Struct Config 

pub struct Config { /* private fields */ }

Runtime configuration facade. Phase-1 sidecar domains are typed modules; the remaining values keep field-access compatibility through Deref.

Implementations

impl Config

pub fn hydrate_cluster_credentials_from_store( &mut self, data_dir: &Path, ) -> Result<(), ConfigStoreError>

Resolve isolated SSH credentials after the legacy migration has completed. Metadata is server-owned: every reference must be the canonical node-scoped reference for its auth field, must match the SSH auth variant, and must not be shared with another configuration consumer. Any validation or store failure leaves every cluster runtime secret empty.

pub fn clear_cluster_runtime_credentials(&mut self)

Remove legacy/cached cluster secrets from a runtime snapshot. Used both before store hydration and when migration readiness is unavailable.

pub fn hydrate_cluster_fabric_from_encrypted(&mut self)

Decrypt SSH secrets into in-memory plaintext after loading config.

Mirrors Config::hydrate_env_vars_from_encrypted: only fills a plaintext field that is currently empty, from its *_encrypted counterpart.

pub fn refresh_cluster_fabric_encrypted(&mut self) -> Result<(), Error>

Re-encrypt SSH secrets from current in-memory plaintext before persisting.

Mirrors Config::refresh_env_vars_encrypted: a non-empty plaintext is (re-)encrypted; an empty plaintext leaves any existing ciphertext intact (so a redacted round-trip where the client never re-sent the secret keeps it). To CLEAR a secret, the caller swaps the whole auth variant.

pub fn sanitize_cluster_fabric_for_disk(&mut self)

Clear plaintext SSH secrets before serialization to disk.

impl Config

pub fn memory(&self) -> &Option<MemoryConfig>

Compatibility accessor for independently persisted memory settings.

pub fn memory_mut(&mut self) -> &mut Option<MemoryConfig>

pub fn subagents(&self) -> &SubagentsConfig

Compatibility accessor for independently persisted sub-agent settings.

pub fn subagents_mut(&mut self) -> &mut SubagentsConfig

pub fn providers(&self) -> &ProviderConfigs

Compatibility accessor for independently persisted legacy providers.

pub fn providers_mut(&mut self) -> &mut ProviderConfigs

pub fn to_compatibility_value(&self) -> Result<Value, Error>

Build the legacy full-config JSON view used by in-memory patching APIs.

Public serde and patch/dot-path callers retain the historical full configuration shape. This value is never the persistence representation: Config::save_to_dir explicitly writes a root-only DTO plus sidecars.

pub fn new() -> Config

Load configuration from file with environment variable overrides

Configuration loading order:

1. Try loading from config.json ({data_dir}/config.json)
2. Use defaults
3. Apply environment variable overrides (highest priority)

Environment Variables

• BAMBOO_PORT: Override server port
• BAMBOO_BIND: Override bind address
• BAMBOO_DATA_DIR: Override data directory
• BAMBOO_PROVIDER: Override default provider
• BAMBOO_HEADLESS: Enable headless authentication mode
• BAMBOO_MEMORY_PROJECT_PROMPT_INJECTION: Override project durable-memory index prompt injection
• BAMBOO_MEMORY_RELEVANT_RECALL: Override relevant durable-memory recall prompt injection
• BAMBOO_MEMORY_RELEVANT_RECALL_RERANK: Override model-based relevant recall reranking
• BAMBOO_MEMORY_PROJECT_FIRST_DREAM: Override project-first Dream prompt behavior

pub fn apply_runtime_env_overrides(&mut self)

Apply runtime-only BAMBOO_* overrides to a config assembled by the modular facade. Facade callers use this after durable section snapshots and credential references have been materialized; one-shot writers keep using the no-env load path so overrides are never persisted.

pub fn from_data_dir(data_dir: Option<PathBuf>) -> Config

Load config from disk AND publish its env vars to the process-global cache (so Bash tools inject them). For the context that OWNS that cache — the server bootstrap. Library / secondary readers that only need to read a value must use Config::from_data_dir_without_publish instead, or they will clobber the server’s live cache with stale disk data (#38 / #40).

pub fn from_data_dir_without_publish(data_dir: Option<PathBuf>) -> Config

Load config from disk WITHOUT publishing env vars to the global cache. For non-owning readers (e.g. permission storage) that just need a config value and must not clobber the live env-var cache. #40.

pub fn from_data_dir_without_env(data_dir: Option<PathBuf>) -> Config

Load config from disk WITHOUT applying BAMBOO_* env-var overrides and WITHOUT publishing to the global cache. For one-shot CLI writers (bamboo init / config set) that immediately re-save: applying env overrides here would bake transient values (port/bind/provider/memory flags) permanently into config.json. Same corruption-recovery + default fallback as the normal load.

pub fn get_model(&self) -> Option<String>

Get the effective default model for the currently active provider.

When features.provider_model_ref is enabled, reads from defaults.chat before falling back to legacy provider-specific config.

Note: for most providers this is a required config value (returns None when absent). Copilot has a built-in fallback when no model is configured.

pub fn get_fast_model(&self) -> Option<String>

Get the fast/cheap model for the currently active provider.

When features.provider_model_ref is enabled, reads from defaults.fast before falling back to legacy provider-specific config.

Used for lightweight tasks like title generation and summarization. Falls back to get_model() when no fast_model is configured.

pub fn get_task_summary_model(&self) -> Option<String>

Get the configured task summarization model.

When features.provider_model_ref is enabled, reads from defaults.task_summary before falling back through defaults.memory_background → defaults.fast → defaults.chat.

This is used for conversation/task summarization and context compression.

pub fn get_memory_background_model(&self) -> Option<String>

Get the configured memory/background summarization model.

When features.provider_model_ref is enabled, reads from defaults.memory_background before falling back to legacy config.

Falls back to the provider fast model when no background model is configured or resolves to an empty string.

IMPORTANT: this intentionally does not fall back to the main interaction model. Memory compaction / reflection should be skipped or fail loudly when no background/fast model is configured.

pub fn get_default_work_area_path(&self) -> Option<PathBuf>

Resolve the configured default work area path when present.

This validates that the configured directory exists, but intentionally returns the stable expanded path rather than the platform-specific canonicalized path. On macOS, canonicalize() may rewrite /var/... to /private/var/..., which is correct at the filesystem layer but undesirable as a user-facing/config-derived workspace path.

pub fn get_vision_model(&self) -> Option<String>

Get the vision-capable model for the currently active provider.

Used for image understanding tasks. Falls back to get_model() when no vision_model is configured.

pub fn get_reasoning_effort(&self) -> Option<ReasoningEffort>

Get the default reasoning effort for the currently active provider.

pub fn reasoning_effort_for_key(&self, key: &str) -> Option<ReasoningEffort>

Resolve the configured default reasoning effort for a provider routing key.

The key may be a multi-instance provider id (for example "copilot-work") or a legacy provider type (for example "openai"). In multi-instance mode the per-instance reasoning_effort lives under provider_instances[<id>], so we resolve instance ids there first; otherwise we fall back to the legacy per-provider config. Both the execute path (crate’s get_reasoning_effort_for_provider) and the session-create path (Self::get_reasoning_effort) delegate here so the two cannot drift.

pub fn disabled_tool_names(&self) -> BTreeSet<String>

Get normalized disabled tool names.

pub fn normalize_tool_settings(&mut self)

Normalize tool settings (trim / dedupe / sort).

pub fn disabled_skill_ids(&self) -> BTreeSet<String>

Get normalized disabled skill IDs.

pub fn normalize_skill_settings(&mut self)

Normalize skill settings (trim / dedupe / sort).

pub fn normalize_plugin_trust_settings(&mut self)

Normalize plugin_trust.trusted_hosts entries (trim / lowercase / drop empties) so a hand-edited config.json doesn’t silently accumulate mixed-case or whitespace-padded entries. is_host_trusted itself already matches case-insensitively regardless of how an entry is stored, so this is defense in depth / a canonical on-disk form, not the source of the security fix — that’s the host/path-component matching in is_host_trusted itself.

pub fn effective_default_provider(&self) -> &str

Return the effective default provider key.

Prefers default_provider_instance when set; falls back to the legacy provider string.

pub fn has_provider_instances(&self) -> bool

Whether provider instances are configured (new multi-instance path).

pub fn env_vars_as_map(&self) -> HashMap<String, String>

Build a flat map of all env vars with non-empty values (for process injection).

pub fn publish_env_vars(&self)

Update the global env vars cache (called on config load / reload).

pub fn current_env_vars() -> HashMap<String, String>

Read the current env vars snapshot (called by Bash tool at process spawn time).

pub fn current_prompt_safe_env_vars() -> Vec<PromptSafeEnvVarEntry>

Read the current prompt-safe env var snapshot (names + metadata only; no secret values).

pub fn server_addr(&self) -> String

Get the full server address (bind:port)

pub fn save(&self) -> Result<(), Error>

Save configuration to disk

pub fn save_memory_to_dir(&self, data_dir: &Path) -> Result<(), Error>

Persist only the memory module, leaving every other config file untouched.

pub fn save_subagents_to_dir(&self, data_dir: &Path) -> Result<(), Error>

Persist only the sub-agent module, leaving every other config file untouched.

pub fn save_providers_to_dir(&self, data_dir: &Path) -> Result<(), Error>

Persist only provider configuration. Provider plaintext keys are first refreshed into their encrypted at-rest representation.

pub fn recovery_status(&self) -> Option<&ConfigRecoveryStatus>

The pending config-corruption recovery, if config.json failed to parse on load and the recovery hasn’t been confirmed yet. None on every clean load. #153.

pub fn confirm_recovery(&mut self)

Confirm a pending recovery, allowing the next Config::save / Config::save_to_dir to overwrite the quarantined-corrupt config.json with this recovered state. No-op if there’s no pending recovery. Prefer Config::confirm_recovery_and_save_to_dir, which also persists and clears the flag in one step. #153.

pub fn confirm_recovery_and_save_to_dir( &mut self, data_dir: PathBuf, ) -> Result<(), Error>

Confirm a pending recovery AND persist it in one step: marks it confirmed (satisfying the Config::save_to_dir guard), writes the recovered state to config.json, then clears recovery_status entirely — once this succeeds the config is no longer “pending confirmation”, it’s just the normal on-disk config. Errors (and leaves recovery_status untouched) if there’s nothing pending, or if the save itself fails. #153.

pub fn assign_connect_platform_ids(&mut self)

Assign a stable ConnectPlatformConfig::id to every connect.platforms entry that doesn’t already have one (#496).

Migration-on-write: Config::save_to_dir always calls this on its internal save-copy before persisting, so every path that writes connect.json gets ids backfilled. Callers that mutate the live in-memory config as part of a save (e.g. the server’s settings-PATCH handler) should also call this directly on that in-memory value before responding, so a client that echoes the response straight back round-trips the id immediately rather than only after the next reload/restart. Never called from load — a config that’s never saved again (e.g. one sitting in an unconfirmed-recovery state, see #493) is never rewritten just to backfill ids. An entry that already has an id keeps it unchanged; ids are never reassigned or deduplicated once set.

pub fn save_to_dir(&self, data_dir: PathBuf) -> Result<(), Error>

Save configuration to disk under the provided data directory.

Root configuration is stored as {data_dir}/config.json; extracted memory, sub-agent, and provider modules are stored in sibling sidecars.

Refuses to write when this config carries an unconfirmed ConfigRecoveryStatus (#153) — i.e. it was recovered from a corrupt config.json and the recovery hasn’t been confirmed — so a corrupt original a user might want to hand-fix is never silently clobbered by an auto-persisted recovery. Call Config::confirm_recovery (or Config::confirm_recovery_and_save_to_dir) first.

impl Config

pub fn hydrate_proxy_auth_from_encrypted(&mut self)

Populate proxy_auth (plaintext) from proxy_auth_encrypted if present.

Many parts of the code rely on proxy_auth being hydrated in-memory so we can re-encrypt deterministically on save without ever persisting plaintext credentials.

pub fn refresh_proxy_auth_encrypted(&mut self) -> Result<(), Error>

Refresh proxy_auth_encrypted from the current in-memory proxy_auth.

This is used both when persisting the config to disk and when generating API responses that should never include plaintext proxy credentials.

pub fn hydrate_proxy_auth_from_store( &mut self, data_dir: &Path, ) -> Result<(), Error>

Hydrate proxy authentication from its isolated credential-store entry. The stored secret is the JSON representation of crate::ProxyAuth.

pub fn hydrate_provider_api_keys_from_encrypted(&mut self)

pub fn hydrate_provider_credentials_from_store( &mut self, data_dir: &Path, ) -> Result<(), ConfigStoreError>

Resolve built-in provider and provider-instance credential references after legacy ciphertext hydration. Existing in-memory values (notably environment overrides) retain precedence.

pub fn refresh_provider_api_keys_encrypted(&mut self) -> Result<(), Error>

pub fn hydrate_provider_instance_api_keys_from_encrypted(&mut self)

Hydrate plaintext api_key fields on provider instances from their encrypted counterparts.

pub fn refresh_provider_instance_api_keys_encrypted( &mut self, ) -> Result<(), Error>

Re-encrypt all provider instance API keys and write back to api_key_encrypted. Used before persisting to disk.

pub fn ensure_provider_instance_credentials_isolated( &mut self, ) -> Result<(), Error>

Ref-backed provider instances are the only representation permitted in ordinary config documents. Callers that introduce or clear an instance key must use the recoverable credential transaction first.

pub fn hydrate_mcp_secrets_from_encrypted(&mut self)

pub fn hydrate_mcp_credentials_from_store( &mut self, data_dir: &Path, ) -> Result<(), ConfigStoreError>

Resolve MCP env/header references without exposing credential values to serialization or debug output.

pub fn refresh_mcp_secrets_encrypted(&mut self) -> Result<(), Error>

pub fn sanitize_mcp_credential_refs_for_disk(&mut self)

Project credential-ref-backed MCP runtime values to the root disk DTO. Public serialization remains compatibility-oriented, but config.json must never duplicate either hydrated plaintext or legacy ciphertext once the isolated credential store is authoritative.

pub fn hydrate_env_vars_from_encrypted(&mut self)

Decrypt secret env vars into in-memory plaintext after loading config.

pub fn hydrate_env_var_credentials_from_store( &mut self, data_dir: &Path, ) -> Result<(), ConfigStoreError>

Resolve secret env values from the isolated credential store. A configured reference must resolve; silently publishing an empty value would make Bash/session behavior diverge from durable metadata.

pub fn refresh_env_vars_encrypted(&mut self) -> Result<(), Error>

Re-encrypt secret env vars before persisting to disk.

pub fn sanitize_env_vars_for_disk(&mut self)

Clear plaintext values for secrets before serialization to disk.

pub fn hydrate_broker_token_from_encrypted(&mut self)

Decrypt the broker token into in-memory plaintext after loading config.

pub fn refresh_broker_token_encrypted(&mut self) -> Result<(), Error>

Re-encrypt the broker token before persisting to disk.

pub fn sanitize_broker_token_for_disk(&mut self)

Clear the plaintext broker token before serialization to disk.

pub fn hydrate_notifications_from_encrypted(&mut self)

Decrypt legacy notification-channel ciphertext into memory so the credential migration can move it into the isolated store. New writes never serialize these ciphertext fields.

pub fn hydrate_notification_credentials_from_store( &mut self, data_dir: &Path, ) -> Result<(), ConfigStoreError>

Resolve notification channel credentials after legacy migration. A configured reference must resolve; callers treat any failure as a fail-closed notification configuration instead of silently disabling authentication for a protected endpoint.

pub fn refresh_notifications_encrypted(&mut self) -> Result<(), Error>

Maintain legacy in-memory ciphertext compatibility until credential migration runs. New writes sanitize these fields and persist only a credential reference plus configured metadata.

pub fn sanitize_notifications_for_disk(&mut self)

Clear notification plaintext and legacy ciphertext before ordinary root serialization. Only credential references and configured metadata may leave the process.

pub fn hydrate_connect_platform_tokens_from_encrypted(&mut self)

Decrypt every configured platform’s token (and Feishu app_secret) into in-memory plaintext after loading config. Mirrors Config::hydrate_notifications_from_encrypted: both fields are #[serde(skip_serializing)] (never on disk), so this is the only way they get populated after a fresh load.

pub fn hydrate_connect_credentials_from_store( &mut self, data_dir: &Path, ) -> Result<(), ConfigStoreError>

Resolve bamboo-connect token/app-secret references from the isolated credential store. A configured reference is fail-closed: publishing an empty credential would make the bridge appear live while authentication is guaranteed to fail.

pub fn hydrate_access_control_credentials_from_store( &mut self, data_dir: &Path, ) -> Result<(), ConfigStoreError>

Resolve password/device verifier records from the isolated credential store. Any configured-but-unavailable record fails closed for the whole access domain so middleware never silently weakens authentication.

pub fn clear_access_control_runtime_verifiers(&mut self)

pub fn sanitize_access_control_for_disk(&mut self)

Remove runtime verifier material from the durable access projection.

pub fn refresh_connect_platform_tokens_encrypted(&mut self) -> Result<(), Error>

Re-encrypt every configured platform’s token (and Feishu app_secret) from current in-memory plaintext before persisting to disk. Mirrors Config::refresh_notifications_encrypted: an empty/absent plaintext leaves any existing ciphertext intact (a redacted round-trip where the client never re-sent the secret keeps it).

pub fn sanitize_connect_credentials_for_disk(&mut self)

Remove runtime plaintext and legacy ciphertext from the durable connect projection. Only stable refs and configured metadata remain.

pub fn preserve_env_sourced_provider_keys(&mut self, previous: &Config)

Restore env-sourced provider api_keys that a serde round-trip dropped.

api_key is #[serde(skip_serializing)], so serializing previous and deserializing it back — as the settings-PATCH merge in config_manager::build_merged_config does — loses every provider’s plaintext key. hydrate_provider_api_keys_from_encrypted then restores only keys that have a persisted ciphertext, which an env-injected key never has (that’s the #253 design). Without this, a PATCH to ANY provider setting silently blanks the live env-sourced key of every OTHER provider until the process restarts.

Copies the key back from previous for each provider still flagged env-sourced there whose key wasn’t explicitly re-set by the patch (i.e. is empty after the round-trip), so an explicit api_key in the patch still wins. #373.

pub fn preserve_provider_instance_plaintext_keys( &mut self, previous: &Config, intents: &ProviderApiKeyIntents, )

Preserve freshly-created provider-instance plaintext keys that are lost during the compatibility JSON round-trip.

Provider instance api_key fields are #[serde(skip_serializing)], so a round-trip through to_compatibility_value() / from_value() in config_manager::build_merged_config drops them. If no ciphertext was persisted yet (newly created instance), copy key material from the live previous config for instances not explicitly touched by the patch so the key is not silently cleared before the next save.

pub fn refresh_encrypted_secrets(&mut self) -> Result<(), Error>

Re-encrypt every secret domain’s *_encrypted field from current in-memory plaintext, without the disk-only sanitization steps.

Config::save_to_dir runs these refreshes on a save-time clone, so the live in-memory config never sees the resulting ciphertext: a provider instance created over HTTP keeps api_key_encrypted: None in memory for the rest of the session. Any code that then serializes the live config and deserializes it back — the settings-PATCH merge in config_manager::build_merged_config — drops the #[serde(skip_serializing)] plaintext and is left with neither field, permanently losing the key on the next persist (#516). Call this after mutating the live config so ciphertext stays in sync with plaintext.

Trait Implementations

impl Clone for Config

fn clone(&self) -> Config

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Config

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for Config

fn default() -> Config

Returns the “default value” for a type.

impl Deref for Config

type Target = ConfigValues

The resulting type after dereferencing.

fn deref(&self) -> &<Config as Deref>::Target

Dereferences the value.

impl DerefMut for Config

fn deref_mut(&mut self) -> &mut <Config as Deref>::Target

Mutably dereferences the value.

impl<'de> Deserialize<'de> for Config

fn deserialize<D>( deserializer: D, ) -> Result<Config, <D as Deserializer<'de>>::Error>

where D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for Config

fn serialize<S>( &self, serializer: S, ) -> Result<<S as Serializer>::Ok, <S as Serializer>::Error>

where S: Serializer,

Serialize this value into the given Serde serializer.