config

type Config struct {
	// DefaultAgent is used when a tool call does not specify one.
	DefaultAgent string

	// ClaudeBin is the command (name in PATH or absolute path) used to launch
	// Claude Code. Defaults to "claude".
	ClaudeBin string

	// CursorBin is the command used to launch Cursor's headless agent when
	// auto-detection fails. Defaults to "cursor-agent".
	CursorBin string

	// PermissionMode is passed to Claude Code's --permission-mode. Because the
	// agent runs headless (no human at the terminal to approve prompts), this
	// governs how autonomous it is. See README for the safety trade-offs.
	PermissionMode string

	// AllowedTools / DisallowedTools are passed to Claude Code's --allowedTools
	// and --disallowedTools (patterns supported, e.g. "Bash(git push:*),Edit").
	//
	// Important, verified against Claude Code 2.1.207: a headless `-p` run
	// EXECUTES tool calls by default, and --allowedTools is ADDITIVE (it only
	// pre-approves / removes prompts) — it does NOT act as an exclusive allowlist.
	// The reliable restriction is DisallowedTools, which hard-denies matching
	// tools/commands. This is server-side policy tool callers cannot override.
	AllowedTools    string
	DisallowedTools string

	// AllowExtraArgs controls whether tool calls may append arbitrary CLI flags
	// to the agent through the `extra_args` parameter.
	//
	// It defaults to FALSE, and that default is a security boundary: the client
	// driving this server is itself a model, and `extra_args` is appended after
	// the flags configured here. Left open, a caller could pass
	// --dangerously-skip-permissions (or its own --allowedTools) and silently
	// void the policy the operator configured. Only enable it when you trust the
	// caller as much as you trust your own shell.
	AllowExtraArgs bool

	// ClaudeExtraArgs / CursorExtraArgs are appended verbatim to every launch,
	// letting the user tune flags without a rebuild.
	ClaudeExtraArgs []string
	CursorExtraArgs []string

	// AppendSystemPrompt is added to Claude Code's system prompt on every task
	// (--append-system-prompt). Use it for standing, machine-specific guidance —
	// e.g. "for SSH to internal servers use the full Windows OpenSSH path, the
	// bare ssh can't reach the 1Password agent".
	AppendSystemPrompt string

	// CustomName / CustomBin / CustomArgs configure the generic adapter, which
	// can drive any CLI agent without writing Go. CustomArgs is a template whose
	// entries may contain {{prompt}}, {{cwd}}, {{model}} and {{session}}.
	CustomName string
	CustomBin  string
	CustomArgs []string

	// DefaultCwd is the working directory used when a tool call omits `cwd`.
	// Empty means "the server process's own working directory".
	DefaultCwd string

	// AllowedCwds, when non-empty, restricts every task's working directory to
	// live under one of these roots. A safety guardrail against a delegating
	// model wandering the filesystem.
	AllowedCwds []string

	// MaxTasks caps the number of tasks retained in memory.
	MaxTasks int

	// WorktreeDir is where isolated task checkouts are created. Empty puts them
	// alongside the task records, under StateDir — anywhere but inside the
	// repository, which would make them show up as untracked clutter in the very
	// diff they exist to produce.
	WorktreeDir string

	// MaxCostUSD bounds what one task may spend, in US dollars. Zero disables it.
	//
	// It is enforced in two places because neither alone is enough. Claude Code
	// is given the figure as --max-budget-usd, which it applies itself and can
	// act on mid-turn — that is the real protection. But that flag is per
	// invocation, so a task driven through ten follow-ups would get the whole
	// budget ten times over; the server therefore also tracks what a task has
	// spent across all its turns and refuses to start another once it is over.
	MaxCostUSD float64

	// MaxConcurrent caps how many workers may run at the same time. It is a
	// different limit from MaxTasks, which only bounds retained records: a
	// headless coding agent is a heavyweight process, so an orchestrator that
	// fans out ten tasks can exhaust the machine while every other limit still
	// looks satisfied. Zero means no limit.
	MaxConcurrent int

	// AuditLog is a file path for a JSONL audit trail of everything the worker
	// was asked to do. Empty disables it.
	AuditLog string

	// WatchWindow bounds how long a single agent_watch call blocks before
	// returning a resumable partial result. It exists because clients cap tool
	// calls: blocking past that cap loses the response entirely, so the server
	// returns first and tells the caller to come back.
	WatchWindow time.Duration

	// StateDir is where the task registry and the instance lock live, so a
	// restarted or second server instance can still see earlier tasks. Empty
	// means the per-user default.
	StateDir string

	// TaskTimeout, if > 0, cancels any turn that runs longer than this. It is a
	// safety net against a worker that hangs — e.g. blocked on a permission
	// prompt with no human to approve it. Zero means no timeout.
	TaskTimeout time.Duration

	// AskPermission lets a worker put a permission request to the person who
	// delegated the task, instead of stalling on a prompt nobody can answer.
	//
	// It is on by default and reaches every client. One that declared the
	// elicitation capability is asked directly; for the rest the request is
	// parked on the task and released by agent_answer_permission. Turning it
	// off restores the older behaviour, where a tool that is neither
	// pre-approved nor denied stalls until the task timeout.
	AskPermission bool

	// PermissionTimeout bounds how long a worker waits for that answer. It has
	// to be generous — there is a human at the other end who may be looking at
	// something else — but finite, or an unattended run waits forever.
	PermissionTimeout time.Duration

	// Compact controls whether agent_get_output / agent_watch return a filtered,
	// human-readable transcript by default (dropping the noisy init/config dump)
	// rather than raw JSONL.
	Compact bool

	// Token is the pairing credential the launching client presented, proving it
	// is one this server was configured for. It is set by `cli-agent-mcp pair`
	// in the client's own config, never by hand here. Empty means none was
	// offered, which only matters once the server has been paired.
	//
	// It authorizes the launch. It does not protect the MCP conversation, which
	// runs over a private pipe with nothing on it to intercept — see
	// internal/pairing for what this does and does not buy.
	Token string
}