# ServerFS native configuration
#
# Copy this file to serverfs.toml next to your deployment, edit the
# [[workdirs]] entries, then run:
#
#     serverfs doctor --config serverfs.toml    # read-only health report
#     serverfs serve  --config serverfs.toml    # MCP stdio service
#
# Rules that never change:
# - every path here is operator configuration; the agent only ever sees
#   workdir aliases, never host paths;
# - no secrets belong in this file. Tunnel/proxy credentials live in the
#   separate .env consumed by `serverfs tunnel` (see SERVERFS_PROXY_* in
#   README), and the Control Plane API key lives in a file OUTSIDE every
#   workdir referenced below.
#
# Agent delegation (v0.11) is DISABLED by default. A file with no [agent]
# section at all behaves exactly like v0.10: no Bridge process, no Agent
# tools, filesystem-only surface. Nothing below needs to be present unless you
# want Agent delegation.
#
# The [agent] section below is documentation, not a requirement -- it is
# commented out so this example stays filesystem-only by default. Uncomment it
# to opt in.
#
# Agent secrets are NOT configured here either. The dedicated egress proxy
# endpoint arrives through the SERVERFS_AGENT_PROXY_URL environment variable
# (plus optional SERVERFS_AGENT_NO_PROXY) and is deliberately absent from this
# file, from the generated Bridge configuration, and from every log and MCP
# result. The booleans below are routing policy only.
#
# The Agent Bridge is a SEPARATE distribution in a SEPARATE virtual environment
# (the frozen two-environment boundary): point the supervisor at its
# interpreter with SERVERFS_BRIDGE_PYTHON in the .env next to this file, e.g.
#   SERVERFS_BRIDGE_PYTHON=C:\path\to\.venv-bridge\Scripts\python.exe
# The root environment never contains the Bridge package and the Bridge
# environment never contains the product package. Runtime binaries below are
# optional: an absent field means the product default, which is the launch
# path a default deployment runs.

[server]
# DEBUG | INFO | WARNING | ERROR (default: INFO)
# Structured JSON logs go to stderr only; stdout is reserved for MCP frames.
log_level = "INFO"

# Policy defaults applied to every workdir unless noted. These mirror the
# global SERVERFS_* environment defaults of the Docker deployment.
[defaults]
max_read_bytes = 524288  # read_text_file page cap
max_read_lines = 500  # read_text_file line cap per call
max_write_bytes = 1048576  # create/edit text size cap
allow_hidden = false  # true exposes dotfiles on every channel
binary_transfer_enabled = false  # true enables upload/download binary tools
max_binary_transfer_bytes = 8388608

# One [[workdirs]] entry per exposed directory. Aliases must be unique and
# match ^[A-Za-z][A-Za-z0-9_-]{0,31}$. Paths must be absolute native paths
# (D:\trees\project or /srv/trees/project) and must not contain "..".
# read_only defaults to TRUE: mutations are refused by the kernel unless you
# explicitly opt the workdir in.

[[workdirs]]
alias = "docs"
path = "D:\\agent-data\\docs"
description = "Documentation tree, offered read-only"
read_only = true

[[workdirs]]
alias = "workspace"
path = "D:\\agent-data\\workspace"
description = "Writable scratch area for agent tasks"
read_only = false

# ---------------------------------------------------------------------------
# Agent delegation -- opt in by uncommenting. Absent means v0.10 behavior.
# ---------------------------------------------------------------------------
# [agent]
# enabled = true
# # Lifecycle limits. The defaults shown are the Agent Bridge's own; they are
# # written here only so an operator can see and tune them.
# task_timeout_seconds = 7200
# interaction_timeout_seconds = 1800
# max_active_tasks = 4
# retention_seconds = 604800
#
# [agent.proxy]
# # Disabled by default. v0.11 supports exactly one source: the environment.
# enabled = false
# source = "env"
#
# [agent.codex]
# enabled = false
# codex_bin = "codex"
# # true is required where provider egress is unreachable direct (measured on
# # the reference Windows host: api.openai.com and chatgpt.com time out).
# use_proxy = true
#
# [agent.claude]
# enabled = false
# claude_bin = "claude"
# use_proxy = false
#
# [agent.qoder]
# enabled = false
# qoder_bin = "qodercli"
# # Measured directly reachable, so proxying is a policy choice here.
# use_proxy = false
#
# Generic ACP v1 profiles (v0.19.0). Leave this list
# absent or empty when no ACP Agent is configured. Every profile command is
# an operator-selected absolute executable path; argv is fixed at config time.
# Task callers cannot override command, argv or environment. ACP profiles
# require workspace-write workdir policy. Provider authentication remains in
# provider-owned state. No Registry Agent is installed or trusted automatically.
#
# [[agent.acp_profiles]]
# id = "opencode"
# command = "/absolute/path/to/opencode"
# args = ["acp"]
# use_proxy = false
#
# Per-workdir Agent policy. agent_mode is one of disabled | review |
# workspace-write. A workdir that allowlists a native runtime must be
# workspace-write, because a native runtime may only submit with that profile,
# and workspace-write in turn requires read_only = false above.
#
# [[workdirs]]
# alias = "project"
# path = "D:\\agent-data\\project"
# read_only = false
# agent_mode = "workspace-write"
# agent_runtimes = ["acp-opencode"]