config

const (
	DefaultMaxInFlightToolCalls           = 4
	DefaultToolTimeout                    = 45 * time.Second
	MinToolTimeout                        = 5 * time.Second
	MaxToolTimeout                        = 10 * time.Minute
	DefaultMaxMessageSize                 = 4 * 1024 * 1024
	DefaultMaxToolResultBytes             = 50_000
	MaxMessageSize                        = 100 * 1024 * 1024
	MaxToolResultBytes                    = 100 * 1024 * 1024
	DefaultToolset                        = "default"
	DefaultToolRateLimitPerMinute         = 120
	DefaultReadRateLimitPerMinute         = 120
	DefaultWriteRateLimitPerMinute        = 30
	DefaultBillingAdminRateLimitPerMinute = 10
	DefaultDestructiveRateLimitPerMinute  = 5
	DefaultCircuitBreakerFailureThreshold = 5
	DefaultCircuitBreakerOpenDuration     = 45 * time.Second
	DefaultCircuitBreakerHalfOpenProbes   = 1
)

Runtime defaults and ceilings for OneUserConfig. Defaults apply when the corresponding environment variable is unset or empty; Min/Max constants bound user-supplied overrides so a misconfigured env cannot disable tool timeouts or accept unbounded request bodies. The rate limit defaults are per-minute token-bucket budgets and `0` means unlimited (the limiter is disabled).

const DefaultBaseURL = "https://api.clockify.me/api/v1"

DefaultBaseURL is the production Clockify REST API base used when CLOCKIFY_BASE_URL is not set. LoadOneUser rejects overrides that do not point at a documented Clockify host (api.clockify.me, reports.api.clockify.me, auditlog-api.api.clockify.me) or at a loopback target (localhost / 127.x.x.x, for the fake-server fixture and local proxies), unless CLOCKIFY_ALLOW_CUSTOM_BASE_URL=true is set to permit an arbitrary HTTPS host. The allowlist prevents a stray override from silently exfiltrating the API key to a non-Clockify endpoint.