Per-category permission profile applied while a plan is being drafted.
The read-only floor stays the base; these levels decide how far each
carve-out opens. The plan file itself is not a category — being able to
author the plan IS plan mode.
User-supplied remote provider configuration. All fields are optional for a
built-in provider; fully custom OpenAI-compatible providers require a base
URL and API-key environment variable.
One source of configuration in the layered merge. Declaration order IS
precedence: every later layer’s table is deep-merged over the earlier ones,
so Defaults < User < Profile < Project < Session.
Where model-driven shell commands may write. Project engages Linux
Landlock write-confinement (--confine-fs): writes are allowed only beneath
the project directory, the system temp directory, and /dev; reads and
execution stay unrestricted. Best-effort (no-op on kernels without Landlock
and on other platforms). Default Unrestricted preserves today’s behavior.
Whether model-driven actions may reach the network. Deny removes web
capabilities and engages the shell-command network kill-switch where the
OS sandbox supports it. Default Allow preserves explicit network use.
Permission level for one plan-mode category. Mirrors the safety-mode
ladder so the picker reads familiarly: allow runs, auto is vetted by
the Auto classifier, ask raises the approval modal, deny blocks with
the plan-flavored teaching denial.
Which built-in color theme the TUI renders with. A typed enum (not a
free string) so a typo in config.toml is a clear deserialize error and
the reducer’s match stays exhaustive when a theme is added.
Load the user-scope configuration (defaults + the user file, no project or
session layers). This is the view persistence baselines, the daemon, and
runtime re-reads use — anything that must not observe another repo’s
project config or a one-off CLI flag.
Like load_config (user scope, no session flags) but never fails: on a
malformed config, warn on stderr (secret-redacted, #F13) and fall back to
defaults (#111). For standalone subcommands that only read user settings.
Like load_layered_config but never fails — the startup entry point.
On success, prints notices and layer-attributed warnings to stderr. On a
malformed layer, warns (secret-redacted, #F13) and degrades: the session
flags are re-applied over bare defaults so --no-network/-c survive a
corrupt user file rather than being silently dropped with it.
The project-scoped view (defaults + user + project, NO session flags) for
runtime re-reads keyed to a workdir — e.g. the memory settings consulted
per operation. Never fails and never prints; warnings/notices were already
surfaced by the startup load.
Persist the whole [plan] table (the /plan config picker). Values the
user set through the picker are explicit choices, so writing them —
including ones that currently match defaults — is correct; unset Options
stay absent via skip_serializing_if.
Persist a reasoning level for a specific model ID
(e.g. <provider>/<model>). The TUI calls this from Alt+T,
/reasoning <level>, and the does-not-support-thinking auto-snap so
the choice sticks per-model rather than bleeding into other models on
next session start.
Set one key (pre-split path segments, so map keys containing dots — e.g.
reasoning_per_model."ollama/qwen3:8b" — address correctly) in the USER
config file, leaving every other key untouched.