cli_auth_credentials_store = "file"
approval_policy = "never"
check_for_update_on_startup = false
web_search = "disabled"
default_permissions = "agentci-read"
developer_instructions = """
A custom research subagent named `research` is available in every workflow. Delegate focused
external research to it when current documentation, web evidence, or public code examples would
materially improve the plan or implementation. Keep repository analysis and edits in the parent.
"""

[agents]
max_threads = 4
max_depth = 1

[shell_environment_policy]
inherit = "core"
exclude = ["*TOKEN*", "*SECRET*", "*KEY*", "AGENTCI_*", "GITEA_*"]

[permissions.agentci-read]
description = "Read a workflow repository without modifying it or using the network."

[permissions.agentci-read.filesystem]
":minimal" = "read"
glob_scan_max_depth = 5

[permissions.agentci-read.filesystem.":workspace_roots"]
"." = "read"
".git" = "read"
"**/*.env" = "deny"

[permissions.agentci-write]
description = "Edit a workflow repository without changing Git metadata."

[permissions.agentci-write.filesystem]
":minimal" = "read"
glob_scan_max_depth = 5

[permissions.agentci-write.filesystem.":workspace_roots"]
"." = "write"
".git" = "read"
"**/*.env" = "deny"

[permissions.agentci-write.network]
enabled = true
allow_local_binding = false

[permissions.agentci-write.network.domains]
"*" = "allow"

[permissions.agentci-research]
description = "Read a workflow repository and research public internet sources without editing."

[permissions.agentci-research.filesystem]
":minimal" = "read"
glob_scan_max_depth = 5

[permissions.agentci-research.filesystem.":workspace_roots"]
"." = "read"
".git" = "read"
"**/*.env" = "deny"

[permissions.agentci-research.network]
enabled = true
allow_local_binding = false

[permissions.agentci-research.network.domains]
"*" = "allow"