Struct CoderConfig 

pub struct CoderConfig {
    pub engine_preference: Vec<String>,
    pub keep_workspace_on_failure: bool,
    pub default_max_iterations: u32,
    pub model: Option<String>,
    pub approval_patch_bytes: usize,
    pub max_replay_events: usize,
    pub max_session_wall_secs: u64,
    pub max_agent_build_wall_secs: u64,
    pub max_check_timeout_secs: u64,
    pub max_sessions: usize,
    pub max_session_age_days: u64,
}

Resolved coder operator config. Every field is populated (defaults applied), so callers never deal with Option.

Fields

engine_preference: Vec<String>

External/foreman delegation order: the first ready CLI in this list wins. Defaults to DEFAULT_PREFERENCE.

keep_workspace_on_failure: bool

Keep the throwaway worktree when a session ends Failed, so the operator can inspect it for a postmortem. Defaults to false (drop it).

default_max_iterations: u32

Default loop iteration cap when coder.start omits max_iterations. Defaults to DEFAULT_MAX_ITERATIONS.

model: Option<String>

Pin the native loop’s inference model (e.g. "parslee/reasoning" for gpt-5.5 via the Parslee gateway). None = adaptive routing (TaskHint::Code). The seam that lets a paired A/B run the native arm on the same backbone as the external CLI arm.

The pin applies to WHICHEVER engine runs the session: the native loop reasons on it, and an external:<agent_id> session forwards it to the CLI (codex -m, claude --model). It reached only the native loop once, which left a paired A/B’s “both arms on one backbone” an unverified assumption. Foreman is the exception — its farmed workers run their own configured backbones and take no pin at all.

Because the external rung hands this string to a third-party CLI’s own namespace, a value here is NOT required to be a name car models list knows. Nothing validates it, deliberately.

approval_patch_bytes: usize

Byte budget for the patch shown at merge approval. Defaults to DEFAULT_APPROVAL_PATCH_BYTES.

This was a hardcoded 32 KB tail, which made the review surface shrink exactly as the risk grew: the gap between what a contract verifies and what a change actually does widens with session length, so the human backstop weakened precisely where the automated one did (car#706). The --stat is always shown in full regardless of this value.

max_replay_events: usize

Maximum events retained in memory for reconnect replay by one live session. Defaults to DEFAULT_MAX_REPLAY_EVENTS; 0 means unlimited. The event sequence remains monotonic when the oldest retained event is dropped, and coder.subscribe.events_skipped reports a stale cursor.

max_session_wall_secs: u64

Wall-clock ceiling for a whole session, across every rung of the engine fallback ladder. 0 means unlimited — for callers that impose their own bound and want the daemon out of the way. Defaults to car_budget::DEFAULT_SESSION_WALL_SECS.

max_agent_build_wall_secs: u64

Wall-clock ceiling for an Agent project’s complete build: spec generation, repair attempts, and scenario runs. A confirmed contract may lower a positive ceiling, but cannot remove or raise it. 0 is the operator’s explicit choice to keep the contract’s value: a positive timeout is used, while a missing or zero timeout is unlimited. Defaults to 600 seconds, also shown on the synthesized agent_scenarios_pass contract.

max_check_timeout_secs: u64

Wall-clock ceiling for ONE outcome-contract check command. Defaults to MAX_SHELL_TIMEOUT_SECS.

A repository whose real verification gate takes longer than ten minutes could not express that gate as a contract check at all: the check was killed at the shell ceiling however much session budget remained, and no value of max_session_wall_secs moved it (car#1065). Raising this is an operator decision about their own test gate — it does NOT raise the ceiling on the shell tool the model calls, which stays at the 600s the tool description advertises.

Unlike max_session_wall_secs, 0 is not “unlimited” here — it would floor every check at one second — so it is treated as unset.

max_sessions: usize

How many terminal session snapshots to keep in the coder state dir. Defaults to DEFAULT_MAX_SESSIONS; 0 means unlimited.

Only collectable sessions are counted and evicted — see gc_sessions for what is exempt. So this bounds what retention manages, not the size of the directory.

0 disables the cap, matching config.toml’s [runs]. The two used to disagree — crate::run_store::RetentionConfig read 0 literally, so max_per_agent = 0 made completed_rank >= 0 always true and max_age_days = 0 put the cutoff at now, either one deleting every collectable run trace. Two similarly-named retention knobs in one daemon whose zero values inverted was a hazard whose failure mode was silent data loss; car#1338 settled it in this direction. Note this is not a blanket rule — max_check_timeout_secs two fields down reads 0 as UNSET, because zero there would floor every check at one second rather than lift a ceiling.

max_session_age_days: u64

Age ceiling for a retained terminal session snapshot, in days. Defaults to DEFAULT_MAX_SESSION_AGE_DAYS; 0 means unlimited — see the note on Self::max_sessions.

Implementations

impl CoderConfig

pub fn session_retention(&self) -> SessionRetention

The retention policy gc_sessions wants.

impl CoderConfig

pub fn preference_refs(&self) -> Vec<&str>

Resolve engine_preference to the &str slice resolve_engine wants.

pub fn parse_toml(text: &str) -> Self

Parse a TOML string. Tolerant: a malformed document yields defaults rather than an error.

pub fn load_from(path: &Path) -> Self

Load from path. A missing file → defaults; an unreadable or malformed file → defaults (logged). Never panics.

pub fn load() -> Self

Load from the resolved config path (config_path).

Trait Implementations

impl Clone for CoderConfig

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CoderConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for CoderConfig

fn default() -> Self

Returns the “default value” for a type.

impl Eq for CoderConfig

impl PartialEq for CoderConfig

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for CoderConfig