bastion 0.53.2

client-go/agents_other.go

@@ -0,0 +1,36 @@
+//go:build !linux && !darwin && !windows
+
+package main
+
+import "errors"
+
+// Observe-plane stub for platforms with no enumerator. The bastion still runs
+// — tunnel, grants, DCN, every lane — it simply reports that it cannot watch
+// itself, rather than reporting an empty agent list that would be read as
+// "nothing running here". agentScanSupported is what keeps those two apart:
+// the heartbeat withholds the "agent-observe" capability, so the host can say
+// "this box is not watching" instead of "this box is quiet".
+
+const (
+	agentScanSupported = false
+	agentScanKind      = "unsupported"
+)
+
+// errNoEnumerator: the walk cannot happen here, so scanAgents fails and the
+// heartbeat carries no `agents` key at all — the same absence a scan failure
+// produces elsewhere, and the host reads both as "did not look".
+var errNoEnumerator = errors.New("no process enumerator on this platform")
+
+func scanProcesses() (map[int]agentObs, error) { return nil, errNoEnumerator }
+func scanConnections() []connObs               { return []connObs{} }
+func procUser(pid int) string                  { return "" }
+func procCmdline(pid int) string               { return "" }
+func procEnvToken(pid int) string              { return "" }
+
+// procExe: no enumerator, so no kernel path — and an empty one is honest here
+// in a way a guess never could be. sanction.go refuses to mark an observation
+// that has none, which on this build means nothing can be marked at all; that
+// is the same "cannot watch itself" answer agentScanSupported already gives.
+func procExe(pid int) string      { return "" }
+func procParent(pid int) int      { return 0 }
+func processParents() map[int]int { return map[int]int{} }