Auth configuration parsed from auth.* keys. Controls whether this client
resolves provider tokens from the local auth.json (default) or from a
remote credential broker. See task #157 / auth::credential_source.
Subagent fan-out limits (subagent.* keys). They apply to the whole
delegation tree of one session: workers started by workers count against
the same limits as workers started by the foreground. A prompt manifest
with an explicit delegation policy sets its own concurrency and total
limits; max_depth applies either way.
Typed per-role turn-budget overrides (Task 23, spec §8.1). Every field
is optional: unset fields keep the role’s compiled default. Values are
parsed from turn_budget.<role>.<field> config keys.
Default for cache_keepwarm_auto_max_hours: the longest an auto idle
period may run. Without it the ski-rental bound alone lets a 0.05×
cache-read model (Opus 5.5, Sonnet 5.5) ping ~39 times over ~36h and a
0.025× model (Fable 5.1, Mythos 5.1) ~79 times over ~72h under a 1h TTL,
keeping an abandoned session unparked for days. 24h: a user who steps
away for a working day or overnight still comes back to a warm cache; a
session left over a weekend parks. (Owner decision, task #444.)
Every key accepted by the namespaced family parsers that is NOT in
KNOWN_CONFIG_KEYS (shell.*, events.*, turn_budget.*,
memory.*, server.*, bridge.*, auth.*). Open-ended families whose
suffix is user-chosen are listed as prefix.*. Keep this in sync when a
parser learns a key: the /settings coverage test requires each entry to
have a settings row or an explicit exclusion.
Known top-level config keys — used for unknown-key warnings + did-you-mean.
Public so the /settings coverage test can require a settings row (or an
explicit exclusion) for every key here.
Upper bound for the <N>h form of cache_keepwarm. The ski-rental bound
already caps an abandoned session’s spend at about one prefix rewrite; the
hour cap is an extra, user-chosen wall on top of it.
Every problem the parser reports for content: the warnings surfaced
at startup plus the stderr-only diagnostics of the shell.*, events.*,
turn_budget.* and memory.* families. Pure — prints nothing and
touches no process state.
Returns the configured identity string for the system prompt preamble.
Falls back to DEFAULT_IDENTITY (the SynapsCLI identity above) if not set
in config. Initialized by load_config() — safe to call anytime after boot.
Provider API keys parsed from provider.<name> = ... lines in config.
Empty if load_config() hasn’t been called. The registry falls back to
env vars, so e.g. GROQ_API_KEY works even with an empty map.
Whether an env VALUE carries a credential regardless of its key name:
any URL with userinfo (scheme://user:pass@host, scheme://key@host),
anywhere in the value — DATABASE_URL, HTTPS_PROXY, a Sentry DSN or a
JDBC option string all qualify. The key-name denylist alone missed these,
so their credentials reached the daemon and the session files on disk.
A username-only URL (ssh://git@host/…) is treated as a secret too:
rare in an environment, and failing safe beats a guess.
Whether a key matches the secret denylist (case-insensitive).
Used by the journal save path to ensure secret values never reach disk,
and by the client env capture to strip secrets before Hello.
Sets the active profile name. Must be called before any get_profile() call
(i.e., before config resolution begins). Uses OnceLock — first write wins,
subsequent calls are no-ops. No env var mutation (unsafe under tokio).
Write a single key = value pair to ~/.synaps-cli/config (or profile config).
Replaces the first existing line that matches the key, or appends if absent.
Preserves comments and unknown keys. Writes atomically via temp file + rename.