config

type APIConfig struct {
	ApiURL    string
	ApiSecret string
	Models    []constant.Model
}

type Config struct {
	// OS / runtime
	OS string

	// Logging
	LogLevel  string  // default: "info"
	LogFormat string  // default: "text"
	LogDir    *string // default: nil → stdout only

	// Application
	AppEnv     string // default: "development"
	AppName    string // default: "evva" — the binary / brand name; drives AppHome layout.
	AppVersion string

	// Per-user home dir layout
	AppHome            string
	AppHomeSkillsDir   string
	AppHomeUserProfile string
	AppHomeConfigFile  string // absolute path to <app>-config.yml under AppHome/config/

	AutoCompactThreshold float64

	// Workdir layout
	WorkDir          string
	WorkDirSkillsDir string

	// llm providers(from <app>-config.yml) key: provider name, value: provider APIConfig
	LLMProviderConfig map[string]APIConfig

	// DefaultProvider / DefaultModel are the (provider, model) the agent
	// boots with. Sourced from <app>-config.yml; the /model switch updates
	// them in-memory and persists via SaveFile().
	DefaultProvider constant.LLMProvider
	DefaultModel    constant.Model

	// DefaultEffort is the user-facing effort level name: low|medium|high|ultra.
	// Defaults to "medium". Sourced from <app>-config.yml; /effort updates it.
	DefaultEffort string

	// DefaultProfile is the persona the root agent boots into ("evva", "nono",
	// etc). Sourced from <app>-config.yml; /profile updates it. Empty falls
	// back to "evva" at bootstrap so old configs keep working.
	DefaultProfile string

	// PermissionMode is the startup permission stance: one of
	// default|accept_edits|plan|bypass|auto. The -permission-mode CLI flag
	// overrides this at boot; the TUI's Shift+Tab cycle mutates the
	// in-memory value via SetPermissionMode (not yet persisted).
	PermissionMode string

	// Loaded metadata
	LoadedAt time.Time
	// DefaultMaxIterations is the loop's safety cap. Hitting it emits a
	// KindIterLimit event and pauses the agent; the caller may invoke
	// Continue(ctx) to keep going.
	DefaultMaxIterations int
	// DefaultMaxTokens is the per-completion output-token cap passed to
	// the LLM. 0 → let the provider apply its own default.
	DefaultMaxTokens int

	// UI
	DisplayThinking bool

	// Auto-memory subsystem. When true (default), the system prompt carries the
	// typed-memory guidance + the MEMORY.md index, the permission write carve-out
	// is active, and per-turn recall runs. The model writes memory files itself
	// with write/edit (no dedicated tool). /config (or hand-edit) flips this;
	// EVVA_AUTO_MEMORY=0 forces off at boot regardless of the YAML.
	EnableAutoMemory bool

	// EnableMemoryRecall gates the per-turn relevance side-query (only meaningful
	// when EnableAutoMemory is true). Default true; the cost-sensitive escape
	// hatch keeps the index but drops the extra completion per turn.
	EnableMemoryRecall bool

	// MemoryRecallModel optionally pins the recall side-query model id. Empty →
	// a cheap model within the active provider (anthropic: sonnet, deepseek:
	// flash, openai: gpt-5.4-mini, glm: glm-4.6 at medium effort; ollama/other:
	// the active model + the main agent's effort). See internal/agent recall wiring.
	MemoryRecallModel string

	// Auto-dream: background memory consolidation. When EnableAutoDream is true
	// (and EnableAutoMemory is true), the main agent — on going idle — may fork a
	// fenced background agent that consolidates the global memory store (merge
	// duplicates, prune stale entries, rebuild the MEMORY.md index). Gated so it
	// fires at most ~once per AutoDreamMinHours after AutoDreamMinSessions new
	// sessions. Off by default — a dream is a real (if rare) token cost. See the
	// internal/agent dream wiring + docs/roadmap/PRD/auto-dream.md.
	EnableAutoDream bool
	// AutoDreamMinHours is the minimum hours since the last consolidation before
	// dream may fire again (default 24).
	AutoDreamMinHours int
	// AutoDreamMinSessions is the minimum number of sessions touched since the
	// last consolidation before dream may fire (default 5).
	AutoDreamMinSessions int
	// AutoDreamModel optionally pins the dream agent's model id. Empty → the same
	// cheap per-provider default the recall side-query uses (see MemoryRecallModel).
	AutoDreamModel string

	// Checkpoint & rewind. When EnableCheckpoints is true (opt-in; off by default), the main
	// agent records a checkpoint at each user-turn boundary and captures the
	// before-image of every file its fs tools touch, so /rewind can restore the
	// code, the conversation, or both. CheckpointMaxPerSession caps how many
	// checkpoints one session retains (oldest pruned first; 0 = unlimited).
	// Storage lives under <workdir>/.evva/checkpoints — a .gitignore candidate.
	// See docs/roadmap/PRD/checkpoint-rewind.md.
	EnableCheckpoints       bool
	CheckpointMaxPerSession int

	// Repo map. When EnableRepoMap is true (opt-in; off by default), the main
	// agent's session-open prompt carries a compact, ranked, token-bounded
	// overview of the codebase's symbols, built from the LSP layer (or a glob
	// fallback when no language server is configured). RepoMapTokenBudget bounds
	// the map's size; the map is dropped lower-ranked-first to fit. Main agent
	// only. See docs/roadmap/PRD/lsp-repo-map.md.
	EnableRepoMap      bool
	RepoMapTokenBudget int

	// LSPDiagnosticsOnEdit gates the synchronous self-healing-edit tier. When
	// true (opt-in; off by default), the edit/write tools wait a short bounded
	// window (~750ms) after a mutation for LSP diagnostics on that file and
	// fold them into the tool's own result, so the model sees its own
	// compile/type error on the same turn it introduced it. The core tier
	// (didChange sync so the between-turns drain has real content to deliver)
	// runs regardless of this flag whenever an LSP manager is configured.
	// See docs/roadmap/PRD/edit-diagnostics-sync.md.
	LSPDiagnosticsOnEdit bool

	// Solo dynamic workflow. When EnableDynamicWorkflow is true (opt-in; off
	// by default), the main agent mounts the wf_task_* graph-board tools
	// (replacing todo_write) and an in-process engine auto-dispatches
	// ephemeral subagent workers as task dependencies complete.
	// WorkflowMaxWorkers bounds concurrent engine-dispatched workers
	// (default 4; floor 1). Solo main agent only — swarm-resident personas
	// never mount the board. See docs/roadmap/PRD/solo-dynamic-workflow.md.
	EnableDynamicWorkflow bool
	WorkflowMaxWorkers    int

	// OutputStyle names the active output style — a prompt overlay that
	// changes how the main persona talks (built-in "Explanatory"/"Learning"
	// or a custom output-styles/*.md). Empty means the default style (no
	// overlay). Resolution + fallback live in internal/outputstyle; this is
	// just the persisted name. /output-style updates it and rebuilds the
	// profile; /config edits take effect at the next profile build.
	OutputStyle string

	// Web tools
	TavilyAPIKey  string // empty → web_search reports "not configured"
	FetchMaxBytes int    // cap on extracted text returned by web_fetch

	// CustomConfig holds downstream-app-defined settings. Reads/writes go
	// through GetCustom / SetCustom / DeleteCustom under c.mu. Values
	// round-trip through YAML as a `custom:` section; complex types are
	// encoded as whatever gopkg.in/yaml.v3 produces for any (typically a
	// map[string]any tree). Consumers cast at use-site — pkg/config does
	// not know the value shapes.
	//
	// Use this slot for downstream-private secrets/settings that don't fit
	// the typed fields above (e.g. friday's broker URL, a billing token,
	// feature flags). evva itself never reads from CustomConfig.
	CustomConfig map[string]any

	// LLMParamsTemperature / LLMParamsTopP / LLMParamsTopK are session-only
	// sampling knobs the /config form mutates at runtime. nil → provider
	// default (not sent in API request). Reset to nil on every evva start;
	// never persisted to YAML.
	LLMParamsTemperature *float64
	LLMParamsTopP        *float64
	LLMParamsTopK        *int
	// contains filtered or unexported fields
}

type EnvOverride struct {
	Name string
	Fn   func(*Config) error
}

type FileConfig struct {
	MaxIterations        int     `yaml:"max_iterations"`
	MaxTokens            int     `yaml:"max_tokens"`
	AutoCompactThreshold float64 `yaml:"auto_compact_threshold"`
	DisplayThinking      bool    `yaml:"display_thinking"`

	// DefaultProvider / DefaultModel are the (provider, model) pair the
	// agent boots with. Phase 3's /model switch will mutate these and call
	// Save to persist across launches.
	DefaultProvider string `yaml:"default_provider"`
	DefaultModel    string `yaml:"default_model"`

	DefaultEffort string `yaml:"default_effort"`

	// DefaultProfile is the persona the root agent boots into. Phase 6's
	// /profile switch mutates this and calls Save to persist across launches.
	// Empty falls back to "evva" at bootstrap.
	DefaultProfile string `yaml:"default_profile"`

	// PermissionMode is the agent's startup stance. One of:
	// "default" | "accept_edits" | "plan" | "bypass" | "auto". Defaults to
	// "default" when omitted. The -permission-mode CLI flag overrides this.
	PermissionMode string `yaml:"permission_mode"`

	FetchMaxBytes int    `yaml:"fetch_max_bytes"`
	TavilyAPIKey  string `yaml:"tavily_api_key"`

	// EnableAutoMemory gates the typed-memory subsystem (the per-session prompt
	// guidance + MEMORY.md index, the write carve-out, and per-turn recall).
	// Default true; users opt out via /config or by setting this to false.
	// Pointer so a missing key in YAML preserves the default rather than zeroing.
	EnableAutoMemory *bool `yaml:"enable_auto_memory,omitempty"`

	// EnableMemoryRecall gates the per-turn relevance side-query that surfaces
	// stored memories matching the current prompt. Default true (when auto-memory
	// is on); the cost-sensitive escape hatch — set false to keep the MEMORY.md
	// index but drop the extra completion per turn. Pointer to preserve the
	// default on a missing key.
	EnableMemoryRecall *bool `yaml:"enable_memory_recall,omitempty"`

	// MemoryRecallModel optionally pins the model used for the recall side-query.
	// Empty → a cheap model within the active provider (anthropic: sonnet,
	// deepseek: flash, openai: gpt-5.4-mini at medium effort; ollama/other: the
	// active model + the main agent's effort). Set a specific model here to
	// override, e.g. a different cost lever or any model whose provider you have a
	// key for. Unknown values are ignored (fall back to the default resolution).
	MemoryRecallModel string `yaml:"memory_recall_model,omitempty"`

	// EnableAutoDream gates background memory consolidation (the "dream" pass).
	// Default false — opt-in, since each dream is a real (if rare) token cost.
	// Pointer so a missing key preserves the default rather than zeroing.
	EnableAutoDream *bool `yaml:"enable_auto_dream,omitempty"`
	// AutoDreamMinHours / AutoDreamMinSessions are the dream gate thresholds
	// (defaults 24 / 5); load normalizes ≤0 to the default. AutoDreamModel
	// optionally pins the dream agent's model (empty → the recall-style
	// per-provider default).
	AutoDreamMinHours    int    `yaml:"auto_dream_min_hours,omitempty"`
	AutoDreamMinSessions int    `yaml:"auto_dream_min_sessions,omitempty"`
	AutoDreamModel       string `yaml:"auto_dream_model,omitempty"`

	// EnableCheckpoints gates checkpoint/rewind. Default false — opt-in, since an
	// enabled session writes per-turn before-images under .evva/checkpoints. Set
	// true to record them so /rewind can restore code/conversation. Pointer so a
	// missing key preserves the default. CheckpointMaxPerSession caps retained
	// checkpoints per session (default 50; ≤0 normalizes to the default at load).
	EnableCheckpoints       *bool `yaml:"enable_checkpoints,omitempty"`
	CheckpointMaxPerSession int   `yaml:"checkpoint_max_per_session,omitempty"`

	// EnableRepoMap gates the LSP-backed repo map injected into the main agent's
	// session-open prompt. Default false — opt-in, since an enabled session runs
	// a workspace symbol sweep at startup. Pointer so a missing key preserves the
	// default. RepoMapTokenBudget bounds the map's size (default 2000; ≤0
	// normalizes to the default at load).
	EnableRepoMap      *bool `yaml:"enable_repo_map,omitempty"`
	RepoMapTokenBudget int   `yaml:"repo_map_token_budget,omitempty"`

	// LSPDiagnosticsOnEdit gates the synchronous self-healing-edit tier: when
	// true, edit/write wait a short bounded window for LSP diagnostics on the
	// touched file and fold them into the tool's own result. Default false —
	// opt-in, since it adds latency to every edit/write when an LSP manager
	// is configured. Pointer so a missing key preserves the default.
	LSPDiagnosticsOnEdit *bool `yaml:"lsp_diagnostics_on_edit,omitempty"`

	// EnableDynamicWorkflow gates the solo dynamic-workflow board: the main
	// agent swaps todo_write for the wf_task_* graph tools and an in-process
	// engine auto-dispatches ephemeral subagent workers as dependencies
	// complete. Default false — opt-in, since an enabled session can spawn
	// real (token-costing) subagents without a per-dispatch prompt. Pointer so
	// a missing key preserves the default. WorkflowMaxWorkers caps concurrent
	// engine-dispatched workers (default 4; ≤0 normalizes to the default at
	// load).
	EnableDynamicWorkflow *bool `yaml:"enable_dynamic_workflow,omitempty"`
	WorkflowMaxWorkers    int   `yaml:"workflow_max_workers,omitempty"`

	// OutputStyle names the active output style overlaid on the main
	// persona's system prompt: "Explanatory", "Learning", or a custom
	// output-styles/*.md name. Empty (or "default") means no overlay.
	OutputStyle string `yaml:"output_style,omitempty"`

	Providers map[string]FileProviderConfig `yaml:"providers"`

	// Custom is the downstream-app extension slot. Values round-trip through
	// YAML as the `custom:` section. Empty / nil produces no `custom:` key in
	// the output. Decoded as map[string]any — consumers cast at use-site.
	Custom map[string]any `yaml:"custom,omitempty"`
}

type FileProviderConfig struct {
	APIKey string `yaml:"api_key"`
	APIURL string `yaml:"api_url"`
}

type LoadOptions struct {
	AppName    string // brand identifier; drives the AppHome layout. Defaults to "evva".
	AppHome    string // absolute path; defaults to ~/.<AppName>/.
	WorkDir    string // process cwd; defaults to os.Getwd().
	AppVersion string // version string for diagnostics; defaults to DefaultAppVersion.

	// EnvAliases maps the caller's preferred env-var names onto evva's
	// canonical ones BEFORE godotenv.Load runs. Useful when a downstream
	// app advertises friendlier spellings — e.g. `{"LOGDIR": "LOG_DIR",
	// "LOGLEVEL": "LOG_LEVEL"}` lets a friday user write either form in
	// `~/.friday/.env` and have evva's loader pick it up.
	//
	// The promotion is non-overriding: an alias only seeds the canonical
	// name when that canonical name is unset. Existing canonical exports
	// win, so a deliberate `LOG_DIR=...` is never clobbered by a stray
	// alias.
	EnvAliases map[string]string

	// EnvOverrides runs AFTER the YAML + canonical env-vars have built
	// the Config. Each entry gets the populated *Config and can fold in
	// env vars that don't have a native hook inside Load (e.g.
	// MAX_ITERS → cfg.SetMaxIterations). The first error short-circuits
	// the rest and is returned from Load wrapped with the failing
	// override's Name — `config: EnvOverrides[<name>]: <wrapped>` — so
	// a downstream app with several overrides can identify the culprit
	// without grepping stack traces.
	//
	// Use this to translate downstream-flavoured env conventions
	// (APIKEY → cfg.SetProviderCredentials, MAX_ITERS → cfg.SetMaxIterations)
	// in one place instead of post-Load shim code at every call site.
	EnvOverrides []EnvOverride

	// ProviderCredentials wires LLM provider credentials from env vars
	// declaratively — the alternative to writing a separate EnvOverride
	// that reads os.Getenv(...) and calls cfg.SetProviderCredentials.
	//
	// Keyed by provider name (matches pkg/llm.DefaultRegistry); the
	// ProviderCredsFromEnv value names the env vars to read. EnvAliases
	// promotion runs first, so aliased names (e.g. `APIKEY` → `DEEPSEEK_API_KEY`)
	// reach this layer through their canonical form. Empty env-var values
	// are passed through to SetProviderCredentials — the agent's LLM-build
	// step will surface "API_KEY not set" loudly on first Run.
	//
	// Example:
	//
	//	LoadOptions{
	//	    ProviderCredentials: map[string]config.ProviderCredsFromEnv{
	//	        "deepseek": {APIKeyEnv: "DEEPSEEK_API_KEY",
	//	                    APIURLDefault: constant.DEEPSEEK.ApiUrl},
	//	    },
	//	}
	//
	// Applied AFTER the YAML loader populates LLMProviderConfig but
	// BEFORE EnvOverrides run, so an EnvOverride can still mutate the
	// installed creds if it needs to.
	ProviderCredentials map[string]ProviderCredsFromEnv

	// SeedEnvTemplate is written to <AppHome>/.env on first launch when
	// the file is missing. Useful for closing the "evva creates the YAML
	// but the user doesn't know to create .env" first-run gap.
	//
	// Empty means "don't write a .env template" (the historical behaviour).
	// An existing .env is never overwritten, even with SeedEnvTemplate set.
	SeedEnvTemplate string
}

type ProviderCredsFromEnv struct {
	// APIKeyEnv is the env-var name carrying the provider's API key
	// (e.g. "DEEPSEEK_API_KEY"). Empty means "no key from env".
	APIKeyEnv string
	// APIURLEnv is the env-var name carrying the provider's API URL.
	// Most consumers leave this empty and lean on APIURLDefault.
	APIURLEnv string
	// APIURLDefault is the URL to use when APIURLEnv is empty or unset.
	// Typically a constant from pkg/constant (e.g. constant.DEEPSEEK.ApiUrl).
	APIURLDefault string
}