config

type ACP struct {
	// ClientMCPServers starts the MCP servers an ACP client sends with
	// session/new, exposing all their tools (off by default: they are
	// ignored and named in the session's first message).
	ClientMCPServers bool `yaml:"client_mcp_servers"`
}

type AdditionalDir struct {
	// Path is an absolute directory outside --cwd.
	Path string `yaml:"path"`
	// Mode is "read" or "write"; it is required.
	Mode string `yaml:"mode"`
}

type AgentConfig struct {
	ReadOnly bool `yaml:"read_only"`
	// Sandbox confines bash and start_process commands at the OS level:
	// writes only under --cwd, a per-run temp dir and SandboxWritablePaths.
	Sandbox bool `yaml:"sandbox"`
	// SandboxNetwork lets sandboxed commands use the network.
	SandboxNetwork bool `yaml:"sandbox_network"`
	// SandboxWritablePaths are extra absolute directories commands may write.
	SandboxWritablePaths []string `yaml:"sandbox_writable_paths,omitempty"`
	// SandboxAllowedDomains limits sandboxed commands' network to these
	// hosts (exact, "*.domain" or IP, optional ":port"), over HTTP and HTTPS
	// through a filtering proxy. Empty keeps the network denied.
	SandboxAllowedDomains []string `yaml:"sandbox_allowed_domains,omitempty"`
	// SandboxBackend picks the Linux sandbox engine: auto (default; bwrap
	// with Landlock stacked inside, else Landlock alone), landlock or bwrap.
	SandboxBackend string `yaml:"sandbox_backend,omitempty"`
	// TinyGo is an existing tinygo executable to build Go plugin modules
	// with, instead of the pinned release TinyAgent downloads on first use.
	// TinyGo is a separate project, never bundled with TinyAgent.
	TinyGo string `yaml:"tinygo,omitempty"`
	// Environment selects where bash and start_process commands run:
	// "local" (the default, also "") or "container".
	Environment string `yaml:"environment"`
	// Container configures the "container" environment.
	Container Container `yaml:"container"`
	// CommandEnv is the environment policy for local bash and start_process
	// commands. The zero value inherits tinyagent's whole environment.
	CommandEnv CommandEnv `yaml:"command_env"`
	// FileAccess denies the built-in file tools access to matching paths.
	// The zero value denies nothing.
	FileAccess FileAccess `yaml:"file_access"`
	// RedactSecrets masks known secret values in command, process, MCP,
	// web_fetch and hook output before the model sees it (off by default;
	// --redact-secrets overrides Enabled).
	RedactSecrets RedactSecrets `yaml:"redact_secrets"`
	// AdditionalDirs are directories outside --cwd that the built-in file
	// tools, --sandbox and the container environment may also reach. Empty
	// (the default) keeps everything inside --cwd. --add-dir-read and
	// --add-dir-write replace this list.
	AdditionalDirs []AdditionalDir `yaml:"additional_dirs,omitempty"`
	// Model is the provider/model used when neither -m nor $AGENT_MODEL sets
	// one. "" falls back to the built-in default.
	Model string `yaml:"model"`

	SystemPrompt string  `yaml:"system_prompt"`
	StepLimit    int     `yaml:"step_limit"`
	CostLimit    float64 `yaml:"cost_limit"`
	WallTimeSec  int     `yaml:"wall_time_seconds"`
	// TokenLimit caps the run's provider-reported input plus output
	// tokens, delegates and workers included; 0 (the default) = unlimited.
	TokenLimit int `yaml:"token_limit"`
	// MaxFormatErrors ends the run after this many consecutive steps whose
	// tool calls are all malformed. Must be >= 1; default 3.
	MaxFormatErrors int `yaml:"max_format_errors"`
	// MaxOutputTokens is the per-request output-token budget sent to the
	// provider; 0 (the default) keeps the provider default (8192 for
	// Anthropic). Not to be confused with MaxOutputChars, which caps tool
	// output.
	MaxOutputTokens int `yaml:"max_output_tokens"`
	// MaxTruncations ends the run after this many consecutive responses cut
	// off at the output-token limit. Must be >= 1; default 3.
	MaxTruncations int `yaml:"max_truncations"`

	BashTimeoutSec int `yaml:"bash_timeout_seconds"`
	MaxOutputChars int `yaml:"max_output_chars"`
	// MaxBackgroundProcesses bounds how many start_process processes may run
	// at once.
	MaxBackgroundProcesses int `yaml:"max_background_processes"`

	// Optional price override in USD per million tokens, for models
	// missing from the built-in price table.
	InputPricePerMTok  float64 `yaml:"input_price_per_mtok"`
	OutputPricePerMTok float64 `yaml:"output_price_per_mtok"`

	// ContextWindow, in tokens, overrides the built-in context window table.
	// 0 uses the table.
	ContextWindow int `yaml:"context_window"`

	// FallbackModels is the opt-in fallback chain: provider/model specs
	// tried in order when a request still fails with HTTP 429, 5xx or a
	// network error after the provider's retries. Empty (the default)
	// never switches. --fallback-model replaces it; --no-fallback clears it.
	FallbackModels []string `yaml:"fallback_models,omitempty"`

	// ReasoningEffort is sent to the provider's reasoning control: none,
	// minimal, low, medium, high, xhigh, or max. "" sends nothing, so the
	// model's default applies.
	ReasoningEffort string `yaml:"reasoning_effort"`

	// OpenAIAPI picks the openai provider's transport: auto (the default;
	// the Responses API for api.openai.com, Chat Completions when
	// OPENAI_BASE_URL points elsewhere), responses, or chat. Other providers
	// ignore it.
	OpenAIAPI string `yaml:"openai_api"`

	// ClaudeCode and CodexExec configure the claude-code and codex-exec
	// handoff providers (docs/models.md). Unset looks the CLI up on PATH.
	ClaudeCode HandoffCLI `yaml:"claude_code,omitempty"`
	CodexExec  HandoffCLI `yaml:"codex_exec,omitempty"`
	// OpenCode configures the opencode handoff provider the same way.
	OpenCode HandoffCLI `yaml:"opencode,omitempty"`

	MCPServers []MCPServer `yaml:"mcp_servers,omitempty"`

	// Plugins lists Agent Plugins package directories (docs/plugins.md).
	Plugins []Plugin `yaml:"plugins,omitempty"`

	// Providers are named model providers selectable as "<id>/<model>".
	// They come only from -c or a trusted ./tinyagent.yaml (--trust-config).
	Providers []Provider `yaml:"providers,omitempty"`

	// Hooks are trusted local executables run around matching tool calls.
	Hooks Hooks `yaml:"hooks,omitempty"`

	// Permissions is the opt-in tool permission policy: allow/ask/deny rules
	// matched on the tool name and its main argument, applied before hooks.
	// The zero value enforces nothing.
	Permissions Permissions `yaml:"permissions"`

	// CommandTools are user-defined tools that run a fixed argv filled in
	// with schema-checked arguments, without a shell. They come only from
	// -c or a trusted ./tinyagent.yaml (--trust-config).
	CommandTools []CommandTool `yaml:"command_tools,omitempty"`

	// Plan configures the opt-in update_plan tool (off by default).
	Plan Plan `yaml:"plan,omitempty"`
	// VerifyOnStop configures the opt-in verify-before-stop guard (off by
	// default).
	VerifyOnStop VerifyOnStop `yaml:"verify_on_stop"`
	// Images configures the opt-in view_image tool and MCP image
	// pass-through (off by default).
	Images Images `yaml:"images,omitempty"`
	// MaxImageBytes caps one image's raw size. Must be >= 1; default 5 MiB.
	MaxImageBytes int `yaml:"max_image_bytes"`
	// ApplyPatch offers the opt-in apply_patch tool (off by default;
	// --apply-patch overrides it).
	ApplyPatch bool `yaml:"apply_patch"`
	// ChatHistory records interactive chat input in <cwd>/history/chat_history
	// (default on; false or --no-chat-history keeps it in memory only).
	ChatHistory *bool `yaml:"chat_history,omitempty"`
	// ChatMarkdown renders chat replies as formatted Markdown (headings,
	// lists, code blocks, tables); false shows them raw. nil means on.
	ChatMarkdown *bool `yaml:"chat_markdown,omitempty"`
	// ScopedAgentsMD also delivers AGENTS.md files in directories below
	// --cwd with the results of file tools touching paths there (off by
	// default; --scoped-agents-md overrides it).
	ScopedAgentsMD bool `yaml:"scoped_agents_md"`
	// Subagents configures the opt-in delegate tool, which runs a
	// read-only child agent (off by default; --subagents overrides
	// Enabled).
	Subagents Subagents `yaml:"subagents"`
	// Models routes roles and tasks to their own models (empty by
	// default: every task uses the main model).
	Models Models `yaml:"models,omitempty"`
	// WebFetch configures the opt-in web_fetch tool (off by default;
	// --web-fetch overrides Enabled).
	WebFetch WebFetch `yaml:"web_fetch"`
	// AskUser configures the opt-in ask_user tool, which ends a run with
	// one question for the user (off by default; --ask-user overrides
	// Enabled).
	AskUser AskUser `yaml:"ask_user"`
	// LSP configures opt-in language servers: diagnostics appended to edit
	// results and the read-only lsp tool (off by default; --lsp overrides
	// Enabled). It comes only from -c or a trusted ./tinyagent.yaml (--trust-config).
	LSP LSP `yaml:"lsp"`
	// Skills turns on Agent Skills discovery from .agents/skills (off by
	// default; --skills / --no-skills override it).
	Skills bool `yaml:"skills"`
	// Memory configures opt-in cross-run project memory (off by default;
	// --memory overrides Enabled). It comes only from -c or a trusted ./tinyagent.yaml (--trust-config).
	Memory Memory `yaml:"memory"`
	// Handoff configures the opt-in session handoff file (off by default;
	// --handoff overrides Enabled). It comes only from -c or a trusted ./tinyagent.yaml (--trust-config).
	Handoff Handoff `yaml:"handoff"`
	// LogDB is the opt-in SQLite event log.
	LogDB LogDB `yaml:"log_db"`
	// OTel is the opt-in OpenTelemetry (OTLP/HTTP) trace export.
	OTel OTel `yaml:"otel"`
	// ToolOutputFiles saves the full text of over-limit tool results to
	// per-run files the model can page (off by default;
	// --tool-output-files overrides Enabled).
	ToolOutputFiles ToolOutputFiles `yaml:"tool_output_files"`
	// Snapshots configures opt-in workspace snapshots for --rewind (off by
	// default; --snapshots overrides enabled). It may be written as a bare
	// bool (snapshots: true) or as a mapping.
	Snapshots Snapshots `yaml:"snapshots"`
	// ACP configures the --acp editor mode.
	ACP ACP `yaml:"acp"`
	// UntrustedContent configures the opt-in untrusted-content lockdown
	// (off by default; --lockdown overrides Enabled).
	UntrustedContent UntrustedContent `yaml:"untrusted_content"`
	// Attempts configures --attempts best-of-N runs.
	Attempts Attempts `yaml:"attempts"`
}

type AskUser struct {
	Enabled bool `yaml:"enabled"`
	// MaxQuestions caps the questions one run may ask, counted across
	// its whole resume chain: 1 to MaxAskUserQuestions.
	MaxQuestions int `yaml:"max_questions"`
}

type AttemptCheck struct {
	Command string `yaml:"command"`
	// TimeoutSeconds kills the check after this many seconds; 0 means the
	// default (600). Range 1-3600.
	TimeoutSeconds int `yaml:"timeout_seconds,omitempty"`
}

type Attempts struct {
	// Checks are the verification commands an attempt must pass. Each runs
	// with bash -c in the attempt's worktree. --attempt-check replaces the
	// whole list.
	Checks []AttemptCheck `yaml:"checks,omitempty"`
	// StopOnPass stops after the first passing attempt (the default). False
	// runs all N attempts; the lowest-numbered passing attempt still wins.
	StopOnPass *bool `yaml:"stop_on_pass,omitempty"`
	// Keep chooses which non-winning worktrees and branches are kept once
	// an attempt wins: all (the default), failed (remove passing
	// non-winners) or none. Nothing is removed when no attempt wins.
	Keep string `yaml:"keep,omitempty"`
}

type CommandEnv struct {
	Inherit        string            `yaml:"inherit"` // all (default, also ""), core or none
	ExcludeSecrets bool              `yaml:"exclude_secrets"`
	Exclude        []string          `yaml:"exclude,omitempty"` // names or * / ? globs
	Pass           []string          `yaml:"pass,omitempty"`    // names or globs
	Set            map[string]string `yaml:"set,omitempty"`
}

type CommandTool struct {
	Name        string `yaml:"name"`
	Description string `yaml:"description"`
	// Parameters is the JSON Schema of the arguments, in the
	// --output-schema subset; nil means no arguments.
	Parameters map[string]any `yaml:"parameters,omitempty"`
	// Argv is the command; an element that is exactly {{name}} is replaced
	// by the argument name.
	Argv []string `yaml:"argv"`
	// TimeoutSec is the per-call timeout; 0 means bash_timeout_seconds.
	TimeoutSec int `yaml:"timeout_seconds,omitempty"`
	// Dir is the working directory, relative to --cwd and inside it; ""
	// means --cwd.
	Dir string `yaml:"dir,omitempty"`
}

type Container struct {
	Runtime string   `yaml:"runtime"` // docker (default) or podman
	Image   string   `yaml:"image"`
	RunArgs []string `yaml:"run_args,omitempty"` // extra `run` arguments
}

type FileAccess struct {
	DenyRead  []string `yaml:"deny_read,omitempty"`
	DenyWrite []string `yaml:"deny_write,omitempty"`
}

type Handoff struct {
	// Enabled reads and writes the handoff file (off by default; --handoff
	// / --handoff=false override it).
	Enabled bool `yaml:"enabled"`
	// Path is the handoff file, relative to --cwd (default
	// .tinyagent/handoff.md). It must stay inside --cwd.
	Path string `yaml:"path"`
	// MaxBytes caps how much of the file is loaded into the first message
	// (default 16 KiB); a longer file is cut and marked as truncated.
	MaxBytes int `yaml:"max_bytes"`
	// StartupCommand is an optional shell command run in --cwd before the
	// first turn; its exit code and output are given to the model as data.
	StartupCommand string `yaml:"startup_command"`
	// StartupTimeoutSeconds bounds the startup command (default 120).
	StartupTimeoutSeconds int `yaml:"startup_timeout_seconds"`
	// StartupMaxOutput caps the startup output given to the model (default
	// 8 KiB; the tail is kept).
	StartupMaxOutput int `yaml:"startup_max_output"`
}

type HandoffCLI struct {
	// Path is the CLI binary to run; "" looks it up on PATH. A leading ~/
	// is expanded.
	Path string `yaml:"path,omitempty"`
}

type Hook struct {
	Match   string   `yaml:"match,omitempty"` // whole-name Go regexp; "" matches every tool
	Command string   `yaml:"command"`
	Args    []string `yaml:"args,omitempty"`
	Env     []string `yaml:"env,omitempty"`
	// TimeoutSec is nil when unset (30 seconds); 0 is rejected.
	TimeoutSec *int   `yaml:"timeout_seconds,omitempty"`
	OnError    string `yaml:"on_error,omitempty"` // pre_tool only: deny (default) or allow
}

type Hooks struct {
	PreTool  []Hook `yaml:"pre_tool,omitempty"`
	PostTool []Hook `yaml:"post_tool,omitempty"`
	// Stop hooks run when a run is about to end Submitted or Completed and
	// can send the model back to work. Match and OnError are rejected.
	Stop []Hook `yaml:"stop,omitempty"`
	// MaxStopContinuations caps how many times stop hooks may send the
	// model back to work in one run; nil means DefaultMaxStopContinuations.
	MaxStopContinuations *int `yaml:"max_stop_continuations,omitempty"`
}

type Images struct {
	Enabled bool `yaml:"enabled"`
}

type InvalidError struct{ Err error }

type LSP struct {
	Enabled bool `yaml:"enabled"`
	// DiagnosticsAfterEdit appends new diagnostics to write_file, edit_file
	// and apply_patch results (default true). false keeps only the lsp tool.
	DiagnosticsAfterEdit bool `yaml:"diagnostics_after_edit"`
	// DiagnosticsWaitMS is the longest wait for diagnostics after an edit
	// (MinLSPWaitMS..MaxLSPWaitMS; default 3000).
	DiagnosticsWaitMS int `yaml:"diagnostics_wait_ms"`
	// MaxDiagnostics caps the diagnostics listed per file (1..200;
	// default 20).
	MaxDiagnostics int `yaml:"max_diagnostics"`
	// Severity is the lowest severity reported: error (default) or
	// warning (errors and warnings).
	Severity string      `yaml:"severity"`
	Servers  []LSPServer `yaml:"servers,omitempty"`
}

type LSPServer struct {
	Name       string   `yaml:"name"`
	Command    string   `yaml:"command"`
	Args       []string `yaml:"args,omitempty"`
	Extensions []string `yaml:"extensions"`
	// Env names host environment variables to forward; each must be set.
	Env []string `yaml:"env,omitempty"`
	// InitializationOptions is passed to the server's initialize request.
	InitializationOptions map[string]any `yaml:"initialization_options,omitempty"`
	// StartupTimeoutSeconds bounds start and initialize (1..300; 0 means
	// DefaultLSPStartupTimeoutSeconds).
	StartupTimeoutSeconds int `yaml:"startup_timeout_seconds"`
}

type LogDB struct {
	Enabled bool `yaml:"enabled"`
	// Path is the database file; "" means .tinyagent/tinyagent.db under
	// --cwd. A relative path is resolved against --cwd; "~/" is expanded.
	Path string `yaml:"path"`
	// Level is "metadata" (default; no prompt, message, argument or output
	// bodies) or "full".
	Level string `yaml:"level"`
	// MaxDays and MaxRuns prune older runs at run start; 0 keeps all.
	MaxDays int `yaml:"max_days"`
	MaxRuns int `yaml:"max_runs"`
	// MaxPayloadBytes caps each stored event payload; 0 means 65536.
	MaxPayloadBytes int `yaml:"max_payload_bytes"`
}

type MCPServer struct {
	Alias   string   `yaml:"alias"`
	Command string   `yaml:"command"`
	Args    []string `yaml:"args,omitempty"`
	Tools   []string `yaml:"tools"`
	// Resources allowlists the resource URIs the model may list and read:
	// each pattern is an exact URI or a literal prefix ending in "*".
	Resources           []string `yaml:"resources,omitempty"`
	Env                 []string `yaml:"env,omitempty"`
	DiscoveryTimeoutSec int      `yaml:"discovery_timeout_seconds"`
	CallTimeoutSec      int      `yaml:"call_timeout_seconds"`
	// Untrusted false marks the server's results as trusted: with
	// untrusted-content lockdown on they don't taint the run. Absent or
	// true (the default) means they taint.
	Untrusted *bool `yaml:"untrusted,omitempty"`
	// LockdownAllowed keeps the server's tools and resources callable after
	// lockdown taints the run (off by default: they are refused).
	LockdownAllowed bool `yaml:"lockdown_allowed,omitempty"`
	// SetEnv holds NAME=value pairs set for the server, and AllTools
	// exposes every tool it lists. Only servers an ACP client supplies
	// use them; a config file can't set either.
	SetEnv   []string `yaml:"-"`
	AllTools bool     `yaml:"-"`
	// Dir, when set, is the server's working directory instead of --cwd.
	// Only plugin servers (from a plugin's mcp.json) use it.
	Dir string `yaml:"-"`
}

type Memory struct {
	// Enabled loads the project's active memory entries into the system
	// prompt (off by default; --memory / --memory=false override it).
	Enabled bool `yaml:"enabled"`
	// Approval is the policy for new entries: pending (default) holds
	// every new entry until a person approves it; auto saves entries as
	// active unless the run had untrusted content in context.
	Approval string `yaml:"approval"`
	// MaxWritesPerRun caps the entries one run may add, replace or forget
	// (default 5).
	MaxWritesPerRun int `yaml:"max_writes_per_run"`
	// MaxEntries caps the active entries in the store (default 50).
	MaxEntries int `yaml:"max_entries"`
	// MaxBytes caps the Project memory section added to the system
	// prompt (default 8 KiB); the newest entries that fit are loaded.
	MaxBytes int `yaml:"max_bytes"`

	// Backend selects the store: markdown (default; one <id>.md per entry
	// in Path) or sqlite (one database at SQLitePath).
	Backend string `yaml:"backend"`
	// Path is the markdown folder, relative to --cwd and inside it
	// (default ./.tinyagent/memory).
	Path string `yaml:"path"`
	// SQLitePath is the SQLite database (default
	// ./.tinyagent/memory/memory.sqlite).
	SQLitePath string `yaml:"sqlite_path"`
	// MaxEntrySize caps one entry's text, in characters (default 500).
	MaxEntrySize int `yaml:"max_entry_size"`
	// DefaultTags are added to every new entry.
	DefaultTags []string `yaml:"default_tags"`
	// ImportLegacy is ignored: it is still accepted so older configs load,
	// but memory is never imported from outside --cwd (issue #335).
	ImportLegacy bool `yaml:"import_legacy"`
}

type MemoryKey struct {
	Name    string
	Type    string // string, bool, int or []string
	Default string // TOML literal
	Desc    string
	// contains filtered or unexported fields
}

type MemoryLookup struct {
	// Path is the memory.toml to read, or "" for none.
	Path string
	// Local is true for ./memory.toml in cwd (repository-local).
	Local bool
	// Warnings are refused paths, one line each.
	Warnings []string
	// Hint is a single "hint: ..." line when a memory.toml exists in the
	// old user config location (which is no longer read), else "".
	Hint string
}

type MemorySource struct {
	// File is the memory.toml that was read, or "".
	File string
	// Local is true when File is ./memory.toml in the working directory,
	// whose settings may only make memory safer.
	Local bool
	// Env lists the TINYAGENT_MEMORY_* keys that were applied.
	Env []string
	// Warnings are settings and paths that were ignored, one line each.
	Warnings []string
	// Hint is a one-line "hint: ..." about a memory.toml left in the old
	// user config location, or "".
	Hint string
}

type ModelRoute struct {
	Match []string `yaml:"match,omitempty"`
	Type  string   `yaml:"type,omitempty"`
	Model string   `yaml:"model"`
}

type Models struct {
	// Auxiliary is the role of helper calls made outside the agent loop:
	// context compaction (task "compaction") and the verify_on_stop
	// review (task "review").
	Auxiliary RoleModels `yaml:"auxiliary,omitempty"`
	// Delegated is the role of the child agents: the delegate tool's
	// read-only subagents (task "delegate") and workers (task "worker").
	Delegated RoleModels `yaml:"delegated,omitempty"`
	// Flags holds the command-line routing overrides (--aux-model,
	// --route); they beat the config keys. Never read from a file.
	Flags RouteFlags `yaml:"-"`
}

type OTel struct {
	Enabled bool `yaml:"enabled"`
	// Endpoint is the OTLP/HTTP base URL; /v1/traces is appended.
	Endpoint string `yaml:"endpoint"`
	// Protocol is http/protobuf or http/json.
	Protocol string `yaml:"protocol"`
	// HeadersEnv names environment variables whose values are k=v,k2=v2
	// header lists. Header values never come from the config itself.
	HeadersEnv []string `yaml:"headers_env"`
	// Timeout bounds each export, retries included, and the final flush,
	// as a Go duration such as "10s".
	Timeout string `yaml:"timeout"`
	// ServiceName is the resource service.name.
	ServiceName string `yaml:"service_name"`
	// Content adds redacted task, assistant, argument and output text.
	Content bool `yaml:"content"`
	// MaxAttributeBytes caps each content attribute; 0 means 4096.
	MaxAttributeBytes int `yaml:"max_attribute_bytes"`
}

type PermissionRule struct {
	// Tool is a "|"-separated list of tool-name globs ("*" wildcard). It is
	// required.
	Tool string `yaml:"tool"`
	// Command matches the shell command text (bash, start_process, and
	// command tools' resolved argv). At most one of command, path and host
	// may be set.
	Command string `yaml:"command,omitempty"`
	// Path matches a path relative to --cwd in the file_access syntax (for
	// apply_patch, when any path matches).
	Path string `yaml:"path,omitempty"`
	// Host matches a web_fetch URL host in the sandbox_allowed_domains
	// syntax.
	Host string `yaml:"host,omitempty"`
	// Decision is allow, ask or deny; it is required.
	Decision string `yaml:"decision"`
	// Message is shown to the model on deny.
	Message string `yaml:"message,omitempty"`
}

type Permissions struct {
	// Default is the decision when no rule matches: allow (default), ask or
	// deny.
	Default string `yaml:"default"`
	// NonInteractive is what an ask becomes when nobody can answer (no
	// terminal, --json, or an ACP client that does not answer): deny
	// (default) or allow.
	NonInteractive string `yaml:"non_interactive"`
	// Rules are evaluated in order; a deny or ask matches when any of its
	// patterns match, and an allow matches only when every compound-command
	// segment is covered. A profile's rules replace the base list.
	Rules []PermissionRule `yaml:"rules,omitempty"`
}

type Plan struct {
	Enabled bool `yaml:"enabled"`
	// RequireFirst makes the agent record a plan with update_plan before
	// its first workspace-changing tool call (off by default so one-shot
	// questions and read-only lookups aren't slowed down; --plan-first
	// turns it and the plan tool on).
	RequireFirst bool `yaml:"require_first"`
}

type Plugin struct {
	// Path is the absolute path to the plugin root (the directory holding
	// plugin.json).
	Path string `yaml:"path"`
	// MCPServers authorizes servers from the plugin's mcp.json. Servers not
	// listed are never started.
	MCPServers []PluginServer `yaml:"mcp_servers,omitempty"`
	// WasmModules authorizes WebAssembly code modules declared in the
	// plugin's plugin.json (extensions.tinyagent.wasm_modules), by name.
	// Modules not listed are never loaded.
	WasmModules []string `yaml:"wasm_modules,omitempty"`
}

type PluginServer struct {
	Server              string   `yaml:"server"`
	Alias               string   `yaml:"alias"`
	Tools               []string `yaml:"tools"`
	Resources           []string `yaml:"resources,omitempty"`
	DiscoveryTimeoutSec int      `yaml:"discovery_timeout_seconds"`
	CallTimeoutSec      int      `yaml:"call_timeout_seconds"`
}

type Provider struct {
	ID      string `yaml:"id"`
	API     string `yaml:"api"` // chat, responses or anthropic
	BaseURL string `yaml:"base_url"`
	// APIKeyEnv names the variable holding the API key; "" sends no key.
	APIKeyEnv string `yaml:"api_key_env,omitempty"`
	// Headers are static, non-secret request headers.
	Headers map[string]string `yaml:"headers,omitempty"`
	// EnvHeaders maps a header name to the variable holding its value.
	EnvHeaders map[string]string `yaml:"env_headers,omitempty"`
	// Models holds per-model metadata, matched by exact model name.
	Models map[string]ProviderModel `yaml:"models,omitempty"`
}

type ProviderModel struct {
	InputPricePerMTok  float64 `yaml:"input_price_per_mtok"`
	OutputPricePerMTok float64 `yaml:"output_price_per_mtok"`
	// CacheReadMultiplier is the cache-read price as a multiple of the
	// input price, in (0, 1]; 0 means the default 0.1.
	CacheReadMultiplier float64 `yaml:"cache_read_multiplier"`
	ContextWindow       int     `yaml:"context_window"`
}

type RedactSecrets struct {
	Enabled bool `yaml:"enabled"`
	// Env names more variables (names or * / ? globs) whose values are
	// secrets, beyond the secret-named ones.
	Env []string `yaml:"env,omitempty"`
	// Allow names variables (names or globs) not to treat as secrets.
	Allow []string `yaml:"allow,omitempty"`
	// Patterns also masks token-shaped strings (sk-..., ghp_..., Bearer ...).
	Patterns bool `yaml:"patterns"`
}

type RoleModels struct {
	// Model is the role's default provider/model; "" means the main model.
	Model string `yaml:"model,omitempty"`
	// Tasks maps a task name to its own provider/model.
	Tasks map[string]string `yaml:"tasks,omitempty"`
	// FallbackModels is the role's own fallback chain, tried in order
	// when its model keeps failing; empty means none. It never inherits
	// the main model's fallback_models.
	FallbackModels []string `yaml:"fallback_models,omitempty"`
	// Routes pick a model per child task by its brief or declared type;
	// only models.delegated accepts them. The first matching route wins.
	Routes []ModelRoute `yaml:"routes,omitempty"`
}

type RouteFlags struct {
	AuxModel      string            // --aux-model
	DelegateModel string            // --delegate-model
	Routes        map[string]string // --route task=spec
	NoFallback    bool              // --no-fallback also clears every role's fallback_models
	NoRouting     bool              // --no-routing: ignore models: and the routing flags
}

type Snapshots struct {
	Enabled bool `yaml:"enabled"`
	// MaxFileBytes is the largest file captured; larger files are skipped
	// and reported. Must be >= 1; default 2 MiB.
	MaxFileBytes int64 `yaml:"max_file_bytes"`
}

type Source struct {
	Path  string
	Kind  SourceKind
	Notes []string
}

type SourceKind int

type Subagents struct {
	Enabled bool `yaml:"enabled"`
	// Model is the provider/model children use; "" means the parent's
	// model.
	Model string `yaml:"model"`
	// MaxSteps caps each child's model calls; 0 means
	// DefaultSubagentMaxSteps.
	MaxSteps int `yaml:"max_steps"`
	// Workers configures the opt-in worker tool (--workers), whose
	// children may edit files and run commands in their own Git worktree.
	// nil when the config has no subagents.workers section.
	Workers *Workers `yaml:"workers"`
}

type ToolOutputFiles struct {
	Enabled bool `yaml:"enabled"`
	// Dir is relative to --cwd and must stay inside it; "" means
	// DefaultToolOutputDir.
	Dir string `yaml:"dir"`
	// MaxRuns keeps this many earlier run directories at run start; 0
	// keeps all.
	MaxRuns int `yaml:"max_runs"`
}

type UntrustedContent struct {
	// Enabled turns lockdown on (off by default; --lockdown and
	// --lockdown=false override it).
	Enabled bool `yaml:"enabled"`
	// Sources chooses which sources taint the run: web_fetch, mcp, review
	// and acp_client_mcp. Absent (the default) means all of them; an
	// explicit empty list is rejected. --untrusted-task and a resumed
	// untrusted checkpoint always taint.
	Sources []string `yaml:"sources,omitempty"`
	// Lockdown is what stays reachable after taint.
	Lockdown UntrustedLockdown `yaml:"lockdown"`
}

type UntrustedLockdown struct {
	// WebFetchAllowedDomains are the web_fetch hosts still readable after
	// taint, in the sandbox_allowed_domains syntax; each must also be in
	// web_fetch.allowed_domains to be fetched at all. Empty (the default)
	// refuses every web_fetch after taint. A bare * is rejected.
	WebFetchAllowedDomains []string `yaml:"web_fetch_allowed_domains,omitempty"`
	// AllowedDomains are the hosts sandboxed commands may still reach
	// through the allowlist proxy after taint, in the
	// sandbox_allowed_domains syntax; each must also be in
	// sandbox_allowed_domains. Empty (the default) refuses all their
	// network after taint. A bare * is rejected. Commands only keep
	// running after taint under --sandbox without sandbox_network.
	AllowedDomains []string `yaml:"allowed_domains,omitempty"`
	// ContainerProxy lets container-environment commands reach
	// AllowedDomains after taint through a lockdown proxy on an internal
	// runtime network (off by default: they get no network at all).
	// Requires AllowedDomains.
	ContainerProxy bool `yaml:"container_proxy,omitempty"`
}

type VerifyOnStop struct {
	Enabled bool `yaml:"enabled"`
	// Commands are bash commands that count as verification when they exit
	// 0: a run whose command is one of these, or starts with one followed
	// by a space, verifies. They are named in the re-prompt.
	// --verify-command replaces this list.
	Commands []string `yaml:"commands,omitempty"`
	// Patterns are Go regular expressions; a successful bash run whose
	// command matches any of them also verifies. When neither Commands nor
	// Patterns is set, DefaultVerifyPatterns apply.
	Patterns []string `yaml:"patterns,omitempty"`
	// Checks are computational sensors: fast, deterministic bash commands
	// (lint, type check, tests) that pass on exit 0. When the model gives a
	// final answer with changes pending, the harness runs them itself, in
	// the listed order (put the cheapest first), stopping at the first
	// failure. Each also counts as a verification command when the model
	// runs it. --verify-check replaces this list. Empty by default.
	Checks []string `yaml:"checks,omitempty"`
	// Review turns on the inferential tier: after every check in Checks
	// passes at stop, the model is asked once, without tools, to review
	// the changes the run made. Its findings are reported only (event,
	// stderr and trajectory); they never re-prompt the model or change the
	// run's status. Requires at least one check. --verify-review overrides
	// it. Off by default.
	Review bool `yaml:"review,omitempty"`
	// MaxReprompts caps how many times one run is sent back to verify
	// (1 to MaxVerifyReprompts; default DefaultVerifyMaxReprompts). After
	// the cap the run stops and is marked unverified.
	MaxReprompts int `yaml:"max_reprompts"`
}

type WebFetch struct {
	Enabled bool `yaml:"enabled"`
	// AllowedDomains lists the hosts web_fetch may read, in the
	// sandbox_allowed_domains syntax. Required when Enabled.
	AllowedDomains []string `yaml:"allowed_domains,omitempty"`
	// MaxBytes caps the body read per fetch. Must be >= 1; default 2 MiB.
	MaxBytes int `yaml:"max_bytes"`
	// TimeoutSeconds caps each fetch, redirects included (1..120;
	// default 20).
	TimeoutSeconds int `yaml:"timeout_seconds"`
}

type Workers struct {
	Enabled bool `yaml:"enabled"`
	// Model is the provider/model workers use; "" means the parent's.
	Model string `yaml:"model"`
	// MaxSteps caps each worker's model calls; 0 means
	// DefaultWorkerMaxSteps.
	MaxSteps int `yaml:"max_steps"`
	// MaxConcurrent is the cap on workers running at once (1..4; 0 means
	// 1). Worker calls in one response run concurrently up to this cap.
	MaxConcurrent int `yaml:"max_concurrent"`
	// Tools are the tools a worker may use, intersected with the parent's;
	// empty means DefaultWorkerTools.
	Tools []string `yaml:"tools"`
}