefresh is the engine refresh cadence under toolbelt's
	// canonical policy (default 24h; zero = schedule disabled, keeping
	// the manual UI/API refresh).
	ToolCatalogRefresh time.Duration
	AuthConfig         auth.Config
}

Config holds all environment/flag values needed to build the app.

func ConfigFromEnv

func ConfigFromEnv() Config

ConfigFromEnv reads configuration from environment variables with sensible defaults.