Documentation
¶
Overview ¶
Package config loads ~/.yottacode/config.toml — the single tunable surface for context-window watermarks, retrieval, and provider profiles.
The file is parsed with github.com/BurntSushi/toml so we get arrays of tables ([[providers]], [[providers.models]]) without writing a parser. Unknown keys and unknown sections are rejected at load time so a typo like `enbled = ture` doesn't silently pass — we walk the metadata's Undecoded() set after decoding.
API keys NEVER live in this file. Each [[providers]] block names an environment variable via api_key_env; the actual key is provided either via that OS env var or via ~/.yottacode/.env or <repo>/.yottacode/.env. Inline api_key fields are refused at load.
Index ¶
- Constants
- Variables
- func DefaultPath() (string, error)
- func EnsureDefault(path string) (string, error)
- func MCPNameValid(name string) bool
- func ParseCandidate(raw string) (provider, model string, err error)
- func Render(cfg Config) string
- func Save(cfg Config, path string) error
- func Validate(cfg Config) error
- type Active
- type CacheConfig
- type CheckpointsConfig
- type Config
- func (c Config) ContextWindowOverride(model string) int
- func (c *Config) FindProvider(name string) *Provider
- func (c Config) ProviderKindForModel(model string) string
- func (c *Config) ResolveCandidates() ([]ResolvedCandidate, error)
- func (c *Config) ResolveRouterChains() (implementer, advisor []ResolvedCandidate, err error)
- func (c *Config) ResolveRouterModels() (implementer, advisor ResolvedCandidate, err error)
- func (c Config) SubagentSessionTokenBudget() int
- type ContextConfig
- type LSPConfig
- type MCPServer
- type MemoryConfig
- type Model
- type Provider
- type ResolvedCandidate
- type RetrievalConfig
- type RouterConfig
- type SandboxConfig
- type SessionRecallConfig
- type SkillsConfig
- type SubagentsConfig
- type ThemeConfig
Constants ¶
const ( RouterModeOff = "off" RouterModeManual = "manual" RouterModeAuto = "auto" )
RouterMode values for RouterConfig.Mode.
const DefaultCheckpointRetentionDays = 30
DefaultCheckpointRetentionDays mirrors Claude Code's 30-day TTL — long enough to step back through a few days of work, short enough that blob storage doesn't grow without bound. Override per-host via `[checkpoints] retention_days = N` in config.toml.
const DefaultRouterHealthFailureThreshold = 3
DefaultRouterHealthFailureThreshold is the number of failures within the window that mark a candidate as degraded. Set to 0 in the config file to disable observation entirely.
const DefaultRouterHealthWindowSeconds = 60
DefaultRouterHealthWindowSeconds is the sliding-window length the router uses when the user enables routing without specifying health_window_seconds.
const DefaultSandboxImage = "registry.access.redhat.com/ubi9/ubi:9.8-1785906690"
DefaultSandboxImage is the pinned base image for the experimental command sandbox. Keep it as a named constant because the hardening baseline may move as distro images receive security updates.
const DefaultSubagentSessionTokenBudget = 8_000_000
DefaultSubagentSessionTokenBudget bounds cumulative subagent spend per session. Generous — a normal session's delegations sum well under it — but it stops a runaway fan-out from issuing unbounded provider calls on the user's key. Override via `[subagents] session_token_budget = N` (or 0 in code paths that want it unbounded). The figure is in estimated tokens (the same 4-chars-per-token heuristic the status bar uses).
const DefaultsTOML = `` /* 11779-byte string literal not displayed */
DefaultsTOML is the documented default file written by EnsureDefault.
Variables ¶
var ValidCacheTTLs = []string{"5m", "1h"}
ValidCacheTTLs is the whitelist for CacheConfig.AnthropicTTL. Empty is valid too (behaves like "5m") but isn't listed here since it's the unset/default state, not a value a user explicitly chooses.
var ValidKinds = []string{"anthropic", "openai", "openai-auth", "copilot", "openai-compatible", "ollama", "gemini", "xai", "vertex", "vertex-anthropic"}
ValidKinds is the whitelist for Provider.Kind.
var ValidPolicies = []string{"fallback-chain", "cheap-first"}
ValidPolicies is the whitelist for RouterConfig.Policy. Empty is treated as the default (fallback-chain) at construction time.
var ValidRouterModes = []string{RouterModeOff, RouterModeManual, RouterModeAuto}
ValidRouterModes is the whitelist for RouterConfig.Mode. Empty is treated as the default ("off") at load time.
var ValidSandboxBackends = []string{"none", "podman"}
ValidSandboxBackends is the whitelist for SandboxConfig.Backend.
var ValidSandboxNetworks = []string{"none", "host"}
ValidSandboxNetworks is the whitelist for SandboxConfig.Network.
var ValidSessionRecallScopes = []string{"project", "user", "all"}
ValidSessionRecallScopes is the whitelist for SessionRecallConfig.Scope. Empty is coerced to the default ("project") at load time. "user" and "all" both search the whole local store (it is already per-user).
var ValidStrategies = []string{"keyword", "bm25", "semantic", "auto"}
ValidStrategies is the whitelist for RetrievalConfig.Strategy. Empty is coerced to the default ("auto") at load time.
var ValidTiers = []string{"cheap", "balanced", "expensive"}
ValidTiers is the whitelist for Model.Tier. Empty is also accepted (treated as unspecified).
Functions ¶
func EnsureDefault ¶
EnsureDefault writes the documented default config.toml at path if none exists. Returns the resolved path either way so callers can show it to the user. Idempotent — never overwrites an existing file.
func MCPNameValid ¶ added in v0.3.0
MCPNameValid reports whether name matches the MCP server name constraint (lowercase letters, digits, hyphens, underscores; must start with a letter).
func ParseCandidate ¶
ParseCandidate splits a "provider" or "provider:model" router candidate string. Empty model means "use the provider's default". Whitespace is trimmed; an empty input is rejected.
func Render ¶
Render produces the canonical TOML body for a Config. Stable section order: tunables block (context / retrieval) first via the BurntSushi encoder, then human-edited sections (active, providers, router) hand-rendered with explicit alignment so diffs read top-to-bottom. The encoder's emit order isn't guaranteed across releases, which is why we don't lean on it for the human-edited bits.
Used both by wizard.Apply (for fresh writes and merges) and by the TUI's /provider add / /model picker save paths so a single rendering function owns the file shape. Callers that need atomic persistence should pair this with Save.
Types ¶
type Active ¶
type Active struct {
Provider string `toml:"provider"`
Model string `toml:"model"`
DefaultModel string `toml:"default_model"`
}
Active selects which configured provider + model is the session default. All fields are optional — if Provider is empty the user is expected to pass --model / --base-url / --provider via flag or env.
Two TOML keys spell the active model: the new canonical `default_model` and the legacy `model`. Both populate the same in-memory value: after Load(), Model and DefaultModel are kept in sync — whichever the file set (with default_model winning if both appear) is mirrored into the other so existing readers (cfg.Active.Model) keep working unchanged.
type CacheConfig ¶ added in v0.4.0
type CacheConfig struct {
// AnthropicTTL sets the time-to-live for Anthropic's explicit
// cache_control breakpoints: "5m" (Anthropic's own default) or "1h".
// Empty behaves identically to "5m" — the field is simply omitted
// from the request and Anthropic applies its server-side default.
//
// A longer TTL matters for two cases: sessions resumed more than 5
// minutes after the last turn, and Plan/Auto mode round-trips when
// [router] routes them to different models — both otherwise pay a
// full uncached reprocess the moment the 5-minute window lapses.
// The tradeoff is cost, not correctness: Anthropic bills a 1h cache
// write at 2x base instead of 1.25x. See
// yottacode-roadmap/prompt-caching.md.
//
// Anthropic-only. OpenAI/Gemini/xAI/Copilot manage their own cache
// eviction with no client-exposed TTL, so this has no effect there.
AnthropicTTL string `toml:"anthropic_ttl"`
}
CacheConfig tunes provider prompt-cache behavior.
type CheckpointsConfig ¶ added in v0.2.0
type CheckpointsConfig struct {
RetentionDays int `toml:"retention_days"`
}
CheckpointsConfig tunes the per-prompt file/conversation snapshot store behind /checkpoints + Esc Esc. RetentionDays<=0 falls through to DefaultCheckpointRetentionDays so the on-disk default doesn't require users to write a [checkpoints] block.
type Config ¶
type Config struct {
Context ContextConfig `toml:"context"`
Retrieval RetrievalConfig `toml:"retrieval"`
Cache CacheConfig `toml:"cache"`
Memory MemoryConfig `toml:"memory"`
Router RouterConfig `toml:"router"`
Active Active `toml:"active"`
Providers []Provider `toml:"providers"`
Checkpoints CheckpointsConfig `toml:"checkpoints"`
// MCPServers lists Model Context Protocol servers launched at
// session start. Each entry becomes a stdio subprocess whose
// advertised tools register into the agent tool registry under
// the mcp/<name>/<tool> namespace. v1 supports stdio transport
// only; absence of a `transport` field means adding HTTP/SSE
// later is non-breaking.
MCPServers []MCPServer `toml:"mcp_servers"`
Theme ThemeConfig `toml:"theme"`
// LSP carries optional command overrides for the experimental
// language-server code-intelligence tools. Defaults remain built in;
// this only exists for Nix/devcontainer/custom-toolchain paths.
LSP LSPConfig `toml:"lsp"`
// Experimental gates non-default features behind named opt-ins.
// Mirrors the --experimental CLI flag and the
// $YOTTACODE_EXPERIMENTAL env var. Each entry is a feature name
// from internal/experimental; values must be `true` to enable.
// Unrecognized names load without error and emit a startup
// warning so graduated/removed feature names don't break old
// configs.
Experimental map[string]bool `toml:"experimental"`
// Skills carries persistent Agent Skills preferences — currently
// just the default-on list seeded into SkillTool.SetEnabled at
// session start. Absent block keeps the default-off behavior so
// users without preferences see today's small-prompt experience.
Skills SkillsConfig `toml:"skills"`
// Subagents tunes the subagent subsystem (the Agent tool + background
// runs). Absent block falls through to the defaults below.
Subagents SubagentsConfig `toml:"subagents"`
// Sandbox controls whether run_bash executes inside a session-scoped
// podman container instead of directly on the host. Absent block or
// backend="none" (the default) keeps today's host-exec behavior; gated
// behind the "sandbox" experimental feature regardless of backend.
Sandbox SandboxConfig `toml:"sandbox"`
}
Config bundles every tunable yottacode reads from disk. Sub-structs map 1:1 to TOML sections so the file shape mirrors the Go shape.
func Load ¶
Load reads config.toml at the given path, returning the parsed config merged onto Default(). A missing file is not an error — defaults are returned. Invalid values (out-of-range, malformed, unknown sections) ARE an error.
func LoadDefault ¶
LoadDefault loads the file at ~/.yottacode/config.toml.
func (Config) ContextWindowOverride ¶ added in v0.3.0
ContextWindowOverride returns the user-configured context_window for the given model, or 0 when no provider entry sets one. The active provider's entry wins when the same model name is listed under more than one provider (e.g. two proxies fronting the same model). 0 means "no override" — the caller then falls back to the model-tag table and default_window via contextwindow.EffectiveWindow.
This is the read side of the per-model window override: the wizard's registration probe writes Model.ContextWindow (captured from the provider's list-models endpoint), and this surfaces it to the window math so the status bar and auto-summarize threshold honor the real, provider-reported window instead of a stale built-in guess.
func (*Config) FindProvider ¶
FindProvider returns a pointer to the provider with the given name, or nil. Pointer receiver lets callers mutate the slice element if they need to (e.g. /provider use updating Active.Model on switch).
func (Config) ProviderKindForModel ¶ added in v0.3.0
ProviderKindForModel returns the Kind of the provider entry that serves the given model: the active provider when it explicitly names the model (models list or default_model), then any provider that does, then — for models config never enumerates, like openai-auth's scanned set or ollama's local tags — the active provider's Kind. Empty only when nothing matches and no provider is active.
Keying per-backend facts on Kind is what keeps namesake models separated: gpt-5.5 served through "openai-auth" must not inherit numbers from gpt-5.5 served through "openai" (see catalog.ResolveWindowForProvider).
func (*Config) ResolveCandidates ¶
func (c *Config) ResolveCandidates() ([]ResolvedCandidate, error)
ResolveCandidates parses each router.candidates entry and resolves it against the provider catalog. Validate has already been called by Load, so the caller knows every candidate refers to a real provider and a real model — but ResolveCandidates is callable independently for tests and for /router introspection.
func (*Config) ResolveRouterChains ¶ added in v0.4.0
func (c *Config) ResolveRouterChains() (implementer, advisor []ResolvedCandidate, err error)
ResolveRouterChains resolves the implementer and advisor failover chains to ordered candidate lists — primary first, then fallbacks. Validate has confirmed every entry resolves.
func (*Config) ResolveRouterModels ¶ added in v0.3.0
func (c *Config) ResolveRouterModels() (implementer, advisor ResolvedCandidate, err error)
ResolveRouterModels resolves the implementer and advisor primary models named in the [router] block. Callable only when routing is enabled (Mode != off); Validate has already confirmed both strings resolve.
func (Config) SubagentSessionTokenBudget ¶ added in v0.4.0
SubagentSessionTokenBudget resolves the configured cap, applying the generous default when unset (<=0).
type ContextConfig ¶
type ContextConfig struct {
WarnThreshold float64 `toml:"warn_threshold"`
AutoThreshold float64 `toml:"auto_threshold"`
CompactionThreshold float64 `toml:"compaction_threshold"`
CompactionTargetRatio float64 `toml:"compaction_target_ratio"`
DefaultWindow int `toml:"default_window"`
}
ContextConfig governs context-window watermark behavior.
type LSPConfig ¶ added in v0.4.0
type LSPConfig struct {
Servers map[string][]string `toml:"servers"`
Disabled []string `toml:"disabled"`
}
LSPConfig contains optional per-language server command overrides. Keys are stable language IDs such as "go", "typescript", "python", and "rust".
type MCPServer ¶ added in v0.3.0
type MCPServer struct {
// Name is the unique identifier used in tool namespacing and in
// the /mcp slash command. Must match mcpNameRE.
Name string `toml:"name"`
// Transport selects how the server is reached. "" (the zero value)
// and "stdio" both mean stdio; "http" and "sse" dial URL instead of
// spawning Command. See Validate for which fields each transport
// requires.
Transport string `toml:"transport"`
// Command is the executable that runs the MCP server. Resolved via
// exec.LookPath at session start. stdio only.
Command string `toml:"command"`
// Args are passed to Command verbatim. Typical shape:
// command = "npx"
// args = ["-y", "@modelcontextprotocol/server-filesystem", "/workspace"]
// stdio only.
Args []string `toml:"args"`
// Env supplies additional environment variables to the subprocess
// on top of yottacode's inherited environment. Values may use
// $VAR substitution from yottacode's process env, resolved at
// spawn time. Unresolved $VARs surface a startup warning but
// don't fail load. stdio only.
Env map[string]string `toml:"env"`
// URL is the server's HTTP/SSE endpoint. Required when Transport is
// "http" or "sse"; ignored for stdio.
URL string `toml:"url"`
// Headers are set on every outgoing request to URL — e.g. an
// Authorization bearer token. http/sse only.
Headers map[string]string `toml:"headers"`
// Disabled skips this entry at session start without removing it
// from the config file. Useful for temporarily quieting a
// misbehaving server.
Disabled bool `toml:"disabled"`
}
MCPServer describes one Model Context Protocol server launched at session start, over stdio (the default), HTTP, or SSE. The client connects, lists the server's tools, and registers each tool in the agent tool registry under mcp/<Name>/<tool>.
The exec.LookPath/spawn/dial + initialize-handshake is performed at session start by internal/mcp.Manager — config.Validate only checks structural well-formedness. Runtime failures (missing binary, dial failure, init timeout, subprocess crash) are surfaced via /mcp and the next tool invocation rather than refusing the entire session.
type MemoryConfig ¶ added in v0.3.0
type MemoryConfig struct {
// FinalTurnOnQuit, when true, runs one last agent turn on a
// graceful exit (/quit or Ctrl+D while idle) prompting the model
// to persist durable learnings via memory_save before the session
// context is gone. The turn renders in the transcript like any
// other and is skippable (Ctrl+C / Esc cancels it and quits).
// Ctrl+C as the quit gesture always exits immediately without the
// final turn. Default true; set false to make every exit immediate.
FinalTurnOnQuit bool `toml:"final_turn_on_quit"`
// CaptureReminderEveryTurns rides a memory-capture reminder on every
// Nth user message (history-only, like the pre-compaction reminder)
// so sessions that never hit the summarize watermark still get
// periodic reinforcement to persist durable learnings. It is not an
// extra turn and not a per-turn nudge — it appends to a message the
// user was sending anyway. 0 disables. Default 6.
CaptureReminderEveryTurns int `toml:"capture_reminder_every_turns"`
}
MemoryConfig governs proactive agent-managed memory behavior beyond retrieval (which has its own [retrieval] section).
type Model ¶
type Model struct {
// Name is the model identifier passed to the API (e.g.
// "claude-sonnet-4-6"). Required.
Name string `toml:"name"`
// Tier is a coarse cost/capability bucket used by the future
// auto-router. Empty means unspecified. Validated at load time
// against the whitelist below.
Tier string `toml:"tier"`
// ContextWindow overrides yottacode's built-in context-window
// table for this model. 0 means use the built-in fallback.
ContextWindow int `toml:"context_window"`
}
Model is one entry in a provider's catalog.
type Provider ¶
type Provider struct {
// Name is the user-chosen label for this configuration, unique
// within the file. Used by /provider use <name>.
Name string `toml:"name"`
// Kind selects the adapter family. One of:
//
// anthropic — native Messages API (claude-*)
// openai — OpenAI's own endpoints (chat completions
// + responses; auto-routes for o-series and
// gpt-5*)
// openai-compatible — anything that speaks /v1/chat/completions
// (vLLM, Llama Stack, OpenRouter, Together,
// NVIDIA NIM, Groq, …)
// xai — xAI's OpenAI-compatible Grok endpoint
// ollama — Ollama's local server (OpenAI-shim variant)
// vertex — Gemini on Google Vertex AI, via the
// project's OpenAI-compatible chat shim
// vertex-anthropic — Claude on Google Vertex AI, via
// :streamRawPredict (native Messages API)
//
// The two vertex kinds authenticate with Application Default
// Credentials rather than an api_key_env, and carry their GCP project
// and location inside base_url.
Kind string `toml:"kind"`
// BaseURL is the HTTPS endpoint for the API. For Anthropic this is
// typically https://api.anthropic.com; for OpenAI-compatible
// endpoints include the /v1 suffix where the upstream expects it.
BaseURL string `toml:"base_url"`
// APIKeyEnv is the name of the OS environment variable that holds
// the bearer token. Empty for local providers like Ollama. Looked
// up at adapter-construction time, NOT stored here.
APIKeyEnv string `toml:"api_key_env"`
// DefaultModel is the model name to adopt when /provider use
// switches to this provider. Must appear in Models when set.
DefaultModel string `toml:"default_model"`
// Models is the catalog of models available through this provider.
// Used by /model list and as the source of truth for the future
// auto-router.
Models []Model `toml:"models"`
// APIKey is reserved as a tripwire: declaring it inline produces a
// load-time error that points the user at .env. We don't read its
// value — declaring it at all is the failure.
APIKey string `toml:"api_key"`
}
Provider describes one upstream model vendor configuration. Two provider entries can share the same Kind (e.g. OpenRouter and Together both Kind = "openai-compatible") but differ in name + base_url + models.
type ResolvedCandidate ¶
ResolvedCandidate is the fully-resolved view of one router.candidates entry: provider profile + concrete model + tier (looked up from providers.models). Returned by ResolveCandidates so callers (cli.BuildRouter) don't repeat the lookup.
type RetrievalConfig ¶
type RetrievalConfig struct {
Enabled bool `toml:"enabled"`
TopK int `toml:"top_k"`
MaxBytes int `toml:"max_bytes"`
MinScore float64 `toml:"min_score"`
Strategy string `toml:"strategy"`
EmbeddingModel string `toml:"embedding_model"`
// SemanticWeight is the fraction of the "semantic" blend given to
// embedding cosine similarity; BM25 keyword scoring gets the remaining
// (1 - SemanticWeight). Range [0,1]; default 0.4 (the classic 60/40
// BM25/cosine split). 0 = pure BM25, 1 = pure cosine. Only used when the
// effective strategy is "semantic". The blended score is re-normalized
// afterward, so only the ratio matters — one knob covers the full space.
SemanticWeight float64 `toml:"semantic_weight"`
// SessionRecall governs automatic recall of prior conversations — the
// episodic counterpart to the memory retrieval above. When enabled, each
// turn semantically searches past sessions and injects the most relevant
// excerpts into the system prompt, so the agent "remembers" earlier
// discussions without the model having to call session_recall itself.
SessionRecall SessionRecallConfig `toml:"session_recall"`
}
RetrievalConfig governs the per-turn retrieval orchestrator that scores agent-managed memory entries against the user's prompt and injects only the most relevant ones into the system prompt.
type RouterConfig ¶
type RouterConfig struct {
Enabled bool `toml:"enabled"`
Policy string `toml:"policy"`
Candidates []string `toml:"candidates"`
HealthWindowSeconds int `toml:"health_window_seconds"`
HealthFailureThreshold int `toml:"health_failure_threshold"`
// Mode controls cache-safe task routing between an advisor and an
// implementer model. "off" (default) disables it entirely. "manual"
// resolves the role models but only routes when an agent declares an
// explicit model. "auto" makes the advisor the reasoning/planning model
// and the implementer the fast coding/subagent/summarization model. The
// router changes the main-thread model only at explicit session/mode
// boundaries; child/advisor-consult contexts are isolated.
Mode string `toml:"mode"`
// AdvisorModel and ImplementerModel name the role models as
// "<provider>" or "<provider>:<model>" (same grammar as Candidates).
// Required when Mode is not "off" (unless the plural form is set).
AdvisorModel string `toml:"advisor_model"`
ImplementerModel string `toml:"implementer_model"`
// AdvisorModels and ImplementerModels are failover-chain forms: the
// first entry is the primary, the rest are fallbacks tried in order
// when the primary fails. A slot may set the singular OR plural form,
// not both. Empty plural → the singular is used as a one-element chain.
AdvisorModels []string `toml:"advisor_models"`
ImplementerModels []string `toml:"implementer_models"`
// Fast*/Smart* are legacy aliases for Implementer*/Advisor* kept so
// existing configs load. New writes use the role-named fields.
FastModel string `toml:"fast_model"`
SmartModel string `toml:"smart_model"`
FastModels []string `toml:"fast_models"`
SmartModels []string `toml:"smart_models"`
}
RouterConfig describes the multi-provider routing policy. When Enabled is false, yottacode dispatches to the single configured provider (the legacy behavior). When true, Candidates names an ordered list of "<provider>" or "<provider>:<model>" entries and Policy selects the dispatch strategy.
Capability gating across providers is a Phase 2 concern: candidates listed here must be capability-aligned (e.g. all support web_search, or none do) for predictable system-prompt composition. The first candidate is the representative for connection probes and system-prompt rendering.
HealthWindowSeconds and HealthFailureThreshold control the router-level sliding-window failure tracker. After HealthFailureThreshold failures within HealthWindowSeconds for a candidate, the router demotes that candidate to the back of the dispatch order on subsequent requests. A successful turn clears the candidate's failure history. Set either to 0 to disable observation entirely; defaults are 60 seconds / 3 failures.
func (RouterConfig) AdvisorChain ¶ added in v0.4.0
func (r RouterConfig) AdvisorChain() []string
AdvisorChain returns the advisor-model failover chain, falling back to the legacy smart_* aliases when the canonical advisor_* fields are absent. ImplementerChain is the same for implementer_* with legacy fast_* aliases.
func (RouterConfig) FastChain ¶ added in v0.4.0
func (r RouterConfig) FastChain() []string
FastChain and SmartChain are compatibility accessors for older callers and tests. Fast maps to implementer; smart maps to advisor.
func (RouterConfig) ImplementerChain ¶ added in v0.4.0
func (r RouterConfig) ImplementerChain() []string
func (RouterConfig) RoutingAuto ¶ added in v0.3.0
func (r RouterConfig) RoutingAuto() bool
RoutingAuto reports whether automatic (heuristic) routing of subagents and summarization is active.
func (RouterConfig) RoutingEnabled ¶ added in v0.3.0
func (r RouterConfig) RoutingEnabled() bool
RoutingEnabled reports whether task routing is active (Mode is "manual" or "auto"). Empty/"off" means disabled.
func (RouterConfig) SmartChain ¶ added in v0.4.0
func (r RouterConfig) SmartChain() []string
type SandboxConfig ¶ added in v0.4.0
type SandboxConfig struct {
Backend string `toml:"backend"` // "none" (default) | "podman"
Image string `toml:"image"`
Network string `toml:"network"` // "none" (default) | "host"
Mounts []string `toml:"mounts"`
EnvPassthrough []string `toml:"env_passthrough"`
Memory string `toml:"memory"`
CPUs float64 `toml:"cpus"`
PidsLimit int `toml:"pids_limit"`
}
SandboxConfig controls the run_bash command-execution backend. See roadmap/sandbox-podman.md for the design this implements: a session-scoped container, podman exec per command, project-dir-only mount, default-deny network. EnvPassthrough names are forwarded via bare `-e NAME` (podman reads the value from its own environment) so credential values never appear in podman's argv/process list.
type SessionRecallConfig ¶ added in v0.4.0
type SessionRecallConfig struct {
// Auto enables per-turn injection. Default true. Set to false to keep the
// manual session_recall tool but stop automatic injection.
Auto bool `toml:"auto"`
// Scope restricts which sessions are searched: "project" (sessions from
// the current repository — its root and everything below it, so a session
// started in a subdirectory still counts; the safe default that never
// mixes projects), "user"/"all" (the whole local store). Empty defaults to
// "project".
Scope string `toml:"scope"`
// TopK caps how many prior-conversation excerpts are injected per turn.
// Default 3; 0 injects nothing (unlike max_bytes below, where 0 means
// "no bound" — a cap of zero excerpts reads as none, so that is what it
// does).
TopK int `toml:"top_k"`
// MinScore is the cosine-similarity floor (0.0–1.0) an excerpt must clear
// to be injected. Default 0.6 — calibrated for nomic-embed-text, whose
// cosines are compressed (a strongly on-topic paraphrase lands ~0.65,
// unrelated text ~0.37). High enough that only genuinely relevant prior
// conversations surface, so the block stays empty when nothing matches
// rather than padding the prompt with noise.
MinScore float64 `toml:"min_score"`
// MaxBytes caps the combined size of the injected block. Default 2000.
// 0 removes the byte bound (TopK still applies).
MaxBytes int `toml:"max_bytes"`
}
SessionRecallConfig governs automatic injection of relevant past-conversation excerpts each turn. Requires semantic embeddings (Ollama), so it is inert when the embedding model is unavailable — retrieval degrades to the manual session_recall tool. Only reads past sessions; it never writes memory.
type SkillsConfig ¶ added in v0.3.0
type SkillsConfig struct {
DefaultOn []string `toml:"default_on"`
}
SkillsConfig declares persistent Agent Skills behavior. DefaultOn is the set of skill names to mark as enabled when each new TUI session starts (or a session is resumed). Names that don't match any loaded skill produce a startup warning so a typo surfaces instead of silently no-op'ing — same pattern as Experimental.
type SubagentsConfig ¶ added in v0.4.0
type SubagentsConfig struct {
SessionTokenBudget int `toml:"session_token_budget"`
}
SubagentsConfig tunes the subagent subsystem. SessionTokenBudget caps the cumulative ESTIMATED tokens spent across ALL subagent runs in one session — a backstop against an enthusiastic or adversarial prompt fanning out unbounded child loops on the user's API key (the per-child iteration cap and the concurrency cap bound one wave, not the session total). <=0 falls through to DefaultSubagentSessionTokenBudget.
type ThemeConfig ¶ added in v0.3.0
type ThemeConfig struct {
Name string `toml:"name"`
}
ThemeConfig selects the TUI color palette. Name must match a theme registered in internal/tui/themes (terminal, catppuccin, dimmed, gruvbox, high-contrast, low-contrast, no-color, nord, one-dark, solarized-dark, tokyo-night). Empty value falls through to the package default; unknown values are rejected at load time so a typo surfaces immediately instead of silently snapping back to the default.