config

type AgentConfig struct {
	SystemPrompt     string            `toml:"system_prompt"`
	SystemPromptFile string            `toml:"system_prompt_file"`
	MaxSteps         int               `toml:"max_steps"`         // tool-call rounds per turn; 0 = unlimited
	PlannerMaxSteps  int               `toml:"planner_max_steps"` // planner read-only tool-call rounds; 0 = unlimited
	Temperature      float64           `toml:"temperature"`
	PlannerModel     string            `toml:"planner_model"`
	SubagentModel    string            `toml:"subagent_model"`
	SubagentModels   map[string]string `toml:"subagent_models"`
	SubagentEffort   string            `toml:"subagent_effort"`
	SubagentEfforts  map[string]string `toml:"subagent_efforts"`
	FastTaskModel    string            `toml:"fast_task_model"` // lightweight model for dream/distill background tasks
	// OutputStyle selects a persona/tone block folded into the system prompt at
	// startup (a built-in like "explanatory"/"learning"/"concise", or a custom
	// .fairpeer/output-styles/<name>.md). Empty = the unmodified prompt.
	OutputStyle string `toml:"output_style"`
	// AutoPlan controls whether interactive turns that look multi-step start in
	// plan mode automatically: "off" keeps plan mode manual, "on" enables the
	// approval gate. Legacy "ask" is treated as "on".
	AutoPlan string `toml:"auto_plan"`
	// AutoPlanClassifier optionally names a provider/model used to classify
	// borderline auto-plan decisions. Empty keeps the zero-cost heuristic path.
	AutoPlanClassifier string `toml:"auto_plan_classifier"`
	// Compaction window fractions: soft = notice only, compact = trigger, force = hard ceiling.
	SoftCompactRatio  float64 `toml:"soft_compact_ratio"`
	CompactRatio      float64 `toml:"compact_ratio"`
	CompactForceRatio float64 `toml:"compact_force_ratio"`
	// ContextBudgetPercent caps the effective window for compaction decisions
	// (SPEC v2 §3.6). 0/100 = full window (default, zero config). E.g. 80 =
	// compact as if the window were 80% of its real size — saves cost on input
	// pricing tiers and avoids quality drop near the window edge.
	ContextBudgetPercent int `toml:"context_budget_percent"`
}

type BotAllowlist struct {
	Enabled      bool     `toml:"enabled"`
	AllowAll     bool     `toml:"allow_all"`
	Mode         string   `toml:"mode"` // "open"（默认，自动加入）| "review"（需管理员审批）
	QQUsers      []string `toml:"qq_users"`
	FeishuUsers  []string `toml:"feishu_users"`
	WeixinUsers  []string `toml:"weixin_users"`
	QQGroups     []string `toml:"qq_groups"`
	FeishuGroups []string `toml:"feishu_groups"`
	WeixinGroups []string `toml:"weixin_groups"`
}

type BotConfig struct {
	Enabled     bool                  `toml:"enabled"`
	Model       string                `toml:"model"` // 用于 bot 的模型名，空则用 default_model
	MaxSteps    int                   `toml:"max_steps"`
	DebounceMs  int                   `toml:"debounce_ms"` // 消息合并窗口，毫秒
	Allowlist   BotAllowlist          `toml:"allowlist"`
	QQ          QQBotConfig           `toml:"qq"`
	Feishu      FeishuBotConfig       `toml:"feishu"`
	Weixin      WeixinBotConfig       `toml:"weixin"`
	Connections []BotConnectionConfig `toml:"connections"`
}

type BotConnectionConfig struct {
	ID              string                        `toml:"id"`
	Provider        string                        `toml:"provider"` // qq|feishu|weixin
	Domain          string                        `toml:"domain"`   // feishu|lark|weixin|qq
	Label           string                        `toml:"label"`
	Enabled         bool                          `toml:"enabled"`
	Status          string                        `toml:"status"` // disconnected|pending|connected|error
	Model           string                        `toml:"model"`
	WorkspaceRoot   string                        `toml:"workspace_root"`
	Credential      BotConnectionCredential       `toml:"credential"`
	SessionMappings []BotConnectionSessionMapping `toml:"session_mappings"`
	LastError       string                        `toml:"last_error"`
	CreatedAt       string                        `toml:"created_at"`
	UpdatedAt       string                        `toml:"updated_at"`
}

type BotConnectionCredential struct {
	AppID        string `toml:"app_id"`
	AppSecretEnv string `toml:"app_secret_env"`
	AccountID    string `toml:"account_id"`
	TokenEnv     string `toml:"token_env"`
}

type BotConnectionSessionMapping struct {
	RemoteID      string `toml:"remote_id"`
	SessionID     string `toml:"session_id"`
	Scope         string `toml:"scope"`
	WorkspaceRoot string `toml:"workspace_root"`
	UpdatedAt     string `toml:"updated_at"`
}

type BuiltInMCPConfig struct {
	Context7Enabled bool `toml:"context7_enabled"`
}

type CodegraphConfig struct {
	Enabled     bool   `toml:"enabled"`
	AutoInstall bool   `toml:"auto_install"`
	Path        string `toml:"path"` // local binary path (skips download)
	Tier        string `toml:"tier"`
	DownloadURL string `toml:"download_url"` // custom download base URL for air-gapped/intranet (replaces GitHub default)
}

type Config struct {
	ConfigVersion int    `toml:"config_version"`
	DefaultModel  string `toml:"default_model"`
	Language      string `toml:"language"` // ui/model language tag (e.g. "zh"); empty = auto-detect from $LANG / $FAIRPEER_LANG
	// ReasoningLanguage steers ONLY the visible thinking/reasoning text language
	// (auto|zh|en), independent of the final-answer language. Default "auto" leaves
	// it to the provider. It is injected as a transient per-turn block, never into
	// the cache-stable system prompt prefix.
	ReasoningLanguage string              `json:"-" toml:"reasoning_language"` // auto|zh|en; empty = auto
	UI                UIConfig            `toml:"ui"`
	Desktop           DesktopConfig       `toml:"desktop"`
	Notifications     NotificationsConfig `toml:"notifications"`
	Agent             AgentConfig         `toml:"agent"`
	Providers         []ProviderEntry     `toml:"providers"`
	Tools             ToolsConfig         `toml:"tools"`
	Permissions       PermissionsConfig   `toml:"permissions"`
	Sandbox           SandboxConfig       `toml:"sandbox"`
	Network           NetworkConfig       `toml:"network"`
	Plugins           []PluginEntry       `toml:"plugins"`
	Skills            SkillsConfig        `toml:"skills"`
	Codegraph         CodegraphConfig     `toml:"codegraph"`
	BuiltInMCP        BuiltInMCPConfig    `toml:"builtin_mcp"`
	Dream             DreamConfig         `toml:"dream"`
	Statusline        StatuslineConfig    `toml:"statusline"`
	LSP               LSPConfig           `toml:"lsp"`
	Bot               BotConfig           `toml:"bot"`
	// Cowork holds coWork (office) profile settings — currently just the browser
	// path override. Empty means auto-detect; a non-empty path is tried first
	// (and the user is guided to set it when no browser is found).
	Cowork CoworkConfig `toml:"cowork"`
	// LLM holds the global request budget (rate limiting) applied to all
	// providers. RPM=0 (the default) disables limiting for backward compat.
	LLM LLMConfig `toml:"llm"`
	// Profiles holds optional [[profiles]] entries that override the built-in
	// dev/cowork profiles by name. A name collision with a builtin replaces it,
	// so users can customise a profile's model/prompt/skills without code. Empty
	// means only the builtins are available (dev + cowork).
	Profiles []Profile `toml:"profiles"`
}

type CoworkConfig struct {
	BrowserPath string `toml:"browser_path"` // absolute path to a Chromium-based browser exe; empty = auto-detect
	// BrowserHeadless controls whether the driven browser runs headless. Default
	// false (headed/visible) — a visible browser behaves closer to a human user,
	// keeps login state in a persistent profile, and avoids the rendering
	// quirks headless has on JS-heavy/anti-bot sites (e.g. GitHub's challenge
	// page). Set true for servers/CI where there is no display.
	BrowserHeadless bool `toml:"browser_headless"`
	// BrowserUserDataDir gives the driven browser a persistent user-data
	// directory. Empty = a fresh temp profile per launch (state is lost on
	// restart). Set to a fixed path to keep cookies/login across sessions —
	// essential for sites that require sign-in, and it reduces the "verify you
	// are human" friction on revisit.
	BrowserUserDataDir string `toml:"browser_user_data_dir"`
	// PPTActiveTemplate is the id of the active PPT template (from the templates
	// dir <user-config>/fairpeer/ppt-templates/<id>.json). When set, the ppt-wizard
	// skill generates decks from that template: it opens the template's master_file
	// in WPS (if any) and places content at the template's pre-defined layout
	// coordinates, so most slides don't need per-step VLM perception. Empty = no
	// template, the CUA builds from a blank deck.
	PPTActiveTemplate string `toml:"ppt_active_template"`
	// PPTMode selects how the ppt-wizard skill builds decks. "fast" (default
	// when empty) generates in one pass with no rework; "validate" generates,
	// then checks and reworks on issues. The desktop cowork settings panel
	// exposes this as a dropdown; PPTActiveTemplate still selects the template
	// used in either mode.
	PPTMode string `toml:"ppt_mode"`
	// SMTP configures outbound email (email_send). All fields required to enable
	// sending; empty SMTPHost disables email_send (it returns a config error).
	SMTP SMTPConfig `toml:"smtp"`
	// RAGEnabled is the master switch for the knowledge base (RAG). nil/unset =
	// enabled (the historical default, backward compatible). Set to false to
	// fully disable the knowledge base: no auto-injection into messages, the
	// rag_search/rag_import/... tools are not registered, and expert teams skip
	// knowledge-base context. This is distinct from EmbeddingModel (which only
	// toggles semantic reranking on top of FTS5) — RAGEnabled governs whether RAG
	// runs at all.
	RAGEnabled *bool `toml:"rag_enabled"`
	// EmbeddingModel enables semantic RAG reranking. When set to a provider model
	// ref that supports embeddings, rag_search computes a query embedding and
	// reranks FTS5 hits by cosine similarity. Empty = FTS5-only (the default,
	// works offline). Set to a real embedding model (e.g. a provider with kind
	// "embedding") to upgrade RAG to hybrid.
	EmbeddingModel string `toml:"embedding_model"`
	// VLMBackend is legacy: VLM now always uses the provider multimodal chat path
	// (base64 image_url content parts). Kept for TOML backward-compat but ignored.
	// Use VLMModel / ScreenshotVLMModel to pick the vision model.
	VLMBackend string `toml:"vlm_backend"`
	// VLMModel is the provider model ref for image recognition (screen_perceive).
	// E.g. "<provider>/<model>". Must be vision-capable (provider vision=true).
	VLMModel string `toml:"vlm_model"`
	// IMAP configures inbound email (email_read/search). Empty Host = read tools
	// return "not configured". Reading uses go-imap + go-message (protocol-level
	// correct: full SEARCH, RFC 2047 header decoding, multipart MIME).
	IMAP IMAPConfig `toml:"imap"`
	// EmailAccounts holds the mailboxes FairPeer can talk to. At load time
	// normalizeEmailAccounts folds the legacy single [cowork.smtp]/[cowork.imap]
	// pair above into EmailAccounts[0] when this slice is empty, so existing
	// single-account configs keep working unchanged; new configs may use either
	// form. Tools select an account by Name; Default (or [0]) is the fallback.
	EmailAccounts []EmailAccount `toml:"email_accounts"`
	// ExtractModel is the LLM used by the RAG deep-extraction pipeline (turns
	// imported documents into a structured entity/relation graph). Empty = fall
	// back to the active profile's main model. Pair with ExtractInterval /
	// ExtractConcurrency to tune request cadence; the pipeline is conservative
	// by default (1 concurrent chunk, 3s between chunks) to avoid rate limits.
	ExtractModel string `toml:"extract_model"`
	// ExtractInterval is the pause between chunk extractions (default "3s").
	// Raise it on rate-limited endpoints; lower on generous local models.
	ExtractInterval string `toml:"extract_interval"`
	// ExtractConcurrency is how many chunks extract in parallel (default 1).
	// Keep low to avoid tripping rate limits — extraction is a background task
	// where throughput matters less than "no errors".
	ExtractConcurrency int `toml:"extract_concurrency"`

	// ScreenshotEnabled turns on the global-hotkey screenshot-to-VLM feature.
	// When true, pressing ScreenshotHotkey anywhere (even when FairPeer is in
	// the background) captures the screen, sends it to ScreenshotVLMModel for
	// recognition, and replies via IM bot + in-app toast. Default false — the
	// user opts in via the cowork settings tab.
	ScreenshotEnabled bool `toml:"screenshot_enabled"`
	// ScreenshotHotkey is the global hotkey combination (e.g. "Ctrl+Shift+Alt+W").
	// Detected via GetAsyncKeyState polling so it fires even when FairPeer isn't
	// focused. Default "Ctrl+Shift+Alt+W".
	ScreenshotHotkey string `toml:"screenshot_hotkey"`
	// ScreenshotVLMModel is the model used for screenshot recognition.
	// This is the SINGLE place all image-recognition config lives —
	// set it once in the cowork settings page.
	ScreenshotVLMModel string `toml:"screenshot_vlm_model"`
	// ScreenshotPrompt is the user prompt sent with the screenshot image to the
	// VLM model. Users can customize this to change the solving behavior (e.g.
	// focus on specific subjects, require verification, etc.). Empty means use
	// the built-in default.
	ScreenshotPrompt string `toml:"screenshot_prompt"`

	// EStopHotkey is the global EMERGENCY-STOP hotkey for coWork desktop
	// automation. Pressing it anywhere (even with FairPeer minimized) cancels
	// the in-flight turn on the active tab — the kill switch for screen_* tools,
	// whose clicks/typing are irreversible. Registered via Win32 RegisterHotKey
	// like the screenshot hotkey. Default "Ctrl+Shift+Pause". Set to "off" to
	// disable the feature entirely.
	EStopHotkey string `toml:"estop_hotkey"`
	// HEPort is the port for the Hyper-Extract Python server. Default 0 means
	// use the built-in default (18900).
	HEPort int `toml:"he_port"`
	// BrowserUseEnabled controls whether the browser-use autonomous-browsing
	// sidecar is wired up. When false (the zero-value DEFAULT), browser_auto
	// returns a clear "disabled" error and no Python sidecar is started. This
	// is intentionally opt-in: the sidecar needs the browser-use Python package
	// installed (and a provider client), so users who haven't set that up are
	// not bothered by startup failures. Set browser_use_enabled = true once
	// the environment is ready.
	BrowserUseEnabled bool `toml:"browser_use_enabled"`
	// BrowserUsePython overrides the Python interpreter used to run the
	// browser-use sidecar. Empty = "python" (Windows) / "python3" (other). In
	// the packaged build this resolves to the bundled runtime's python.exe.
	BrowserUsePython string `toml:"browser_use_python"`
	// BrowserUsePort is the port for the browser-use sidecar. Default 0 means
	// use the built-in default (18901, distinct from HE's 18900).
	BrowserUsePort int `toml:"browser_use_port"`
	// BrowserUseModel is the provider model ref the sidecar uses for the
	// agentic loop (e.g. "<provider>/<model>"). Empty = fall back to VLMModel,
	// then the main agent model. A strong vision-capable model is strongly
	// recommended — the loop reads screenshots/accessibility trees.
	BrowserUseModel string `toml:"browser_use_model"`
	// BrowserUseMaxSteps caps the agentic loop. Default 0 means let the sidecar
	// pick a sensible bound. Set lower for cheaper/faster runs, higher for
	// complex multi-page tasks.
	BrowserUseMaxSteps int `toml:"browser_use_max_steps"`
	// FastLLMBaseDomain overrides the base URL for direct /chat/completions calls
	// made by the scheduler time-parser and RAG ask (legacy path; Phase 3 will
	// route these through the resolved fast-task provider instead). Empty = the
	// built-in default.
	FastLLMBaseDomain string `toml:"fast_llm_base_domain"`
}

type DesktopConfig struct {
	Language       string   `toml:"language"`        // auto|en|zh; empty/auto = browser/OS auto-detect
	Theme          string   `toml:"theme"`           // auto|dark|light; empty resolves to dark
	ThemeStyle     string   `toml:"theme_style"`     // graphite|aurora|slate|carbon|nocturne|amber and legacy aliases
	CloseBehavior  string   `toml:"close_behavior"`  // quit|background; desktop window close behavior
	DisplayMode    string   `toml:"display_mode"`    // standard|compact|minimal; transcript display mode
	CheckUpdates   *bool    `toml:"check_updates"`   // startup update checks; nil keeps the default enabled
	Telemetry      *bool    `toml:"telemetry"`       // anonymous launch ping (install id + version + OS); nil keeps the default enabled
	Metrics        *bool    `toml:"metrics"`         // opt-in aggregate agent metrics (anonymous signal/bucket counts; no content); nil = disabled
	ProviderAccess []string `toml:"provider_access"` // desktop-only list of provider entries shown in Settings > Model > Access
	ExpandThinking bool     `toml:"expand_thinking"` // true = show reasoning text expanded by default; false = collapsed
}

type DreamConfig struct {
	Enabled         bool `toml:"enabled"`          // master switch; false disables both background agents
	DreamInterval   int  `toml:"dream_interval"`   // days between automatic Dream runs; 0 = default 7
	DistillInterval int  `toml:"distill_interval"` // days between automatic Distill runs; 0 = default 30
	SkillColdDays   int  `toml:"skill_cold_days"`  // days a skill is unused before cold-retirement; 0 = default 90
	IdleMinutes     int  `toml:"idle_minutes"`     // minutes of user inactivity before a Dream run may fire; 0 = default 10
}

type EffortCapability struct {
	Supported bool
	Levels    []string
	Default   string
}

type EmailAccount struct {
	Name    string     `toml:"name"`    // stable handle tools/scheduler address (e.g. "personal-139")
	Default bool       `toml:"default"` // used when a tool omits an account name
	SMTP    SMTPConfig `toml:"smtp"`
	IMAP    IMAPConfig `toml:"imap"`
}

type FeishuBotConfig struct {
	Enabled           bool   `toml:"enabled"`
	Domain            string `toml:"domain"` // feishu（默认）| lark
	AppID             string `toml:"app_id"`
	AppSecretEnv      string `toml:"app_secret_env"`     // 如 FEISHU_BOT_APP_SECRET
	VerificationToken string `toml:"verification_token"` // 事件订阅验证 token
	Mode              string `toml:"mode"`               // webhook（默认）| websocket
	WebhookPort       int    `toml:"webhook_port"`       // webhook 模式端口
	RequireMention    bool   `toml:"require_mention"`
}

type IMAPConfig struct {
	Host          string `toml:"host"`            // IMAP server host, e.g. imap.example.com
	Port          int    `toml:"port"`            // IMAP port (993 for implicit TLS, 143 for STARTTLS/plain)
	Username      string `toml:"username"`        // mailbox login
	PasswordEnv   string `toml:"password_env"`    // env var holding the password
	SkipTLSVerify bool   `toml:"skip_tls_verify"` // opt in to skip TLS cert verification (self-signed/corporate CAs). Verification stays ON unless this is true.
}

type LLMConfig struct {
	RPM         int `toml:"rpm"`          // max requests/minute per API key (0 = unlimited)
	TPM         int `toml:"tpm"`          // max tokens/minute (0 = unlimited; reserved, not enforced yet)
	ReserveMain int `toml:"reserve_main"` // requests reserved for main-agent priority (default 2)
}

type LSPConfig struct {
	Enabled bool                 `toml:"enabled"`
	Servers map[string]LSPServer `toml:"servers"`
}

type LSPServer struct {
	Command     string            `toml:"command"`
	Args        []string          `toml:"args"`
	Env         map[string]string `toml:"env"`
	LanguageID  string            `toml:"language_id"`
	Extensions  []string          `toml:"extensions"`
	InstallHint string            `toml:"install_hint"`
}

type MCPImportCandidate struct {
	Entry       PluginEntry
	Recommended bool
	Reasons     []string
}

type MigrationResult struct {
	From     string
	To       string
	KeyToEnv bool
	Plugins  int
	Warnings []string
}

type NetworkConfig struct {
	// ProxyMode is "auto" (default; environment proxy for now), "env", "custom",
	// or "off". auto leaves room for OS proxy detection later without changing the
	// config shape.
	ProxyMode string `toml:"proxy_mode"`
	// ProxyURL is an advanced custom override such as "socks5://127.0.0.1:7890".
	// When set and proxy_mode = "custom", it wins over the structured proxy table.
	ProxyURL string `toml:"proxy_url"`
	// NoProxy is honored for custom proxies. Env/auto modes use NO_PROXY from the
	// process environment instead.
	NoProxy string             `toml:"no_proxy"`
	Proxy   NetworkProxyConfig `toml:"proxy"`
}

type NetworkProxyConfig struct {
	Type     string `toml:"type"` // http|https|socks5|socks5h
	Server   string `toml:"server"`
	Port     int    `toml:"port"`
	Username string `toml:"username"`
	Password string `toml:"password"`
}

type NotificationsConfig struct {
	Enabled         bool `toml:"enabled"`
	TurnDone        bool `toml:"turn_done"`
	ApprovalRequest bool `toml:"approval_request"`
	AskRequest      bool `toml:"ask_request"`
}

type PermissionsConfig struct {
	Mode  string   `toml:"mode"`
	Allow []string `toml:"allow"`
	Ask   []string `toml:"ask"`
	Deny  []string `toml:"deny"`
}

type PluginEntry struct {
	Name    string            `toml:"name"`
	Type    string            `toml:"type"` // "stdio" (default) | "http" | "sse"
	Command string            `toml:"command"`
	Args    []string          `toml:"args"`
	Env     map[string]string `toml:"env"`
	URL     string            `toml:"url"`
	Headers map[string]string `toml:"headers"`
	// AutoStart controls whether the server connects during session startup.
	// Nil preserves historical behavior: configured servers start automatically.
	AutoStart *bool `toml:"auto_start"`
	// Tier selects how aggressively the server is connected at boot:
	//   "eager"      — blocks startup until the handshake completes; required for
	//                  servers whose tools the system prompt depends on.
	//   "lazy"       — registers placeholder tools immediately (from on-disk
	//                  schema cache when available) and only spawns the real
	//                  subprocess on first model use. Kept for legacy configs.
	//   "background" — placeholder + spawn fired at boot but not waited on;
	//                  swap happens once the spawn finishes.
	// Empty defaults to "background" so enabled MCPs connect automatically
	// without blocking chat. Unknown non-empty values fall back to "lazy".
	Tier string `toml:"tier"`
	// CallTimeout overrides the per-call default timeout (60s) for this MCP
	// server's JSON-RPC calls. Prevents a slow server from blocking the agent.
	// Format: Go duration string (e.g. "30s", "2m", "0" to disable).
	CallTimeout string `toml:"call_timeout"`
	// Risk marks this MCP server's tools' risk class for the permission gate
	// (SPEC v2 §3.2A). MCP tools default to "external" (safe: outward
	// operations need approval). Set to "read" for a trusted read-only server
	// so its tools don't prompt; "write_local"/"exec" for the in-between cases.
	// Empty/unknown = "external" (fail-safe). See internal/permission/risk.go.
	Risk string `toml:"risk"`
}

type Profile struct {
	Name              string   `toml:"name"`
	DisplayName       string   `toml:"display_name"`
	Model             string   `toml:"model"`               // overrides DefaultModel; "" = config default
	SubagentModel     string   `toml:"subagent_model"`      // overrides agent.subagent_model; "" = unchanged
	Effort            string   `toml:"effort"`              // overrides effort; "" = provider default
	SystemPromptAddon string   `toml:"system_prompt_addon"` // appended to resolved prompt; "" = unchanged
	SystemPromptFile  string   `toml:"system_prompt_file"`  // when set, replaces the resolved prompt entirely
	EnabledSkills     []string `toml:"enabled_skills"`      // whitelist; empty = all skills
	DisabledSkills    []string `toml:"disabled_skills"`     // extra-disabled on top of config
	Plugins           []string `toml:"plugins"`             // plugin name whitelist; empty = all plugins
	HiddenTools       []string `toml:"hidden_tools"`        // tools to Hide from main loop schemas; empty = all visible. Subagents still see them via FilterRegistry.
	WorkspaceType     string   `toml:"workspace_type"`      // "code" | "document"; frontend hint only
}

type ProviderEntry struct {
	Name      string   `toml:"name"`
	Kind      string   `toml:"kind"`
	BaseURL   string   `toml:"base_url"`
	Model     string   `toml:"model"`      // a single model (back-compat)
	Models    []string `toml:"models"`     // a vendor's model list (one base_url/key, many models)
	ModelsURL string   `toml:"models_url"` // auto-fetch models from this URL on startup
	Default   string   `toml:"default"`    // default model when Models is set (else Models[0])
	// FastModel is the lightweight model used for background/fast tasks
	// (dream/distill/rag-extract, scheduler time-parse). Empty = fall back to
	// Default at runtime. This is the per-provider "fast" role; the global
	// agent.fast_task_model can override it.
	FastModel     string            `toml:"fast_model"`
	APIKeyEnv     string            `toml:"api_key_env"`
	ContextWindow int               `toml:"context_window"`
	Price         *provider.Pricing `toml:"price"`
	// Thinking / Effort are provider-kind-specific knobs forwarded to the provider
	// via Config.Extra. The anthropic provider reads Thinking="adaptive" to enable
	// extended thinking and Effort ("low".."max") to tune depth. The
	// openai-compatible provider forwards Effort as reasoning_effort for
	// thinking-capable models.
	// Empty = provider default.
	Thinking string `toml:"thinking"`
	Effort   string `toml:"effort"`
	// ReasoningProtocol selects the request shape for OpenAI-compatible reasoning
	// models. Empty/auto uses the model capability registry plus endpoint
	// heuristics; none disables automatic reasoning controls for this provider.
	ReasoningProtocol string `toml:"reasoning_protocol"`
	// SupportedEfforts lists the /effort levels this provider/model exposes.
	// When non-empty, it overrides the built-in defaults. All providers
	// support the unified low/medium/high vocabulary by default. "auto" is
	// the implicit prefix — always accepted.
	SupportedEfforts []string `toml:"supported_efforts"`
	// DefaultEffort is the /effort level used when the user picks "auto" or
	// has not set Effort. Ignored when SupportedEfforts is empty.
	DefaultEffort string `toml:"default_effort"`
	// Vision enables image support for this provider. When true, user-attached
	// images are sent as image_url content parts. When false (default), images
	// are stripped before sending to avoid 400 errors from text-only models.
	Vision bool `toml:"vision"`
	// VisionDetail controls the image detail level sent to the API ("auto",
	// "low", "high"). Only effective when Vision is true.
	VisionDetail string `toml:"vision_detail"`
	// NoProxy reaches this provider's base_url directly, never through the proxy.
	// For China-only endpoints a foreign-exit proxy resets the TLS handshake (#2803).
	NoProxy bool `toml:"no_proxy"`
	// CodingOnly marks this provider as consuming a Coding Plan subscription
	// quota (vs the regular token quota). UI surfaces a "consumes subscription
	// quota" hint; optionally restricts to coding-tool use per vendor terms.
	CodingOnly bool `toml:"coding_only"`
	// Aggregator marks this provider as a model-aggregation platform that can
	// call multiple vendors' models under one endpoint+key (e.g. a Coding Plan).
	// UI groups these under an "aggregators" section; not a routing branch.
	Aggregator bool `toml:"aggregator"`
}

type QQBotConfig struct {
	Enabled      bool   `toml:"enabled"`
	AppID        string `toml:"app_id"`
	AppSecretEnv string `toml:"app_secret_env"` // 环境变量名，如 QQ_BOT_APP_SECRET
}

type RenderScope string

type SMTPConfig struct {
	Host           string `toml:"host"`            // SMTP server host, e.g. smtp.example.com
	Port           int    `toml:"port"`            // SMTP port (587 for STARTTLS, 465 for implicit TLS, 25 plain)
	From           string `toml:"from"`            // sender address, e.g. agent@example.com
	Username       string `toml:"username"`        // SMTP auth username (often = From); empty = no auth
	PasswordEnv    string `toml:"password_env"`    // env var holding the SMTP password (never stored)
	UseTLS         bool   `toml:"use_tls"`         // implicit TLS (port 465); false = STARTTLS/plain. DEPRECATED: use encryption_mode.
	EncryptionMode string `toml:"encryption_mode"` // "tls" (implicit, 465) | "starttls" (587) | "none" (25). Empty → migrate from use_tls.
}

type SandboxConfig struct {
	WorkspaceRoot string   `toml:"workspace_root"`
	AllowWrite    []string `toml:"allow_write"`
	// Bash is the OS-sandbox mode for the bash tool: "enforce" (default) jails
	// each command, "off" runs it unconfined. Phase 1; macOS only for now, with
	// a graceful fallback elsewhere (see internal/sandbox).
	Bash string `toml:"bash"`
	// Network allows network egress from inside the bash sandbox. Defaults true
	// so module/package downloads keep working; the boundary is then writes.
	Network bool `toml:"network"`
	// RequireAvailable, when true, makes bash mode "enforce" fail-closed (refuse
	// all commands) if no OS sandbox is available on this platform, rather than
	// silently degrading to unconfined. False (default) keeps the graceful
	// fallback so fairpeer stays usable on unsupported OSes.
	RequireAvailable bool `toml:"require_available"`
	// StrictWrites narrows the macOS Seatbelt toolchain-cache grants to true
	// cache subdirs only (~/.cargo/registry/cache, ~/Library/Caches, …) so a
	// prompt-injected command can't drop an executable in ~/.cargo/bin or
	// ~/.npm. Default false: the broad grants are needed for `go install`/
	// `cargo build`/`npm install` (they write to bin/pkg dirs). Turn on for
	// high-security deployments that don't run build tools. Audit A8. macOS only.
	StrictWrites bool `toml:"strict_writes"`
	// ReadRoots confines read_file/grep to these directories (opt-in). Empty =
	// unconfined reads (the default), because an agent legitimately reads /etc,
	// system headers, ~/.gitconfig, package caches, etc. A high-security
	// deployment that wants read/data isolation sets this; boot then wires
	// ConfineReaders to override the unconfined defaults. Note: bash is NOT
	// read-confined even when this is set, so this is defense-in-depth. Audit A7.
	ReadRoots []string `toml:"read_roots"`
}

type SearchConfig struct {
	Engine string `toml:"engine"`
	RgPath string `toml:"rg_path"`
}

type SkillsConfig struct {
	Paths          []string `toml:"paths"`
	ExcludedPaths  []string `toml:"excluded_paths"`
	DisabledSkills []string `toml:"disabled_skills"`
	MaxDepth       int      `toml:"max_depth"`
}

type StatuslineConfig struct {
	Command string `toml:"command"`
}

type ToolsConfig struct {
	Enabled            []string     `toml:"enabled"`
	BashTimeoutSeconds *int         `toml:"bash_timeout_seconds"`
	Search             SearchConfig `toml:"search"`
}

type UIConfig struct {
	Theme          string `toml:"theme"`           // auto|dark|light; empty resolves to auto
	ThemeStyle     string `toml:"theme_style"`     // graphite|aurora|slate|carbon|nocturne|amber and legacy aliases
	ShortcutLayout string `toml:"shortcut_layout"` // classic|desktop; accepted for compatibility
	CloseBehavior  string `toml:"close_behavior"`  // legacy desktop close behavior; prefer desktop.close_behavior
	ShowReasoning  bool   `toml:"show_reasoning"`  // Ctrl+O / /verbose: show thinking text in CLI; false = collapsed
}

type WeixinBotConfig struct {
	Enabled   bool   `toml:"enabled"`
	AccountID string `toml:"account_id"`
	TokenEnv  string `toml:"token_env"` // 环境变量名，如 WEIXIN_BOT_TOKEN
	APIBase   string `toml:"api_base"`  // iLink API base URL
}