config

Documentation

Overview

Package config loads agentcookie's on-disk configuration: source.yaml, sink.yaml, and blocklist.yaml. Each file is independently optional so `agentcookie status` can report partial state.

Index

• func DefaultChromeCookiesPath() string
• func ExpandTilde(p string) string
• func SourceBrowserCookiesPath(name, profile string) (string, error)
• func SupportedBrowserNames() []string
• type Allowlist
• type AllowlistEntry
• type Blocklist
  • func LoadAllowlist(dir string) (*Blocklist, error)
  • func LoadBlocklist(dir string) (*Blocklist, error)
  • func (bl *Blocklist) CookiePolicySummary() string
  • func (bl *Blocklist) PolicyMode() CookiePolicy
• type BlocklistEntry
• type BrowserRef
• type CDPRef
• type ChromeRef
• type CmuxRef
• type CookiePolicy
• type ListenRef
• type PeerRef
• type SecurityRef
• type SinkConfig
  • func LoadSink(dir string) (*SinkConfig, error)
• type SinkRef
• type SourceConfig
  • func LoadSource(dir string) (*SourceConfig, error)
  • func LoadSourceLocal(dir string) (*SourceConfig, error)

Functions

func DefaultChromeCookiesPath

func DefaultChromeCookiesPath() string

DefaultChromeCookiesPath returns the default Chrome cookies SQLite path on macOS. Kept here so config can populate omitted db_path fields without importing chrome (which pulls CGO sqlite).

func ExpandTilde

func ExpandTilde(p string) string

ExpandTilde turns a leading "~/" into the user's home dir. Leaves all other paths alone.

func SourceBrowserCookiesPath

func SourceBrowserCookiesPath(name, profile string) (string, error)

SourceBrowserCookiesPath returns the Cookies SQLite path for the configured source browser. Empty name/profile default to Chrome/Default.

func SupportedBrowserNames

func SupportedBrowserNames() []string

SupportedBrowserNames returns the source-browser adapter names accepted by source.yaml.

Types

type Allowlist

type Allowlist = Blocklist

Allowlist is retained as a type alias for the v0.2 -> v0.3 transition. New code should use Blocklist.

type AllowlistEntry

type AllowlistEntry = BlocklistEntry

AllowlistEntry is retained as a type alias so callers that named the v0.2 type continue to compile. New code should use BlocklistEntry directly.

type Blocklist

type Blocklist struct {
	Version int              `yaml:"version" json:"version"`
	Policy  CookiePolicy     `yaml:"policy,omitempty" json:"policy,omitempty"`
	Domains []BlocklistEntry `yaml:"domains" json:"domains"`
}

Blocklist is the on-disk shape of blocklist.yaml. Version is bumped if/when the file format changes incompatibly. Omitted policy preserves legacy blocklist semantics. Empty domains list (or missing file) means sync all cookies only in blocklist mode; empty allowlist mode syncs no cookies.

func LoadAllowlist

func LoadAllowlist(dir string) (*Blocklist, error)

LoadAllowlist is a compatibility wrapper kept so existing callers still compile during the v0.2 -> v0.3 transition. Behavior is identical to LoadBlocklist; the returned struct uses the new shape.

func LoadBlocklist

func LoadBlocklist(dir string) (*Blocklist, error)

LoadBlocklist reads blocklist.yaml from dir. A missing file is NOT an error; it produces an empty Blocklist (sync-all semantic). v0.3 inverts the v0.2 allowlist model; if a legacy allowlist.yaml is present and blocklist.yaml is not, the legacy file is renamed to allowlist.yaml.v2.bak and an empty blocklist is returned with a one-line warning to stderr.

func (*Blocklist) CookiePolicySummary

func (bl *Blocklist) CookiePolicySummary() string

CookiePolicySummary returns the operator-facing policy label.

func (*Blocklist) PolicyMode

func (bl *Blocklist) PolicyMode() CookiePolicy

PolicyMode returns the effective cookie filter policy. Empty is the legacy blocklist mode so old blocklist.yaml files keep their behavior unchanged.

type BlocklistEntry

type BlocklistEntry struct {
	Pattern     string `yaml:"pattern" json:"pattern"`
	Description string `yaml:"description,omitempty" json:"description,omitempty"`
}

BlocklistEntry is one explicitly opted-OUT cookie domain. Pattern follows SQLite LIKE syntax (use '%' as wildcard, e.g. "%.chase.com"). Cookies whose host_key matches any pattern are NOT synced in blocklist mode. In allowlist mode, entries are explicitly opted-IN domains.

type BrowserRef

type BrowserRef struct {
	Name    string `yaml:"name" json:"name"`
	Profile string `yaml:"profile" json:"profile"`
}

type CDPRef

type CDPRef struct {
	Enabled    bool   `yaml:"enabled" json:"enabled"`
	ProfileDir string `yaml:"profile_dir,omitempty" json:"profile_dir,omitempty"`
}

CDPRef configures the v0.12.0-beta.3 CDP-injection mode. When Enabled, the sink launches a headless Chrome via chromedp after each /sync and pushes the synced cookies through Storage.setCookies. Chrome encrypts its own SQLite with its own Safe Storage key; agentcookie never reads Chrome's Keychain item on this path.

type ChromeRef

type ChromeRef struct {
	DBPath string `yaml:"db_path" json:"db_path"`
}

type CmuxRef

type CmuxRef struct {
	Enabled bool `yaml:"enabled" json:"enabled"`
	// CmuxPath overrides the cmux CLI location. Empty uses the
	// canonical app-bundle path with a PATH fallback (see
	// internal/sinkpush.NewCmux).
	CmuxPath string `yaml:"cmux_path,omitempty" json:"cmux_path,omitempty"`
	// DomainFilter narrows which cookies reach cmux, as SQLite-LIKE
	// host_key patterns (e.g. "%github.com"). Empty means deliver the
	// full synced set (after the sink's blocklist filter).
	DomainFilter []string `yaml:"domain_filter,omitempty" json:"domain_filter,omitempty"`
}

CmuxRef configures the cmux cookie-delivery surface (a fourth surface alongside Chrome SQLite, the sidecar, and the per-CLI adapters). When Enabled, the sink injects the synced cookies into cmux's embedded WebKit browser after each /sync via `cmux rpc browser.cookies.set`, so an agent driving cmux's browser wakes up authenticated. cmux holds its own WebKit cookie jar (separate from Chrome's SQLite), so this surface is purely additive.

omitempty keeps a pre-cmux sink.yaml valid with the surface off: an absent block decodes to Enabled=false and the sink never touches cmux.

NOTE: cmux's RPC socket defaults to socketControlMode "cmuxOnly", which rejects this sink (a LaunchAgent, not a cmux child). `agentcookie doctor` detects that and prints the one-line remediation (socketControlMode allowAll/password in ~/.config/cmux/cmux.json, then a full cmux restart -- the mode is read only at app launch).

type CookiePolicy

type CookiePolicy string

const (
	CookiePolicyBlocklist CookiePolicy = "blocklist"
	CookiePolicyAllowlist CookiePolicy = "allowlist"
)

type ListenRef

type ListenRef struct {
	Addr string `yaml:"addr" json:"addr"`
}

type PeerRef

type PeerRef struct {
	Hostname string `yaml:"hostname" json:"hostname"`
}

PeerRef names the other side of a paired sync relationship. Hostname is the key under ~/.config/agentcookie/keys/.

type SecurityRef

type SecurityRef struct {
	SharedSecret string `yaml:"shared_secret" json:"-"` // never marshal to JSON
}

SecurityRef holds transport credentials. SharedSecret is the pre-pairing stopgap; U5 replaces it with a pairing-derived per-peer key persisted in the OS keychain.

type SinkConfig

type SinkConfig struct {
	Listen           ListenRef   `yaml:"listen" json:"listen"`
	Chrome           ChromeRef   `yaml:"chrome" json:"chrome"`
	Peer             PeerRef     `yaml:"peer,omitempty" json:"peer,omitempty"`
	Security         SecurityRef `yaml:"security,omitempty" json:"security,omitempty"`
	SkipChromeSQLite bool        `yaml:"skip_chrome_sqlite,omitempty" json:"skip_chrome_sqlite,omitempty"`
	CDP              CDPRef      `yaml:"cdp,omitempty" json:"cdp,omitempty"`
	Cmux             CmuxRef     `yaml:"cmux,omitempty" json:"cmux,omitempty"`
	Delivery         string      `yaml:"delivery,omitempty" json:"delivery,omitempty"`
}

SinkConfig captures the sink machine's settings.

SkipChromeSQLite is the v0.12.0-beta.3 headless-sink flag. When true, the sink never reads Chrome Safe Storage and never writes Chrome's SQLite/leveldb/indexeddb files. The sidecar (~/.agentcookie/cookies-plain.db, pair-derived shared key) and adapter push (per-PP-CLI session files) remain the cookie-delivery paths and are unaffected. This unblocks SSH-only installs on headless Mac minis where no GUI session can answer the Chrome Safe Storage Keychain prompt.

Delivery is the v0.13 universal-cookie-delivery marker. It records the INTENT a wizard install resolved to, so `doctor` can report "any cookie CLI works here" vs "degraded" without re-inferring it from SkipChromeSQLite + keychain probe state. Values: "universal" (real Default Chrome profile + any-app keychain open) or "degraded" (the -T/skip_chrome_sqlite opt-out). It is omitempty: an existing sink.yaml written before this field keeps its current behavior with no migration and no silent flip on a binary upgrade.

func LoadSink

func LoadSink(dir string) (*SinkConfig, error)

LoadSink reads sink.yaml from dir.

type SinkRef

type SinkRef struct {
	URL string `yaml:"url" json:"url"`
}

type SourceConfig

type SourceConfig struct {
	Sink     SinkRef     `yaml:"sink" json:"sink"`
	Chrome   ChromeRef   `yaml:"chrome" json:"chrome"`
	Browser  BrowserRef  `yaml:"browser,omitempty" json:"browser,omitempty"`
	Peer     PeerRef     `yaml:"peer,omitempty" json:"peer,omitempty"`
	Security SecurityRef `yaml:"security,omitempty" json:"security,omitempty"`
	// Cmux configures the same-machine local loop: `agentcookie cmux-sync`
	// reads this machine's Chrome and injects into this machine's cmux
	// browser. Independent of the sink/peer push path; absent = loop off.
	// Reuses the CmuxRef shape (see SinkConfig.Cmux).
	Cmux CmuxRef `yaml:"cmux,omitempty" json:"cmux,omitempty"`
}

SourceConfig captures the source machine's settings: where to push, which Chrome profile to read from, and how transport is authenticated. After pairing (U5), Peer.Hostname references a key in the keystore. The legacy Security.SharedSecret field is kept for backwards compat with v0 configs that predate pairing.

func LoadSource

func LoadSource(dir string) (*SourceConfig, error)

LoadSource reads source.yaml from dir.

func LoadSourceLocal

func LoadSourceLocal(dir string) (*SourceConfig, error)

LoadSourceLocal loads source.yaml for local-only consumers like `cmux-sync`, which read Chrome and act on this machine alone. Unlike LoadSource it does NOT require sink.url or a peer/secret -- the local loop has no push target, so demanding push config would break the documented "no sink, no peer" use case. A missing source.yaml is fine: it yields defaults (default Chrome path, no blocklist, cmux off).