config

type ClaudeConfig struct {
	// Model selects the Claude model (e.g. "claude-sonnet-4-20250514", "sonnet", "opus").
	Model string `yaml:"model"`
	// SystemPrompt overrides the default system prompt entirely.
	SystemPrompt string `yaml:"systemPrompt"`
	// AppendSystemPrompt is appended to the default system prompt.
	AppendSystemPrompt string `yaml:"appendSystemPrompt"`
	// MaxTurns limits agentic turns per prompt; 0 means unlimited.
	MaxTurns int `yaml:"maxTurns"`
	// PermissionMode controls how Claude handles tool permissions.
	// Valid values: "default", "acceptEdits", "bypassPermissions", "dontAsk", "plan", "delegate".
	PermissionMode string `yaml:"permissionMode"`
	// MCPConfigPath is a path to an MCP servers configuration file.
	MCPConfigPath string `yaml:"mcpConfigPath"`
	// StrictMCPConfig when true only uses MCP servers from MCPConfigPath.
	StrictMCPConfig bool `yaml:"strictMcpConfig"`
	// Workspace is the working directory for the Claude subprocess.
	Workspace string `yaml:"workspace"`
	// MaxBudgetUSD caps the maximum dollar spend per invocation; 0 means no limit.
	MaxBudgetUSD float64 `yaml:"maxBudgetUSD"`
	// Effort controls the effort level: "low", "medium", "high"; empty means default.
	Effort string `yaml:"effort"`
	// FallbackModel specifies a model to use when the primary is overloaded.
	FallbackModel string `yaml:"fallbackModel"`
	// JSONSchema constrains the output to conform to a JSON Schema.
	JSONSchema string `yaml:"jsonSchema"`
	// SettingsFile is a path to a settings JSON file or inline JSON string.
	SettingsFile string `yaml:"settingsFile"`
	// SettingSources controls which setting sources are loaded (comma-separated: "user,project,local").
	SettingSources string `yaml:"settingSources"`
	// Tools controls the base set of built-in tools available.
	Tools []string `yaml:"tools"`
	// AllowedTools restricts tool access; empty means all allowed.
	AllowedTools []string `yaml:"allowedTools"`
	// DisallowedTools explicitly blocks specific tools.
	DisallowedTools []string `yaml:"disallowedTools"`
	// PluginDirs are directories to load plugins from.
	PluginDirs []string `yaml:"pluginDirs"`
	// AddDirs are directories to search for .claude/ subdirectories.
	AddDirs []string `yaml:"addDirs"`
	// Agents defines custom subagents as a raw JSON string.
	// Parsed into map[string]AgentConfig by the caller.
	Agents string `yaml:"agents"`
	// ActiveAgent selects which agent runs as the top-level agent.
	ActiveAgent string `yaml:"activeAgent"`
	// Mode selects the operating mode: "agent" (default) or "chat".
	// agent: single-shot Process subprocess with --no-session-persistence.
	// chat: PersistentProcess subprocess with sessions saved to disk.
	Mode string `yaml:"mode"`
}

type Config struct {
	// Claude holds settings passed to the Claude Code subprocess.
	Claude ClaudeConfig `yaml:"claude"`

	// Server holds settings consumed by the klaus HTTP server itself.
	Server ServerConfig `yaml:"server"`

	// OAuth holds OAuth 2.1 authentication settings.
	OAuth OAuthFileConfig `yaml:"oauth"`
}

type DexConfig struct {
	IssuerURL    string `yaml:"issuerURL"`
	ClientID     string `yaml:"clientID"`
	ClientSecret string `yaml:"clientSecret"`
	ConnectorID  string `yaml:"connectorID"`
	CAFile       string `yaml:"caFile"`
}

type GoogleConfig struct {
	ClientID     string `yaml:"clientID"`
	ClientSecret string `yaml:"clientSecret"`
}

type OAuthFileConfig struct {
	// Enabled turns on OAuth 2.1 authentication for the MCP endpoint.
	Enabled bool `yaml:"enabled"`
	// BaseURL is the server base URL (e.g., https://klaus.example.com).
	BaseURL string `yaml:"baseURL"`
	// Provider specifies the OAuth provider: "dex" or "google".
	Provider string `yaml:"provider"`

	// Google holds Google-specific OAuth credentials.
	Google GoogleConfig `yaml:"google"`
	// Dex holds Dex-specific OIDC credentials.
	Dex DexConfig `yaml:"dex"`

	// Security holds token encryption and registration settings.
	Security SecurityFileConfig `yaml:"security"`
	// TLS holds optional TLS certificate paths for HTTPS.
	TLS TLSFileConfig `yaml:"tls"`
	// DisableStreaming disables streaming for streamable-http transport.
	DisableStreaming bool `yaml:"disableStreaming"`
}

type SecurityFileConfig struct {
	// EncryptionKey is a base64-encoded AES-256 key for token encryption (32 bytes decoded).
	EncryptionKey                    string   `yaml:"encryptionKey"`
	RegistrationToken                string   `yaml:"registrationToken"`
	AllowPublicRegistration          bool     `yaml:"allowPublicRegistration"`
	AllowInsecureAuthWithoutState    bool     `yaml:"allowInsecureAuthWithoutState"`
	MaxClientsPerIP                  int      `yaml:"maxClientsPerIP"`
	EnableCIMD                       *bool    `yaml:"enableCIMD"`
	CIMDAllowPrivateIPs              bool     `yaml:"cimdAllowPrivateIPs"`
	TrustedPublicRegistrationSchemes []string `yaml:"trustedPublicRegistrationSchemes"`
	DisableStrictSchemeMatching      bool     `yaml:"disableStrictSchemeMatching"`
}

type ServerConfig struct {
	// Port is the HTTP listen port (default "8080").
	Port string `yaml:"port"`
	// OwnerSubject restricts /mcp to the configured identity.
	OwnerSubject string `yaml:"ownerSubject"`
}

type TLSFileConfig struct {
	CertFile string `yaml:"certFile"`
	KeyFile  string `yaml:"keyFile"`
}