@quickchatai/quickreview 0.0.0-stage → 1.2.0

package/dist/src/config.js

@@ -0,0 +1,1041 @@
+// Typed access to config.toml — the single source of every runtime knob.
+// The review sections (their types, defaults and parsers) live in
+// packages/pi-plugin/src/reviewconfig.ts, the core's half; this module adds every other
+// surface's, the install homes and the live config's loader, and re-exports
+// the review half so its importers need not know where a knob lives.
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { resolve, dirname, isAbsolute, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { parse } from "smol-toml";
+import { locateConfig, locateSecrets, missingConfigMessage, strandedCheckoutConfig, } from "./install.js";
+import { packageRootFrom } from "@quickchatai/pi-quickreview/src/assetroot.js";
+import { repoCloneDirName } from "./clonedir.js";
+import { MissingConfigError } from "./missingconfig.js";
+import { DEFAULT_LENS_GRANT_STAGGER_MS, DEFAULT_LENS_PERMITS } from "./ipc/permits.js";
+import { configDeprecations, foldLegacyOwnerSlackId, MEMORY_DELIVERY_MODES, parseEngine, parseEscalation, parseGithubSection, parseGuardsSection, parseModels, parseOwnerSection, parsePiSection, parseReviewSection, parseScan, presetOf, req, requireGithubKeys, REVIEW_PRESETS, validateReviewSection, } from "@quickchatai/pi-quickreview/src/reviewconfig.js";
+export * from "@quickchatai/pi-quickreview/src/reviewconfig.js";
+/** Directory name of the base clone: `[github] clone_dir` when set, else the
+ * repo slug's basename ("owner/name" → "name"; a URL's trailing path segment,
+ * `.git` stripped), e.g. "acme/webapp" ⇒ "webapp". */
+export function githubCloneDir(g) {
+    // ?? "": hand-rolled configs (tests) may omit both keys.
+    const explicit = (g.clone_dir ?? "").trim();
+    if (explicit)
+        return explicit;
+    return repoCloneDirName(g.repo ?? "");
+}
+/** Per-cause defaults. Absent causes fall back to `default_cooldown_min`. */
+export const SLACK_CAUSE_DEFAULTS = {
+    "round.overdue": { enabled: true, cooldown_min: 60 },
+    "round.malformed_verdict": { enabled: true, cooldown_min: 60 },
+    "review.failed_loud": { enabled: true, cooldown_min: 60 },
+    "pr.not_picked_up": { enabled: true, cooldown_min: 120 },
+    "daemon.up": { enabled: true, cooldown_min: 0 },
+    "daemon.stopping": { enabled: true, cooldown_min: 0 },
+    "slack.cap_reached": { enabled: true, cooldown_min: 0 },
+    "reconcile.storm": { enabled: false, cooldown_min: 180 },
+    "digest.eod": { enabled: false, cooldown_min: 0 },
+    "pr.awaiting_author_stale": { enabled: false, cooldown_min: 1440 },
+};
+export const SLACK_POLICY_DEFAULTS = {
+    daily_turns: 80,
+    per_user_daily_turns: 20,
+    thread_replies_per_day: 6,
+    soft_exchange_limit: 3,
+    announcements_per_hour: 20,
+    default_cooldown_min: 60,
+    // Effective value comes from [slack.policy] timezone, else [ops] timezone
+    // (parseSlack) — this static default (= OPS_DEFAULTS.timezone, declared
+    // below) only reaches direct constructions that bypass parseConfig.
+    timezone: "UTC",
+    pickup_grace_min: 20,
+    downtime_notice_min: 5,
+    heartbeat_interval_min: 5,
+    storm_corrections: 5,
+    awaiting_author_stale_h: 48,
+    broadcast_verdicts: "never",
+    causes: SLACK_CAUSE_DEFAULTS,
+};
+/** [slack] is optional in config.toml, exactly like [tui] / [companion]. */
+export const SLACK_DEFAULTS = {
+    enabled: false,
+    channel: "",
+    channel_kind: "public",
+    bot_token_file: "slack_bot_token",
+    app_token_file: "slack_app_token",
+    post_min_interval_ms: 1100,
+    reconnect_backoff_ms: [1000, 2000, 5000, 15000, 30000],
+    server_ping_timeout_ms: 30000,
+    catchup_max_age_s: 300,
+    max_reply_chars: 3000,
+    name_cache_ttl_s: 86400,
+    users: {},
+    policy: SLACK_POLICY_DEFAULTS,
+};
+export const RECHECK_DEFAULTS = {
+    enabled: true,
+    on_push: true,
+    on_ci: true,
+    on_base_advance: true,
+};
+export const OPENVIKING_ENDPOINTS = ["local", "remote"];
+export const EMBEDDING_PROVIDERS = ["local", "openai"];
+/**
+ * The LOCAL ENGLISH EMBEDDER: the model
+ * `embedding_provider = "local"` runs, served on loopback by
+ * `scripts/openviking-embedder.py` from the GGUF the image pins. Chosen by an
+ * offline retrieval evaluation over the reviewer's own memory
+ * (docs/memory-embeddings.md: MRR@10 0.56 against 0.34 for the engine's
+ * built-in Chinese-first model; ~25 ms per round query on one thread). The
+ * service's model table (`--describe`) carries the same name and dimension
+ * plus the query instruction; `tests/openviking-embedder.test.ts` holds the
+ * two together. Mirrored by `LOCAL_EMBEDDER` in scripts/openviking-reembed.mjs.
+ */
+export const LOCAL_EMBEDDING = Object.freeze({ model: "bge-small-en-v1.5-f16", dimension: 384 });
+/** The engine's BUILT-IN local embedder — the retired meaning of `local`, and
+ * what an older store was embedded under. A config.toml that still spells it
+ * under `local` is read as the current local embedder rather than refused: the
+ * daemon must not stop booting over a value an earlier release required. The
+ * re-embed migration carries the store across. */
+export const RETIRED_LOCAL_EMBEDDING = Object.freeze({
+    model: "bge-small-zh-v1.5-f16",
+    dimension: 512,
+});
+/** What an `openai` opt-in runs unless the operator names another model. */
+export const HOSTED_EMBEDDING = Object.freeze({ model: "text-embedding-3-small", dimension: 1536 });
+/** ov.conf's `embedding.dense.provider` under `local`: the engine's OpenAI-
+ * COMPATIBLE client — its async embedder — pointed at the loopback service.
+ * The wire format, never a destination. */
+export const LOCAL_EMBEDDER_WIRE_PROVIDER = "openai";
+/** `http://127.0.0.1:<port>/v1` — ov.conf's `api_base` under `local`. */
+export function localEmbedderBaseUrl(c) {
+    return `http://127.0.0.1:${c.local_embedder_port}/v1`;
+}
+export function ovConfEmbedder(c) {
+    if (c.embedding_provider === "local")
+        return {
+            provider: LOCAL_EMBEDDER_WIRE_PROVIDER,
+            model: c.embedding_model,
+            dimension: c.embedding_dimension,
+            api_base: localEmbedderBaseUrl(c),
+        };
+    return {
+        provider: c.embedding_provider,
+        model: c.embedding_model,
+        dimension: c.embedding_dimension,
+    };
+}
+/** The three memory timeouts are BOUNDED — memory must never
+ * hold a round past a budget an operator can read off the config, and a
+ * mistyped 0 must not turn every seed memory-less. Inclusive ms. */
+export const CONTEXT_TIMEOUT_BOUNDS_MS = { min: 100, max: 15_000 };
+export const SEARCH_TIMEOUT_BOUNDS_MS = { min: 100, max: 15_000 };
+export const HEALTH_TIMEOUT_BOUNDS_MS = { min: 100, max: 20_000 };
+export const CASE_EMBED_TAIL_MAX_MS = 30_000;
+/** `v` as an integer inside `bounds`, or `fallback` when it is not a finite
+ * number at all. */
+function clampMs(v, bounds, fallback) {
+    const n = typeof v === "number" ? v : Number.NaN;
+    if (!Number.isFinite(n))
+        return fallback;
+    return Math.max(bounds.min, Math.min(bounds.max, Math.floor(n)));
+}
+/** The contract's hard ceiling on the lesson prefetch. */
+export const LESSON_PREFETCH_MAX_MS = 2000;
+/** The shadow prefetch's ceiling and default. The default covers
+ * the live VM's measured worst case — a find's 2.5 s p90 behind a case batch
+ * already on the embedder (two ~3.4 s embeddings, src/cases.ts). */
+export const LESSON_SHADOW_PREFETCH_MAX_MS = 20_000;
+export const LESSON_SHADOW_PREFETCH_DEFAULT_MS = 10_000;
+/**
+ * The [memory] block, defaults filled and the delivery switch checked: an
+ * unknown `delivery` value REFUSES to load (a misspelt `"onn"` must not
+ * quietly mean shadow, or off), and the prefetch budget is clamped to the
+ * contract's ceiling.
+ */
+export function parseMemory(raw) {
+    const m = { ...MEMORY_DEFAULTS, ...raw };
+    if (!MEMORY_DELIVERY_MODES.includes(m.delivery))
+        throw new Error(`[memory] delivery must be one of ${MEMORY_DELIVERY_MODES.map((v) => `"${v}"`).join(", ")} (got ${JSON.stringify(m.delivery)})`);
+    const budget = Number(m.delivery_budget_ms);
+    m.delivery_budget_ms = Number.isFinite(budget)
+        ? Math.max(1, Math.min(LESSON_PREFETCH_MAX_MS, Math.floor(budget)))
+        : LESSON_PREFETCH_MAX_MS;
+    const shadow = Number(m.shadow_budget_ms);
+    m.shadow_budget_ms = Number.isFinite(shadow)
+        ? Math.max(1, Math.min(LESSON_SHADOW_PREFETCH_MAX_MS, Math.floor(shadow)))
+        : LESSON_SHADOW_PREFETCH_DEFAULT_MS;
+    m.context_timeout_ms = clampMs(m.context_timeout_ms, CONTEXT_TIMEOUT_BOUNDS_MS, MEMORY_DEFAULTS.context_timeout_ms);
+    m.case_embed_tail_ms = clampMs(m.case_embed_tail_ms, { min: 0, max: CASE_EMBED_TAIL_MAX_MS }, MEMORY_DEFAULTS.case_embed_tail_ms);
+    return m;
+}
+/** The quota a round's context search gives each area it searches when
+ * `[memory] context_quotas` names none (the round context assembler reads
+ * this same constant). */
+export const DEFAULT_ROUND_QUOTA = 24;
+export const MEMORY_DEFAULTS = {
+    context_tokens: 2000,
+    context_timeout_ms: 9000,
+    case_embed_tail_ms: 4000,
+    probe_interval_s: 120,
+    down_after_min: 10,
+    boot_grace_min: 5,
+    rewake_h: 6,
+    incident_ticket_after_min: 120,
+    backfill_interval_s: 60,
+    write_backlog_after_min: 120,
+    cases_interval_s: 120,
+    cases_backfill_days: 60,
+    lessons_mine_lead_min: 15,
+    lessons_mine_days: 45,
+    lessons_receipt_wait_min: 180,
+    lessons_expiry_ops_days: 7,
+    lessons_packet_new_max: 40,
+    lessons_recall_window_days: 14,
+    lessons_recurrence_days: 90,
+    lessons_digest_backfill_from: "2026-08-31",
+    lessons_digest_backfill_to: "2026-10-02",
+    context_quotas: { experiences: DEFAULT_ROUND_QUOTA },
+    delivery: "shadow",
+    delivery_budget_ms: LESSON_PREFETCH_MAX_MS,
+    shadow_budget_ms: LESSON_SHADOW_PREFETCH_DEFAULT_MS,
+};
+/** [openviking] is optional in config.toml — the defaults ARE the shipped
+ * configuration, exactly like [tui]/[companion]. */
+export const OPENVIKING_DEFAULTS = {
+    enabled: true,
+    endpoint: "local",
+    version: "0.4.15",
+    llama_cpp_python_version: "0.3.35",
+    extension_commit: "d436baa23c83938b22bb0aab08b0ce48568b5ff4",
+    user: "reviewer",
+    account: "",
+    reviewer_key_file: "openviking_reviewer_key",
+    auth_mode: "api_key",
+    root_key_file: "openviking_root_key",
+    provision_users: ["reviewer", "companion"],
+    request_timeout_ms: 10000,
+    search_timeout_ms: 8000,
+    default_category: "experiences",
+    read_cache_ttl_ms: 15000,
+    host: "127.0.0.1",
+    port: 1933,
+    bin: "/opt/openviking/venv/bin/openviking-server",
+    home: "/opt/quickreview/state/openviking",
+    config_file: "", // → <home>/ov.conf
+    workspace: "", // → <home>/workspace
+    workers: 1,
+    queue_concurrency: 2,
+    health_interval_s: 30,
+    health_timeout_ms: 6000,
+    restart_backoff_ms: [1000, 2000, 5000, 15000, 30000, 60000],
+    restart_reset_after_s: 120,
+    embedding_provider: "local",
+    embedding_model: LOCAL_EMBEDDING.model,
+    embedding_dimension: LOCAL_EMBEDDING.dimension,
+    embedding_key_file: "openai_embeddings_api_key",
+    local_embedder_file: `/opt/openviking/models/${LOCAL_EMBEDDING.model}.gguf`,
+    local_embedder_url: `https://huggingface.co/CompendiumLabs/bge-small-en-v1.5-gguf/resolve/d32f8c040ea3b516330eeb75b72bcc2d3a780ab7/${LOCAL_EMBEDDING.model}.gguf`,
+    local_embedder_sha256: "f0b2fef971e8366438bfd2d9aefea1b0115919389448806d290237f638bae999",
+    local_embedder_port: 1934,
+    local_embedder_threads: 1,
+};
+/**
+ * The [openviking] block, defaults filled and the embedder checked.
+ *
+ * The embedder is validated at LOAD time because the boot validates it too,
+ * and a memory engine that refuses to start is a silent outage: an unknown
+ * provider, a non-positive dimension, a `local` model/dimension that is not
+ * the local embedder's, or a local model-file pin that does not name that
+ * model are all config errors here.
+ */
+export function parseOpenViking(raw) {
+    const merged = { ...OPENVIKING_DEFAULTS, ...raw };
+    if (!OPENVIKING_ENDPOINTS.includes(merged.endpoint)) {
+        throw new Error(`config.toml: [openviking] endpoint must be one of ${OPENVIKING_ENDPOINTS.join(", ")} (got '${String(merged.endpoint)}')`);
+    }
+    // Bounded, never a tight loop or an unbounded wait.
+    merged.search_timeout_ms = clampMs(merged.search_timeout_ms, SEARCH_TIMEOUT_BOUNDS_MS, OPENVIKING_DEFAULTS.search_timeout_ms);
+    merged.health_timeout_ms = clampMs(merged.health_timeout_ms, HEALTH_TIMEOUT_BOUNDS_MS, OPENVIKING_DEFAULTS.health_timeout_ms);
+    // The defaults are the LOCAL embedder: a hosted opt-in that omits the model
+    // runs HOSTED_EMBEDDING, never the local model (which no hosted API serves).
+    // A named hosted model with no dimension has no default to fall back on.
+    if (merged.embedding_provider !== "local") {
+        if (raw.embedding_model === undefined) {
+            merged.embedding_model = HOSTED_EMBEDDING.model;
+            if (raw.embedding_dimension === undefined)
+                merged.embedding_dimension = HOSTED_EMBEDDING.dimension;
+        }
+        else if (raw.embedding_dimension === undefined) {
+            if (merged.embedding_model !== HOSTED_EMBEDDING.model)
+                throw new Error(`config.toml: [openviking] embedding_model = "${String(merged.embedding_model)}" needs its embedding_dimension set too`);
+            merged.embedding_dimension = HOSTED_EMBEDDING.dimension;
+        }
+    }
+    else if (merged.embedding_model === RETIRED_LOCAL_EMBEDDING.model &&
+        (raw.embedding_dimension === undefined ||
+            merged.embedding_dimension === RETIRED_LOCAL_EMBEDDING.dimension)) {
+        // An earlier release required this spelling under `local`. It means the
+        // current local embedder — the boot renders the same, and the re-embed
+        // migration moves the store across.
+        merged.embedding_model = LOCAL_EMBEDDING.model;
+        merged.embedding_dimension = LOCAL_EMBEDDING.dimension;
+    }
+    if (!EMBEDDING_PROVIDERS.includes(merged.embedding_provider)) {
+        throw new Error(`config.toml: [openviking] embedding_provider must be one of ${EMBEDDING_PROVIDERS.join(", ")} (got '${String(merged.embedding_provider)}')`);
+    }
+    if (!Number.isInteger(merged.embedding_dimension) || merged.embedding_dimension <= 0) {
+        throw new Error(`config.toml: [openviking] embedding_dimension must be a positive integer (got '${String(merged.embedding_dimension)}')`);
+    }
+    if (merged.embedding_provider === "local" &&
+        (merged.embedding_model !== LOCAL_EMBEDDING.model ||
+            merged.embedding_dimension !== LOCAL_EMBEDDING.dimension)) {
+        throw new Error(`config.toml: [openviking] embedding_provider = "local" runs the local English embedder, ${LOCAL_EMBEDDING.model} at ${LOCAL_EMBEDDING.dimension} dims — ` +
+            `the only local model the image pins; set embedding_model/embedding_dimension to it, or opt into a hosted provider`);
+    }
+    if (typeof merged.embedding_key_file !== "string" ||
+        merged.embedding_key_file.trim() === "" ||
+        merged.embedding_key_file.includes("/")) {
+        throw new Error("config.toml: [openviking] embedding_key_file must be a bare file name inside the secrets dir");
+    }
+    checkLocalEmbedderPin(merged);
+    return resolveOpenVikingPaths(merged);
+}
+/** The local embedder's model-file pin and service knobs. The
+ * file and the URL must both name `LOCAL_EMBEDDING.model`: a pin for another
+ * model would put a file the service's model table does not describe under a
+ * name the vector store trusts. */
+function checkLocalEmbedderPin(c) {
+    const gguf = `${LOCAL_EMBEDDING.model}.gguf`;
+    const file = c.local_embedder_file;
+    if (typeof file !== "string" || !file.startsWith("/") || !file.endsWith(`/${gguf}`)) {
+        throw new Error(`config.toml: [openviking] local_embedder_file must be an absolute container path ending in /${gguf} (got '${String(file)}')`);
+    }
+    const url = c.local_embedder_url;
+    if (typeof url !== "string" || !url.startsWith("https://") || !url.endsWith(`/${gguf}`)) {
+        throw new Error(`config.toml: [openviking] local_embedder_url must be an https URL ending in /${gguf} (got '${String(url)}')`);
+    }
+    if (typeof c.local_embedder_sha256 !== "string" ||
+        !/^[0-9a-f]{64}$/.test(c.local_embedder_sha256)) {
+        throw new Error("config.toml: [openviking] local_embedder_sha256 must be the file's sha256, 64 lowercase hex digits");
+    }
+    const port = c.local_embedder_port;
+    if (!Number.isInteger(port) || port < 1 || port > 65535 || port === c.port) {
+        throw new Error(`config.toml: [openviking] local_embedder_port must be a TCP port other than the server's own ${c.port} (got '${String(port)}')`);
+    }
+    const threads = c.local_embedder_threads;
+    if (!Number.isInteger(threads) || threads < 1 || threads > 16) {
+        throw new Error(`config.toml: [openviking] local_embedder_threads must be an integer in 1..16 (got '${String(threads)}')`);
+    }
+}
+/** Derived paths: `config_file`/`workspace` default off `home`, so the three
+ * never drift apart in a hand-edited config. */
+export function resolveOpenVikingPaths(c) {
+    const home = expandHome(c.home);
+    return {
+        ...c,
+        home,
+        config_file: c.config_file ? expandHome(c.config_file) : join(home, "ov.conf"),
+        workspace: c.workspace ? expandHome(c.workspace) : join(home, "workspace"),
+    };
+}
+/** `http://host:port` — the one place the base URL is spelled. */
+export function openVikingBaseUrl(c) {
+    return `http://${c.host}:${c.port}`;
+}
+/** `[eod] pinned_watchdog_window_min`'s default, and the watchdog's own. */
+export const EOD_PINNED_WATCHDOG_WINDOW_MIN = 90;
+/** Neutral default — a config that never names a zone runs on UTC days. */
+export const OPS_DEFAULTS = { timezone: "UTC" };
+/** The same Intl-based check the EOD machinery relies on (src/eod.ts builds
+ * an Intl.DateTimeFormat per zone): an unknown zone throws RangeError at
+ * formatter construction, so validate at parse time rather than at 18:00. */
+export function assertIanaTimeZone(tz, where) {
+    try {
+        new Intl.DateTimeFormat("en-US", { timeZone: tz });
+    }
+    catch {
+        throw new Error(`config.toml: ${where} '${tz}' is not a valid IANA timezone`);
+    }
+    return tz;
+}
+/** A section carrying its own `timezone` (defaulted from [ops]), returned
+ * once that zone passes `assertIanaTimeZone`. */
+function checkSectionTimeZone(section, where) {
+    assertIanaTimeZone(String(section.timezone), where);
+    return section;
+}
+export const INGRESS_DEFAULTS = {
+    shape: "none",
+    hostname_file: "",
+    debounce_ms: 3000,
+    sweep_interval_s: 300,
+};
+/** Does this install take webhooks at all? Not under the polling shape
+ * (and so never under `[github] auth = "user"`, which requires it): there the
+ * `/webhook` route refuses every delivery and no webhook secret is read. */
+export function webhooksEnabled(cfg) {
+    return cfg.ingress.shape !== "polling";
+}
+/** The hostname file's resolved path — the one place the default is spelled. */
+export function ingressHostnameFile(cfg, root) {
+    const configured = cfg.ingress.hostname_file.trim();
+    return configured ? expandHome(configured) : join(root, "state", "ingress", "hostname");
+}
+export const LOGIN_REFRESH_DEFAULTS = Object.freeze({
+    enabled: false,
+    margin_min: 90,
+});
+/** Parse `[login_refresh]`; with the refresher enabled, a margin that does not
+ * outlast the longest worker cap REFUSES to load (a worker would then outlive
+ * the token it borrowed). Disabled, nothing borrows, so the rule is not checked. */
+export function parseLoginRefresh(raw, roundDeadlineMin) {
+    const enabled = raw.enabled ?? LOGIN_REFRESH_DEFAULTS.enabled;
+    if (typeof enabled !== "boolean")
+        throw new Error(`config.toml [login_refresh]: enabled must be true or false`);
+    const m = raw.margin_min ?? LOGIN_REFRESH_DEFAULTS.margin_min;
+    const margin = typeof m === "bigint" ? Number(m) : m;
+    if (typeof margin !== "number" || !Number.isFinite(margin) || margin > 1440)
+        throw new Error(`config.toml [login_refresh]: margin_min must be a number of minutes up to 1440 (got ${JSON.stringify(typeof m === "bigint" ? String(m) : m)})`);
+    if (enabled && margin <= roundDeadlineMin)
+        throw new Error(`config.toml [login_refresh]: margin_min (${margin}) must exceed [daemon] round_deadline_min (${roundDeadlineMin}), the longest worker cap`);
+    return { enabled, margin_min: margin };
+}
+/** Where a `qcr scan start` driver runs. `docker`: in a throwaway
+ * container from the scan sandbox image that mounts only the reviewed repo
+ * (read-only), the state home, the scan's own pi home and the config
+ * (src/scanbox.ts). `host`: a detached process on this machine. */
+export const SCAN_SANDBOXES = ["docker", "host"];
+/** The scan sandbox's own image (docker/companion/Dockerfile, built by
+ * `qcr scan rebuild`). Not the companion's: now that is the release
+ * image in `companion` mode, which the sandbox's one-shot entrypoint does not
+ * serve. */
+export const SCAN_IMAGE_DEFAULT = "qcr-scan";
+export const SCAN_SANDBOX_DEFAULTS = {
+    sandbox: "docker",
+    sandbox_set: false,
+};
+/** `[scan] sandbox / pihome_volume / image`; the pi home volume defaults to
+ * the companion's, the image to `SCAN_IMAGE_DEFAULT`. */
+export function parseScanSandbox(raw, companion) {
+    const t = (typeof raw === "object" && raw !== null ? raw : {});
+    const name = (key, fallback) => {
+        const v = t[key];
+        if (v === undefined)
+            return fallback;
+        if (typeof v !== "string" || v.trim() === "")
+            throw new Error(`config.toml [scan] ${key} must be a non-empty name (got ${JSON.stringify(v)})`);
+        return v.trim();
+    };
+    const sandbox = t["sandbox"] ?? SCAN_SANDBOX_DEFAULTS.sandbox;
+    if (typeof sandbox !== "string" || !SCAN_SANDBOXES.includes(sandbox))
+        throw new Error(`config.toml [scan] sandbox must be "docker" or "host" (got ${JSON.stringify(sandbox)})`);
+    return {
+        sandbox: sandbox,
+        sandbox_set: t["sandbox"] !== undefined,
+        pihome_volume: name("pihome_volume", companion.pihome_volume),
+        image: name("image", SCAN_IMAGE_DEFAULT),
+    };
+}
+export const LEVERS_DEFAULTS = {
+    session_drain_max_min: 30,
+    session_drain_budget_min_per_day: 90,
+    session_pause_max_min: 240,
+    session_pause_budget_min_per_day: 480,
+};
+/** Parse `[levers]`; a bound that is not a positive integer, or a budget
+ * smaller than its cap, refuses to load — a lever bound of zero or a budget
+ * that can never fund one full grant is a misconfiguration, not a setting. */
+export function parseLevers(raw) {
+    const cfg = { ...LEVERS_DEFAULTS, ...raw };
+    for (const key of Object.keys(LEVERS_DEFAULTS)) {
+        const v = cfg[key];
+        if (!Number.isInteger(v) || v < 1) {
+            throw new Error(`config.toml [levers]: ${key} must be a positive integer number of minutes (got ${JSON.stringify(v)})`);
+        }
+    }
+    if (cfg.session_drain_budget_min_per_day < cfg.session_drain_max_min) {
+        throw new Error("config.toml [levers]: session_drain_budget_min_per_day must be at least session_drain_max_min");
+    }
+    if (cfg.session_pause_budget_min_per_day < cfg.session_pause_max_min) {
+        throw new Error("config.toml [levers]: session_pause_budget_min_per_day must be at least session_pause_max_min");
+    }
+    return cfg;
+}
+/** The values `[archive] mode` takes (docs/archiving.md §12). */
+export const ARCHIVE_MODES = ["off", "plan", "on"];
+export const ARCHIVE_DEFAULTS = Object.freeze({
+    mode: "plan",
+    after_days: 14,
+    events_after_days: 35,
+    interval_s: 60,
+    start_delay_min: 10,
+    tick_budget_s: 20,
+    max_prs_per_tick: 5,
+    max_mb_per_s: 8,
+    disk_headroom_gb: 2,
+    db_batch_rows: 500,
+    gzip_level: 6,
+    live_retention_days: 30,
+    live_cap_gb: 20,
+});
+/** Each numeric `[archive]` key's range, and whether it is a whole number. */
+export const ARCHIVE_LIMITS = Object.freeze({
+    after_days: [7, 3650, true],
+    events_after_days: [31, 3650, true],
+    interval_s: [10, 3600, true],
+    start_delay_min: [0, 1440, true],
+    tick_budget_s: [1, 300, true],
+    max_prs_per_tick: [1, 100, true],
+    max_mb_per_s: [1, 200, false],
+    disk_headroom_gb: [0.5, 1024, false],
+    db_batch_rows: [100, 2000, true],
+    gzip_level: [1, 9, true],
+    live_retention_days: [7, 3650, true],
+    live_cap_gb: [0, 4096, false],
+});
+/**
+ * Parse `[archive]`. An unknown `mode` REFUSES to load (a misspelt `"onn"`
+ * must not quietly mean plan, or off), and so does a key that is not a
+ * number; a number out of its range is CLAMPED into it (`ARCHIVE_LIMITS`).
+ */
+export function parseArchive(raw) {
+    const mode = raw.mode ?? ARCHIVE_DEFAULTS.mode;
+    if (!ARCHIVE_MODES.includes(mode))
+        throw new Error(`config.toml [archive]: mode must be one of ${ARCHIVE_MODES.map((v) => `"${v}"`).join(", ")} (got ${JSON.stringify(mode)})`);
+    const out = { ...ARCHIVE_DEFAULTS, mode: mode };
+    for (const [key, [min, max, int]] of Object.entries(ARCHIVE_LIMITS)) {
+        const v = raw[key];
+        if (v === undefined)
+            continue;
+        const n = typeof v === "bigint" ? Number(v) : v;
+        if (typeof n !== "number" || !Number.isFinite(n))
+            throw new Error(`config.toml [archive]: ${key} must be a number (got ${JSON.stringify(typeof v === "bigint" ? String(v) : v)})`);
+        out[key] = Math.min(max, Math.max(min, int ? Math.floor(n) : n));
+    }
+    return out;
+}
+/** The team slug a configured `org/team` review team is requested as — the
+ * one rule the webhook's trigger and withdrawal, the trigger consumption and
+ * the backfill all match on. A bare slug is its own slug. */
+export function reviewTeamSlug(reviewTeam) {
+    return reviewTeam.split("/")[1] ?? reviewTeam;
+}
+/** Defaults for [backfill], derived from the already-parsed [github] block. */
+export function backfillDefaults(github) {
+    return {
+        bot_login: github.bot_login,
+        bot_actor: github.app_slug,
+        reviewed_label: github.reviewed_label,
+        trigger_label: github.trigger_label,
+        in_progress_label: github.in_progress_label,
+        review_team_slug: reviewTeamSlug(github.review_team),
+        concurrency: 2,
+        max_search_pages: 10,
+    };
+}
+/** [tui] is optional in config.toml — the TUI is an operator convenience and
+ * older configs must keep parsing. */
+export const TUI_DEFAULTS = {
+    target: "ssh",
+    ssh_host: "my-vm",
+    container: "quickreview-sandbox",
+    memory_container: "",
+    remote_state_dir: "/opt/quickreview/state",
+    remote_sandbox_root: "",
+    sudo_docker: true,
+    poll_interval_s: 3,
+    stale_after_s: 90,
+    msg_timeout_s: 30,
+    evidence_timeout_s: 60,
+    evidence_why_interval_s: 10,
+};
+/** The local companion image's tag: the release image (docker/Dockerfile) in
+ * `companion` mode, built on the host. */
+export const COMPANION_IMAGE = "qcr-companion:release";
+/** [companion] is optional in config.toml, exactly like [tui]. */
+export const COMPANION_DEFAULTS = {
+    enabled: true,
+    container_name: "qcr-companion",
+    // The release image, locally built (`qcr companion rebuild`). A tag of its own:
+    // the name `qcr-companion` is the retired companion image on an existing
+    // PC, which the new container's entrypoint modes do not serve, so a
+    // recreate must find no image here and build the right one.
+    image: COMPANION_IMAGE,
+    pihome_volume: "companion-pihome",
+    session: "companion",
+    model: "openai-codex/gpt-6.1-sol:medium",
+    repo_dir: "", // → sandboxRoot()
+    tracker_dir: "", // → /tracker (rw) when set; empty = no tracker mount
+    tracker_docs_dir: "", // → /tracker-docs (ro) when set
+    reviewed_repo_dir: "", // → /reviewed-repo (ro) when set and present
+    evidence_dir: "~/.local/share/qcr/evidence", // → /evidence (ro)
+    feed_dir: "", // → <root>/state/companion/feed
+    alerts_dir: "", // → <root>/state/companion/alerts
+    ssh_dir: "~/.ssh",
+    build_context: "", // → <root> (the release image is built from it; Dockerfile at docker/Dockerfile)
+    overdue_grace_min: 30,
+    stale_alert_s: 300,
+    awaiting_age_h: 24,
+    cooldown_min: 20,
+};
+export const SINK_DEFAULTS = {
+    kind: "none",
+    root: "",
+    effort: "",
+    parent: "",
+    tickets_effort: "",
+};
+/** [sink] parse + validation. Misconfig is loud at boot, not a quiet no-op:
+ * a `wayfinder` sink missing its effort or parent would otherwise silently
+ * file nothing (or file into a nameless effort) forever. */
+function parseSink(raw, companion) {
+    const sink = { ...SINK_DEFAULTS, ...raw };
+    if (!["wayfinder", "github", "none"].includes(sink.kind)) {
+        throw new Error(`config.toml [sink]: kind must be "wayfinder", "github" or "none" (got ${JSON.stringify(sink.kind)})`);
+    }
+    sink.root = sink.root ? expandHome(sink.root) : companion.tracker_dir;
+    if (sink.kind === "wayfinder") {
+        if (!sink.root.trim())
+            throw new Error('config.toml [sink]: kind = "wayfinder" requires a `root` (or a [companion] tracker_dir to default from)');
+        if (!sink.effort.trim())
+            throw new Error('config.toml [sink]: kind = "wayfinder" requires a non-empty `effort`');
+        if (!sink.parent.trim())
+            throw new Error('config.toml [sink]: kind = "wayfinder" requires a non-empty `parent`');
+    }
+    return sink;
+}
+/** The ticket projection's effort — its own key when set, else the filer's.
+ * Empty ⇒ the projection has nothing configured to read. */
+export function sinkTicketsEffort(cfg) {
+    return cfg.sink.tickets_effort.trim() || cfg.sink.effort.trim();
+}
+/** Default lost-prompt grace when [daemon] carries no
+ * `round_stall_grace_min`: long enough that a slow first tool call is never
+ * mistaken for a dropped prompt, far shorter than the round deadline. */
+export const DEFAULT_ROUND_STALL_GRACE_MIN = 10;
+/** Default self-requeue budget per PR head when [daemon] carries no
+ * `max_self_requeues`. */
+export const DEFAULT_MAX_SELF_REQUEUES = 2;
+/** Default prompt-redelivery budget per round. Two is enough to cover
+ * a delivery that raced a busy session and one that raced a session restart;
+ * a third failure is no longer a delivery problem, so escalating beats
+ * re-sending the same file forever. */
+export const DEFAULT_MAX_PROMPT_REDELIVERIES = 2;
+/** Finite daemon→pi stage bounds. The 45-minute hard run cap is above the
+ * measured live maximum (~23 minutes) yet materially below the 75-minute
+ * defense-in-depth round deadline. */
+export const DEFAULT_SESSION_COMMAND_START_LEASE_S = 120;
+export const DEFAULT_SESSION_BRIDGE_READY_TIMEOUT_S = 30;
+export const DEFAULT_SESSION_COMMAND_RUNNING_MAX_MIN = 45;
+export const DEFAULT_ROUND_FIRST_PASS_MAX_MIN = 5;
+export const DEFAULT_ROUND_PASSES_MAX_MIN = 35;
+export const DEFAULT_ROUND_FINALIZE_GRACE_MIN = 5;
+/** Measured posting→verdict tails run to ~6.5 min; 15 is over twice that and
+ * still well inside the 75-minute round deadline. */
+export const DEFAULT_ROUND_POSTED_TAIL_GRACE_MIN = 15;
+/** `[daemon] follow_up_sweep_extra_min`'s default. */
+export const DEFAULT_FOLLOW_UP_SWEEP_EXTRA_MIN = 20;
+/** The round stage bounds in minutes, each with its code default: the one
+ * resolution status publication and the stage supervisor both use. */
+export function resolveRoundStageBounds(daemon) {
+    return {
+        first_pass_max_min: daemon.round_first_pass_max_min ?? DEFAULT_ROUND_FIRST_PASS_MAX_MIN,
+        passes_max_min: daemon.round_passes_max_min ?? DEFAULT_ROUND_PASSES_MAX_MIN,
+        running_max_min: daemon.session_command_running_max_min ?? DEFAULT_SESSION_COMMAND_RUNNING_MAX_MIN,
+        follow_up_sweep_extra_min: daemon.follow_up_sweep_extra_min ?? DEFAULT_FOLLOW_UP_SWEEP_EXTRA_MIN,
+    };
+}
+export const DEFAULT_POSTING_RECEIPT_GRACE_S = 120;
+/** Three retries, exponential,
+ * all inside an hour of the first failure. */
+export const DEFAULT_POSTING_RETRY_OFFSETS_MIN = [4, 12, 36];
+export const DEFAULT_POSTING_RETRY_WINDOW_MIN = 60;
+export const DEFAULT_SESSION_COMMAND_UNKNOWN_GRACE_S = 60;
+export const DEFAULT_SESSION_COMMAND_UNKNOWN_MAX_CHECKS = 1;
+export const DEFAULT_SESSION_COMMAND_MAX_START_RETRIES = 2;
+/** A post-verdict compaction can take over a minute with the container
+ * CPU-starved; ten minutes is several times the worst seen and still well
+ * inside the 75-minute round deadline. */
+export const DEFAULT_SESSION_COMPACTION_MAX_S = 600;
+/** The idle-PR answer worker: ten minutes of wall clock, two dollars. */
+export const DEFAULT_ANSWER_TIMEOUT_S = 600;
+export const DEFAULT_ANSWER_CAP_USD = 2;
+export const DEFAULT_ROUND_STAGE_SUPERVISOR_STALE_S = 180;
+/** The app's root: the checkout (or image tree) this module runs from. The
+ * review core's shipped data is found through `assetRoot` (packages/pi-plugin/src/assetroot.ts). */
+export function sandboxRoot() {
+    return packageRootFrom(dirname(fileURLToPath(import.meta.url)), "sandbox root");
+}
+export function expandHome(p) {
+    return p.startsWith("~/") || p === "~" ? resolve(homedir(), p.slice(2)) : p;
+}
+/** Host paths for every companion mount: a set path gets its `~` expanded (a relative one stays relative); "" means derive from root. */
+export function resolveCompanionPaths(c, root = sandboxRoot()) {
+    return {
+        ...c,
+        repo_dir: c.repo_dir ? expandHome(c.repo_dir) : root,
+        tracker_dir: c.tracker_dir ? expandHome(c.tracker_dir) : "",
+        tracker_docs_dir: c.tracker_docs_dir ? expandHome(c.tracker_docs_dir) : "",
+        reviewed_repo_dir: expandHome(c.reviewed_repo_dir),
+        evidence_dir: c.evidence_dir ? expandHome(c.evidence_dir) : resolve(root, "evidence"),
+        feed_dir: c.feed_dir ? expandHome(c.feed_dir) : resolve(root, "state", "companion", "feed"),
+        alerts_dir: c.alerts_dir
+            ? expandHome(c.alerts_dir)
+            : resolve(root, "state", "companion", "alerts"),
+        ssh_dir: expandHome(c.ssh_dir),
+        build_context: c.build_context ? expandHome(c.build_context) : root,
+    };
+}
+/**
+ * `[caps]` parsed with each numeric cap CHECKED, not cast: a key missing
+ * from an operator's file must never reach `checkDiffstat` as `undefined`,
+ * where `files > undefined` is `false` and the cap would pass. A cap the
+ * daemon cannot compare against is a startup refusal: the improvement
+ * channel is the one place this system pushes code, and it must never run uncapped.
+ */
+export function parseCaps(raw) {
+    const cap = (key) => {
+        const v = raw[key];
+        if (typeof v !== "number" || !Number.isFinite(v) || v < 0) {
+            throw new Error(`config.toml [caps]: ${key} must be a non-negative number (got ${JSON.stringify(v)})`);
+        }
+        return v;
+    };
+    const isStrings = (v) => Array.isArray(v) && v.every((x) => typeof x === "string");
+    const denyPrefixes = () => {
+        const prefixes = raw.improvement_pr_deny_prefixes;
+        if (prefixes === undefined)
+            return [...IMPROVEMENT_DENY_PREFIXES_DEFAULT];
+        if (isStrings(prefixes))
+            return [...prefixes];
+        throw new Error(`config.toml [caps]: improvement_pr_deny_prefixes must be an array of strings (got ${JSON.stringify(prefixes)})`);
+    };
+    return {
+        improvement_pr_max_lines: cap("improvement_pr_max_lines"),
+        improvement_pr_max_files: cap("improvement_pr_max_files"),
+        improvement_pr_per_day: cap("improvement_pr_per_day"),
+        improvement_pr_per_week: cap("improvement_pr_per_week"),
+        issues_per_day: cap("issues_per_day"),
+        improvement_pr_deny_prefixes: denyPrefixes(),
+    };
+}
+/** The shipped improvement-PR path denylist. Lives here (not in
+ * improvements.ts) so config carries the default without a runtime import cycle. */
+export const IMPROVEMENT_DENY_PREFIXES_DEFAULT = [
+    "migrations/",
+    "infra/",
+    "ansible/",
+    ".github/workflows/",
+];
+export function parseConfig(toml) {
+    const raw = parse(toml);
+    for (const line of configDeprecations(raw))
+        console.warn(`[quickreviewd] ${line}`);
+    const github = parseGithubSection(raw);
+    const preset = presetOf(raw);
+    const engine = parseEngine((raw.engine ?? {}));
+    const companion = resolveCompanionPaths({
+        ...COMPANION_DEFAULTS,
+        ...(raw.companion ?? {}),
+    });
+    // [ops] is optional so older configs keep parsing; [eod] and
+    // [slack.policy] timezones default from it below, own-section value wins.
+    const ops = {
+        timezone: assertIanaTimeZone(String((raw.ops ?? {}).timezone ?? OPS_DEFAULTS.timezone), "[ops] timezone"),
+    };
+    // [ingress] is optional: absent ⇒ shape "none", nothing starts.
+    const ingress = {
+        ...INGRESS_DEFAULTS,
+        ...(raw.ingress ?? {}),
+    };
+    if (!["none", "tunnel-file", "polling"].includes(ingress.shape)) {
+        throw new Error(`config.toml [ingress]: shape must be "none", "tunnel-file" or "polling" (got ${JSON.stringify(ingress.shape)})`);
+    }
+    // The person's own credential has no webhook: GitHub delivers webhooks to
+    // an App, and the person has none. So that mode is polling-only, and any
+    // other shape is refused here rather than left to run half-wired.
+    if (github.auth === "user" && ingress.shape !== "polling") {
+        throw new Error(`config.toml: [github] auth = "user" runs polling-only — set [ingress] shape = "polling" ` +
+            `(got ${JSON.stringify(ingress.shape)}${raw.ingress === undefined ? ", the default for an absent [ingress]" : ""}). ` +
+            `Webhooks and the webhook self-heal need a GitHub App: use auth = "app" for them.`);
+    }
+    const cfg = {
+        dry_run: Boolean(req(raw, "dry_run")),
+        ops,
+        ingress,
+        github,
+        server: { ...req(raw, "server") },
+        // Every optional knob defaults so older configs keep parsing.
+        daemon: {
+            max_self_requeues: DEFAULT_MAX_SELF_REQUEUES,
+            expire_overdue_after_h: 24,
+            session_command_start_lease_s: DEFAULT_SESSION_COMMAND_START_LEASE_S,
+            session_bridge_ready_timeout_s: DEFAULT_SESSION_BRIDGE_READY_TIMEOUT_S,
+            session_command_running_max_min: DEFAULT_SESSION_COMMAND_RUNNING_MAX_MIN,
+            round_first_pass_max_min: DEFAULT_ROUND_FIRST_PASS_MAX_MIN,
+            round_passes_max_min: DEFAULT_ROUND_PASSES_MAX_MIN,
+            round_finalize_grace_min: DEFAULT_ROUND_FINALIZE_GRACE_MIN,
+            round_posted_tail_grace_min: DEFAULT_ROUND_POSTED_TAIL_GRACE_MIN,
+            follow_up_sweep_extra_min: DEFAULT_FOLLOW_UP_SWEEP_EXTRA_MIN,
+            posting_receipt_grace_s: DEFAULT_POSTING_RECEIPT_GRACE_S,
+            posting_retry_offsets_min: [...DEFAULT_POSTING_RETRY_OFFSETS_MIN],
+            posting_retry_window_min: DEFAULT_POSTING_RETRY_WINDOW_MIN,
+            session_command_unknown_grace_s: DEFAULT_SESSION_COMMAND_UNKNOWN_GRACE_S,
+            session_command_unknown_max_checks: DEFAULT_SESSION_COMMAND_UNKNOWN_MAX_CHECKS,
+            session_command_max_start_retries: DEFAULT_SESSION_COMMAND_MAX_START_RETRIES,
+            session_compaction_max_s: DEFAULT_SESSION_COMPACTION_MAX_S,
+            lens_permits: DEFAULT_LENS_PERMITS,
+            lens_grant_stagger_ms: DEFAULT_LENS_GRANT_STAGGER_MS,
+            answer_timeout_s: DEFAULT_ANSWER_TIMEOUT_S,
+            answer_cap_usd: DEFAULT_ANSWER_CAP_USD,
+            round_stage_supervisor_stale_s: DEFAULT_ROUND_STAGE_SUPERVISOR_STALE_S,
+            ...req(raw, "daemon"),
+        },
+        // heartbeat_time defaults so older configs keep parsing; the timezone
+        // defaults from [ops], own [eod] value wins — and is checked as [ops] is.
+        eod: checkSectionTimeZone({
+            heartbeat_time: "09:00",
+            pinned_watchdog: true,
+            pinned_watchdog_window_min: EOD_PINNED_WATCHDOG_WINDOW_MIN,
+            timezone: ops.timezone,
+            ...req(raw, "eod"),
+        }, "[eod] timezone"),
+        caps: parseCaps(req(raw, "caps")),
+        models: parseModels(req(raw, "models"), REVIEW_PRESETS[preset].effort),
+        engine,
+        pi: parsePiSection(raw),
+        openviking: parseOpenViking((raw.openviking ?? {})),
+        memory: parseMemory((raw.memory ?? {})),
+        tui: { ...TUI_DEFAULTS, ...(raw.tui ?? {}) },
+        companion,
+        sink: parseSink((raw.sink ?? {}), companion),
+        backfill: { ...backfillDefaults(github), ...(raw.backfill ?? {}) },
+        guards: parseGuardsSection(raw),
+        recheck: { ...RECHECK_DEFAULTS, ...(raw.recheck ?? {}) },
+        review: parseReviewSection(raw, preset),
+        escalation: parseEscalation((raw.escalation ?? {})),
+        levers: parseLevers((raw.levers ?? {})),
+        slack: parseSlack((raw.slack ?? {}), ops.timezone),
+        owner: parseOwnerSection(raw),
+        scan: parseScan(raw.scan),
+        scan_sandbox: parseScanSandbox(raw.scan, companion),
+        archive: parseArchive((raw.archive ?? {})),
+        login_refresh: parseLoginRefresh((raw.login_refresh ?? {}), Number(req(raw, "daemon").round_deadline_min ?? 75)),
+    };
+    validateReviewSection(cfg);
+    foldLegacyOwnerSlackId(raw, cfg.owner);
+    requireGithubKeys(cfg.github);
+    // Every secrets reader in the daemon reads THIS field, so the
+    // install locator decides it here, once, for all of them.
+    cfg.github.secrets_dir = locateSecrets({
+        configured: typeof cfg.github.secrets_dir === "string" ? cfg.github.secrets_dir : "",
+    }).path;
+    if (cfg.tui.target !== "ssh" && cfg.tui.target !== "local") {
+        throw new Error(`config.toml [tui]: target must be "ssh" or "local" (got ${JSON.stringify(cfg.tui.target)})`);
+    }
+    const firstPass = cfg.daemon.round_first_pass_max_min ?? DEFAULT_ROUND_FIRST_PASS_MAX_MIN;
+    const passes = cfg.daemon.round_passes_max_min ?? DEFAULT_ROUND_PASSES_MAX_MIN;
+    const running = cfg.daemon.session_command_running_max_min ?? DEFAULT_SESSION_COMMAND_RUNNING_MAX_MIN;
+    const finalize = cfg.daemon.round_finalize_grace_min ?? DEFAULT_ROUND_FINALIZE_GRACE_MIN;
+    const stageBounds = [firstPass, passes, running, finalize];
+    if (!(stageBounds.every((v) => typeof v === "number" && Number.isFinite(v)) &&
+        firstPass > 0 &&
+        firstPass < passes &&
+        passes < running &&
+        finalize > 0 &&
+        finalize < running)) {
+        throw new Error("config.toml: require finite numbers 0 < round_first_pass_max_min < round_passes_max_min < session_command_running_max_min and 0 < round_finalize_grace_min < session_command_running_max_min");
+    }
+    // The two second-scale daemon→pi bounds become command deadlines
+    // (`toISOString`), which a non-finite value would throw at the first command.
+    for (const key of ["session_command_start_lease_s", "session_bridge_ready_timeout_s"]) {
+        const v = cfg.daemon[key];
+        if (!(typeof v === "number" && Number.isFinite(v) && v > 0))
+            throw new Error(`config.toml: require a finite number [daemon] ${key} > 0`);
+    }
+    const postedTail = cfg.daemon.round_posted_tail_grace_min ?? DEFAULT_ROUND_POSTED_TAIL_GRACE_MIN;
+    if (!(typeof postedTail === "number" && Number.isFinite(postedTail) && postedTail > 0)) {
+        throw new Error("config.toml: require round_posted_tail_grace_min > 0");
+    }
+    const sweepExtra = cfg.daemon.follow_up_sweep_extra_min ?? DEFAULT_FOLLOW_UP_SWEEP_EXTRA_MIN;
+    if (!(typeof sweepExtra === "number" && Number.isFinite(sweepExtra) && sweepExtra >= 0)) {
+        throw new Error("config.toml: require follow_up_sweep_extra_min >= 0");
+    }
+    const retryWindow = cfg.daemon.posting_retry_window_min ?? DEFAULT_POSTING_RETRY_WINDOW_MIN;
+    const retryOffsets = cfg.daemon.posting_retry_offsets_min ?? DEFAULT_POSTING_RETRY_OFFSETS_MIN;
+    if (!(typeof retryWindow === "number" && Number.isFinite(retryWindow) && retryWindow > 0) ||
+        !Array.isArray(retryOffsets) ||
+        retryOffsets.length === 0 ||
+        !retryOffsets.every((m, i) => typeof m === "number" &&
+            Number.isFinite(m) &&
+            m > 0 &&
+            m < retryWindow &&
+            (i === 0 || m > retryOffsets[i - 1]))) {
+        throw new Error("config.toml: require posting_retry_offsets_min = a non-empty, strictly increasing list of minutes, each > 0 and < posting_retry_window_min (> 0)");
+    }
+    const lensPermits = cfg.daemon.lens_permits ?? DEFAULT_LENS_PERMITS;
+    if (!(Number.isSafeInteger(lensPermits) && lensPermits >= 1)) {
+        throw new Error("config.toml: require an integer [daemon] lens_permits >= 1");
+    }
+    const lensStagger = cfg.daemon.lens_grant_stagger_ms ?? DEFAULT_LENS_GRANT_STAGGER_MS;
+    if (!(typeof lensStagger === "number" && Number.isFinite(lensStagger) && lensStagger >= 0)) {
+        throw new Error("config.toml: require a finite number [daemon] lens_grant_stagger_ms >= 0");
+    }
+    const answerTimeout = cfg.daemon.answer_timeout_s ?? DEFAULT_ANSWER_TIMEOUT_S;
+    if (!(typeof answerTimeout === "number" && Number.isFinite(answerTimeout) && answerTimeout > 0)) {
+        throw new Error("config.toml: require a finite number [daemon] answer_timeout_s > 0");
+    }
+    const answerCap = cfg.daemon.answer_cap_usd ?? DEFAULT_ANSWER_CAP_USD;
+    if (!(typeof answerCap === "number" && Number.isFinite(answerCap) && answerCap > 0)) {
+        throw new Error("config.toml: require a finite number [daemon] answer_cap_usd > 0");
+    }
+    const compactionMax = cfg.daemon.session_compaction_max_s ?? DEFAULT_SESSION_COMPACTION_MAX_S;
+    if (!(typeof compactionMax === "number" && Number.isFinite(compactionMax) && compactionMax > 0)) {
+        throw new Error("config.toml: require session_compaction_max_s > 0");
+    }
+    // Shape checks are pure, so they fire on every parse (tests included);
+    // the token-file check is I/O and lives in validateSlackConfig.
+    checkSlackShape(cfg.slack, cfg.owner);
+    delete cfg.daemon["overseer_rotation_days"];
+    return cfg;
+}
+function parseSlack(raw, defaultTimezone) {
+    // Inbound turns went with the overseer: nothing routes a Slack message to a
+    // model any more. A config that still asks for it is refused, not ignored,
+    // so nobody believes the bot is listening.
+    if (raw.inbound !== undefined && raw.inbound !== false) {
+        throw new Error("config.toml [slack]: `inbound` is retired — Slack inbound turns went with the overseer " +
+            "(the router refuses them: dropped_no_overseer); outbound announcements are unchanged. Remove the key.");
+    }
+    const rawPolicy = (raw.policy ?? {});
+    // A cause with no cooldown of its own takes the configured default — the
+    // same one an unlisted cause gets (`causePolicy`).
+    const defaultCooldown = rawPolicy.default_cooldown_min ?? SLACK_POLICY_DEFAULTS.default_cooldown_min;
+    const causes = { ...SLACK_CAUSE_DEFAULTS };
+    for (const [cause, v] of Object.entries((rawPolicy.causes ?? {}))) {
+        causes[cause] = {
+            enabled: v.enabled ?? causes[cause]?.enabled ?? true,
+            cooldown_min: Number(v.cooldown_min ?? causes[cause]?.cooldown_min ?? defaultCooldown),
+        };
+    }
+    const { causes: _drop, ...policyScalars } = rawPolicy;
+    // `legacy_owner_slack_id` is the legacy alias for [owner] slack_id —
+    // consumed by parseConfig's fold, never carried on the parsed shape.
+    const { legacy_owner_slack_id: _legacyOwnerId, inbound: _retiredInbound, ...rawScalars } = raw;
+    const slack = {
+        ...SLACK_DEFAULTS,
+        ...rawScalars,
+        users: { ...(raw.users ?? {}) },
+        // The day boundary defaults from [ops]; an explicit
+        // [slack.policy] timezone still wins.
+        policy: {
+            ...SLACK_POLICY_DEFAULTS,
+            timezone: defaultTimezone,
+            ...policyScalars,
+            causes,
+        },
+    };
+    // An explicit zone is checked as [ops]'s is — when the concierge is on;
+    // a switched-off section is a draft, and nothing reads its clock.
+    if (slack.enabled)
+        checkSectionTimeZone(slack.policy, "[slack.policy] timezone");
+    // Token *files* are names under secrets_dir, but an absolute or ~-rooted
+    // override must still work — expand here so every reader sees one shape.
+    slack.bot_token_file = expandHome(slack.bot_token_file);
+    slack.app_token_file = expandHome(slack.app_token_file);
+    return slack;
+}
+/** Absolute path of a Slack token file: a bare name resolves under
+ * [github].secrets_dir, an absolute/~ path is taken as given. */
+export function slackTokenPath(cfg, which) {
+    const name = which === "bot" ? cfg.slack.bot_token_file : cfg.slack.app_token_file;
+    return isAbsolute(name) ? name : join(cfg.github.secrets_dir, name);
+}
+/** Pure (I/O-free) part of Slack boot validation. When disabled, nothing at
+ * all is required — the concierge is simply not there. When enabled, the
+ * owner's Slack id (`[owner] slack_id`, legacy alias
+ * `[slack] legacy_owner_slack_id`) must be set and be a key of [slack.users]. */
+function checkSlackShape(slack, owner) {
+    if (!slack.enabled)
+        return;
+    const fail = (msg) => {
+        throw new Error(`config.toml [slack]: ${msg}`);
+    };
+    if (!slack.channel.trim())
+        fail("enabled = true requires a non-empty `channel`");
+    if (slack.channel_kind !== "public" && slack.channel_kind !== "private") {
+        fail(`channel_kind must be "public" or "private" (got ${JSON.stringify(slack.channel_kind)})`);
+    }
+    if (!owner.slack_id.trim())
+        fail("enabled = true requires a non-empty `[owner] slack_id`");
+    if (!(owner.slack_id in slack.users)) {
+        fail(`[owner] slack_id '${owner.slack_id}' must appear as a key in [slack.users] (it is the only source of own-PR rights)`);
+    }
+    for (const key of [
+        "daily_turns",
+        "per_user_daily_turns",
+        "thread_replies_per_day",
+        "announcements_per_hour",
+    ]) {
+        const cap = slack.policy[key];
+        if (typeof cap !== "number" || !Number.isFinite(cap) || cap < 0)
+            fail(`policy.${key} must be a finite non-negative number`);
+    }
+}
+export const fsSecretReader = (path) => {
+    let v;
+    try {
+        v = readFileSync(path, "utf8").trim();
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return undefined;
+        throw new Error(`cannot read secret file '${path}': ${err.message}`, { cause: err });
+    }
+    return v.length > 0 ? v : undefined;
+};
+/**
+ * Full Slack boot validation — shape plus token-file presence. A missing or
+ * empty token is a HARD startup error: the concierge never degrades silently
+ * into a read-only half-presence in the channel. Disabled ⇒ nothing is read.
+ */
+export function validateSlackConfig(cfg, deps = {}) {
+    checkSlackShape(cfg.slack, cfg.owner);
+    if (!cfg.slack.enabled)
+        return;
+    const read = deps.readSecret ?? fsSecretReader;
+    for (const which of ["bot", "app"]) {
+        const path = slackTokenPath(cfg, which);
+        if (!read(path)) {
+            throw new Error(`config.toml [slack]: ${which} token file '${path}' is missing or empty — Slack cannot start`);
+        }
+    }
+}
+let cached = null;
+/**
+ * The live config's path for this process, decided by the install locator:
+ * `$QCR_CONFIG`, else the install's config home — never the checkout's
+ * `config.toml`. The ONE answer every no-argument
+ * `loadConfig()` reads, and the one the daemon hands its sessions.
+ */
+export function liveConfigPath() {
+    return locateConfig().path;
+}
+export function loadConfig(path) {
+    if (cached && !path)
+        return cached;
+    const p = path ?? liveConfigPath();
+    if (!path && !existsSync(p)) {
+        // A missing live config says where it was looked for, and — when the
+        // checkout still strands one — how to move it.
+        throw new MissingConfigError(missingConfigMessage(locateConfig(), strandedCheckoutConfig({ root: sandboxRoot() })));
+    }
+    const cfg = parseConfig(readFileSync(p, "utf8"));
+    validateSlackConfig(cfg);
+    if (!path)
+        cached = cfg;
+    return cfg;
+}
+//# sourceMappingURL=config.js.map