Managed and user configuration: paths, providers, and merge.
Writes live in deepagents_code.configuration.writer and are imported from
there directly, so no writer symbol is re-exported here.
Return the fixed managed-config path for the current operating system.
For display and error messages. Anything that decides whether policy is
enforceable wants resolve_managed_path.
Return the fixed managed-config path and whether it is authoritative.
What the snapshot loader reads. Callers that report health need this rather
than managed_config_path, so a guessed path is never mistaken for an
authoritative one.
Load one user snapshot and the current managed snapshot.
Managed policy is included exactly when user_path is None, which is
what every production caller passes. Reading an explicit path is a
test-and-tooling operation on one file, and its result must not be mistaken
for the effective configuration.
Deliberately not a caller-supplied flag: an include_managed=False source
is indistinguishable from a machine with no policy installed, because the
fabricated status reports MISSING and the table is empty. Deriving it here
keeps that state one keyword out of reach.
Drop the cached managed snapshot.
Test-only. Production reloads pass refresh=True instead, which keeps the
last snapshot that parsed cleanly if the new one fails; clearing the cache
first would leave readers with an empty managed table on a failed reload.
Return managed provider health for diagnostics and config inspection.
Classify what managed policy says at one manifest path.
Return both halves of exit 78 for one managed snapshot.
Reading health and violations as two calls is a live bug, not a style
choice. get_managed_snapshot declines to cache a candidate it cannot
enforce, so a refreshed status describes the file on disk while a second,
non-refreshed violation read still sees the last enforceable snapshot and
reports none. Every diagnostic surface then shows ok for the exact file
that just refused to launch. One snapshot, both answers.
Return managed settings whose declaration cannot be safely applied.
A key is a violation when an enforced managed policy declaration cannot be applied, or when a known managed section has a non-table value. The shape cases matter because "wrong shape" is not "absent": merging such a value can erase a user subtree before a reader falls back to a default.
Required rather than defaulted to the process snapshot: managed_health
pairs this with the health of the same snapshot, and a default that
silently read the cache is what let a refreshed status be reported next to
stale violations.
Fail startup when present managed policy cannot be parsed or enforced.
A file that parses is not necessarily enforceable: a privilege-affecting key can carry a value the manifest rejects, or a known section can be a scalar instead of a table. Both can otherwise resolve in the user's favor or erase a user subtree, so they stop the launch here rather than at each consumer.
Where managed policy is read from, and whether that location is certain.
fallback holds why the path is a guess, or None when the path is
authoritative. A failed registry query leaves the lookup pointing at the
hardcoded default. On a host whose ProgramData is relocated, the guessed
path holds no file, which reads as "no administrator deployed policy" — the
same state as a machine with no policy at all. The reason travels with the
path so the two can never be confused: a guessed path yields an
INDETERMINATE snapshot rather than a clean MISSING one.
Raised when an enforced managed source cannot be read safely.
Provider health and policy enforceability from one managed snapshot.
Raised when managed policy declares a value that cannot be enforced.
The file parses, so provider health is OK; the policy it states is what
cannot be applied. A subclass of ManagedConfigError so every caller that
already fails closed on an unreadable file fails closed here too.
