Resolve the on-disk path for a given SHA256 hash.

Push a log entry into the bus. Drops the oldest entry if at capacity. No-op if the bus is closed.

Check if the queue is empty.

Check whether a sample exists on disk.

Get the current number of tasks in the queue.

Store `msg` as the current thread-local error message. Any previously stored message is overwritten. The string is converted to a `CString`; if it c

Construct a healthy status.

Fetch a single machine by ID.

Send a task request. Returns a handle to receive streamed responses. `header` contains task_id and request_type. `payload` is postcard-serialized Tas

Update the lifecycle status of a machine, with an optional error message.

Take the entry for `handle`, removing it from the map. The returned entry's file has **not** been deleted - the caller (typically `on_pull_result`) r

Serialize a value as JSON and wrap it as a named result.

Push a single result back to the daemon. Small results (below the stash threshold) travel inline on the control stream. Large byte/JSON payloads are

Get a [`ResultSink`] for pushing results back to the daemon.

Create a libvirt domain with a COW disk overlay. Defines the domain in libvirt but does **not** boot it. Call [`start`] to boot.

Queue a command and wake the reactor thread.

Store sample bytes at the content-addressed path. Idempotent: if a file with this hash already exists, the write is skipped. Atomic: writes to a temp

Escape hatch - push any [`Block`] directly.

Append a section. The closure receives a [`SectionBuilder`] and returns it - the typical shape is `|s| s.heading(2, "...").table(...)`.

Non-blocking receive of the next response chunk. Returns None if no response is available yet.

Update the state of a task both in memory and database.

Finalize and return the [`Report`]. Merges any pending labels into the verdict.

Check a response for API-level errors (4xx/5xx with JSON body). Returns the response unchanged if status is success.

Get the Snapshot capability if available.

Get the libvirt connection.

Add a markdown text block.

Check a return code from a Malbox C API function. Throws malbox::Error (with message retrieved from malbox_last_error) if rc < 0.

Add an indicator of compromise to the report's semantic layer.

Clear the current thread-local error message. After this call [`malbox_last_error`] will return `-1` (no error).

Emit a task IPC event, logging errors but not propagating them.

Helper to create a MalboxEvent with null string pointers (most events).

Drain all buffered entries and return them.

Retrieve the last error message as a Rust `String`, if one is set.

Report execution progress (0.0 to 1.0) with a status message. Progress updates are streamed to the daemon in real-time and can be shown in the UI. Th

Push a single PluginResult to the daemon.

Get the current plugin snapshot. Cheap (Arc clone).

Enable a provider. Returns `false` when it was already enabled. The first enabled provider becomes the default.

Emit a signal-only event (no payload).

Flush a batch of PluginResult objects to the daemon.

Add a heading (level 1-6, maps to HTML heading levels).