bonecode 1.0.0

package/src/cli.ts

@@ -0,0 +1,475 @@
+#!/usr/bin/env node
+/**
+ * BoneCode CLI
+ *
+ * Usage:
+ *   bonecode                          Start server + open TUI (default)
+ *   bonecode serve                    Start server only (headless)
+ *   bonecode run "fix the login bug"  Send a one-shot prompt, stream output
+ *   bonecode run -i                   Interactive mode (stream to terminal)
+ *   bonecode compile                  Recompile .bone files
+ *   bonecode migrate                  Run database migrations
+ *   bonecode status                   Show server status
+ *   bonecode --help                   Show help
+ */
+
+import "dotenv/config";
+import * as path from "path";
+import * as fs from "fs";
+import * as http from "http";
+import * as os from "os";
+import { spawn, execSync } from "child_process";
+
+const PKG_ROOT = path.resolve(__dirname, "..");
+
+// Also load .env from package root when running globally (dotenv/config only loads from cwd)
+const pkgEnv = path.join(PKG_ROOT, ".env");
+if (pkgEnv !== path.join(process.cwd(), ".env") && fs.existsSync(pkgEnv)) {
+  require("dotenv").config({ path: pkgEnv, override: false });
+}
+
+const VERSION = JSON.parse(
+  fs.readFileSync(path.join(PKG_ROOT, "package.json"), "utf-8")
+).version;
+
+// ─── ANSI helpers ─────────────────────────────────────────────────────────────
+
+const isTTY = process.stdout.isTTY;
+const c = {
+  reset: isTTY ? "\x1b[0m" : "",
+  bold: isTTY ? "\x1b[1m" : "",
+  dim: isTTY ? "\x1b[2m" : "",
+  cyan: isTTY ? "\x1b[36m" : "",
+  green: isTTY ? "\x1b[32m" : "",
+  yellow: isTTY ? "\x1b[33m" : "",
+  red: isTTY ? "\x1b[31m" : "",
+  blue: isTTY ? "\x1b[34m" : "",
+  magenta: isTTY ? "\x1b[35m" : "",
+};
+
+function logo() {
+  console.log(`
+${c.cyan}${c.bold}  ██████╗  ██████╗ ███╗   ██╗███████╗${c.reset}
+${c.cyan}${c.bold}  ██╔══██╗██╔═══██╗████╗  ██║██╔════╝${c.reset}
+${c.cyan}${c.bold}  ██████╔╝██║   ██║██╔██╗ ██║█████╗  ${c.reset}
+${c.cyan}${c.bold}  ██╔══██╗██║   ██║██║╚██╗██║██╔══╝  ${c.reset}
+${c.cyan}${c.bold}  ██████╔╝╚██████╔╝██║ ╚████║███████╗${c.reset}
+${c.cyan}${c.bold}  ╚═════╝  ╚═════╝ ╚═╝  ╚═══╝╚══════╝${c.reset}
+${c.dim}  BoneCode v${VERSION} — AI coding agent${c.reset}
+`);
+}
+
+function help() {
+  logo();
+  console.log(`${c.bold}Usage:${c.reset}
+  ${c.cyan}bonecode${c.reset}                          Start server and open interactive session
+  ${c.cyan}bonecode serve${c.reset}                    Start headless server only
+  ${c.cyan}bonecode run${c.reset} ${c.dim}[message]${c.reset}            Send a prompt and stream the response
+  ${c.cyan}bonecode run -i${c.reset}                   Interactive terminal mode
+  ${c.cyan}bonecode compile${c.reset}                  Recompile .bone domain models
+  ${c.cyan}bonecode migrate${c.reset}                  Run database migrations
+  ${c.cyan}bonecode status${c.reset}                   Check if server is running
+  ${c.cyan}bonecode --version${c.reset}                Show version
+
+${c.bold}Options for ${c.cyan}run${c.reset}${c.bold}:${c.reset}
+  ${c.dim}-m, --model${c.reset}     Model to use (e.g. claude-sonnet-4-5, gpt-4o)
+  ${c.dim}-s, --session${c.reset}   Continue a specific session ID
+  ${c.dim}-c, --continue${c.reset}  Continue the last session
+  ${c.dim}--dir${c.reset}           Working directory (default: current directory)
+  ${c.dim}--port${c.reset}          Server port (default: 3000)
+  ${c.dim}-i, --interactive${c.reset} Stream output interactively
+
+${c.bold}Environment:${c.reset}
+  DATABASE_URL     PostgreSQL connection string
+  JWT_SECRET       JWT signing secret
+  DEFAULT_MODEL    Default LLM model
+  DEFAULT_PROVIDER Default LLM provider
+  PORT             Server port (default: 3000)
+
+${c.bold}Examples:${c.reset}
+  ${c.dim}# Start the server and open a session in the browser${c.reset}
+  bonecode
+
+  ${c.dim}# Send a one-shot prompt${c.reset}
+  bonecode run "fix the TypeScript errors in src/auth.ts"
+
+  ${c.dim}# Continue last session interactively${c.reset}
+  bonecode run -i -c
+
+  ${c.dim}# Use a specific model${c.reset}
+  bonecode run -m anthropic/claude-sonnet-4-5 "refactor the payment module"
+`);
+}
+
+// ─── Server health check ──────────────────────────────────────────────────────
+
+function checkServer(port: number): Promise<boolean> {
+  return new Promise((resolve) => {
+    const req = http.get(`http://localhost:${port}/health`, (res) => {
+      resolve(res.statusCode === 200);
+    });
+    req.on("error", () => resolve(false));
+    req.setTimeout(2000, () => { req.destroy(); resolve(false); });
+  });
+}
+
+// ─── Start server ─────────────────────────────────────────────────────────────
+
+function startServer(port: number, detached = false): Promise<void> {
+  return new Promise((resolve, reject) => {
+    const serverScript = path.join(PKG_ROOT, "src", "server.ts");
+    const tsNode = path.join(PKG_ROOT, "node_modules", ".bin", "ts-node");
+
+    const child = spawn(
+      fs.existsSync(tsNode) ? tsNode : "ts-node",
+      ["--project", path.join(PKG_ROOT, "tsconfig.json"), serverScript],
+      {
+        cwd: process.cwd(),
+        env: { ...process.env, PORT: String(port) },
+        stdio: detached ? "ignore" : ["ignore", "pipe", "pipe"],
+        detached,
+      }
+    );
+
+    if (detached) {
+      child.unref();
+      // Wait for server to be ready
+      let attempts = 0;
+      const poll = setInterval(async () => {
+        attempts++;
+        if (await checkServer(port)) {
+          clearInterval(poll);
+          resolve();
+        } else if (attempts > 30) {
+          clearInterval(poll);
+          reject(new Error("Server failed to start within 30 seconds"));
+        }
+      }, 1000);
+      return;
+    }
+
+    // Pipe server output
+    child.stdout?.on("data", (d: Buffer) => process.stdout.write(d));
+    child.stderr?.on("data", (d: Buffer) => process.stderr.write(d));
+
+    child.on("error", reject);
+    child.on("exit", (code) => {
+      if (code !== 0) reject(new Error(`Server exited with code ${code}`));
+    });
+
+    // Resolve once server is ready
+    let ready = false;
+    child.stdout?.on("data", (d: Buffer) => {
+      if (!ready && d.toString().includes("Server running on port")) {
+        ready = true;
+        resolve();
+      }
+    });
+  });
+}
+
+// ─── Ensure server is running ─────────────────────────────────────────────────
+
+async function ensureServer(port: number): Promise<void> {
+  if (await checkServer(port)) return;
+
+  process.stdout.write(`${c.dim}Starting BoneCode server on port ${port}...${c.reset} `);
+  try {
+    await startServer(port, true);
+    console.log(`${c.green}ready${c.reset}`);
+  } catch (e: any) {
+    console.log(`${c.red}failed${c.reset}`);
+    throw e;
+  }
+}
+
+// ─── Commands ─────────────────────────────────────────────────────────────────
+
+async function cmdServe(args: string[]) {
+  const port = parseInt(args.find(a => a.startsWith("--port="))?.split("=")[1] || process.env.PORT || "3000");
+  console.log(`${c.cyan}${c.bold}BoneCode${c.reset} server starting on port ${port}...`);
+  console.log(`${c.dim}  API:       http://localhost:${port}/v2/session${c.reset}`);
+  console.log(`${c.dim}  Health:    http://localhost:${port}/health${c.reset}`);
+  console.log(`${c.dim}  WebSocket: ws://localhost:${port}/ws${c.reset}`);
+  console.log(`${c.dim}  Press Ctrl+C to stop${c.reset}\n`);
+
+  // Run server in foreground (blocking)
+  const serverScript = path.join(PKG_ROOT, "src", "server.ts");
+  const tsNode = path.join(PKG_ROOT, "node_modules", ".bin", "ts-node");
+  const child = spawn(
+    fs.existsSync(tsNode) ? tsNode : "ts-node",
+    ["--project", path.join(PKG_ROOT, "tsconfig.json"), serverScript],
+    { cwd: process.cwd(), env: { ...process.env, PORT: String(port) }, stdio: "inherit" }
+  );
+  child.on("exit", (code) => process.exit(code ?? 0));
+  process.on("SIGINT", () => child.kill("SIGINT"));
+  process.on("SIGTERM", () => child.kill("SIGTERM"));
+}
+
+async function cmdRun(args: string[]) {
+  // Parse flags
+  let message = "";
+  let model = process.env.DEFAULT_MODEL;
+  let provider = process.env.DEFAULT_PROVIDER || "openai_compatible";
+  let sessionId: string | undefined;
+  let continueSession = false;
+  let interactive = false;
+  let port = parseInt(process.env.PORT || "3000");
+  let dir = process.cwd();
+
+  const positional: string[] = [];
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a === "-m" || a === "--model") { const v = args[++i]; if (v?.includes("/")) { const [p, ...m] = v.split("/"); provider = p; model = m.join("/"); } else { model = v; } }
+    else if (a.startsWith("--model=")) { const v = a.slice(8); if (v.includes("/")) { const [p, ...m] = v.split("/"); provider = p; model = m.join("/"); } else { model = v; } }
+    else if (a === "-s" || a === "--session") { sessionId = args[++i]; }
+    else if (a === "-c" || a === "--continue") { continueSession = true; }
+    else if (a === "-i" || a === "--interactive") { interactive = true; }
+    else if (a === "--port") { port = parseInt(args[++i]); }
+    else if (a.startsWith("--port=")) { port = parseInt(a.slice(7)); }
+    else if (a === "--dir") { dir = path.resolve(args[++i]); }
+    else if (!a.startsWith("-")) { positional.push(a); }
+  }
+  message = positional.join(" ");
+
+  if (!message && !interactive && !continueSession && !sessionId) {
+    console.error(`${c.red}Error:${c.reset} provide a message or use ${c.cyan}-i${c.reset} for interactive mode`);
+    console.error(`  Example: bonecode run "fix the login bug"`);
+    process.exit(1);
+  }
+
+  await ensureServer(port);
+
+  // Get JWT token for API calls
+  const jwt = require("jsonwebtoken");
+  const secret = process.env.JWT_SECRET || "bonecode-dev-secret-do-not-use-in-production-at-all-ever";
+  const token = jwt.sign({ sub: "cli-user" }, secret, { expiresIn: "1h" });
+  const headers: Record<string, string> = {
+    "Content-Type": "application/json",
+    "Authorization": `Bearer ${token}`,
+  };
+
+  const baseUrl = `http://localhost:${port}`;
+
+  // Resolve or create session
+  let sid = sessionId;
+  if (!sid && continueSession) {
+    const r = await fetch(`${baseUrl}/v2/session`, { headers });
+    const sessions = await r.json() as any[];
+    sid = sessions.find((s: any) => !s.parentID)?.id;
+  }
+  if (!sid) {
+    const r = await fetch(`${baseUrl}/v2/session`, {
+      method: "POST", headers,
+      body: JSON.stringify({ title: message.slice(0, 60) || "Interactive session", directory: dir }),
+    });
+    const sess = await r.json() as any;
+    sid = sess.id;
+    if (!sid) { console.error(`${c.red}Failed to create session${c.reset}`); process.exit(1); }
+  }
+
+  if (!message && interactive) {
+    // Interactive TUI mode
+    const jwtLib = require("jsonwebtoken");
+    const secret = process.env.JWT_SECRET || "bonecode-dev-secret-do-not-use-in-production-at-all-ever";
+    const token = jwtLib.sign({ sub: "tui-user" }, secret, { expiresIn: "24h" });
+
+    const { startInteractiveTUI } = await import("./tui");
+    await startInteractiveTUI({ port, token, model: model!, provider, worktree: dir });
+    return;
+  }
+
+  // One-shot prompt with streaming output
+  console.log(`${c.dim}Session: ${sid}${c.reset}`);
+  console.log(`${c.dim}Model:   ${provider}/${model}${c.reset}\n`);
+
+  await streamPrompt(baseUrl, sid, message, model!, provider, headers, interactive);
+}
+
+async function streamPrompt(
+  baseUrl: string, sessionId: string, message: string,
+  model: string, provider: string, headers: Record<string, string>,
+  interactive: boolean
+) {
+  const r = await fetch(`${baseUrl}/v2/session/${sessionId}/prompt`, {
+    method: "POST", headers,
+    body: JSON.stringify({ content: message, modelID: model, providerID: provider }),
+  });
+
+  if (!r.ok) {
+    console.error(`${c.red}Error:${c.reset} ${await r.text()}`);
+    process.exit(1);
+  }
+
+  // Stream SSE events
+  const reader = r.body!.getReader();
+  const decoder = new TextDecoder();
+  let buffer = "";
+  let inAssistantTurn = false;
+
+  while (true) {
+    const { value, done } = await reader.read();
+    if (done) break;
+    buffer += decoder.decode(value, { stream: true });
+
+    const lines = buffer.split("\n");
+    buffer = lines.pop() || "";
+
+    for (const line of lines) {
+      if (!line.startsWith("data: ")) continue;
+      try {
+        const event = JSON.parse(line.slice(6));
+
+        if (event.type === "part.delta" && event.delta?.type === "text") {
+          if (!inAssistantTurn) {
+            process.stdout.write(`\n${c.cyan}${c.bold}●${c.reset} `);
+            inAssistantTurn = true;
+          }
+          process.stdout.write(event.delta.text);
+        }
+
+        if (event.type === "session.retry") {
+          process.stdout.write(`\n${c.yellow}⟳ Retrying (attempt ${event.attempt}): ${event.message}${c.reset}\n`);
+        }
+
+        if (event.type === "error") {
+          process.stdout.write(`\n${c.red}✗ ${event.properties?.message || "Unknown error"}${c.reset}\n`);
+        }
+
+        if (event.type === "tool.requested") {
+          process.stdout.write(`\n${c.dim}⚙ ${event.tool_name}${c.reset}`);
+        }
+      } catch { /* non-JSON line */ }
+    }
+  }
+
+  if (inAssistantTurn) process.stdout.write("\n\n");
+
+  // Fetch and display the final stored response
+  const msgsR = await fetch(`${baseUrl}/v2/session/${sessionId}/message`, { headers });
+  const msgs = await msgsR.json() as any[];
+  const lastAssistant = msgs.filter((m: any) => m.role === "assistant").slice(-1)[0];
+  if (lastAssistant && !inAssistantTurn) {
+    const text = (lastAssistant.parts || [])
+      .filter((p: any) => p.type === "text")
+      .map((p: any) => p.data?.text || p.text || "")
+      .join("");
+    if (text.trim()) {
+      console.log(`${c.cyan}${c.bold}●${c.reset} ${text.trim()}\n`);
+    }
+  }
+}
+
+async function cmdStatus(args: string[]) {
+  const port = parseInt(args.find(a => a.startsWith("--port="))?.split("=")[1] || process.env.PORT || "3000");
+  const running = await checkServer(port);
+
+  if (running) {
+    console.log(`${c.green}${c.bold}●${c.reset} BoneCode server is ${c.green}running${c.reset} on port ${port}`);
+    console.log(`  ${c.dim}http://localhost:${port}/health${c.reset}`);
+  } else {
+    console.log(`${c.red}${c.bold}●${c.reset} BoneCode server is ${c.red}not running${c.reset}`);
+    console.log(`  ${c.dim}Start with: bonecode serve${c.reset}`);
+  }
+}
+
+async function cmdCompile() {
+  console.log(`${c.cyan}Compiling .bone files...${c.reset}`);
+  try {
+    execSync(`node --max-old-space-size=512 ${path.join(PKG_ROOT, "scripts", "compile.js")}`, {
+      cwd: PKG_ROOT, stdio: "inherit",
+    });
+  } catch {
+    process.exit(1);
+  }
+}
+
+async function cmdMigrate() {
+  console.log(`${c.cyan}Running migrations...${c.reset}`);
+  try {
+    execSync(`node --max-old-space-size=256 ${path.join(PKG_ROOT, "scripts", "migrate.js")}`, {
+      cwd: PKG_ROOT, stdio: "inherit",
+      env: { ...process.env },
+    });
+  } catch {
+    process.exit(1);
+  }
+}
+
+async function cmdDefault() {
+  // Default: start server (if not running) then launch the interactive TUI
+  const port = parseInt(process.env.PORT || "3000");
+  const model = process.env.DEFAULT_MODEL || "local-model";
+  const provider = process.env.DEFAULT_PROVIDER || "openai_compatible";
+  const worktree = process.cwd();
+
+  // Generate JWT for API calls
+  const jwtLib = require("jsonwebtoken");
+  const secret = process.env.JWT_SECRET || "bonecode-dev-secret-do-not-use-in-production-at-all-ever";
+  const token = jwtLib.sign({ sub: "tui-user" }, secret, { expiresIn: "24h" });
+
+  // Start server in background if not already running
+  const running = await checkServer(port);
+  if (!running) {
+    process.stdout.write(`${c.dim}Starting BoneCode server on port ${port}...${c.reset} `);
+    try {
+      await startServer(port, true);
+      console.log(`${c.green}ready${c.reset}`);
+    } catch (e: any) {
+      console.error(`\n${c.red}Failed to start server:${c.reset} ${e.message}`);
+      console.error(`${c.dim}Try: bonecode serve${c.reset}`);
+      process.exit(1);
+    }
+  }
+
+  // Launch the interactive TUI
+  const { startInteractiveTUI } = await import("./tui");
+  await startInteractiveTUI({ port, token, model, provider, worktree });
+}
+
+// ─── Main ─────────────────────────────────────────────────────────────────────
+
+async function main() {
+  const args = process.argv.slice(2);
+  const cmd = args[0];
+
+  if (cmd === "--version" || cmd === "-v") {
+    console.log(`bonecode v${VERSION}`);
+    return;
+  }
+
+  if (cmd === "--help" || cmd === "-h" || cmd === "help") {
+    help();
+    return;
+  }
+
+  switch (cmd) {
+    case "serve":
+      await cmdServe(args.slice(1));
+      break;
+    case "run":
+      await cmdRun(args.slice(1));
+      break;
+    case "status":
+      await cmdStatus(args.slice(1));
+      break;
+    case "compile":
+      await cmdCompile();
+      break;
+    case "migrate":
+      await cmdMigrate();
+      break;
+    default:
+      if (cmd && !cmd.startsWith("-")) {
+        // Treat unknown first arg as a message to `run`
+        await cmdRun(args);
+      } else {
+        await cmdDefault();
+      }
+  }
+}
+
+main().catch((e) => {
+  console.error(`${c.red}Error:${c.reset} ${e.message}`);
+  process.exit(1);
+});

package/src/config.ts

@@ -0,0 +1,162 @@
+/**
+ * BoneCode Configuration System
+ *
+ * Loads config from (in order of precedence, highest last wins):
+ *   1. Built-in defaults
+ *   2. ~/.config/bonecode/config.json  (user-level)
+ *   3. <project>/.bonecode/config.json (project-level)
+ *   4. Environment variables
+ *
+ * Compatible with OpenCode's config format so existing opencode.json files
+ * are recognized.
+ */
+
+import * as fs from "fs";
+import * as path from "path";
+import * as os from "os";
+
+export interface BoneCodeConfig {
+  port: number;
+  databaseUrl: string;
+  jwtSecret: string;
+  allowedOrigins: string[];
+  requestTimeoutMs: number;
+  eventMode: "in_process" | "durable";
+  eventWorkerIntervalMs: number;
+  defaultModel: string;
+  defaultProvider: string;
+  // Embeddings — all optional. When embeddingProvider is unset, structural
+  // context only (FTS + git + imports). When set, hybrid search is enabled.
+  embeddingProvider: string | null;
+  embeddingModel: string;
+  embeddingDimensions: number;
+  ragChunkStrategy: string;
+  ragChunkSize: number;
+  ragChunkOverlap: number;
+  ragWorkerIntervalMs: number;
+  mcpServers: MCPServerConfig[];
+  logLevel: "debug" | "info" | "warn" | "error";
+}
+
+/** Returns true when an embedding provider is configured in .env */
+export function embeddingsEnabled(cfg?: BoneCodeConfig): boolean {
+  const provider = cfg?.embeddingProvider ?? process.env.EMBEDDING_PROVIDER;
+  return !!(provider && provider !== "none" && provider !== "");
+}
+
+export interface MCPServerConfig {
+  name: string;
+  command: string;
+  args: string[];
+  env?: Record<string, string>;
+  transport: "stdio" | "http";
+  url?: string;
+}
+
+const DEFAULTS: BoneCodeConfig = {
+  port: 3000,
+  databaseUrl: "postgresql://postgres:postgres@localhost:5432/bonecode",
+  jwtSecret: "",
+  allowedOrigins: [],
+  requestTimeoutMs: 30_000,
+  eventMode: "in_process",
+  eventWorkerIntervalMs: 1_000,
+  defaultModel: "claude-sonnet-4-5",
+  defaultProvider: "anthropic",
+  // Embeddings default to null — structural context only
+  embeddingProvider: null,
+  embeddingModel: "text-embedding-3-small",
+  embeddingDimensions: 1536,
+  ragChunkStrategy: "ast",
+  ragChunkSize: 1500,
+  ragChunkOverlap: 150,
+  ragWorkerIntervalMs: 2_000,
+  mcpServers: [],
+  logLevel: "info",
+};
+
+function readJsonFile(filePath: string): Partial<BoneCodeConfig> {
+  try {
+    if (fs.existsSync(filePath)) {
+      const raw = fs.readFileSync(filePath, "utf-8");
+      return JSON.parse(raw);
+    }
+  } catch {
+    // Ignore malformed config files
+  }
+  return {};
+}
+
+function fromEnv(): Partial<BoneCodeConfig> {
+  const cfg: Partial<BoneCodeConfig> = {};
+  if (process.env.PORT) cfg.port = parseInt(process.env.PORT);
+  if (process.env.DATABASE_URL) cfg.databaseUrl = process.env.DATABASE_URL;
+  if (process.env.JWT_SECRET) cfg.jwtSecret = process.env.JWT_SECRET;
+  if (process.env.ALLOWED_ORIGINS) {
+    cfg.allowedOrigins = process.env.ALLOWED_ORIGINS.split(",").map(s => s.trim()).filter(Boolean);
+  }
+  if (process.env.REQUEST_TIMEOUT_MS) cfg.requestTimeoutMs = parseInt(process.env.REQUEST_TIMEOUT_MS);
+  if (process.env.EVENT_MODE) cfg.eventMode = process.env.EVENT_MODE as any;
+  if (process.env.EVENT_WORKER_INTERVAL_MS) cfg.eventWorkerIntervalMs = parseInt(process.env.EVENT_WORKER_INTERVAL_MS);
+  if (process.env.DEFAULT_MODEL) cfg.defaultModel = process.env.DEFAULT_MODEL;
+  if (process.env.DEFAULT_PROVIDER) cfg.defaultProvider = process.env.DEFAULT_PROVIDER;
+  if (process.env.EMBEDDING_PROVIDER) cfg.embeddingProvider = process.env.EMBEDDING_PROVIDER;
+  if (process.env.EMBEDDING_MODEL) cfg.embeddingModel = process.env.EMBEDDING_MODEL;
+  if (process.env.EMBEDDING_DIMENSIONS) cfg.embeddingDimensions = parseInt(process.env.EMBEDDING_DIMENSIONS);
+  if (process.env.RAG_CHUNK_STRATEGY) cfg.ragChunkStrategy = process.env.RAG_CHUNK_STRATEGY;
+  if (process.env.RAG_CHUNK_SIZE) cfg.ragChunkSize = parseInt(process.env.RAG_CHUNK_SIZE);
+  if (process.env.RAG_CHUNK_OVERLAP) cfg.ragChunkOverlap = parseInt(process.env.RAG_CHUNK_OVERLAP);
+  if (process.env.RAG_WORKER_INTERVAL_MS) cfg.ragWorkerIntervalMs = parseInt(process.env.RAG_WORKER_INTERVAL_MS);
+  if (process.env.LOG_LEVEL) cfg.logLevel = process.env.LOG_LEVEL as any;
+  return cfg;
+}
+
+let _config: BoneCodeConfig | null = null;
+
+export function loadConfig(): BoneCodeConfig {
+  if (_config) return _config;
+
+  // Layer 1: defaults
+  const merged: BoneCodeConfig = { ...DEFAULTS };
+
+  // Layer 2: user-level config (~/.config/bonecode/config.json or opencode.json)
+  const userConfigPaths = [
+    path.join(os.homedir(), ".config", "bonecode", "config.json"),
+    path.join(os.homedir(), ".config", "opencode", "config.json"),
+    path.join(os.homedir(), ".local", "share", "opencode", "config.json"),
+  ];
+  for (const p of userConfigPaths) {
+    Object.assign(merged, readJsonFile(p));
+  }
+
+  // Layer 3: project-level config (.bonecode/config.json or opencode.json)
+  const projectConfigPaths = [
+    path.join(process.cwd(), ".bonecode", "config.json"),
+    path.join(process.cwd(), "opencode.json"),
+    path.join(process.cwd(), ".opencode", "config.json"),
+  ];
+  for (const p of projectConfigPaths) {
+    Object.assign(merged, readJsonFile(p));
+  }
+
+  // Layer 4: environment variables (highest precedence)
+  Object.assign(merged, fromEnv());
+
+  // Validate required fields in production
+  if (process.env.NODE_ENV === "production") {
+    if (!merged.jwtSecret || merged.jwtSecret.length < 32) {
+      console.error("[FATAL] JWT_SECRET must be set and at least 32 characters in production.");
+      process.exit(1);
+    }
+  } else if (!merged.jwtSecret) {
+    console.warn("[WARN] JWT_SECRET not set. Using insecure default — do not use in production.");
+    merged.jwtSecret = "bonecode-dev-secret-do-not-use-in-production";
+  }
+
+  _config = merged;
+  return merged;
+}
+
+export function getConfig(): BoneCodeConfig {
+  return _config || loadConfig();
+}