# Reasonix configuration.
# Resolution order: flag > ./reasonix.toml > ~/.reasonix/config.toml > built-in defaults.
# Fields marked user/global only are not overridden by ./reasonix.toml.
# Secrets are named via api_key_env and stored in Reasonix's global .env; never put keys here.

config_version = 4   # schema marker for diagnostics; old versions may ignore it
default_model = "deepseek-flash"
# language      = "zh"   # ui/model language; empty = auto-detect from $LANG / $REASONIX_LANG

[agent]
# system_prompt = """..."""   # omit to use the built-in prompt for this version
# system_prompt_file = "prompts/system.md"   # overrides system_prompt when set
temperature       = 0.0
# reasoning_language = "zh"   # visible reasoning language: auto|zh|en
# auto_plan_classifier = "deepseek-flash"   # optional; only used for borderline tasks
soft_compact_ratio  = 0.5   # notice only; keeps cache-first prefix intact
tool_result_snip_ratio = 0.6   # snip stale tool results at this fraction before summary compaction
compact_ratio       = 0.8   # try compacting when prompt reaches this fraction
compact_force_ratio = 0.9   # force compacting at this high-water mark
# keep                = ["errors"]   # compaction keep policy: errors, user_marked
# recent_keep         = 2   # minimum recent messages kept verbatim
cold_resume_prune   = true   # elide stale tool results when reopening a session past the provider cache window
# plan_mode_allowed_tools = ["custom_reader"]   # extra read-only declarations; cannot unlock known blocked tools or unsafe bash
plan_mode_read_only_commands = ["git -C"]   # concrete read-only shell prefixes available while planning
# planner_model = "deepseek-pro"   # optional: enable two-model collaboration
# subagent_model = "deepseek-pro"   # optional default for runAs=subagent skills
# subagent_models = { review = "deepseek-pro", security_review = "deepseek-pro" }   # per-skill overrides
# subagent_effort = "high"   # optional default effort for subagents
# subagent_efforts = { review = "max", task = "high" }   # per-tool/skill effort overrides
# max_subagent_depth = 2   # nested subagent delegation depth; set 1 to disable nested delegation
# output_style = "explanatory"   # explanatory | learning | concise | custom; empty = default

[tools]
enabled = []   # empty = all built-in tools
bash_timeout_seconds = 120   # foreground safety cap; set 0 for no tool-local cap
mcp_call_timeout_seconds = 300   # default MCP call safety cap; per-plugin/tool overrides may raise it

[tools.background_jobs]
stalled_warning_seconds = 900   # warn once per background job after this many quiet seconds; 0 disables

[tools.shell]
# prefer = "auto"   # auto|bash|powershell|pwsh; empty/default = auto-detect
# path   = "/opt/homebrew/bin/bash"   # absolute path to the shell executable; empty = PATH lookup

[lsp]
enabled = true   # language server tools; servers launch lazily when used
# [lsp.servers.go]
# command = "gopls"
# args = []
# extensions = [".go"]

[skills]
# paths = ["~/my-skills", "../shared/skills"]   # extra custom skill roots
# excluded_paths = ["~/.agents/skills"]   # hide convention roots without deleting folders
# max_depth = 3   # nested scan depth; set 1 for legacy root-only discovery
# disabled_skills = ["review"]   # hide noisy or unwanted skills

[permissions]
# Per-call gating. mode = writer fallback when no rule matches: ask|allow|deny.
# Readers always default to allow. Precedence: deny > ask > allow > fallback.
# Rules are "Tool" or "Tool(specifier)"; e.g. Bash(go test:*), Edit(src/**).
mode  = "ask"
# deny = ["Bash(rm -rf*)", "Bash(git push*)"]   # hard-blocked in every mode
# allow = ["Bash(go test:*)", "Bash(git status:*)"]   # never prompted
# ask = ["Edit(src/**)"]   # force a prompt even if otherwise allowed

[sandbox]
# Confine tool blast radius. File-writers (write_file/edit_file/multi_edit/move_file)
# may only write under workspace_root (empty = current dir) and allow_write extras.
# bash = "enforce" jails each command in an OS sandbox when available;
# without one, bash execution is refused. Empty defaults to enforce on macOS/Linux
# and off on Windows. Set bash = "off" to restore pre-1.16 unconfined shell execution.
# network allows sandboxed bash egress.
# workspace_root = ""            # default: current working directory
# allow_write = ["/tmp"]          # extra dirs writers may also modify
# forbid_read = []                  # dirs the agent cannot read or list
bash    = "enforce"
network = true

[statusline]
# A custom status line: a command whose first stdout line replaces the built-in
# data row. It receives {"model","contextUsed","contextWindow","cwd"} as JSON on stdin.
# command = "my-statusline.sh"

# External MCP servers. type: "stdio" (default, a subprocess) | "http" | "sse".
# ${VAR} / ${VAR:-default} are expanded from the environment in command/args/env/url/headers.
# [[plugins]]
# name    = "example"
# command = "reasonix-plugin-example"
# call_timeout_seconds = 600       # optional per-server MCP call timeout
# tool_timeout_seconds = { "generate_video" = 1800 }   # raw MCP tool names
# trusted_read_only_tools = ["search"]   # optional pre-seeded MCP read-only trust
# [[plugins]]                                  # a remote server over Streamable HTTP
# name    = "stripe"
# type    = "http"
# url     = "https://mcp.stripe.com"
# headers = { Authorization = "Bearer ${STRIPE_KEY}" }