config

type APIAuthConfig struct {
	// PasswordHash is a bcrypt hash of the dashboard password. Generated via `denkeeper passwd`.
	PasswordHash string `toml:"password_hash"`
	// SessionSecret is a hex-encoded AES key (≥32 bytes) for encrypting session cookies.
	// Required when either password or OIDC auth is configured.
	SessionSecret string `toml:"session_secret"`
	// SessionMaxAge is the session cookie lifetime as a Go duration string. Default: "24h".
	SessionMaxAge string `toml:"session_max_age"`
	// OIDC configures optional OpenID Connect SSO.
	OIDC OIDCConfig `toml:"oidc"`
}

type APIConfig struct {
	// Enabled controls whether the API server starts. Default: true.
	// Use a pointer so that an omitted field can be distinguished from an
	// explicit false, allowing applyDefaults to set the value to true when
	// unspecified.
	Enabled *bool `toml:"enabled"`

	// Listen is the address to listen on (e.g. "0.0.0.0:8443", ":8080").
	Listen string `toml:"listen"`

	// TLS enables HTTPS. When true, CertFile and KeyFile are required.
	TLS      bool   `toml:"tls"`
	CertFile string `toml:"cert_file"`
	KeyFile  string `toml:"key_file"`

	// CORS configures allowed origins for cross-origin requests.
	// Empty means no CORS headers are sent.
	CORSOrigins []string `toml:"cors_origins"`

	// RateLimit is the maximum requests per second per API key. 0 = unlimited.
	RateLimit float64 `toml:"rate_limit"`

	// Keys defines API keys with scoped permissions.
	Keys []APIKeyConfig `toml:"keys"`

	// Auth configures optional password and OIDC authentication for the dashboard.
	Auth APIAuthConfig `toml:"auth"`

	// LoginRateLimit is the maximum number of password login attempts per IP
	// within LoginRateWindow before requests are rejected with 429.
	// Default: 5. Set to 0 to disable login rate limiting.
	LoginRateLimit *int `toml:"login_rate_limit"`

	// LoginRateWindow is the duration (Go duration string) of the login rate
	// limit window. Default: "15m".
	LoginRateWindow string `toml:"login_rate_window"`

	// WebSocketEnabled controls whether the WebSocket endpoint (GET /api/v1/ws)
	// is available. Default: true. Use a pointer so omitted = true.
	WebSocketEnabled *bool `toml:"websocket_enabled"`

	// WebSocketMaxConnections is the maximum number of concurrent WebSocket
	// connections. 0 = unlimited.
	WebSocketMaxConnections int `toml:"websocket_max_connections"`

	// WebSocketReplayBufferTTL is how long to buffer events for replay after
	// a client disconnects. Parsed as time.Duration. Default: "5m".
	WebSocketReplayBufferTTL string `toml:"websocket_replay_buffer_ttl"`

	// ExternalURL is the publicly-reachable base URL for this instance.
	// Used for constructing OAuth callback URLs for remote MCP tool authorization.
	// If empty, defaults to http(s)://<listen>.
	ExternalURL string `toml:"external_url"`

	// Timezone is the IANA timezone name used for evaluating cron schedule
	// expressions (e.g. "America/New_York", "Europe/London"). Default: "UTC".
	// Changes take effect after restart.
	Timezone string `toml:"timezone"`
}

type APIKeyConfig struct {
	// Name is a human-readable label for this key.
	Name string `toml:"name"`

	// Key is the secret API key value. Loaded from config or env.
	Key string `toml:"key"`

	// Scopes controls what this key can access.
	// Valid scopes: "chat", "sessions:read", "costs:read", "skills:read",
	// "skills:write", "schedules:read", "schedules:write", "approvals:read",
	// "approvals:write", "tools:read", "tools:write", "browser:read",
	// "browser:write", "health", "admin".
	Scopes []string `toml:"scopes"`
}

type AgentConfig struct {
	PersonaDir string `toml:"persona_dir"`
	SkillsDir  string `toml:"skills_dir"` // defaults to ~/.denkeeper/skills
}

type AgentInstanceConfig struct {
	// Name is a unique identifier for this agent. One agent must be named "default".
	Name string `toml:"name"`

	// Description is a human-readable summary of the agent's purpose.
	Description string `toml:"description"`

	// PersonaDir is the path to the agent's persona directory (SOUL.md, USER.md, MEMORY.md).
	PersonaDir string `toml:"persona_dir"`

	// SkillsDir overrides the global skills directory for this agent. If empty,
	// the global skills directory is used. Agent-specific skills in
	// <persona_dir>/skills/ are always loaded and override global skills by name.
	SkillsDir string `toml:"skills_dir"`

	// Adapters lists the adapter bindings for this agent.
	// "telegram" — wildcard: all messages on that adapter go to this agent.
	// "telegram:12345" — specific: only messages from that chat ID.
	Adapters []string `toml:"adapters"`

	// LLMModel overrides the global default_model for this agent.
	LLMModel string `toml:"llm_model"`

	// SessionTier overrides the global session.tier for this agent.
	SessionTier string `toml:"session_tier"`

	// BrowserURLAllowlist overrides the global browser URL allowlist for this agent.
	// If set, only these domains are reachable. Supports wildcards: "*.example.com".
	BrowserURLAllowlist []string `toml:"browser_url_allowlist"`

	// CostLimitSoft overrides the global cost_limit_soft for this agent.
	// Nil means inherit global. 0 means disabled.
	CostLimitSoft *float64 `toml:"cost_limit_soft"`

	// CostLimitHard overrides the global cost_limit_hard for this agent.
	// Nil means inherit global. 0 means disabled.
	CostLimitHard *float64 `toml:"cost_limit_hard"`
}

type AnthropicConfig struct {
	// APIKey is the Anthropic API key (sk-ant-...). Required to enable the provider.
	APIKey string `toml:"api_key"`
	// BaseURL overrides the default API endpoint. Useful for Bedrock/Vertex proxies.
	BaseURL string `toml:"base_url"`
}

type BrowserConfig struct {
	// Enabled controls whether browser automation is available. Default: false.
	Enabled bool `toml:"enabled"`
	// Image is the Docker/OCI image for the browser plugin. Default: "ghcr.io/temikus/denkeeper-browser:latest".
	Image string `toml:"image"`
	// MemoryLimit is the container memory limit. Default: "512m".
	MemoryLimit string `toml:"memory_limit"`
	// CPULimit is the container CPU limit. Default: "1".
	CPULimit string `toml:"cpu_limit"`
	// ProfileDir is the base directory for per-agent browser profiles, relative to the data directory.
	// Default: "data/browser-profiles".
	ProfileDir string `toml:"profile_dir"`
	// SessionTTL is the duration after which an idle browser session is closed. Default: "10m".
	SessionTTL string `toml:"session_ttl"`
	// MaxPages is the maximum number of concurrent pages per agent. Default: 5.
	MaxPages int `toml:"max_pages"`
	// URLAllowlist restricts which domains the browser can navigate to.
	// Empty list means unrestricted. Supports wildcards: "*.example.com".
	URLAllowlist BrowserURLAllowlist `toml:"url_allowlist"`
}

type BrowserURLAllowlist struct {
	// Domains is the list of allowed domains. Empty = unrestricted.
	// Supports wildcards: "*.example.com" matches all subdomains.
	Domains []string `toml:"domains"`
}

type Config struct {
	DataDir   string                  `toml:"data_dir"` // base directory for all data; defaults to ~/.denkeeper
	Telegram  TelegramConfig          `toml:"telegram"`
	Discord   DiscordConfig           `toml:"discord"`
	LLM       LLMConfig               `toml:"llm"`
	Memory    MemoryConfig            `toml:"memory"`
	Log       LogConfig               `toml:"log"`
	Agent     AgentConfig             `toml:"agent"`
	Session   SessionConfig           `toml:"session"`
	Agents    []AgentInstanceConfig   `toml:"agents"`
	Schedules []ScheduleConfig        `toml:"schedules"`
	Tools     map[string]ToolConfig   `toml:"tools"`
	MaxTools  int                     `toml:"max_tools"` // combined limit for tools + plugins; 0 = default (50)
	Plugins   map[string]PluginConfig `toml:"plugins"`
	Voice     VoiceConfig             `toml:"voice"`
	API       APIConfig               `toml:"api"`
	Security  SecurityConfig          `toml:"security"`
	KV        KVConfig                `toml:"kv"`
	Sandbox   SandboxConfig           `toml:"sandbox"`
	Web       WebConfig               `toml:"web"`
	Browser   BrowserConfig           `toml:"browser"`
	OTel      OTelConfig              `toml:"otel"`
	MCP       MCPConfig               `toml:"mcp"`
	Costs     CostsConfig             `toml:"costs"`
}

type CostsConfig struct {
	// DefaultRatePerKTokens is the fallback rate (USD per 1K tokens) used when
	// the model is not found in the bundled registry or operator overrides.
	// Set to 0 to record $0.00 and emit a warning. Default: 0.
	DefaultRatePerKTokens float64 `toml:"default_rate_per_1k_tokens"`
	// ModelPrices allows operators to override or add model pricing.
	// Keys are model name prefixes; values are [input, output, cached_input]
	// rates per million tokens.
	ModelPrices map[string]ModelPriceConfig `toml:"model_prices"`
}

type DiscordConfig struct {
	// Token is the Discord bot token. Required to enable the Discord adapter.
	Token string `toml:"token"`
	// AllowedUsers is a list of Discord user snowflake IDs (as strings) that
	// may interact with the bot. Required when token is set.
	AllowedUsers []string `toml:"allowed_users"`
}

type FallbackConfig struct {
	Trigger    string  `toml:"trigger"`     // "error" | "rate_limit" | "low_funds"
	Action     string  `toml:"action"`      // "switch_provider" | "switch_model" | "wait_and_retry"
	Provider   string  `toml:"provider"`    // required for switch_provider
	Model      string  `toml:"model"`       // required for switch_model; optional for switch_provider
	Threshold  float64 `toml:"threshold"`   // required for low_funds (USD remaining)
	MaxRetries int     `toml:"max_retries"` // required for wait_and_retry
	Backoff    string  `toml:"backoff"`     // "exponential" (default) | "constant"
}

type JinaFetchConfig struct {
	// Enabled activates Jina Reader as a fallback for JS-heavy pages. Default: false.
	Enabled bool `toml:"enabled"`
}

type KVConfig struct {
	// MaxKeysPerAgent limits the number of keys each agent can store (0 = unlimited).
	MaxKeysPerAgent int `toml:"max_keys_per_agent"`
	// MaxValueBytes limits the size of each value in bytes.
	MaxValueBytes int `toml:"max_value_bytes"`
	// CleanupInterval is how often expired keys are purged (Go duration string).
	CleanupInterval string `toml:"cleanup_interval"`
}

type KubernetesSandboxConfig struct {
	// Namespace is the Kubernetes namespace for sandbox Pods. Default: "denkeeper-sandboxes".
	Namespace string `toml:"namespace"`
	// Kubeconfig is the path to a kubeconfig file. Empty uses in-cluster config.
	Kubeconfig string `toml:"kubeconfig"`
	// RuntimeClass is the Kubernetes RuntimeClassName for sandbox Pods (e.g. "gvisor", "kata").
	RuntimeClass string `toml:"runtime_class"`
}

type LLMConfig struct {
	DefaultProvider   string           `toml:"default_provider"`
	DefaultModel      string           `toml:"default_model"`
	OpenRouter        OpenRouterConfig `toml:"openrouter"`
	Ollama            OllamaConfig     `toml:"ollama"`
	Anthropic         AnthropicConfig  `toml:"anthropic"`
	OpenAI            OpenAIConfig     `toml:"openai"`
	MaxCostPerSession float64          `toml:"max_cost_per_session"` // Deprecated: use CostLimitHard.
	CostLimitSoft     float64          `toml:"cost_limit_soft"`
	CostLimitHard     float64          `toml:"cost_limit_hard"`
	Fallbacks         []FallbackConfig `toml:"fallback"`
}

type LogConfig struct {
	Level  string `toml:"level"`
	Format string `toml:"format"`
}

type MCPConfig struct {
	// RequestTimeoutSecs is the default per-request timeout for MCP calls. Default: 30.
	RequestTimeoutSecs int `toml:"request_timeout_secs"`
	// AutoRestart enables automatic restart of crashed MCP servers. Default: true.
	AutoRestart *bool `toml:"auto_restart"`
	// MaxRestartAttempts is the maximum number of consecutive restart attempts before
	// a server is disabled. Default: 3.
	MaxRestartAttempts int `toml:"max_restart_attempts"`
	// RestartCooldown is the duration a server must stay connected before its
	// consecutive failure counter resets (e.g. "5m"). Default: "5m".
	RestartCooldown string `toml:"restart_cooldown"`
	// URLAllowlist restricts which hosts SSE tool servers may connect to.
	// Supports wildcards (e.g. "*.internal.corp"). Empty = all non-blocked hosts allowed.
	URLAllowlist []string `toml:"url_allowlist"`
}

type MemoryConfig struct {
	DBPath string `toml:"db_path"`
}

type ModelPriceConfig struct {
	InputPerMTok       float64 `toml:"input"`
	OutputPerMTok      float64 `toml:"output"`
	CachedInputPerMTok float64 `toml:"cached_input"`
}

type OIDCConfig struct {
	// Enabled activates OIDC login.
	Enabled bool `toml:"enabled"`
	// Issuer is the OIDC discovery URL (e.g. "https://accounts.google.com").
	Issuer string `toml:"issuer"`
	// ClientID is the OAuth2 client ID.
	ClientID string `toml:"client_id"`
	// ClientSecret is the OAuth2 client secret.
	ClientSecret string `toml:"client_secret"`
	// RedirectURL is the callback URL (e.g. "https://myserver/auth/callback").
	RedirectURL string `toml:"redirect_url"`
	// Scopes requested from the OIDC provider. Default: ["openid", "email", "profile"].
	Scopes []string `toml:"scopes"`
	// AllowedEmails restricts login to these email addresses (case-insensitive).
	// Required when OIDC is enabled.
	AllowedEmails []string `toml:"allowed_emails"`
}

type OTelConfig struct {
	// Enabled activates OTel metric collection and Prometheus /metrics endpoint. Default: false.
	Enabled bool `toml:"enabled"`
	// TracesEndpoint is the OTLP HTTP endpoint for trace export (e.g. "localhost:4318").
	// When empty, tracing is disabled even if Enabled is true.
	TracesEndpoint string `toml:"traces_endpoint"`
	// ServiceName is the OTel service name. Default: "denkeeper".
	ServiceName string `toml:"service_name"`
}

type OllamaConfig struct {
	// BaseURL is the Ollama server address. Defaults to http://localhost:11434.
	BaseURL string `toml:"base_url"`
}

type OpenAIConfig struct {
	// APIKey is the OpenAI API key. Required to enable the provider.
	APIKey string `toml:"api_key"`
	// BaseURL overrides the default API endpoint. Useful for Azure, vLLM, etc.
	BaseURL string `toml:"base_url"`
	// Organization is the optional OpenAI organization ID.
	Organization string `toml:"organization"`
}

type OpenRouterConfig struct {
	APIKey string `toml:"api_key"`
}

type PluginConfig struct {
	// Type is the execution strategy: "subprocess" or "docker".
	Type    string            `toml:"type"`
	Command string            `toml:"command"`
	Args    []string          `toml:"args"`
	Env     map[string]string `toml:"env"`
	// Capabilities declares contracts this plugin satisfies.
	// Currently only "tools" is meaningful — registers the plugin as an MCP server.
	Capabilities []string `toml:"capabilities"`

	// Image is the Docker/OCI image to run (e.g. "myregistry/mcp-plugin:v1").
	// Required for docker plugins.
	Image string `toml:"image"`
	// MemoryLimit is the container memory limit (e.g. "256m", "1g").
	// Passed directly to --memory. Optional; no limit if empty.
	MemoryLimit string `toml:"memory_limit"`
	// CPULimit is the container CPU limit (e.g. "0.5", "2").
	// Passed directly to --cpus. Optional; no limit if empty.
	CPULimit string `toml:"cpu_limit"`
	// Network is the Docker network mode. Defaults to "none" (fully isolated).
	// Valid values: "none", "host", "bridge", or a named network.
	Network string `toml:"network"`
	// Volumes is a list of bind mounts in Docker format ("host:container[:ro]").
	Volumes []string `toml:"volumes"`
}

type SandboxConfig struct {
	// Runtime selects the sandbox backend: "docker" (default) or "kubernetes".
	Runtime string `toml:"runtime"`
	// Kubernetes holds Kubernetes-specific sandbox settings.
	Kubernetes KubernetesSandboxConfig `toml:"kubernetes"`
}

type ScheduleConfig struct {
	// Name is a unique identifier for this schedule. Required.
	Name string `toml:"name"`

	// Type classifies the schedule. Must be "system" or "agent". Required.
	Type string `toml:"type"`

	// Schedule is the timing expression. Required.
	Schedule string `toml:"schedule"`

	// Skill is the name of the skill to invoke on each run. Optional for
	// system schedules; typically required for agent schedules.
	Skill string `toml:"skill"`

	// SessionTier is the permission tier for the session spawned on each run.
	// Allowed values: "supervised" (default), "autonomous", "restricted".
	SessionTier string `toml:"session_tier"`

	// Channel is the adapter channel to deliver results to (e.g. "telegram:123456").
	Channel string `toml:"channel"`

	// SessionMode controls which conversation context is used for the scheduled run.
	// "shared" (default): reuses the channel's existing conversation history.
	// "isolated": creates a fresh conversation for each run with no prior context.
	SessionMode string `toml:"session_mode"`

	// Agent is the name of the agent that handles this schedule. Defaults to "default".
	Agent string `toml:"agent"`

	// Tags are freeform labels for organizing and filtering schedules.
	Tags []string `toml:"tags"`

	// Enabled controls whether this schedule is active. Use a pointer so that
	// an omitted field can be distinguished from an explicit false, allowing
	// applyDefaults to set the value to true when unspecified.
	Enabled *bool `toml:"enabled"`
}

type SecurityConfig struct {
	// TrustedKeys is a list of file paths to PEM-encoded Ed25519 public keys.
	// Plugins signed by any of these keys are trusted.
	TrustedKeys []string `toml:"trusted_keys"`
	// AllowUnsigned controls whether unsigned plugins are allowed.
	// Defaults to true. Set to false to require all plugins to be signed.
	AllowUnsigned *bool `toml:"allow_unsigned"`
}

type SessionConfig struct {
	Tier string `toml:"tier"` // "supervised" (default), "autonomous", "restricted"
}

type TelegramConfig struct {
	Token        string  `toml:"token"`
	AllowedUsers []int64 `toml:"allowed_users"`
}

type ToolConfig struct {
	Command            string            `toml:"command"`
	Args               []string          `toml:"args"`
	Env                map[string]string `toml:"env"`
	Transport          string            `toml:"transport"`            // "stdio" (default) or "sse"
	URL                string            `toml:"url"`                  // required for sse transport
	Headers            map[string]string `toml:"headers"`              // optional HTTP headers for sse
	RequestTimeoutSecs int               `toml:"request_timeout_secs"` // per-server override (0 = use global)

	// OAuth fields — only valid when Transport is "sse".
	Auth         string   `toml:"auth"`          // "" (none) or "oauth"
	ClientID     string   `toml:"client_id"`     // pre-registered OAuth client ID (optional)
	ClientSecret string   `toml:"client_secret"` // pre-registered OAuth client secret (optional)
	Scopes       []string `toml:"scopes"`        // OAuth scopes to request (optional)

	// Unsafe options.
	AllowLoopback bool `toml:"allow_loopback"` // bypass SSRF loopback block (localhost/127.x/::1)
}

type VoiceConfig struct {
	STTProvider    string            `toml:"stt_provider"`     // "openai" or "" (disabled)
	TTSProvider    string            `toml:"tts_provider"`     // "openai" or "" (disabled)
	TTSVoice       string            `toml:"tts_voice"`        // e.g. "alloy"
	AutoVoiceReply bool              `toml:"auto_voice_reply"` // reply with voice when user sends voice
	OpenAI         VoiceOpenAIConfig `toml:"openai"`
}

type VoiceOpenAIConfig struct {
	APIKey string `toml:"api_key"`
}

type WebConfig struct {
	// Enabled controls whether web tools are available to agents. Default: true.
	// Use a pointer so that an omitted field can be distinguished from an
	// explicit false, allowing applyDefaults to set the value to true when
	// unspecified.
	Enabled *bool           `toml:"enabled"`
	Search  WebSearchConfig `toml:"search"`
	Fetch   WebFetchConfig  `toml:"fetch"`
}

type WebFetchConfig struct {
	// Timeout is the HTTP request timeout as a Go duration string. Default: "30s".
	Timeout string `toml:"timeout"`
	// MaxSizeBytes limits the response body size. Default: 5242880 (5MB).
	MaxSizeBytes int64 `toml:"max_size_bytes"`
	// UserAgent is the HTTP User-Agent header. Default: "Denkeeper/1.0 (+https://denkeeper.io)".
	UserAgent string `toml:"user_agent"`
	// RespectRobotsTxt checks robots.txt before fetching. Default: false.
	RespectRobotsTxt bool `toml:"respect_robots_txt"`
	// RespectAgentsTxt checks agents.txt before fetching. Default: false.
	RespectAgentsTxt bool `toml:"respect_agents_txt"`
	// Jina configures optional Jina Reader integration for JS-heavy pages.
	Jina JinaFetchConfig `toml:"jina"`
}

type WebSearchConfig struct {
	// Provider selects the search backend: "duckduckgo" (default) or "tavily".
	Provider string `toml:"provider"`
	// APIKey is required for providers that need authentication (e.g. Tavily).
	APIKey string `toml:"api_key"`
	// MaxResults is the default number of search results to return. Default: 5.
	MaxResults int `toml:"max_results"`
}