mercury-agent 0.4.28 → 0.5.0

package/docs/ARCHITECTURE.md

@@ -28,3 +28,7 @@
 ## Extension Points
 
 > Where the system is designed to be extended — plugin interfaces, hook points, configuration surfaces.
+
+- **Applicative profiles** (`src/core/profiles.ts`) — a `mercury-profile.yaml` declares `capabilities`, an exhaustive `member_permissions` set, and a `system_prompt`. `applyProfile` validates capabilities and persists `.mercury/active-profile.json`; `main.ts` activates it at startup (project-wide). Member permission scoping is in `getRolePermissions` (`src/core/permissions.ts`). Authoring contract: `docs/authoring-profiles.md`.
+- **Host-side capability broker** — extensions register `mercury.capability(name, handler)` (`src/extensions/types.ts`, `api.ts`); the agent invokes them from the container via `mrctl capability <name> <action>` → `POST /api/capability/:name/:action` (`src/core/routes/capability.ts`). Handlers run on the host with credentials that never enter the container; identity is the token-derived caller.
+- **Caller-bound capability token** (`src/core/caller-token.ts`) — per-turn HMAC token minted at container spawn, made authoritative over spoofable identity headers in the control-plane API auth middleware (`src/core/api.ts`).

package/docs/ROADMAP.md

@@ -10,7 +10,7 @@ Single source of truth for priority. Rule: ≤15 min/week to maintain.
 
 | Item | Doc | Notes |
 |------|-----|-------|
-| **business-extensions** | [doc](ideas/business-extensions.md) | Dedicated business extensions wrapping raw capabilities with deterministic logic |
+| — | — | — |
 
 ## Now
 

package/docs/{backlog/applicative-profiles.md → archive/2026-07-01-applicative-profiles.md}

@@ -1,6 +1,6 @@
 # Applicative Profiles
 
-**Status**: Backlog
+**Status**: Done
 **Slug**: applicative-profiles
 **Created**: 2026-07-01
 **Last updated**: 2026-07-01
@@ -70,7 +70,7 @@ Therefore **any credential injected into a customer's container is readable by t
 | 1. Profile schema + permission scoping | `mercury-public` | New `mercury-profile.yaml` fields; profile-aware member permissions |
 | 2. Host-side capability broker | `mercury-public` | Profile capabilities run host-side via `mrctl`→API, à la TradeStation; secrets stay on host |
 | 3. Per-turn caller token | `mercury-public` | [[caller-bound-capability-token]] — trustworthy `callerId` on the host (dependency) |
-| 4. Barber business logic | **private profiles repo** | Availability, 2 barbers, per-number limits, ownership rules — the moat |
+| 4. Barber business logic | **private repo** `tagula-agents/tagula-agent-profiles` | Availability, 2 barbers, per-number limits, ownership rules — the moat |
 
 ### Part 1 — Schema + permission scoping
 
@@ -115,7 +115,7 @@ The broker's ownership checks require a `callerId` the customer cannot forge. To
 
 ### Part 4 — Barber business logic (private repo)
 
-Lives in `tagula-agent-profiles` (or similar). Contains the `mercury-profile.yaml`, the agent persona, and the host-side route implementations' business rules (availability windows, 2-barber scheduling, per-number booking limits, double-booking prevention). Consumes Parts 1-3 as the public contract; never touches `mercury-public`.
+Lives in the private monorepo `Avishai-tsabari/tagula-agents` (`c:/code/agentic/tagula-agents`), under `tagula-agent-profiles/` (the repo also holds the cloud console). Checked out as a sibling of `mercury-public`. Contains the `mercury-profile.yaml`, the agent persona, and the host-side route implementations' business rules (availability windows, 2-barber scheduling, per-number booking limits, double-booking prevention). Consumes Parts 1-3 as the public contract; never touches `mercury-public`.
 
 ### Example manifest (in the private repo)
 
@@ -217,14 +217,15 @@ defaults:
 - [x] Context for Claude pointers filled in
 
 ### Implementation
-- [ ] Step 1 — Extend profile schema
-- [ ] Step 2 — Capability validation
-- [ ] Step 3 — Activation + config
-- [ ] Step 4 — Profile-aware permissions
-- [ ] Step 5 — Caller token dependency ([[caller-bound-capability-token]])
-- [ ] Step 6 — Broker route pattern (mirror `tradestation.ts`)
-- [ ] Step 7 — Tests
-- [ ] Step 8 — Example config
+- [x] Step 1 — Extend profile schema (`capabilities`, `member_permissions`, `system_prompt`); swapped hand-rolled `parseSimpleYaml` for the `yaml` lib (multiline `system_prompt` support, less fragility)
+- [x] Step 2 — Capability validation (`validateProfileCapabilities`, called in `applyProfile`); tests in `tests/applicative-profiles.test.ts`
+- [x] Step 3 — Activation + config: `profile` config key; `applyProfile` persists `.mercury/active-profile.json`; `main.ts` reads it at startup (after extensions load) and calls `setActiveProfileMemberPermissions`
+- [x] Step 4 — Profile-aware permissions: `getRolePermissions` uses the active profile's member set as exhaustive; precedence = explicit per-space override > profile > defaults; admin/system unaffected
+- [x] Step 5 — Caller token dependency ([[caller-bound-capability-token]]) — implemented and committed
+- [x] Step 5b — Inject `system_prompt` at container spawn (appended to `MERCURY_EXT_SYSTEM_PROMPT` in `runtime.ts`, ahead of per-space prompt)
+- [x] Step 6 — Host-side capability broker: `mercury.capability(name, handler)` extension API; `POST /api/capability/:name/:action` route (auth = token-derived caller, authz = permission named after the capability); `registry.getCapability`; `mrctl capability <name> <action> [json]`
+- [x] Step 7 — Tests: `tests/api.test.ts` capability broker (dispatch with token-derived caller; permission-denied → 403) + schema/scoping tests in `tests/applicative-profiles.test.ts`
+- [x] Step 8 — Example config: profile + `mrctl capability` + `MERCURY_CALLER_TOKEN_KEY` notes in `mercury.example.yaml`
 - [ ] `bun run check` passes
 - [ ] No secrets or `.env` files committed
 - [ ] No unrelated files modified
@@ -243,17 +244,27 @@ defaults:
 ## Retrospective
 
 **Residual risks / follow-ups:**
-- Per-turn caller token is a hard dependency for safe ownership → backlog/caller-bound-capability-token.md
-- Barber business logic tracked in the private profiles repo (out of this repo's scope) — accepted
+- Barber business logic (availability, 2-barber, per-number limits) lives in the private `tagula-agents` repo — out of this repo's scope — accepted
+- Ephemeral caller-token key breaks `mrctl` if the API and container-runner ever run in separate processes without `MERCURY_CALLER_TOKEN_KEY` set; documented in config + `docs/authoring-profiles.md` — accepted
+- `mrctl capability <name>/<action>` are not URL-encoded (path traversal only reaches other RBAC-guarded routes, no escalation) — accepted
+- Duplicate capability-name registration across two extensions silently first-wins in `registry.getCapability` — accepted
+- Empty `member_permissions: []` in a manifest gives members zero permissions (author's explicit exhaustive choice) — accepted
 
 **What changed from the plan:**
-- ...
+- Signing key is NOT derived from `API_SECRET` (the plan's fallback) — `API_SECRET` is readable in the container, so an ephemeral host-only random key is used instead (config `callerTokenKey` for multi-process).
+- Caller token split into its own delivered dependency (`caller-bound-capability-token`) — also hardened TradeStation, which reads identity from the same auth context (no code change needed there).
+- Replaced the hand-rolled `parseSimpleYaml` in `profiles.ts` with the `yaml` lib (multiline `system_prompt` support + less fragility); built-in profiles still parse.
+- Profile activation is project-wide via a module-level registry + persisted `.mercury/active-profile.json`, not per-space `space_config` writes (simpler, works for later-created dm-auto-space spaces).
+- Broker registration model chosen with the user: generic `mercury.capability(name, handler)` + `POST /api/capability/:name/:action` + `mrctl capability`, authorized by the permission named after the capability.
+- Added `docs/authoring-profiles.md` as the contract for the external profiles repo.
 
 **Key decisions made during implementation:**
-- ...
+- Token = HMAC-SHA256 over `base64url(payload).base64url(sig)`, constant-time compare with length guard; TTL = container timeout + 60s.
+- `getRolePermissions` uses `Array.isArray` (not `!== null`) on the active-profile member set so a malformed `active-profile.json` falls back to defaults instead of throwing in the hot path (found in session review).
+- Profile schema uses plain `z.object` (no `.strict()`), so unknown manifest keys are stripped, honoring the `2026-07-01-strict-yaml-schema-crash` post-mortem (warn/ignore unknown keys, fail only on invalid values); startup `loadActiveProfile` is try/catch → null.
 
 **Architecture impact** (update `docs/ARCHITECTURE.md` if any of these apply):
-- [ ] New package/module added
-- [ ] New data model or schema change
-- [ ] New inter-package interaction
+- [x] New package/module added — `src/core/caller-token.ts`, `src/core/routes/capability.ts`
+- [ ] New data model or schema change (uses existing `space_config`; adds a local `.mercury/active-profile.json` file, no DB schema change)
+- [x] New inter-package interaction — extension host-side capability handlers invoked via the control-plane API
 - [ ] Deployment topology changed

package/docs/{backlog/caller-bound-capability-token.md → archive/2026-07-01-caller-bound-capability-token.md}

@@ -1,6 +1,6 @@
 # Caller-Bound Capability Token
 
-**Status**: Backlog
+**Status**: Done
 **Slug**: caller-bound-capability-token
 **Created**: 2026-07-01
 **Last updated**: 2026-07-01
@@ -144,14 +144,14 @@ The signing key never enters the container. The container holds only its **own**
 - [x] Context for Claude pointers filled in
 
 ### Implementation
-- [ ] Step 1 — Token helpers
-- [ ] Step 2 — Mint at spawn
-- [ ] Step 3 — Forward in mrctl
-- [ ] Step 4 — Verify host-side
-- [ ] Step 5 — Migrate TradeStation guard
-- [ ] Step 6 — Tests
-- [ ] `bun run check` passes
-- [ ] No secrets committed
+- [x] Step 1 — Token helpers (`src/core/caller-token.ts`)
+- [x] Step 2 — Mint at spawn (`container-runner.ts`; key added to `BLOCKED_ENV_VARS`)
+- [x] Step 3 — Forward in mrctl (`x-mercury-token` header)
+- [x] Step 4 — Verify host-side (`api.ts` middleware; token identity wins)
+- [x] Step 5 — TradeStation guard: **no change needed** — it reads `c.get("auth")`, which now derives from the token
+- [x] Step 6 — Tests (`tests/caller-token.test.ts` unit; `tests/api.test.ts` integration: token overrides spoofed header, invalid token → 401)
+- [x] `bun run check` passes (one unrelated discord-adapter timeout flake under full parallel run; passes in isolation)
+- [x] No secrets committed
 
 ---
 
@@ -168,10 +168,14 @@ The signing key never enters the container. The container holds only its **own**
 - none
 
 **What changed from the plan:**
-- ...
+- **Signing key is NOT derived from `API_SECRET`.** The plan suggested deriving it when unset, but `API_SECRET` is injected into containers — the agent could recompute the key and forge tokens. Instead: an optional host-only `callerTokenKey` (env `MERCURY_CALLER_TOKEN_KEY`, in `BLOCKED_ENV_VARS`), falling back to an **ephemeral random key** generated once per host process. Zero required config; nothing forgeable from inside the container.
+- **TradeStation guard needed no code change** — it already reads identity from `c.get("auth")`, which the middleware now sets from the token.
+- Token injected as container env `CALLER_TOKEN` (unprefixed, like `CALLER_ID`/`API_SECRET`), forwarded as `x-mercury-token`.
 
 **Key decisions made during implementation:**
-- ...
+- HMAC-SHA256 over `base64url(payload).base64url(sig)`, payload `{c,s,exp}`; constant-time compare; no new dependency (`node:crypto`).
+- TTL = container timeout + 60s buffer, so a token never expires mid-turn but stays short-lived vs the permanent shared secret.
+- Header path retained as fallback → fully backward compatible; existing header-based tests and old container images keep working.
 
 **Architecture impact:**
 - [ ] New package/module added

package/docs/authoring-profiles.md

@@ -0,0 +1,174 @@
+# Authoring Applicative Profiles
+
+The contract for building a **profile** — a package of deterministic business
+logic that wraps raw capabilities (Calendar, email, …) and scopes what members
+can do. Mercury (this repo) provides the schema, loader, permission scoping, and
+the host-side capability broker; **profiles live in a separate repo** and depend
+only on this contract.
+
+> Layers: **Mercury** = platform (messaging, spaces, permissions, tokens,
+> broker). **Capability extensions** = raw API access (e.g. `gws`), admin-only.
+> **Profiles** = deterministic domain logic wrapping capabilities, member-facing.
+
+## 1. Profile manifest — `mercury-profile.yaml`
+
+```yaml
+name: barber-appointments            # lowercase-kebab; required
+description: Appointment booking for a barber shop
+version: 0.1.0
+
+agents_md: ./AGENTS.md               # optional; copied to the global AGENTS.md
+
+# Raw capability extensions this profile requires to be installed. Validated at
+# apply time — activation fails loudly if any are missing.
+capabilities:
+  - gws
+
+# Extensions this profile ships (copied into .mercury/extensions).
+extensions:
+  - name: barber
+    source: ./extensions/barber
+
+# EXHAUSTIVE member permission set while active. When present it REPLACES the
+# default member permissions — nothing is merged in — so raw capabilities stay
+# admin-only unless listed here. Omit entirely to keep built-in defaults.
+member_permissions:
+  - prompt
+  - prefs.get
+  - barber                           # the profile's own capability, NOT gws
+
+# Optional env the profile needs (host-side credentials for capabilities).
+env:
+  - key: MERCURY_BARBER_BUSINESS_HOURS
+    description: "Business hours"
+    default: "09:00-18:00"
+
+# Project-wide agent persona, injected into every container's system prompt.
+system_prompt: |
+  You are a barber shop assistant. Help each customer book, view, and cancel
+  ONLY their own appointments. Never reveal other customers' schedules.
+
+defaults:
+  trigger_patterns: always
+```
+
+Apply it with `mercury profile apply <name|path|git-url>`. That validates
+capabilities, copies extensions/AGENTS.md, and persists activation to
+`.mercury/active-profile.json`, which Mercury loads at startup.
+
+## 2. The capability broker (where the business logic runs)
+
+A profile's privileged work runs **on the host**, so credentials never enter the
+customer-controlled agent container. The profile's extension registers a
+handler; the agent invokes it through a thin CLI.
+
+### Register a handler (in the extension's `index.ts`)
+
+```ts
+import type { ExtensionSetupFn } from "mercury-agent"; // types from this repo
+
+const setup: ExtensionSetupFn = (mercury) => {
+  // Make the capability gate-able. Members get it via member_permissions.
+  mercury.permission({ defaultRoles: [] });
+
+  // Host-side credentials for the wrapped capability (never sent to the container).
+  mercury.env({ from: "MERCURY_BARBER_GOOGLE_CREDENTIALS" });
+
+  mercury.capability("barber", async (req, ctx) => {
+    // req.callerId is the TOKEN-DERIVED, unspoofable caller — safe for ownership.
+    switch (req.action) {
+      case "availability":
+        return { data: await listOpenSlots(req.body, ctx) };
+      case "book":
+        return { data: await book(req.callerId, req.body, ctx) };
+      case "cancel":
+        return { data: await cancelOwn(req.callerId, req.body, ctx) };
+      case "my-appointments":
+        return { data: await listOwn(req.callerId, ctx) };
+      default:
+        return { status: 400, data: { error: `unknown action: ${req.action}` } };
+    }
+  });
+};
+
+export default setup;
+```
+
+### The contract types (exported from this repo)
+
+```ts
+type CapabilityHandler = (
+  req: CapabilityRequest,
+  ctx: MercuryExtensionContext,
+) => Promise<CapabilityResult>;
+
+interface CapabilityRequest {
+  name: string;      // capability name
+  action: string;    // sub-action (book, cancel, …)
+  callerId: string;  // token-derived, TRUSTWORTHY — use for ownership checks
+  spaceId: string;
+  body: unknown;     // parsed JSON request body (or null)
+}
+
+interface CapabilityResult {
+  status?: number;   // default 200
+  data: unknown;     // JSON-serializable response
+}
+```
+
+`ctx` (`MercuryExtensionContext`) gives you `db`, `config`, `log`, and
+`hasCallerPermission(spaceId, callerId, permission)`. Store per-profile state via
+`mercury.store` (namespaced KV) or your own tables through `ctx.db`.
+
+### How the agent invokes it
+
+Inside the container the agent runs:
+
+```
+mrctl capability barber book '{"slot":"2026-07-02T15:00"}'
+```
+
+→ `POST /api/capability/barber/book`. Document these commands for the agent in
+the extension's `SKILL.md` or the profile's `AGENTS.md`.
+
+## 3. Permission & security model (non-negotiable)
+
+- **`member_permissions` is exhaustive.** List every permission a member may
+  hold, including the capability name (e.g. `barber`). Anything not listed —
+  including raw capabilities like `gws` — is unavailable to members.
+- **Authorization = permission named after the capability.** The broker route
+  requires the caller to hold the `<name>` permission; the same grant gates both
+  the `mrctl capability <name> …` CLI and the route. Keep capability name ==
+  permission name == the entry in `member_permissions`.
+- **Credentials stay on the host.** Put capability credentials in host env
+  (`mercury.env`) / `mercury.store` and use them only inside the handler. Never
+  expose a raw capability CLI (e.g. `gws`) to members — its secret would be
+  readable inside the container.
+- **Enforce ownership with `req.callerId`.** It is token-derived and cannot be
+  spoofed by the container. Never trust an id passed in `req.body`.
+- **`callerId === "system"`** for scheduled/system runs — handle it explicitly
+  (e.g. skip per-customer ownership).
+
+## 4. Suggested profile repo layout
+
+```
+<profile-repo>/
+  barber/                      # one folder per profile
+    mercury-profile.yaml
+    AGENTS.md
+    extensions/
+      barber/
+        index.ts               # registers permission + capability
+        package.json
+```
+
+Depend on this repo (`mercury-agent`) for the types
+(`ExtensionSetupFn`, `CapabilityRequest`, `CapabilityResult`,
+`MercuryExtensionContext`). See `src/extensions/types.ts` for the full surface.
+
+## 5. Local test loop
+
+1. `mercury profile apply ./barber`
+2. `mercury service install` (builds the derived image with the extension CLI)
+3. DM the bot as a non-admin number; confirm you can `book`/`cancel` only your
+   own appointments and cannot reach `gws`/Gmail.

package/docs/pending-updates/applicative-profiles.md

@@ -0,0 +1,15 @@
+---
+slug: applicative-profiles
+shipped: 2026-07-01
+---
+
+## ROADMAP changes
+
+**Remove from:** Next (table row where Item = applicative-profiles)
+
+**Also pull:** none
+
+**Add to Shipped table** (insert at top, after header row):
+| **applicative-profiles** | 2026-07-01 | Generic profile layer: manifest schema, exhaustive member scoping, host-side capability broker |
+
+**Milestone Map:** none

package/docs/pending-updates/caller-bound-capability-token.md

@@ -0,0 +1,15 @@
+---
+slug: caller-bound-capability-token
+shipped: 2026-07-01
+---
+
+## ROADMAP changes
+
+**Remove from:** Next (table row where Item = caller-bound-capability-token)
+
+**Also pull:** none
+
+**Add to Shipped table** (insert at top, after header row):
+| **caller-bound-capability-token** | 2026-07-01 | Per-turn unspoofable caller token for host API auth; also hardens TradeStation |
+
+**Milestone Map:** none

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mercury-agent",
-  "version": "0.4.28",
+  "version": "0.5.0",
   "description": "Personal AI assistant for chat platforms (WhatsApp, Slack, Discord, Telegram)",
   "license": "MIT",
   "author": "Avishai Tsabari",

package/resources/templates/mercury.example.yaml

@@ -1,84 +1,99 @@
-# Copy to mercury.yaml in your project root (optional).
-# Precedence: MERCURY_* env vars override this file when the env key is set.
-# Secrets (API keys, tokens, MERCURY_API_SECRET, etc.) belong in .env only — not here.
-
-# server:
-#   port: 8787
-#   bot_username: mercury
-
-# model:
-#   chain:
-#     - provider: anthropic
-#       model: claude-sonnet-4-20250514
-#   # Legacy single primary + optional fallback (when chain is omitted):
-#   # provider: anthropic
-#   # model: claude-sonnet-4-20250514
-#   # fallback_provider: openai
-#   # fallback: gpt-4o-mini
-#   # max_retries_per_leg: 2
-#   # chain_budget_ms: 120000
-#   # capabilities: { tools: false }
-
-# Top-level alias for model.chain (optional; model.chain wins if both are set):
-# model_chain:
-#   - provider: google
-#     model: gemini-2.5-flash
-
-# ingress:
-#   discord: false
-#   slack: false
-#   teams: false
-#   whatsapp: false
-#   telegram: false
-
-# runtime:
-#   data_dir: .mercury
-#   # auth_path: ...
-#   # whatsapp_auth_dir: .mercury/whatsapp-auth
-#   max_concurrency: 2
-#   log_level: info
-#   log_format: text
-#   rate_limit_per_user: 10
-#   rate_limit_window_ms: 60000
-#   rate_limit_daily_member: 0     # 0 = unlimited; global daily message cap for members
-#   rate_limit_daily_admin: 0      # 0 = unlimited; global daily message cap for admins
-
-# trigger:
-#   patterns: "@Mercury,Mercury"
-#   match: mention
-
-# conditional_context:
-#   enabled: true
-#   classifier: heuristic
-#   # classifier_provider: groq
-#   # classifier_model: llama-3.3-70b-versatile
-
-# compaction:
-#   keep_recent_tokens: 20000
-#   # After each full-session run, auto-compact if the pi session has more than this many entries (10–10000). Omit to disable.
-#   # auto_compact_threshold: 50
-
-# agent:
-#   image: ghcr.io/avishai-tsabari/mercury-agent:latest
-#   container_timeout_ms: 300000
-#   container_bwrap_docker_compat: false
-
-# discord:
-#   gateway_duration_ms: 600000
-
-# telegram:
-#   format_enabled: true
-
-# media:
-#   enabled: true
-#   max_size_mb: 10
-
-# permissions:
-#   admins: ""
-
-# dm_auto_space:
-#   enabled: false
-#   admin_ids:                              # auto-link to "main" space
-#     - "972501234567"
-#   default_system_prompt: ""                   # seeded into auto-created customer spaces
-#   default_member_permissions: "prompt,prefs.get"  # restrict customers to chat only
+# Copy to mercury.yaml in your project root (optional).
+# Precedence: MERCURY_* env vars override this file when the env key is set.
+# Secrets (API keys, tokens, MERCURY_API_SECRET, etc.) belong in .env only — not here.
+
+# server:
+#   port: 8787
+#   bot_username: mercury
+
+# model:
+#   chain:
+#     - provider: anthropic
+#       model: claude-sonnet-4-20250514
+#   # Legacy single primary + optional fallback (when chain is omitted):
+#   # provider: anthropic
+#   # model: claude-sonnet-4-20250514
+#   # fallback_provider: openai
+#   # fallback: gpt-4o-mini
+#   # max_retries_per_leg: 2
+#   # chain_budget_ms: 120000
+#   # capabilities: { tools: false }
+
+# Top-level alias for model.chain (optional; model.chain wins if both are set):
+# model_chain:
+#   - provider: google
+#     model: gemini-2.5-flash
+
+# ingress:
+#   discord: false
+#   slack: false
+#   teams: false
+#   whatsapp: false
+#   telegram: false
+
+# runtime:
+#   data_dir: .mercury
+#   # auth_path: ...
+#   # whatsapp_auth_dir: .mercury/whatsapp-auth
+#   max_concurrency: 2
+#   log_level: info
+#   log_format: text
+#   rate_limit_per_user: 10
+#   rate_limit_window_ms: 60000
+#   rate_limit_daily_member: 0     # 0 = unlimited; global daily message cap for members
+#   rate_limit_daily_admin: 0      # 0 = unlimited; global daily message cap for admins
+
+# trigger:
+#   patterns: "@Mercury,Mercury"
+#   match: mention
+
+# conditional_context:
+#   enabled: true
+#   classifier: heuristic
+#   # classifier_provider: groq
+#   # classifier_model: llama-3.3-70b-versatile
+
+# compaction:
+#   keep_recent_tokens: 20000
+#   # After each full-session run, auto-compact if the pi session has more than this many entries (10–10000). Omit to disable.
+#   # auto_compact_threshold: 50
+
+# agent:
+#   image: ghcr.io/avishai-tsabari/mercury-agent:latest
+#   container_timeout_ms: 300000
+#   container_bwrap_docker_compat: false
+
+# discord:
+#   gateway_duration_ms: 600000
+
+# telegram:
+#   format_enabled: true
+
+# media:
+#   enabled: true
+#   max_size_mb: 10
+
+# permissions:
+#   admins: ""
+
+# dm_auto_space:
+#   enabled: false
+#   admin_ids:                              # auto-link to "main" space
+#     - "972501234567"
+#   default_system_prompt: ""                   # seeded into auto-created customer spaces
+#   default_member_permissions: "prompt,prefs.get"  # restrict customers to chat only
+
+# ─── Applicative profile ────────────────────────────────────────────────────
+# A profile wraps raw capabilities with deterministic business logic and scopes
+# what members may do. Apply one with `mercury profile apply <name|path|git-url>`
+# (it persists to .mercury/active-profile.json and is loaded at startup).
+# The active profile's member_permissions become the EXHAUSTIVE member set, and
+# its capabilities run host-side via `mrctl capability <name> <action>` so
+# credentials never enter the agent container.
+#
+# Env-only override of the active profile name (informational):
+#   MERCURY_PROFILE=barber-appointments
+#
+# Host-only signing key for per-turn caller tokens (auto-generated if unset;
+# only set when the API and container-runner run in separate processes):
+#   MERCURY_CALLER_TOKEN_KEY=<random-secret>