broker

Documentation

Index

• Variables
• func RedactHeaders(headers map[string]string) map[string]string
• func SocketPath() (string, error)
• type Broker
  • func New() *Broker
  • func (b *Broker) Acquire(agentID, runID string, ttl time.Duration) (Lease, error)
  • func (b *Broker) Authenticate(token string) bool
  • func (b *Broker) CanMutate(token, page string) bool
  • func (b *Broker) OwnPage(token, page string) error
  • func (b *Broker) Release(token string) bool
• type Client
  • func NewClient(socketPath string) *Client
  • func (c *Client) Acquire(agentID, runID string, ttl time.Duration) (Lease, error)
  • func (c *Client) CanMutate(token, page string) bool
  • func (c *Client) OwnPage(token, page string) error
  • func (c *Client) Reachable() bool
  • func (c *Client) Release(token string) error
• type Lease
• type Server
  • func Serve(b *Broker, socketPath string) (*Server, error)
  • func (s *Server) Close() error

Variables

var ErrNotConnected = errors.New("browser broker not reachable — is the gateway running with existing-Chrome configured?")

ErrNotConnected is returned by a Client call when the socket itself is unreachable (no gateway running, or existing-Chrome never set up) — the caller's job is to fail closed on this, never to fall back to ephemeral.

Functions

func RedactHeaders

func RedactHeaders(headers map[string]string) map[string]string

func SocketPath

func SocketPath() (string, error)

SocketPath is the well-known location of the gateway-owned existing-Chrome broker socket — shared between the gateway (which Serves it) and any process that dials it as a Client, including a autonomous agent's delegated worker running as a standalone `memcode run` job, not just inside the gateway. Its absence (no gateway running) is exactly the fail-closed signal existing-Chrome delegation must respect — see ErrNotConnected.

Types

type Broker

type Broker struct {
	// contains filtered or unexported fields
}

func New

func New() *Broker

func (*Broker) Acquire

func (b *Broker) Acquire(agentID, runID string, ttl time.Duration) (Lease, error)

func (*Broker) Authenticate

func (b *Broker) Authenticate(token string) bool

func (*Broker) CanMutate

func (b *Broker) CanMutate(token, page string) bool

func (*Broker) OwnPage

func (b *Broker) OwnPage(token, page string) error

func (*Broker) Release

func (b *Broker) Release(token string) bool

type Client

type Client struct {
	// contains filtered or unexported fields
}

Client talks to a gateway-owned Server over its Unix socket. A delegated worker is a separate OS process from the gateway (see jobs.SpawnWithSpec), so it cannot hold the *Broker* itself — this is how it reaches the SAME broker the gateway owns to get an exclusive existing-Chrome lease.

func NewClient

func NewClient(socketPath string) *Client

NewClient does not itself verify the socket is reachable — call Acquire and handle ErrNotConnected; that is the fail-closed path callers must take.

func (*Client) Acquire

func (c *Client) Acquire(agentID, runID string, ttl time.Duration) (Lease, error)

Acquire requests exclusive existing-Chrome mutation rights for (agentID, runID). Callers MUST fail closed on error — no ephemeral-browser fallback.

func (*Client) CanMutate

func (c *Client) CanMutate(token, page string) bool

func (*Client) OwnPage

func (c *Client) OwnPage(token, page string) error

func (*Client) Reachable

func (c *Client) Reachable() bool

Reachable reports whether the socket exists and a gateway is actually listening on it — the check callers use to fail closed before ever trying to drive existing-Chrome, rather than surfacing a confusing connect error mid-task.

func (*Client) Release

func (c *Client) Release(token string) error

type Lease

type Lease struct {
	ID, AgentID, RunID, Token string
	ExpiresAt                 time.Time
	OwnedPages                map[string]bool
}

type Server

type Server struct {
	// contains filtered or unexported fields
}

Server exposes a Broker over a permission-protected local Unix socket, so a process OTHER than the one holding the *Broker* (a delegated worker, a separate OS process spawned via jobs.SpawnWithSpec) can Acquire/Release/ OwnPage/CanMutate against the SAME broker instance the gateway owns. The broker itself must stay a single, long-lived, in-process object — cloning it per connection would defeat its whole purpose (one lease, one owner, at a time, for the user's ONE real Chrome).

The socket is created with 0600 permissions inside a 0700 directory (see gwconfig.Dir), so only the user who started the gateway can reach it — that ownership check is the "permission-protected" half of the design doc's "gateway-owned broker and permission-protected local socket".

func Serve

func Serve(b *Broker, socketPath string) (*Server, error)

Serve starts listening on socketPath (removing any stale socket file left by a prior crashed gateway) and returns once the listener is up; Close stops it. b is the SAME *Broker instance the gateway's own in-process callers (if any) use — there is exactly one broker per gateway process.

func (*Server) Close

func (s *Server) Close() error