config.yaml.example

server:
  listen: ":8080"
  base_url: "http://localhost:8080"  # Base URL for links in notifications
  admin_key_env: WARDGATE_ADMIN_KEY  # Env var for admin key (enables Web UI at /ui/)
  # grants_file: grants.json        # Path to dynamic grants file (default: grants.json)
  logging:
    max_entries: 1000      # Max log entries to keep in memory for dashboard (default: 1000)
    store_bodies: false    # Store request bodies in logs (default: false, for privacy)

# =============================================================================
# SENSITIVE DATA FILTERING (global defaults)
# =============================================================================
# Filtering is enabled by default to prevent agents from seeing OTP codes,
# verification links, and API keys. Configure per-endpoint to override.

filter_defaults:
  enabled: true
  patterns:
    - otp_codes           # OTP/verification codes (e.g., "Code: 123456")
    - verification_links  # Email verification/password reset URLs
    - api_keys            # Common API key formats (sk-..., ghp_..., etc.)
    - ssn                 # Common SSN formats
    - passport            # Common passport number formats
  action: block           # block | redact | ask | log
  replacement: "[SENSITIVE DATA REDACTED]"

# =============================================================================
# JWT AGENT AUTHENTICATION (optional)
# =============================================================================
# Instead of static keys, agents can authenticate with signed JWTs.
# The JWT "sub" claim is used as the agent ID. Standard "exp" handles expiry.
# Both modes coexist -- static keys are checked first, JWT as fallback.
#
# server:
#   jwt:
#     secret_env: WARDGATE_JWT_SECRET  # env var holding HMAC signing secret
#     # secret: "inline-secret"        # or inline (for dev only)
#     # issuer: "my-orchestrator"      # optional: validate "iss" claim
#     # audience: "wardgate"           # optional: validate "aud" claim

# Agents can be added manually below, or via CLI: wardgate agent add <id>
agents:
  - id: agent-name
    key_env: WARDGATE_AGENT_KEY

# Notification settings for "ask" workflow
notify:
  timeout: "5m"  # How long to wait for approval
  # slack:
  #   webhook_url: "https://hooks.slack.com/services/YOUR/WEBHOOK/URL"
  # webhook:
  #   url: "https://your-webhook.example.com/notify"
  #   headers:
  #     Authorization: "Bearer your-token"

# =============================================================================
# PRESETS DIRECTORY
# =============================================================================
# Presets are loaded from YAML files. The presets/ directory contains
# pre-configured presets for popular APIs. See docs/presets.md for details.

# Load presets from the presets directory (required for using presets)
presets_dir: ./presets

# =============================================================================
# CUSTOM PRESETS (optional)
# =============================================================================
# Define your own presets inline, or add YAML files to presets_dir.

# Or define inline custom presets
# custom_presets:
#   my-internal-api:
#     description: "My Company Internal API"
#     upstream: https://api.internal.company.com/v1
#     auth_type: bearer
#     capabilities:
#       - name: read_data
#         description: "Read resources"
#         rules:
#           - match: { method: GET }
#       - name: create_resources
#         description: "Create new resources"
#         rules:
#           - match: { method: POST, path: "/resources" }
#       - name: delete_resources
#         description: "Delete resources"
#         rules:
#           - match: { method: DELETE }

# =============================================================================
# CONCLAVES (remote execution environments)
# =============================================================================
# Conclaves are isolated environments that run wardgate-exec and connect
# to wardgate via WebSocket. Agents execute commands on conclaves through
# wardgate, which enforces policy and logs everything.
#
# Each conclave needs:
#   - A key for authentication (stored in env var)
#   - Policy rules (same syntax as endpoint exec rules)
#   - A wardgate-exec instance running on the conclave host

# conclaves:
#   # --- Command templates (recommended for most use cases) ---
#   # Define pre-made commands that agents invoke by name.
#   # The agent only provides arguments; the command shape is fixed.
#   # Use: wardgate-cli run <conclave> <command> [args...]
#
#   obsidian:
#     description: "Obsidian vault (personal notes)"
#     key_env: WARDGATE_CONCLAVE_OBSIDIAN_KEY
#     agents: [agent-name]  # Optional: restrict to specific agents (omit for all)
#     cwd: /data/vault
#
#     # Output filtering - scan stdout/stderr for sensitive data before returning
#     filter:
#       enabled: true
#       patterns: [api_keys, passwords, private_keys]
#       action: block  # block, redact, or log (not ask - command already ran)
#
#     commands:
#       search:
#         description: "Search notes by filename"
#         template: "find . -iname {query}"
#         args:
#           - name: query
#             description: "Filename pattern (e.g. *.md)"
#         filter:
#           enabled: false  # filenames only, no sensitive data
#       grep:
#         description: "Search note contents"
#         template: "rg {pattern}"
#         args:
#           - name: pattern
#             description: "Text pattern to search for"
#
#       # --- Standard file tools (scripts/file_*.py) ---
#       # Install scripts to /usr/local/lib/wardgate-tools/ in your conclave.
#       # See examples/file-tools-commands.yaml for the full set.
#       #
#       # Path args support two layers of control:
#       #   type: path + allowed_paths  - hard boundary (rejects immediately)
#       #   rules                       - policy (allow/ask/deny per path)
#       read:
#         description: "Read a note (numbered lines)"
#         template: "python3 /usr/local/lib/wardgate-tools/file_read.py {file}"
#         args:
#           - name: file
#             description: "Path to note file"
#             type: path
#             allowed_paths: ["notes/**", "config/**"]
#         rules:
#           - match: { file: "notes/**" }
#             action: allow
#           - match: { file: "config/**" }
#             action: ask
#         # no catch-all -> unmatched paths default deny
#       read-raw:
#         description: "Read a note (raw content)"
#         template: "python3 /usr/local/lib/wardgate-tools/file_read.py {file} --raw"
#         args:
#           - name: file
#             description: "Path to note file"
#             type: path
#             allowed_paths: ["notes/**", "config/**"]
#         rules:
#           - match: { file: "notes/**" }
#             action: allow
#           - match: { file: "config/**" }
#             action: ask
#       create:
#         description: "Create a new note (fails if exists)"
#         template: "python3 /usr/local/lib/wardgate-tools/file_create.py {file} {content}"
#         args:
#           - name: file
#             description: "Path for new note"
#             type: path
#             allowed_paths: ["notes/**"]
#           - name: content
#             description: "Note content"
#         action: ask
#       update:
#         description: "Replace entire note contents"
#         template: "python3 /usr/local/lib/wardgate-tools/file_update.py {file} {content}"
#         args:
#           - name: file
#             description: "Path to existing note"
#             type: path
#             allowed_paths: ["notes/**"]
#           - name: content
#             description: "New note content"
#         action: ask
#       patch:
#         description: "Replace exact text in a note"
#         template: "python3 /usr/local/lib/wardgate-tools/file_patch.py {file} {old_text} {new_text}"
#         args:
#           - name: file
#             description: "Path to the note file"
#             type: path
#             allowed_paths: ["notes/**"]
#           - name: old_text
#             description: "Exact text to find"
#           - name: new_text
#             description: "Replacement text"
#         action: ask
#       insert:
#         description: "Insert text at location in a note"
#         template: "python3 /usr/local/lib/wardgate-tools/file_insert.py {file} {text}"
#         args:
#           - name: file
#             description: "Path to note file"
#             type: path
#             allowed_paths: ["notes/**"]
#           - name: text
#             description: "Text to insert (appends to end)"
#         action: ask
#     # Optional: also allow raw exec with policy rules
#     # allow_redirects: false  # Default: false. Set true to allow >, >>, <, etc.
#     # rules:
#     #   - match: { command: "cat" }
#     #     action: allow
#     #   - match: { command: "*" }
#     #     action: deny
#
#   # --- Raw exec with policy rules (for more flexibility) ---
#
#   code:
#     description: "Development environment"
#     key_env: WARDGATE_CONCLAVE_CODE_KEY
#     cwd: /workspace/project
#     rules:
#       - match: { command: "git", args_pattern: "^(status|log|diff|show|branch)" }
#         action: allow
#       - match: { command: "git", args_pattern: "^(push|commit|rebase)" }
#         action: ask
#       - match: { command: "rg" }
#         action: allow
#       - match: { command: "make" }
#         action: allow
#       - match: { command: "setup-dev.sh" }
#         action: ask
#       - match: { command: "*" }
#         action: deny

# =============================================================================
# ENDPOINTS
# =============================================================================

endpoints:
  # ---------------------------------------------------------------------------
  # USING PRESETS (recommended)
  # ---------------------------------------------------------------------------
  # See docs/presets.md for all presets, capabilities and examples.

  todoist:
    preset: todoist
    description: "Todoist API (Personal)"  # Optional: shown in discovery API for agents
    # agents: [agent-name]                 # Optional: restrict to specific agents (omit for all)
    auth:
      credential_env: WARDGATE_CRED_TODOIST_API_KEY
    capabilities:
      read_data: allow
      create_tasks: allow
      close_tasks: allow
      update_tasks: ask
      delete_tasks: deny

  # ---------------------------------------------------------------------------
  # MANUAL CONFIGURATION (for custom APIs or advanced use)
  # ---------------------------------------------------------------------------
  # See docs/config.md for full configuration reference.

  # custom-api:
  #   upstream: https://api.example.com/v1
  #   auth:
  #     type: bearer
  #     credential_env: WARDGATE_CRED_CUSTOM_API
  #   rules:
  #     - match: { method: GET }
  #       action: allow
  #     - match: { method: POST, path: "/allowed-endpoint" }
  #       action: allow
  #     - match: { method: "*" }
  #       action: deny

  # ---------------------------------------------------------------------------
  # DYNAMIC UPSTREAMS (agent chooses target per-request)
  # ---------------------------------------------------------------------------
  # The agent sets X-Wardgate-Upstream header; Wardgate validates against the
  # allowed_upstreams glob patterns. Useful for multi-host APIs (e.g., Google).
  # See docs/config.md#dynamic-upstreams for details.

  # google-apis:
  #   allowed_upstreams:
  #     - "https://*.googleapis.com"
  #   auth:
  #     type: bearer
  #     credential_env: WARDGATE_CRED_GOOGLE
  #   rules:
  #     - match: { method: GET }
  #       action: allow
  #     - match: { method: "*" }
  #       action: deny

  # ---------------------------------------------------------------------------
  # LLM API with SSE streaming filter
  # ---------------------------------------------------------------------------
  # SSE streams (text/event-stream) are filtered per-message in real time.
  # Set sse_mode: passthrough to skip filtering on trusted SSE endpoints.

  # openai:
  #   upstream: https://api.openai.com/v1
  #   auth:
  #     type: bearer
  #     credential_env: WARDGATE_CRED_OPENAI
  #   filter:
  #     enabled: true
  #     patterns: [api_keys]
  #     action: redact
  #     sse_mode: filter  # "filter" (default) or "passthrough"
  #   rules:
  #     - match: { method: POST, path: "/chat/completions" }
  #       action: allow
  #     - match: { method: "*" }
  #       action: deny

  # ---------------------------------------------------------------------------
  # IMAP (email reading) - using preset
  # ---------------------------------------------------------------------------

  # mail-read:
  #   preset: imap
  #   upstream: imaps://imap.gmail.com:993  # Override with your server
  #   auth:
  #     credential_env: WARDGATE_CRED_IMAP  # format: user@gmail.com:app-password
  #   capabilities:
  #     list_folders: allow
  #     read_inbox: allow
  #     mark_read: ask
  #   # Filter sensitive data (OTPs, verification links) - enabled by default
  #   # filter:
  #   #   enabled: true
  #   #   action: block

  # ---------------------------------------------------------------------------
  # IMAP for OTP inbox (filtering disabled to allow agent to read codes)
  # ---------------------------------------------------------------------------

  # mail-otp:
  #   preset: imap
  #   upstream: imaps://imap.gmail.com:993
  #   auth:
  #     credential_env: WARDGATE_CRED_IMAP_OTP
  #   capabilities:
  #     list_folders: allow
  #     read_inbox: allow
  #   filter:
  #     enabled: false  # Allow OTP codes for automated account creation

  # ---------------------------------------------------------------------------
  # SMTP (email sending) - using preset
  # ---------------------------------------------------------------------------

  # mail-send:
  #   preset: smtp
  #   upstream: smtps://smtp.gmail.com:465  # Override with your server
  #   auth:
  #     credential_env: WARDGATE_CRED_SMTP  # format: user@gmail.com:app-password
  #   capabilities:
  #     send_email: ask
  #   # Optional: additional SMTP controls (see docs/config.md)
  #   # smtp:
  #   #   from: "your-email@gmail.com"
  #   #   known_recipients:
  #   #     - "@company.com"
  #   #   ask_new_recipients: true

  # ---------------------------------------------------------------------------
  # SSH (remote execution) - using preset
  # ---------------------------------------------------------------------------

  # prod-server:
  #   preset: ssh
  #   ssh:
  #     host: prod.example.com
  #     port: 22
  #     username: deploy
  #     known_host: "prod.example.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA..."
  #   auth:
  #     credential_env: WARDGATE_SSH_KEY_PROD
  #   capabilities:
  #     exec_commands: ask  # require human approval for every command