{"repo": "caic-xyz/caic", "files": {"contrib/config.toml": {"e364e4036d74cbec468d90e7065e3dfdb7b85616": {"t": 1785745323.9829369, "n": 8264, "h": "b1e0c524c92021e6", "c": "# caic configuration\n# Copy to ~/.config/caic/config.toml and edit as needed.\n\n# ── Core ─────────────────────────────────────────────────────────────────────\n\n[core]\n# Parent directory containing the git repositories managed by caic.\n#root = \".\"\n\n# Auto-update schedule (cron expression, local time). Checks GitHub Releases and\n# replaces the binary on a match. Unset = daily at 04:50; \"\" disables.\n# e.g. auto_update = \"50 4 * * *\"\n\n# Environment variables added to those inherited by the server process. Each key\n# falls back to the host environment when omitted here.\n[core.env]\n# Tailscale API key: required for Tailscale ephemeral node.\n# Obtain from https://login.tailscale.com/admin/settings/keys\n# TAILSCALE_API_KEY = \"tskey-...\"\n# Gemini API key: required for the Gemini Live voice agent and for title\n# generation when provider is \"gemini\". Obtain from https://aistudio.google.com/app/apikey\n# GEMINI_API_KEY = \"AIza...\"\n\n# ── Server ───────────────────────────────────────────────────────────────────\n\n[server]\n# HTTP listen address for the web UI. Defaults to localhost only; prefix with\n# \"0.0.0.0\" to listen on all IPv4 addresses.\n# Safety: the MCP endpoint at /api/caic/v1/mcp is disabled when no OAuth login\n# is configured and the server binds a non-loopback address, so an exposed\n# server never serves MCP without authentication. Configure OAuth login below to\n# enable MCP off-localhost.\n#http = \":2242\"\n\n# Public base URL. \"auto\" locks the hostname from the first FQDN request. Set an\n# explicit URL for OAuth login and webhooks.\n#external_url = \"auto\"  # e.g. \"https://caic.example.com\"\n\n# MaxMind MMDB file for country-code resolution and logging. Relative paths\n# resolve against the config directory. Empty defaults to\n# \"~/.config/caic/GeoLite2-Country.mmdb\" if present, otherwise geoip is disabled.\n# https://dev.maxmind.com/geoip/geolite2-free-geolocation-data\n#geo_db = \"\"  # e.g. \"~/.config/caic/GeoLite2-Country.mmdb\"\n\n# Allowed origins; requests from non-matching IPs are rejected with HTTP 403.\n# Named:\n# - \"anthropic\" (published Anthropic outbound IPs): necessary for Claude MCP.\n# - \"github\" (GitHub webhook IPs): necessary for GitHub App.\n# - \"local\" (loopback/private): highly recommended.\n# - \"openai\" (published ChatGPT integration and Codex cloud IPs): necessary for ChatGPT MCP.\n# - \"tailscale\" (100.64.0.0/10): very useful if you use tailscale.com.\n# Others:\n# - CIDR: e.g. \"203.0.113.0/24\"\n# - Country codes: ISO 3166-1 alpha-2 (e.g. \"CA\"), require geo_db.\n#allow_origins = [\"local\", \"tailscale\", \"github\"]\n\n# ── Voice Gateway ────────────────────────────────────────────────────────────\n\n# Voice support is derived automatically:\n#   url set                       advertise that standalone gateway.\n#   no url and GEMINI_API_KEY set  host the embedded gateway in-process.\n#   no url and no GEMINI_API_KEY   disabled.\n[voice-gateway]\n# Standalone voice gateway URL.\n#url = \"\"  # e.g. \"https://voice.example.com\"\n\n# Embedded gateway runtime config, used only when caic hosts the gateway\n# in-process. Same shape as contrib/voice-gateway-config.toml.\n[voice-gateway.config]\n# The API key is always read from GEMINI_API_KEY.\n#model = \"gemini-3.1-flash-live-preview\"\n\n[voice-gateway.config.server]\n# UDP port for WebRTC ICE (single-port mux). 0 = OS-assigned ephemeral port;\n# >0 = a static port (open it for UDP in your firewall). Requires GEMINI_API_KEY.\n# The gateway HTTP port is not configurable here; use server.http.\n#webrtc_udp_port = 0\n\n# Local model stack (set backend = \"local-stack\"). Omit these to let caic manage\n# llama.cpp with the default Gemma model; set them to point at servers you run.\n# [voice-gateway.config.local_stack.asr]\n# provider = \"llamacpp\"\n# remote = \"http://127.0.0.1:8081\"\n# model = \"...\"\n# [voice-gateway.config.local_stack.llm]\n# provider = \"llamacpp\"\n# remote = \"http://127.0.0.1:8080\"\n# model = \"unsloth/gemma-4-E2B-it-GGUF:UD-Q4_K_XL\"\n\n# ── AI ───────────────────────────────────────────────────────────────────────\n\n[ai]\n# LLM provider for title generation, commit descriptions, etc. Empty =\n# auto-detect in order: codex, opencode, claudecode, then any available.\n# https://pkg.go.dev/github.com/maruel/genai/providers\n#provider = \"\"  # e.g. \"codex\"\n\n# Model name or alias. Empty = the provider's auto-detected cheapest model.\n#model = \"\"  # e.g. \"claude-haiku-4-5-20251001\"\n\n# ── Harness ──────────────────────────────────────────────────────────────────\n# Per-harness environment variables injected into containers.\n\n[harness.claude.env]\n# Warning: ANTHROPIC_API_KEY makes Claude Code use API billing and ignore your subscription.\n# ANTHROPIC_API_KEY = \"sk-...\"\n\n[harness.codex.env]\n# Most of codex configuration is via its configuration described at\n# https://developers.openai.com/codex/config-reference\n\n[harness.opencode.env]\n# Most of opencode configuration is via its configuration described at\n# https://opencode.ai/docs/config/\n\n[harness.pi.env]\n# See https://github.com/badlogic/pi-mono/blob/main/packages/coding-agent/docs/providers.md\n# Here's example keys, you can set any environment variable you want.\n# DEEPSEEK_API_KEY = \"...\"\n# GEMINI_API_KEY = \"AIza...\"\n# OPENROUTER_API_KEY = \"sk-or-...\"\n# OPENAI_API_KEY = \"sk-...\"\n\n# ── GitHub ───────────────────────────────────────────────────────────────────\n\n[github]\n\n# PAT for server-level API access (forges, container token fallback).\n# https://github.com/settings/personal-access-tokens/new\n# Required permissions: pull_requests:write, checks:read. If empty and the gh\n# CLI is in PATH, caic uses `gh auth token` automatically.\n[github.pat]\n#token = \"\"  # e.g. \"ghp_...\"\n\n# OAuth — multi-user login.\n# See https://docs.caic.xyz/caic/github for OAuth app setup instructions.\n[github.oauth]\n#client_id = \"\"\n#client_secret = \"\"\n# GitHub users allowed to log in (highly recommended).\n# allowed_users = [\"alice\", \"bob\"]\n\n# GitHub App — org-wide webhooks and automatic task creation.\n# Layered on top of PAT or OAuth; not mutually exclusive with either.\n# See https://docs.caic.xyz/caic/ for GitHub App setup instructions.\n[github.app]\n#id = 0  # e.g. 12345\n# PEM file path (relative paths resolve against the config directory).\n#private_key_pem = \"\"  # e.g. \"~/.config/caic/private-key.pem\"\n# Owners/orgs allowed to install the app (highly recommended).\n# allowed_owners = [\"my-org\", \"my-username\"]\n# HMAC-SHA256 secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── GitLab ───────────────────────────────────────────────────────────────────\n# Choose one of PAT (token) or OAuth.\n\n[gitlab]\n# GitLab instance URL. Empty targets gitlab.com (the REST API always does); set\n# only for self-hosted OAuth login.\n#url = \"\"  # e.g. \"https://gitlab.example.com\"\n\n# Shared secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# PAT — single-user / headless, mutually exclusive with OAuth. Scope: api.\n# Create at https://gitlab.com/-/user_settings/personal_access_tokens\n# Required scope: api\n[gitlab.pat]\n#token = \"\"  # e.g. \"glpat-...\"\n\n# OAuth multi-user login, mutually exclusive with token.\n# See https://docs.caic.xyz/caic/gitlab for OAuth app setup instructions.\n[gitlab.oauth]\n#client_id = \"\"\n#client_secret = \"\"\n# GitLab users allowed to login. Highly recommended.\n# allowed_users = [\"alice\", \"bob\"]\n\n# ── Google ───────────────────────────────────────────────────────────────────\n\n# Google Sign-In is identity-only: it authenticates users for dashboard access\n# but provides no forge integration. Configure github/gitlab above for repo,\n# CI, and PR operations. Requires server.external_url (https).\n[google.oauth]\n#client_id = \"\"\n#client_secret = \"\"\n# Google account emails allowed to login. Highly recommended.\n# allowed_users = [\"alice@example.com\", \"bob@example.com\"]\n\n# ── Debug ────────────────────────────────────────────────────────────────────\n\n[debug]\n# Log level: debug, info, warn, error.\n#log_level = \"info\"\n\n# Omit timestamps from log output.\n#no_log_time = false\n\n# Expose /debug/pprof/* profiling endpoints.\n#pprof = false\n\n# Profiling output files; empty disables each.\n#cpuprofile = \"\"  # e.g. \"~/.cache/caic/cpu.prof\"\n#memprofile = \"\"  # e.g. \"~/.cache/caic/mem.prof\"\n#trace = \"\"       # e.g. \"~/.cache/caic/trace.out\"\n"}, "7722e27fe0b95732f5ca476f887543bc83a1b604": {"t": 1785750194.476749, "n": 8264, "h": "b1e0c524c92021e6", "c": "# caic configuration\n# Copy to ~/.config/caic/config.toml and edit as needed.\n\n# ── Core ─────────────────────────────────────────────────────────────────────\n\n[core]\n# Parent directory containing the git repositories managed by caic.\n#root = \".\"\n\n# Auto-update schedule (cron expression, local time). Checks GitHub Releases and\n# replaces the binary on a match. Unset = daily at 04:50; \"\" disables.\n# e.g. auto_update = \"50 4 * * *\"\n\n# Environment variables added to those inherited by the server process. Each key\n# falls back to the host environment when omitted here.\n[core.env]\n# Tailscale API key: required for Tailscale ephemeral node.\n# Obtain from https://login.tailscale.com/admin/settings/keys\n# TAILSCALE_API_KEY = \"tskey-...\"\n# Gemini API key: required for the Gemini Live voice agent and for title\n# generation when provider is \"gemini\". Obtain from https://aistudio.google.com/app/apikey\n# GEMINI_API_KEY = \"AIza...\"\n\n# ── Server ───────────────────────────────────────────────────────────────────\n\n[server]\n# HTTP listen address for the web UI. Defaults to localhost only; prefix with\n# \"0.0.0.0\" to listen on all IPv4 addresses.\n# Safety: the MCP endpoint at /api/caic/v1/mcp is disabled when no OAuth login\n# is configured and the server binds a non-loopback address, so an exposed\n# server never serves MCP without authentication. Configure OAuth login below to\n# enable MCP off-localhost.\n#http = \":2242\"\n\n# Public base URL. \"auto\" locks the hostname from the first FQDN request. Set an\n# explicit URL for OAuth login and webhooks.\n#external_url = \"auto\"  # e.g. \"https://caic.example.com\"\n\n# MaxMind MMDB file for country-code resolution and logging. Relative paths\n# resolve against the config directory. Empty defaults to\n# \"~/.config/caic/GeoLite2-Country.mmdb\" if present, otherwise geoip is disabled.\n# https://dev.maxmind.com/geoip/geolite2-free-geolocation-data\n#geo_db = \"\"  # e.g. \"~/.config/caic/GeoLite2-Country.mmdb\"\n\n# Allowed origins; requests from non-matching IPs are rejected with HTTP 403.\n# Named:\n# - \"anthropic\" (published Anthropic outbound IPs): necessary for Claude MCP.\n# - \"github\" (GitHub webhook IPs): necessary for GitHub App.\n# - \"local\" (loopback/private): highly recommended.\n# - \"openai\" (published ChatGPT integration and Codex cloud IPs): necessary for ChatGPT MCP.\n# - \"tailscale\" (100.64.0.0/10): very useful if you use tailscale.com.\n# Others:\n# - CIDR: e.g. \"203.0.113.0/24\"\n# - Country codes: ISO 3166-1 alpha-2 (e.g. \"CA\"), require geo_db.\n#allow_origins = [\"local\", \"tailscale\", \"github\"]\n\n# ── Voice Gateway ────────────────────────────────────────────────────────────\n\n# Voice support is derived automatically:\n#   url set                       advertise that standalone gateway.\n#   no url and GEMINI_API_KEY set  host the embedded gateway in-process.\n#   no url and no GEMINI_API_KEY   disabled.\n[voice-gateway]\n# Standalone voice gateway URL.\n#url = \"\"  # e.g. \"https://voice.example.com\"\n\n# Embedded gateway runtime config, used only when caic hosts the gateway\n# in-process. Same shape as contrib/voice-gateway-config.toml.\n[voice-gateway.config]\n# The API key is always read from GEMINI_API_KEY.\n#model = \"gemini-3.1-flash-live-preview\"\n\n[voice-gateway.config.server]\n# UDP port for WebRTC ICE (single-port mux). 0 = OS-assigned ephemeral port;\n# >0 = a static port (open it for UDP in your firewall). Requires GEMINI_API_KEY.\n# The gateway HTTP port is not configurable here; use server.http.\n#webrtc_udp_port = 0\n\n# Local model stack (set backend = \"local-stack\"). Omit these to let caic manage\n# llama.cpp with the default Gemma model; set them to point at servers you run.\n# [voice-gateway.config.local_stack.asr]\n# provider = \"llamacpp\"\n# remote = \"http://127.0.0.1:8081\"\n# model = \"...\"\n# [voice-gateway.config.local_stack.llm]\n# provider = \"llamacpp\"\n# remote = \"http://127.0.0.1:8080\"\n# model = \"unsloth/gemma-4-E2B-it-GGUF:UD-Q4_K_XL\"\n\n# ── AI ───────────────────────────────────────────────────────────────────────\n\n[ai]\n# LLM provider for title generation, commit descriptions, etc. Empty =\n# auto-detect in order: codex, opencode, claudecode, then any available.\n# https://pkg.go.dev/github.com/maruel/genai/providers\n#provider = \"\"  # e.g. \"codex\"\n\n# Model name or alias. Empty = the provider's auto-detected cheapest model.\n#model = \"\"  # e.g. \"claude-haiku-4-5-20251001\"\n\n# ── Harness ──────────────────────────────────────────────────────────────────\n# Per-harness environment variables injected into containers.\n\n[harness.claude.env]\n# Warning: ANTHROPIC_API_KEY makes Claude Code use API billing and ignore your subscription.\n# ANTHROPIC_API_KEY = \"sk-...\"\n\n[harness.codex.env]\n# Most of codex configuration is via its configuration described at\n# https://developers.openai.com/codex/config-reference\n\n[harness.opencode.env]\n# Most of opencode configuration is via its configuration described at\n# https://opencode.ai/docs/config/\n\n[harness.pi.env]\n# See https://github.com/badlogic/pi-mono/blob/main/packages/coding-agent/docs/providers.md\n# Here's example keys, you can set any environment variable you want.\n# DEEPSEEK_API_KEY = \"...\"\n# GEMINI_API_KEY = \"AIza...\"\n# OPENROUTER_API_KEY = \"sk-or-...\"\n# OPENAI_API_KEY = \"sk-...\"\n\n# ── GitHub ───────────────────────────────────────────────────────────────────\n\n[github]\n\n# PAT for server-level API access (forges, container token fallback).\n# https://github.com/settings/personal-access-tokens/new\n# Required permissions: pull_requests:write, checks:read. If empty and the gh\n# CLI is in PATH, caic uses `gh auth token` automatically.\n[github.pat]\n#token = \"\"  # e.g. \"ghp_...\"\n\n# OAuth — multi-user login.\n# See https://docs.caic.xyz/caic/github for OAuth app setup instructions.\n[github.oauth]\n#client_id = \"\"\n#client_secret = \"\"\n# GitHub users allowed to log in (highly recommended).\n# allowed_users = [\"alice\", \"bob\"]\n\n# GitHub App — org-wide webhooks and automatic task creation.\n# Layered on top of PAT or OAuth; not mutually exclusive with either.\n# See https://docs.caic.xyz/caic/ for GitHub App setup instructions.\n[github.app]\n#id = 0  # e.g. 12345\n# PEM file path (relative paths resolve against the config directory).\n#private_key_pem = \"\"  # e.g. \"~/.config/caic/private-key.pem\"\n# Owners/orgs allowed to install the app (highly recommended).\n# allowed_owners = [\"my-org\", \"my-username\"]\n# HMAC-SHA256 secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── GitLab ───────────────────────────────────────────────────────────────────\n# Choose one of PAT (token) or OAuth.\n\n[gitlab]\n# GitLab instance URL. Empty targets gitlab.com (the REST API always does); set\n# only for self-hosted OAuth login.\n#url = \"\"  # e.g. \"https://gitlab.example.com\"\n\n# Shared secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# PAT — single-user / headless, mutually exclusive with OAuth. Scope: api.\n# Create at https://gitlab.com/-/user_settings/personal_access_tokens\n# Required scope: api\n[gitlab.pat]\n#token = \"\"  # e.g. \"glpat-...\"\n\n# OAuth multi-user login, mutually exclusive with token.\n# See https://docs.caic.xyz/caic/gitlab for OAuth app setup instructions.\n[gitlab.oauth]\n#client_id = \"\"\n#client_secret = \"\"\n# GitLab users allowed to login. Highly recommended.\n# allowed_users = [\"alice\", \"bob\"]\n\n# ── Google ───────────────────────────────────────────────────────────────────\n\n# Google Sign-In is identity-only: it authenticates users for dashboard access\n# but provides no forge integration. Configure github/gitlab above for repo,\n# CI, and PR operations. Requires server.external_url (https).\n[google.oauth]\n#client_id = \"\"\n#client_secret = \"\"\n# Google account emails allowed to login. Highly recommended.\n# allowed_users = [\"alice@example.com\", \"bob@example.com\"]\n\n# ── Debug ────────────────────────────────────────────────────────────────────\n\n[debug]\n# Log level: debug, info, warn, error.\n#log_level = \"info\"\n\n# Omit timestamps from log output.\n#no_log_time = false\n\n# Expose /debug/pprof/* profiling endpoints.\n#pprof = false\n\n# Profiling output files; empty disables each.\n#cpuprofile = \"\"  # e.g. \"~/.cache/caic/cpu.prof\"\n#memprofile = \"\"  # e.g. \"~/.cache/caic/mem.prof\"\n#trace = \"\"       # e.g. \"~/.cache/caic/trace.out\"\n"}, "0040afe7f5ddc0ce97311865f609bbb7700e5355": {"t": 1785750195.5543857, "n": 8483, "h": "cb8f38bc2e056343", "c": "# caic configuration\n# Copy to ~/.config/caic/config.toml and edit as needed.\n\n# ── Core ─────────────────────────────────────────────────────────────────────\n\n[core]\n# Parent directory containing the git repositories managed by caic.\n#root = \".\"\n\n# Container runtime. \"\" auto-detects (docker preferred, then podman); set\n# \"docker\" or \"podman\" to pin one. sudo is unsupported with rootless podman, so\n# use docker if you need sudo-enabled containers.\n#runtime = \"\"\n\n# Auto-update schedule (cron expression, local time). Checks GitHub Releases and\n# replaces the binary on a match. Unset = daily at 04:50; \"\" disables.\n# e.g. auto_update = \"50 4 * * *\"\n\n# Environment variables added to those inherited by the server process. Each key\n# falls back to the host environment when omitted here.\n[core.env]\n# Tailscale API key: required for Tailscale ephemeral node.\n# Obtain from https://login.tailscale.com/admin/settings/keys\n# TAILSCALE_API_KEY = \"tskey-...\"\n# Gemini API key: required for the Gemini Live voice agent and for title\n# generation when provider is \"gemini\". Obtain from https://aistudio.google.com/app/apikey\n# GEMINI_API_KEY = \"AIza...\"\n\n# ── Server ───────────────────────────────────────────────────────────────────\n\n[server]\n# HTTP listen address for the web UI. Defaults to localhost only; prefix with\n# \"0.0.0.0\" to listen on all IPv4 addresses.\n# Safety: the MCP endpoint at /api/caic/v1/mcp is disabled when no OAuth login\n# is configured and the server binds a non-loopback address, so an exposed\n# server never serves MCP without authentication. Configure OAuth login below to\n# enable MCP off-localhost.\n#http = \":2242\"\n\n# Public base URL. \"auto\" locks the hostname from the first FQDN request. Set an\n# explicit URL for OAuth login and webhooks.\n#external_url = \"auto\"  # e.g. \"https://caic.example.com\"\n\n# MaxMind MMDB file for country-code resolution and logging. Relative paths\n# resolve against the config directory. Empty defaults to\n# \"~/.config/caic/GeoLite2-Country.mmdb\" if present, otherwise geoip is disabled.\n# https://dev.maxmind.com/geoip/geolite2-free-geolocation-data\n#geo_db = \"\"  # e.g. \"~/.config/caic/GeoLite2-Country.mmdb\"\n\n# Allowed origins; requests from non-matching IPs are rejected with HTTP 403.\n# Named:\n# - \"anthropic\" (published Anthropic outbound IPs): necessary for Claude MCP.\n# - \"github\" (GitHub webhook IPs): necessary for GitHub App.\n# - \"local\" (loopback/private): highly recommended.\n# - \"openai\" (published ChatGPT integration and Codex cloud IPs): necessary for ChatGPT MCP.\n# - \"tailscale\" (100.64.0.0/10): very useful if you use tailscale.com.\n# Others:\n# - CIDR: e.g. \"203.0.113.0/24\"\n# - Country codes: ISO 3166-1 alpha-2 (e.g. \"CA\"), require geo_db.\n#allow_origins = [\"local\", \"tailscale\", \"github\"]\n\n# ── Voice Gateway ────────────────────────────────────────────────────────────\n\n# Voice support is derived automatically:\n#   url set                       advertise that standalone gateway.\n#   no url and GEMINI_API_KEY set  host the embedded gateway in-process.\n#   no url and no GEMINI_API_KEY   disabled.\n[voice-gateway]\n# Standalone voice gateway URL.\n#url = \"\"  # e.g. \"https://voice.example.com\"\n\n# Embedded gateway runtime config, used only when caic hosts the gateway\n# in-process. Same shape as contrib/voice-gateway-config.toml.\n[voice-gateway.config]\n# The API key is always read from GEMINI_API_KEY.\n#model = \"gemini-3.1-flash-live-preview\"\n\n[voice-gateway.config.server]\n# UDP port for WebRTC ICE (single-port mux). 0 = OS-assigned ephemeral port;\n# >0 = a static port (open it for UDP in your firewall). Requires GEMINI_API_KEY.\n# The gateway HTTP port is not configurable here; use server.http.\n#webrtc_udp_port = 0\n\n# Local model stack (set backend = \"local-stack\"). Omit these to let caic manage\n# llama.cpp with the default Gemma model; set them to point at servers you run.\n# [voice-gateway.config.local_stack.asr]\n# provider = \"llamacpp\"\n# remote = \"http://127.0.0.1:8081\"\n# model = \"...\"\n# [voice-gateway.config.local_stack.llm]\n# provider = \"llamacpp\"\n# remote = \"http://127.0.0.1:8080\"\n# model = \"unsloth/gemma-4-E2B-it-GGUF:UD-Q4_K_XL\"\n\n# ── AI ───────────────────────────────────────────────────────────────────────\n\n[ai]\n# LLM provider for title generation, commit descriptions, etc. Empty =\n# auto-detect in order: codex, opencode, claudecode, then any available.\n# https://pkg.go.dev/github.com/maruel/genai/providers\n#provider = \"\"  # e.g. \"codex\"\n\n# Model name or alias. Empty = the provider's auto-detected cheapest model.\n#model = \"\"  # e.g. \"claude-haiku-4-5-20251001\"\n\n# ── Harness ──────────────────────────────────────────────────────────────────\n# Per-harness environment variables injected into containers.\n\n[harness.claude.env]\n# Warning: ANTHROPIC_API_KEY makes Claude Code use API billing and ignore your subscription.\n# ANTHROPIC_API_KEY = \"sk-...\"\n\n[harness.codex.env]\n# Most of codex configuration is via its configuration described at\n# https://developers.openai.com/codex/config-reference\n\n[harness.opencode.env]\n# Most of opencode configuration is via its configuration described at\n# https://opencode.ai/docs/config/\n\n[harness.pi.env]\n# See https://github.com/badlogic/pi-mono/blob/main/packages/coding-agent/docs/providers.md\n# Here's example keys, you can set any environment variable you want.\n# DEEPSEEK_API_KEY = \"...\"\n# GEMINI_API_KEY = \"AIza...\"\n# OPENROUTER_API_KEY = \"sk-or-...\"\n# OPENAI_API_KEY = \"sk-...\"\n\n# ── GitHub ───────────────────────────────────────────────────────────────────\n\n[github]\n\n# PAT for server-level API access (forges, container token fallback).\n# https://github.com/settings/personal-access-tokens/new\n# Required permissions: pull_requests:write, checks:read. If empty and the gh\n# CLI is in PATH, caic uses `gh auth token` automatically.\n[github.pat]\n#token = \"\"  # e.g. \"ghp_...\"\n\n# OAuth — multi-user login.\n# See https://docs.caic.xyz/caic/github for OAuth app setup instructions.\n[github.oauth]\n#client_id = \"\"\n#client_secret = \"\"\n# GitHub users allowed to log in (highly recommended).\n# allowed_users = [\"alice\", \"bob\"]\n\n# GitHub App — org-wide webhooks and automatic task creation.\n# Layered on top of PAT or OAuth; not mutually exclusive with either.\n# See https://docs.caic.xyz/caic/ for GitHub App setup instructions.\n[github.app]\n#id = 0  # e.g. 12345\n# PEM file path (relative paths resolve against the config directory).\n#private_key_pem = \"\"  # e.g. \"~/.config/caic/private-key.pem\"\n# Owners/orgs allowed to install the app (highly recommended).\n# allowed_owners = [\"my-org\", \"my-username\"]\n# HMAC-SHA256 secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── GitLab ───────────────────────────────────────────────────────────────────\n# Choose one of PAT (token) or OAuth.\n\n[gitlab]\n# GitLab instance URL. Empty targets gitlab.com (the REST API always does); set\n# only for self-hosted OAuth login.\n#url = \"\"  # e.g. \"https://gitlab.example.com\"\n\n# Shared secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# PAT — single-user / headless, mutually exclusive with OAuth. Scope: api.\n# Create at https://gitlab.com/-/user_settings/personal_access_tokens\n# Required scope: api\n[gitlab.pat]\n#token = \"\"  # e.g. \"glpat-...\"\n\n# OAuth multi-user login, mutually exclusive with token.\n# See https://docs.caic.xyz/caic/gitlab for OAuth app setup instructions.\n[gitlab.oauth]\n#client_id = \"\"\n#client_secret = \"\"\n# GitLab users allowed to login. Highly recommended.\n# allowed_users = [\"alice\", \"bob\"]\n\n# ── Google ───────────────────────────────────────────────────────────────────\n\n# Google Sign-In is identity-only: it authenticates users for dashboard access\n# but provides no forge integration. Configure github/gitlab above for repo,\n# CI, and PR operations. Requires server.external_url (https).\n[google.oauth]\n#client_id = \"\"\n#client_secret = \"\"\n# Google account emails allowed to login. Highly recommended.\n# allowed_users = [\"alice@example.com\", \"bob@example.com\"]\n\n# ── Debug ────────────────────────────────────────────────────────────────────\n\n[debug]\n# Log level: debug, info, warn, error.\n#log_level = \"info\"\n\n# Omit timestamps from log output.\n#no_log_time = false\n\n# Expose /debug/pprof/* profiling endpoints.\n#pprof = false\n\n# Profiling output files; empty disables each.\n#cpuprofile = \"\"  # e.g. \"~/.cache/caic/cpu.prof\"\n#memprofile = \"\"  # e.g. \"~/.cache/caic/mem.prof\"\n#trace = \"\"       # e.g. \"~/.cache/caic/trace.out\"\n"}, "cb51d8f340a9b0b703f8c8359125ab69f0648cd3": {"t": 1785750196.8727312, "n": 8010, "h": "74a5920c813f83ea", "c": "# caic configuration\n# Copy to ~/.config/caic/config.toml and edit as needed.\n\n# ── Core ─────────────────────────────────────────────────────────────────────\n\n[core]\n# Parent directory containing the git repositories managed by caic.\n#root = \".\"\n\n# Container runtime. \"\" auto-detects (docker preferred, then podman); set\n# \"docker\" or \"podman\" to pin one. sudo is unsupported with rootless podman, so\n# use docker if you need sudo-enabled containers.\n#runtime = \"\"\n\n# Auto-update schedule (cron expression, local time). Checks GitHub Releases and\n# replaces the binary on a match. Unset = daily at 04:50; \"\" disables.\n# e.g. auto_update = \"50 4 * * *\"\n\n# Environment variables added to those inherited by the server process. Each key\n# falls back to the host environment when omitted here.\n[core.env]\n# Tailscale API key: required for Tailscale ephemeral node.\n# Obtain from https://login.tailscale.com/admin/settings/keys\n# TAILSCALE_API_KEY = \"tskey-...\"\n# Gemini API key: required for the Gemini Live voice agent and for title\n# generation when provider is \"gemini\". Obtain from https://aistudio.google.com/app/apikey\n# GEMINI_API_KEY = \"AIza...\"\n\n# ── Server ───────────────────────────────────────────────────────────────────\n\n[server]\n# HTTP listen address for the web UI. Defaults to localhost only; prefix with\n# \"0.0.0.0\" to listen on all IPv4 addresses.\n# Safety: the MCP endpoint at /api/caic/v1/mcp is disabled when no OAuth login\n# is configured and the server binds a non-loopback address, so an exposed\n# server never serves MCP without authentication. Configure OAuth login below to\n# enable MCP off-localhost.\n#http = \":2242\"\n\n# Public base URL. \"auto\" locks the hostname from the first FQDN request. Set an\n# explicit URL for OAuth login and webhooks.\n#external_url = \"auto\"  # e.g. \"https://caic.example.com\"\n\n# MaxMind MMDB file for country-code resolution and logging. Relative paths\n# resolve against the config directory. Empty defaults to\n# \"~/.config/caic/GeoLite2-Country.mmdb\" if present, otherwise geoip is disabled.\n# https://dev.maxmind.com/geoip/geolite2-free-geolocation-data\n#geo_db = \"\"  # e.g. \"~/.config/caic/GeoLite2-Country.mmdb\"\n\n# Allowed origins; requests from non-matching IPs are rejected with HTTP 403.\n# Named:\n# - \"anthropic\" (published Anthropic outbound IPs): necessary for Claude MCP.\n# - \"github\" (GitHub webhook IPs): necessary for GitHub App.\n# - \"local\" (loopback/private): highly recommended.\n# - \"openai\" (published ChatGPT integration and Codex cloud IPs): necessary for ChatGPT MCP.\n# - \"tailscale\" (100.64.0.0/10): very useful if you use tailscale.com.\n# Others:\n# - CIDR: e.g. \"203.0.113.0/24\"\n# - Country codes: ISO 3166-1 alpha-2 (e.g. \"CA\"), require geo_db.\n#allow_origins = [\"local\", \"tailscale\", \"github\"]\n\n# ── Voice Gateway ────────────────────────────────────────────────────────────\n\n# Voice support is derived automatically:\n#   url set                       advertise that standalone gateway.\n#   no url and GEMINI_API_KEY set  host the embedded gateway in-process.\n#   no url and no GEMINI_API_KEY   disabled.\n[voice-gateway]\n# Standalone voice gateway URL.\n#url = \"\"  # e.g. \"https://voice.example.com\"\n\n# Embedded gateway runtime config, used only when caic hosts the gateway\n# in-process. Same shape as contrib/voice-gateway-config.toml.\n[voice-gateway.config]\n# The API key is always read from GEMINI_API_KEY.\n#model = \"gemini-3.1-flash-live-preview\"\n\n[voice-gateway.config.server]\n# UDP port for WebRTC ICE (single-port mux). 0 = OS-assigned ephemeral port;\n# >0 = a static port (open it for UDP in your firewall). Requires GEMINI_API_KEY.\n# The gateway HTTP port is not configurable here; use server.http.\n#webrtc_udp_port = 0\n\n# Local model stack (set backend = \"local-stack\"). Omit these to let caic manage\n# llama.cpp with the default Gemma model; set them to point at servers you run.\n# [voice-gateway.config.local_stack.asr]\n# provider = \"llamacpp\"\n# remote = \"http://127.0.0.1:8081\"\n# model = \"...\"\n# [voice-gateway.config.local_stack.llm]\n# provider = \"llamacpp\"\n# remote = \"http://127.0.0.1:8080\"\n# model = \"unsloth/gemma-4-E2B-it-GGUF:UD-Q4_K_XL\"\n\n# ── AI ───────────────────────────────────────────────────────────────────────\n\n[ai]\n# LLM provider for title generation, commit descriptions, etc. Empty =\n# auto-detect in order: codex, opencode, claudecode, then any available.\n# https://pkg.go.dev/github.com/maruel/genai/providers\n#provider = \"\"  # e.g. \"codex\"\n\n# Model name or alias. Empty = the provider's auto-detected cheapest model.\n#model = \"\"  # e.g. \"claude-haiku-4-5-20251001\"\n\n# ── Harness ──────────────────────────────────────────────────────────────────\n# Per-harness environment variables injected into containers.\n\n[harness.claude.env]\n# Warning: ANTHROPIC_API_KEY makes Claude Code use API billing and ignore your subscription.\n# ANTHROPIC_API_KEY = \"sk-...\"\n\n[harness.codex.env]\n# Most of codex configuration is via its configuration described at\n# https://developers.openai.com/codex/config-reference\n\n[harness.opencode.env]\n# Most of opencode configuration is via its configuration described at\n# https://opencode.ai/docs/config/\n\n[harness.pi.env]\n# See https://github.com/badlogic/pi-mono/blob/main/packages/coding-agent/docs/providers.md\n# Here's example keys, you can set any environment variable you want.\n# DEEPSEEK_API_KEY = \"...\"\n# GEMINI_API_KEY = \"AIza...\"\n# OPENROUTER_API_KEY = \"sk-or-...\"\n# OPENAI_API_KEY = \"sk-...\"\n\n# ── GitHub ───────────────────────────────────────────────────────────────────\n\n[github]\n\n# PAT for server-level API access (forges, container token fallback).\n# https://github.com/settings/personal-access-tokens/new\n# Required permissions: pull_requests:write, checks:read. If empty and the gh\n# CLI is in PATH, caic uses `gh auth token` automatically.\n[github.pat]\n#token = \"\"  # e.g. \"ghp_...\"\n\n# OAuth — multi-user login.\n# See https://docs.caic.xyz/caic/github for OAuth app setup instructions.\n[github.oauth]\n#client_id = \"\"\n#client_secret = \"\"\n# GitHub users allowed to log in (highly recommended).\n# allowed_users = [\"alice\", \"bob\"]\n\n# GitHub App — org-wide webhooks and automatic task creation.\n# Layered on top of PAT or OAuth; not mutually exclusive with either.\n# See https://docs.caic.xyz/caic/ for GitHub App setup instructions.\n[github.app]\n#id = 0  # e.g. 12345\n# PEM file path (relative paths resolve against the config directory).\n#private_key_pem = \"\"  # e.g. \"~/.config/caic/private-key.pem\"\n# Owners/orgs allowed to install the app (highly recommended).\n# allowed_owners = [\"my-org\", \"my-username\"]\n# HMAC-SHA256 secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── GitLab ───────────────────────────────────────────────────────────────────\n# Choose one of PAT (token) or OAuth.\n\n[gitlab]\n# GitLab instance URL. Empty targets gitlab.com (the REST API always does); set\n# only for self-hosted OAuth login.\n#url = \"\"  # e.g. \"https://gitlab.example.com\"\n\n# Shared secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# PAT — single-user / headless, mutually exclusive with OAuth. Scope: api.\n# Create at https://gitlab.com/-/user_settings/personal_access_tokens\n# Required scope: api\n[gitlab.pat]\n#token = \"\"  # e.g. \"glpat-...\"\n\n# OAuth multi-user login, mutually exclusive with token.\n# See https://docs.caic.xyz/caic/gitlab for OAuth app setup instructions.\n[gitlab.oauth]\n#client_id = \"\"\n#client_secret = \"\"\n# GitLab users allowed to login. Highly recommended.\n# allowed_users = [\"alice\", \"bob\"]\n\n# ── Debug ────────────────────────────────────────────────────────────────────\n\n[debug]\n# Log level: debug, info, warn, error.\n#log_level = \"info\"\n\n# Omit timestamps from log output.\n#no_log_time = false\n\n# Expose /debug/pprof/* profiling endpoints.\n#pprof = false\n\n# Profiling output files; empty disables each.\n#cpuprofile = \"\"  # e.g. \"~/.cache/caic/cpu.prof\"\n#memprofile = \"\"  # e.g. \"~/.cache/caic/mem.prof\"\n#trace = \"\"       # e.g. \"~/.cache/caic/trace.out\"\n"}, "ddab20f1ce2854964c958b3eacee07b989a310ee": {"t": 1785750198.0102937, "n": 7974, "h": "f536ed5a76dec85a", "c": "# caic configuration\n# Copy to ~/.config/caic/config.toml and edit as needed.\n\n# ── Core ─────────────────────────────────────────────────────────────────────\n\n[core]\n# Parent directory containing the git repositories managed by caic.\n#root = \".\"\n\n# Container runtime. \"\" auto-detects (docker preferred, then podman); set\n# \"docker\" or \"podman\" to pin one. sudo is unsupported with rootless podman, so\n# use docker if you need sudo-enabled containers.\n#runtime = \"\"\n\n# Auto-update schedule (cron expression, local time). Checks GitHub Releases and\n# replaces the binary on a match. Unset = daily at 04:50; \"\" disables.\n# e.g. auto_update = \"50 4 * * *\"\n\n# Environment variables added to those inherited by the server process. Each key\n# falls back to the host environment when omitted here.\n[core.env]\n# Tailscale API key: required for Tailscale ephemeral node.\n# Obtain from https://login.tailscale.com/admin/settings/keys\n# TAILSCALE_API_KEY = \"tskey-...\"\n# Gemini API key: required for the Gemini Live voice agent and for title\n# generation when provider is \"gemini\". Obtain from https://aistudio.google.com/app/apikey\n# GEMINI_API_KEY = \"AIza...\"\n\n# ── Server ───────────────────────────────────────────────────────────────────\n\n[server]\n# HTTP listen address for the web UI. Defaults to localhost only; prefix with\n# \"0.0.0.0\" to listen on all IPv4 addresses.\n# Safety: the MCP endpoint at /api/caic/v1/mcp is disabled when no OAuth login\n# is configured and the server binds a non-loopback address, so an exposed\n# server never serves MCP without authentication. Configure OAuth login below to\n# enable MCP off-localhost.\n#http = \":2242\"\n\n# Public base URL. \"auto\" locks the hostname from the first FQDN request. Set an\n# explicit URL for OAuth login and webhooks.\n#external_url = \"auto\"  # e.g. \"https://caic.example.com\"\n\n# MaxMind MMDB file for country-code resolution and logging. Relative paths\n# resolve against the config directory. Empty defaults to\n# \"~/.config/caic/GeoLite2-Country.mmdb\" if present, otherwise geoip is disabled.\n# https://dev.maxmind.com/geoip/geolite2-free-geolocation-data\n#geo_db = \"\"  # e.g. \"~/.config/caic/GeoLite2-Country.mmdb\"\n\n# Allowed origins; requests from non-matching IPs are rejected with HTTP 403.\n# Named:\n# - \"anthropic\" (published Anthropic outbound IPs): necessary for Claude MCP.\n# - \"github\" (GitHub webhook IPs): necessary for GitHub App.\n# - \"local\" (loopback/private): highly recommended.\n# - \"openai\" (published ChatGPT integration and Codex cloud IPs): necessary for ChatGPT MCP.\n# - \"tailscale\" (100.64.0.0/10): very useful if you use tailscale.com.\n# Others:\n# - CIDR: e.g. \"203.0.113.0/24\"\n# - Country codes: ISO 3166-1 alpha-2 (e.g. \"CA\"), require geo_db.\n#allow_origins = [\"local\", \"tailscale\", \"github\"]\n\n# ── Voice Gateway ────────────────────────────────────────────────────────────\n\n# Voice support is derived automatically:\n#   url set                       advertise that standalone gateway.\n#   no url and GEMINI_API_KEY set  host the embedded gateway in-process.\n#   no url and no GEMINI_API_KEY   disabled.\n[voice-gateway]\n# Standalone voice gateway URL.\n#url = \"\"  # e.g. \"https://voice.example.com\"\n\n# Embedded gateway runtime config, used only when caic hosts the gateway\n# in-process. Same shape as contrib/voice-gateway-config.toml.\n[voice-gateway.config]\n# The API key is always read from GEMINI_API_KEY.\n#model = \"gemini-3.1-flash-live-preview\"\n\n[voice-gateway.config.server]\n# UDP port for WebRTC ICE (single-port mux). 0 = OS-assigned ephemeral port;\n# >0 = a static port (open it for UDP in your firewall). Requires GEMINI_API_KEY.\n# The gateway HTTP port is not configurable here; use server.http.\n#webrtc_udp_port = 0\n\n# Local model stack (set backend = \"local-stack\"). Omit these to let caic manage\n# llama.cpp with the default Gemma model; set them to point at servers you run.\n# [voice-gateway.config.local_stack.asr]\n# provider = \"llamacpp\"\n# remote = \"http://127.0.0.1:8081\"\n# model = \"...\"\n# [voice-gateway.config.local_stack.llm]\n# provider = \"llamacpp\"\n# remote = \"http://127.0.0.1:8080\"\n# model = \"unsloth/gemma-4-E2B-it-GGUF:UD-Q4_K_XL\"\n\n# ── AI ───────────────────────────────────────────────────────────────────────\n\n[ai]\n# LLM provider for title generation, commit descriptions, etc. Empty =\n# auto-detect in order: codex, opencode, claudecode, then any available.\n# https://pkg.go.dev/github.com/maruel/genai/providers\n#provider = \"\"  # e.g. \"codex\"\n\n# Model name or alias. Empty = the provider's auto-detected cheapest model.\n#model = \"\"  # e.g. \"claude-haiku-4-5-20251001\"\n\n# ── Harness ──────────────────────────────────────────────────────────────────\n# Per-harness environment variables injected into containers.\n\n[harness.claude.env]\n# Warning: ANTHROPIC_API_KEY makes Claude Code use API billing and ignore your subscription.\n# ANTHROPIC_API_KEY = \"sk-...\"\n\n[harness.codex.env]\n# Most of codex configuration is via its configuration described at\n# https://developers.openai.com/codex/config-reference\n\n[harness.opencode.env]\n# Most of opencode configuration is via its configuration described at\n# https://opencode.ai/docs/config/\n\n[harness.pi.env]\n# See https://github.com/badlogic/pi-mono/blob/main/packages/coding-agent/docs/providers.md\n# Here's example keys, you can set any environment variable you want.\n# DEEPSEEK_API_KEY = \"...\"\n# GEMINI_API_KEY = \"AIza...\"\n# OPENROUTER_API_KEY = \"sk-or-...\"\n# OPENAI_API_KEY = \"sk-...\"\n\n# ── GitHub ───────────────────────────────────────────────────────────────────\n\n[github]\n# PAT for server-level API access (forges, container token fallback).\n# https://github.com/settings/personal-access-tokens/new\n# Required permissions: pull_requests:write, checks:read. If empty and the gh\n# CLI is in PATH, caic uses `gh auth token` automatically.\n#token = \"\"  # e.g. \"ghp_...\"\n\n# OAuth — multi-user login.\n# See https://docs.caic.xyz/caic/github for OAuth app setup instructions.\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitHub users allowed to log in (highly recommended).\n# oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitHub App — org-wide webhooks and automatic task creation.\n# Layered on top of PAT or OAuth; not mutually exclusive with either.\n# See https://docs.caic.xyz/caic/ for GitHub App setup instructions.\n#app_id = 0  # e.g. 12345\n# PEM file path (relative paths resolve against the config directory).\n#app_private_key_pem = \"\"  # e.g. \"private-key.pem\"\n# Owners/orgs allowed to install the app (highly recommended).\n# app_allowed_owners = [\"my-org\", \"my-username\"]\n\n# HMAC-SHA256 secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── GitLab ───────────────────────────────────────────────────────────────────\n# Choose one of PAT (token) or OAuth.\n\n[gitlab]\n# PAT — single-user / headless, mutually exclusive with OAuth. Scope: api.\n# Create at https://gitlab.com/-/user_settings/personal_access_tokens\n# Required scope: api\n#token = \"\"  # e.g. \"glpat-...\"\n\n# OAuth multi-user login, mutually exclusive with token.\n# See https://docs.caic.xyz/caic/gitlab for OAuth app setup instructions.\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitLab users allowed to login. Highly recommended.\n# oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitLab instance URL. Empty targets gitlab.com (the REST API always does); set\n# only for self-hosted OAuth login.\n#url = \"\"  # e.g. \"https://gitlab.example.com\"\n\n# Shared secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── Debug ────────────────────────────────────────────────────────────────────\n\n[debug]\n# Log level: debug, info, warn, error.\n#log_level = \"info\"\n\n# Omit timestamps from log output.\n#no_log_time = false\n\n# Expose /debug/pprof/* profiling endpoints.\n#pprof = false\n\n# Profiling output files; empty disables each.\n#cpuprofile = \"\"  # e.g. \"~/.cache/caic/cpu.prof\"\n#memprofile = \"\"  # e.g. \"~/.cache/caic/mem.prof\"\n#trace = \"\"       # e.g. \"~/.cache/caic/trace.out\"\n"}, "669b9e2ff82644b2a00608fe940f258a8d431675": {"t": 1785750199.604897, "n": 7912, "h": "fb8dfef3b1a0f0c9", "c": "# caic configuration\n# Copy to ~/.config/caic/config.toml and edit as needed.\n\n# ── Core ─────────────────────────────────────────────────────────────────────\n\n[core]\n# Parent directory containing the git repositories managed by caic.\n#root = \".\"\n\n# Container runtime. \"\" auto-detects (docker preferred, then podman); set\n# \"docker\" or \"podman\" to pin one. sudo is unsupported with rootless podman, so\n# use docker if you need sudo-enabled containers.\n#runtime = \"\"\n\n# Auto-update schedule (cron expression, local time). Checks GitHub Releases and\n# replaces the binary on a match. Unset = daily at 04:50; \"\" disables.\n# e.g. auto_update = \"50 4 * * *\"\n\n# Environment variables added to those inherited by the server process. Each key\n# falls back to the host environment when omitted here.\n[core.env]\n# Tailscale API key: required for Tailscale ephemeral node.\n# Obtain from https://login.tailscale.com/admin/settings/keys\n# TAILSCALE_API_KEY = \"tskey-...\"\n# Gemini API key: required for the Gemini Live voice agent and for title\n# generation when provider is \"gemini\". Obtain from https://aistudio.google.com/app/apikey\n# GEMINI_API_KEY = \"AIza...\"\n\n# ── Server ───────────────────────────────────────────────────────────────────\n\n[server]\n# HTTP listen address for the web UI. Defaults to localhost only; prefix with\n# \"0.0.0.0\" to listen on all IPv4 addresses.\n# Safety: the MCP endpoint at /api/caic/v1/mcp is disabled when no OAuth login\n# is configured and the server binds a non-loopback address, so an exposed\n# server never serves MCP without authentication. Configure OAuth login below to\n# enable MCP off-localhost.\n#http = \":2242\"\n\n# Public base URL. \"auto\" locks the hostname from the first FQDN request. Set an\n# explicit URL for OAuth login and webhooks.\n#external_url = \"auto\"  # e.g. \"https://caic.example.com\"\n\n# MaxMind MMDB file for country-code resolution and logging. Relative paths\n# resolve against the config directory. Empty defaults to\n# \"~/.config/caic/GeoLite2-Country.mmdb\" if present, otherwise geoip is disabled.\n# https://dev.maxmind.com/geoip/geolite2-free-geolocation-data\n#geo_db = \"\"  # e.g. \"~/.config/caic/GeoLite2-Country.mmdb\"\n\n# Allowed origins; requests from non-matching IPs are rejected with HTTP 403.\n# Named: \"local\" (loopback/private), \"tailscale\" (100.64.0.0/10),\n#   \"anthropic\" (published Anthropic outbound IPs), \"github\" (GitHub webhook\n#   IPs), \"openai\" (published ChatGPT integration and Codex cloud IPs). Dynamic\n#   named origins are cached in ~/.cache/caic/ip-origins.json and refreshed after\n#   24h. CIDR: \"203.0.113.0/24\". Country codes: ISO 3166-1 alpha-2 (e.g. \"CA\"),\n#   which require geo_db.\n#allow_origins = [\"local\", \"tailscale\", \"github\"]\n\n# ── Voice Gateway ────────────────────────────────────────────────────────────\n\n# Voice support is derived automatically:\n#   url set                       advertise that standalone gateway.\n#   no url and GEMINI_API_KEY set  host the embedded gateway in-process.\n#   no url and no GEMINI_API_KEY   disabled.\n[voice-gateway]\n# Standalone voice gateway URL.\n#url = \"\"  # e.g. \"https://voice.example.com\"\n\n# Embedded gateway runtime config, used only when caic hosts the gateway\n# in-process. Same shape as contrib/voice-gateway-config.toml.\n[voice-gateway.config]\n# The API key is always read from GEMINI_API_KEY.\n#model = \"gemini-3.1-flash-live-preview\"\n\n[voice-gateway.config.server]\n# UDP port for WebRTC ICE (single-port mux). 0 = OS-assigned ephemeral port;\n# >0 = a static port (open it for UDP in your firewall). Requires GEMINI_API_KEY.\n# The gateway HTTP port is not configurable here; use server.http.\n#webrtc_udp_port = 0\n\n# Local model stack (set backend = \"local-stack\"). Omit these to let caic manage\n# llama.cpp with the default Gemma model; set them to point at servers you run.\n# [voice-gateway.config.local_stack.asr]\n# provider = \"llamacpp\"\n# remote = \"http://127.0.0.1:8081\"\n# model = \"...\"\n# [voice-gateway.config.local_stack.llm]\n# provider = \"llamacpp\"\n# remote = \"http://127.0.0.1:8080\"\n# model = \"unsloth/gemma-4-E2B-it-GGUF:UD-Q4_K_XL\"\n\n# ── AI ───────────────────────────────────────────────────────────────────────\n\n[ai]\n# LLM provider for title generation, commit descriptions, etc. Empty =\n# auto-detect in order: codex, opencode, claudecode, then any available.\n# https://pkg.go.dev/github.com/maruel/genai/providers\n#provider = \"\"  # e.g. \"codex\"\n\n# Model name or alias. Empty = the provider's auto-detected cheapest model.\n#model = \"\"  # e.g. \"claude-haiku-4-5-20251001\"\n\n# ── Harness ──────────────────────────────────────────────────────────────────\n# Per-harness environment variables injected into containers.\n\n[harness.claude.env]\n# Warning: ANTHROPIC_API_KEY makes Claude Code use API billing and ignore your subscription.\n# ANTHROPIC_API_KEY = \"sk-...\"\n\n[harness.codex.env]\n# Most of codex configuration is via its configuration described at\n# https://developers.openai.com/codex/config-reference\n\n[harness.opencode.env]\n# Most of opencode configuration is via its configuration described at\n# https://opencode.ai/docs/config/\n\n[harness.pi.env]\n# See https://github.com/badlogic/pi-mono/blob/main/packages/coding-agent/docs/providers.md\n# Here's example keys, you can set any environment variable you want.\n# DEEPSEEK_API_KEY = \"...\"\n# GEMINI_API_KEY = \"AIza...\"\n# OPENROUTER_API_KEY = \"sk-or-...\"\n# OPENAI_API_KEY = \"sk-...\"\n\n# ── GitHub ───────────────────────────────────────────────────────────────────\n\n[github]\n# PAT for server-level API access (forges, container token fallback).\n# https://github.com/settings/personal-access-tokens/new\n# Required permissions: pull_requests:write, checks:read. If empty and the gh\n# CLI is in PATH, caic uses `gh auth token` automatically.\n#token = \"\"  # e.g. \"ghp_...\"\n\n# OAuth — multi-user login.\n# See https://docs.caic.xyz/caic/github for OAuth app setup instructions.\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitHub users allowed to log in (highly recommended).\n# oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitHub App — org-wide webhooks and automatic task creation.\n# Layered on top of PAT or OAuth; not mutually exclusive with either.\n# See https://docs.caic.xyz/caic/ for GitHub App setup instructions.\n#app_id = 0  # e.g. 12345\n# PEM file path (relative paths resolve against the config directory).\n#app_private_key_pem = \"\"  # e.g. \"private-key.pem\"\n# Owners/orgs allowed to install the app (highly recommended).\n# app_allowed_owners = [\"my-org\", \"my-username\"]\n\n# HMAC-SHA256 secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── GitLab ───────────────────────────────────────────────────────────────────\n# Choose one of PAT (token) or OAuth.\n\n[gitlab]\n# PAT — single-user / headless, mutually exclusive with OAuth. Scope: api.\n# Create at https://gitlab.com/-/user_settings/personal_access_tokens\n# Required scope: api\n#token = \"\"  # e.g. \"glpat-...\"\n\n# OAuth multi-user login, mutually exclusive with token.\n# See https://docs.caic.xyz/caic/gitlab for OAuth app setup instructions.\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitLab users allowed to login. Highly recommended.\n# oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitLab instance URL. Empty targets gitlab.com (the REST API always does); set\n# only for self-hosted OAuth login.\n#url = \"\"  # e.g. \"https://gitlab.example.com\"\n\n# Shared secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── Debug ────────────────────────────────────────────────────────────────────\n\n[debug]\n# Log level: debug, info, warn, error.\n#log_level = \"info\"\n\n# Omit timestamps from log output.\n#no_log_time = false\n\n# Expose /debug/pprof/* profiling endpoints.\n#pprof = false\n\n# Profiling output files; empty disables each.\n#cpuprofile = \"\"  # e.g. \"~/.cache/caic/cpu.prof\"\n#memprofile = \"\"  # e.g. \"~/.cache/caic/mem.prof\"\n#trace = \"\"       # e.g. \"~/.cache/caic/trace.out\"\n"}, "d813ed03312d49a6a750a57eee893f88ed3c3022": {"t": 1785750200.841169, "n": 7649, "h": "9e522b720fa9ee59", "c": "# caic configuration\n# Copy to ~/.config/caic/config.toml and edit as needed.\n\n# ── Core ─────────────────────────────────────────────────────────────────────\n\n[core]\n# Parent directory containing the git repositories managed by caic.\n#root = \".\"\n\n# Container runtime. \"\" auto-detects (docker preferred, then podman); set\n# \"docker\" or \"podman\" to pin one. sudo is unsupported with rootless podman, so\n# use docker if you need sudo-enabled containers.\n#runtime = \"\"\n\n# Auto-update schedule (cron expression, local time). Checks GitHub Releases and\n# replaces the binary on a match. Unset = daily at 04:50; \"\" disables.\n# e.g. auto_update = \"50 4 * * *\"\n\n# Environment variables added to those inherited by the server process. Each key\n# falls back to the host environment when omitted here.\n[core.env]\n# Tailscale API key: required for Tailscale ephemeral node.\n# Obtain from https://login.tailscale.com/admin/settings/keys\n# TAILSCALE_API_KEY = \"tskey-...\"\n# Gemini API key: required for the Gemini Live voice agent and for title\n# generation when provider is \"gemini\". Obtain from https://aistudio.google.com/app/apikey\n# GEMINI_API_KEY = \"AIza...\"\n\n# ── Server ───────────────────────────────────────────────────────────────────\n\n[server]\n# HTTP listen address for the web UI. Defaults to localhost only; prefix with\n# \"0.0.0.0\" to listen on all IPv4 addresses.\n#http = \":2242\"\n\n# Public base URL. \"auto\" locks the hostname from the first FQDN request. Set an\n# explicit URL for OAuth login and webhooks.\n#external_url = \"auto\"  # e.g. \"https://caic.example.com\"\n\n# MaxMind MMDB file for country-code resolution and logging. Relative paths\n# resolve against the config directory. Empty defaults to\n# \"~/.config/caic/GeoLite2-Country.mmdb\" if present, otherwise geoip is disabled.\n# https://dev.maxmind.com/geoip/geolite2-free-geolocation-data\n#geo_db = \"\"  # e.g. \"~/.config/caic/GeoLite2-Country.mmdb\"\n\n# Allowed origins; requests from non-matching IPs are rejected with HTTP 403.\n# Named: \"local\" (loopback/private), \"tailscale\" (100.64.0.0/10),\n#   \"anthropic\" (published Anthropic outbound IPs), \"github\" (GitHub webhook\n#   IPs), \"openai\" (published ChatGPT integration and Codex cloud IPs). Dynamic\n#   named origins are cached in ~/.cache/caic/ip-origins.json and refreshed after\n#   24h. CIDR: \"203.0.113.0/24\". Country codes: ISO 3166-1 alpha-2 (e.g. \"CA\"),\n#   which require geo_db.\n#allow_origins = [\"local\", \"tailscale\", \"github\"]\n\n# ── Voice Gateway ────────────────────────────────────────────────────────────\n\n# Voice support is derived automatically:\n#   url set                       advertise that standalone gateway.\n#   no url and GEMINI_API_KEY set  host the embedded gateway in-process.\n#   no url and no GEMINI_API_KEY   disabled.\n[voice-gateway]\n# Standalone voice gateway URL.\n#url = \"\"  # e.g. \"https://voice.example.com\"\n\n# Embedded gateway runtime config, used only when caic hosts the gateway\n# in-process. Same shape as contrib/voice-gateway-config.toml.\n[voice-gateway.config]\n# The API key is always read from GEMINI_API_KEY.\n#model = \"gemini-3.1-flash-live-preview\"\n\n[voice-gateway.config.server]\n# UDP port for WebRTC ICE (single-port mux). 0 = OS-assigned ephemeral port;\n# >0 = a static port (open it for UDP in your firewall). Requires GEMINI_API_KEY.\n# The gateway HTTP port is not configurable here; use server.http.\n#webrtc_udp_port = 0\n\n# Local model stack (set backend = \"local-stack\"). Omit these to let caic manage\n# llama.cpp with the default Gemma model; set them to point at servers you run.\n# [voice-gateway.config.local_stack.asr]\n# provider = \"llamacpp\"\n# remote = \"http://127.0.0.1:8081\"\n# model = \"...\"\n# [voice-gateway.config.local_stack.llm]\n# provider = \"llamacpp\"\n# remote = \"http://127.0.0.1:8080\"\n# model = \"unsloth/gemma-4-E2B-it-GGUF:UD-Q4_K_XL\"\n\n# ── AI ───────────────────────────────────────────────────────────────────────\n\n[ai]\n# LLM provider for title generation, commit descriptions, etc. Empty =\n# auto-detect in order: codex, opencode, claudecode, then any available.\n# https://pkg.go.dev/github.com/maruel/genai/providers\n#provider = \"\"  # e.g. \"codex\"\n\n# Model name or alias. Empty = the provider's auto-detected cheapest model.\n#model = \"\"  # e.g. \"claude-haiku-4-5-20251001\"\n\n# ── Harness ──────────────────────────────────────────────────────────────────\n# Per-harness environment variables injected into containers.\n\n[harness.claude.env]\n# Warning: ANTHROPIC_API_KEY makes Claude Code use API billing and ignore your subscription.\n# ANTHROPIC_API_KEY = \"sk-...\"\n\n[harness.codex.env]\n# Most of codex configuration is via its configuration described at\n# https://developers.openai.com/codex/config-reference\n\n[harness.opencode.env]\n# Most of opencode configuration is via its configuration described at\n# https://opencode.ai/docs/config/\n\n[harness.pi.env]\n# See https://github.com/badlogic/pi-mono/blob/main/packages/coding-agent/docs/providers.md\n# Here's example keys, you can set any environment variable you want.\n# DEEPSEEK_API_KEY = \"...\"\n# GEMINI_API_KEY = \"AIza...\"\n# OPENROUTER_API_KEY = \"sk-or-...\"\n# OPENAI_API_KEY = \"sk-...\"\n\n# ── GitHub ───────────────────────────────────────────────────────────────────\n\n[github]\n# PAT for server-level API access (forges, container token fallback).\n# https://github.com/settings/personal-access-tokens/new\n# Required permissions: pull_requests:write, checks:read. If empty and the gh\n# CLI is in PATH, caic uses `gh auth token` automatically.\n#token = \"\"  # e.g. \"ghp_...\"\n\n# OAuth — multi-user login.\n# See https://docs.caic.xyz/caic/github for OAuth app setup instructions.\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitHub users allowed to log in (highly recommended).\n# oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitHub App — org-wide webhooks and automatic task creation.\n# Layered on top of PAT or OAuth; not mutually exclusive with either.\n# See https://docs.caic.xyz/caic/ for GitHub App setup instructions.\n#app_id = 0  # e.g. 12345\n# PEM file path (relative paths resolve against the config directory).\n#app_private_key_pem = \"\"  # e.g. \"private-key.pem\"\n# Owners/orgs allowed to install the app (highly recommended).\n# app_allowed_owners = [\"my-org\", \"my-username\"]\n\n# HMAC-SHA256 secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── GitLab ───────────────────────────────────────────────────────────────────\n# Choose one of PAT (token) or OAuth.\n\n[gitlab]\n# PAT — single-user / headless, mutually exclusive with OAuth. Scope: api.\n# Create at https://gitlab.com/-/user_settings/personal_access_tokens\n# Required scope: api\n#token = \"\"  # e.g. \"glpat-...\"\n\n# OAuth multi-user login, mutually exclusive with token.\n# See https://docs.caic.xyz/caic/gitlab for OAuth app setup instructions.\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitLab users allowed to login. Highly recommended.\n# oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitLab instance URL. Empty targets gitlab.com (the REST API always does); set\n# only for self-hosted OAuth login.\n#url = \"\"  # e.g. \"https://gitlab.example.com\"\n\n# Shared secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── Debug ────────────────────────────────────────────────────────────────────\n\n[debug]\n# Log level: debug, info, warn, error.\n#log_level = \"info\"\n\n# Omit timestamps from log output.\n#no_log_time = false\n\n# Expose /debug/pprof/* profiling endpoints.\n#pprof = false\n\n# Profiling output files; empty disables each.\n#cpuprofile = \"\"  # e.g. \"~/.cache/caic/cpu.prof\"\n#memprofile = \"\"  # e.g. \"~/.cache/caic/mem.prof\"\n#trace = \"\"       # e.g. \"~/.cache/caic/trace.out\"\n"}, "84dc61f29a12583f43ce34016d14fb4952e8cd74": {"t": 1785750201.950027, "n": 7647, "h": "753bcc4003ef0872", "c": "# caic configuration\n# Copy to ~/.config/caic/config.toml and edit as needed.\n\n# ── Core ─────────────────────────────────────────────────────────────────────\n\n[core]\n# Parent directory containing the git repositories managed by caic.\n#root = \".\"\n\n# Container runtime. \"\" auto-detects (docker preferred, then podman); set\n# \"docker\" or \"podman\" to pin one. sudo is unsupported with rootless podman, so\n# use docker if you need sudo-enabled containers.\n#runtime = \"\"\n\n# Auto-update schedule (cron expression, local time). Checks GitHub Releases and\n# replaces the binary on a match. Unset = daily at 04:50; \"\" disables.\n# e.g. auto_update = \"50 4 * * *\"\n\n# Environment variables added to those inherited by the server process. Each key\n# falls back to the host environment when omitted here.\n[core.env]\n# Tailscale API key: required for Tailscale ephemeral node.\n# Obtain from https://login.tailscale.com/admin/settings/keys\n# TAILSCALE_API_KEY = \"tskey-...\"\n# Gemini API key: required for the Gemini Live voice agent and for title\n# generation when provider is \"gemini\". Obtain from https://aistudio.google.com/app/apikey\n# GEMINI_API_KEY = \"AIza...\"\n\n# ── Server ───────────────────────────────────────────────────────────────────\n\n[server]\n# HTTP listen address for the web UI. Defaults to localhost only; prefix with\n# \"0.0.0.0\" to listen on all IPv4 addresses.\n#http = \":2242\"\n\n# Public base URL. \"auto\" locks the hostname from the first FQDN request. Set an\n# explicit URL for OAuth login and webhooks.\n#external_url = \"auto\"  # e.g. \"https://caic.example.com\"\n\n# MaxMind MMDB file for country-code resolution and logging. Relative paths\n# resolve against the config directory. Empty defaults to\n# \"~/.config/caic/GeoLite2-Country.mmdb\" if present, otherwise geoip is disabled.\n# https://dev.maxmind.com/geoip/geolite2-free-geolocation-data\n#geo_db = \"\"  # e.g. \"~/.config/caic/GeoLite2-Country.mmdb\"\n\n# Allowed origins; requests from non-matching IPs are rejected with HTTP 403.\n# Named: \"local\" (loopback/private), \"tailscale\" (100.64.0.0/10),\n#   \"anthropic\" (published Anthropic outbound IPs), \"github\" (GitHub webhook\n#   IPs), \"openai\" (published ChatGPT integration and Codex cloud IPs). Dynamic\n#   named origins are cached in ~/.cache/caic/ip-origins.json and refreshed after\n#   24h. CIDR: \"203.0.113.0/24\". Country codes: ISO 3166-1 alpha-2 (e.g. \"CA\"),\n#   which require geo_db.\n#allow_origins = [\"local\", \"tailscale\", \"github\"]\n\n# ── Voice Gateway ────────────────────────────────────────────────────────────\n\n# Voice support is derived automatically:\n#   url set                       advertise that standalone gateway.\n#   no url and GEMINI_API_KEY set  host the embedded gateway in-process.\n#   no url and no GEMINI_API_KEY   disabled.\n[voice-gateway]\n# Standalone voice gateway URL.\n#url = \"\"  # e.g. \"https://voice.example.com\"\n\n# Embedded gateway runtime config, used only when caic hosts the gateway\n# in-process. Same shape as contrib/voice-gateway-config.toml.\n[voice-gateway.config]\n# The API key is always read from GEMINI_API_KEY.\n#model = \"gemini-3.1-flash-live-preview\"\n\n[voice-gateway.config.server]\n# UDP port for WebRTC ICE (single-port mux). 0 = OS-assigned ephemeral port;\n# >0 = a static port (open it for UDP in your firewall). Requires GEMINI_API_KEY.\n# The gateway HTTP port is not configurable here; use server.http.\n#webrtc_udp_port = 0\n\n# Local model stack (set backend = \"local-stack\"). Omit these to let caic manage\n# llama.cpp with the default Gemma model; set them to point at servers you run.\n# [voice-gateway.config.local_stack.asr]\n# provider = \"llamacpp\"\n# remote = \"http://127.0.0.1:8081\"\n# model = \"...\"\n# [voice-gateway.config.local_stack.llm]\n# provider = \"llamacpp\"\n# remote = \"http://127.0.0.1:8080\"\n# model = \"unsloth/gemma-4-E2B-it-GGUF:UD-Q4_K_XL\"\n\n# ── AI ───────────────────────────────────────────────────────────────────────\n\n[ai]\n# LLM provider for title generation, commit descriptions, etc. Empty =\n# auto-detect in order: codex, opencode, claudecode, then any available.\n# https://pkg.go.dev/github.com/maruel/genai/providers\n#provider = \"\"  # e.g. \"codex\"\n\n# Model name or alias. Empty = the provider's auto-detected cheapest model.\n#model = \"\"  # e.g. \"claude-haiku-4-5-20251001\"\n\n# ── Harness ──────────────────────────────────────────────────────────────────\n# Per-harness environment variables injected into containers.\n\n[harness.claude.env]\n# Warning: ANTHROPIC_API_KEY makes Claude Code use API billing and ignore your subscription.\n# ANTHROPIC_API_KEY = \"sk-...\"\n\n[harness.codex.env]\n# Most of codex configuration is via its configuration described at\n# https://developers.openai.com/codex/config-reference\n\n[harness.opencode.env]\n# Most of opencode configuration is via its configuration described at\n# https://opencode.ai/docs/config/\n\n[harness.pi.env]\n# See https://github.com/badlogic/pi-mono/blob/main/packages/coding-agent/docs/providers.md\n# Here's example keys, you can set any environment variable you want.\n# DEEPSEEK_API_KEY = \"...\"\n# GEMINI_API_KEY = \"AIza...\"\n# OPENROUTER_API_KEY = \"sk-or-...\"\n# OPENAI_API_KEY = \"sk-...\"\n\n# ── GitHub ───────────────────────────────────────────────────────────────────\n\n[github]\n# PAT for server-level API access (forges, container token fallback).\n# https://github.com/settings/personal-access-tokens/new\n# Required permissions: pull_requests:write, checks:read. If empty and the gh\n# CLI is in PATH, caic uses `gh auth token` automatically.\n#token = \"\"  # e.g. \"ghp_...\"\n\n# OAuth — multi-user login.\n# See https://docs.caic.xyz/caic/github for OAuth app setup instructions.\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitHub users allowed to log in (highly recommended).\n# oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitHub App — org-wide webhooks and automatic task creation.\n# Layered on top of PAT or OAuth; not mutually exclusive with either.\n# See https://docs.caic.xyz/caic/ for GitHub App setup instructions.\n#app_id = 0  # e.g. 12345\n# PEM file path (relative paths resolve against the config directory).\n#app_private_key_pem = \"\"  # e.g. \"private-key.pem\"\n# Owners/orgs allowed to install the app (highly recommended).\n#app_allowed_owners = [\"my-org\", \"my-username\"]\n\n# HMAC-SHA256 secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── GitLab ───────────────────────────────────────────────────────────────────\n# Choose one of PAT (token) or OAuth.\n\n[gitlab]\n# PAT — single-user / headless, mutually exclusive with OAuth. Scope: api.\n# Create at https://gitlab.com/-/user_settings/personal_access_tokens\n# Required scope: api\n#token = \"\"  # e.g. \"glpat-...\"\n\n# OAuth multi-user login, mutually exclusive with token.\n# See https://docs.caic.xyz/caic/gitlab for OAuth app setup instructions.\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitLab users allowed to login. Highly recommended.\n#oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitLab instance URL. Empty targets gitlab.com (the REST API always does); set\n# only for self-hosted OAuth login.\n#url = \"\"  # e.g. \"https://gitlab.example.com\"\n\n# Shared secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── Debug ────────────────────────────────────────────────────────────────────\n\n[debug]\n# Log level: debug, info, warn, error.\n#log_level = \"info\"\n\n# Omit timestamps from log output.\n#no_log_time = false\n\n# Expose /debug/pprof/* profiling endpoints.\n#pprof = false\n\n# Profiling output files; empty disables each.\n#cpuprofile = \"\"  # e.g. \"~/.cache/caic/cpu.prof\"\n#memprofile = \"\"  # e.g. \"~/.cache/caic/mem.prof\"\n#trace = \"\"       # e.g. \"~/.cache/caic/trace.out\"\n"}, "1d70bcbcb7b67b209d4c08f96dd47ff2eb6630f2": {"t": 1785750203.0459442, "n": 7342, "h": "c4ea1ad37ee6e0a2", "c": "# caic configuration\n# Copy to ~/.config/caic/config.toml and edit as needed.\n\n# ── Core ─────────────────────────────────────────────────────────────────────\n\n[core]\n# Parent directory containing the git repositories managed by caic.\n#root = \".\"\n\n# Container runtime. \"\" auto-detects (docker preferred, then podman); set\n# \"docker\" or \"podman\" to pin one. sudo is unsupported with rootless podman, so\n# use docker if you need sudo-enabled containers.\n#runtime = \"\"\n\n# Auto-update schedule (cron expression, local time). Checks GitHub Releases and\n# replaces the binary on a match. Unset = daily at 04:50; \"\" disables.\n# e.g. auto_update = \"50 4 * * *\"\n\n# Environment variables added to those inherited by the server process. Each key\n# falls back to the host environment when omitted here.\n[core.env]\n# Tailscale API key — required for the Tailscale ephemeral node.\n# https://login.tailscale.com/admin/settings/keys\n# TAILSCALE_API_KEY = \"tskey-...\"\n# Gemini API key — required for the Gemini Live voice agent and for title\n# generation when provider is \"gemini\". https://aistudio.google.com/app/apikey\n# GEMINI_API_KEY = \"AIza...\"\n\n# ── Server ───────────────────────────────────────────────────────────────────\n\n[server]\n# HTTP listen address for the web UI. Defaults to localhost only; prefix with\n# \"0.0.0.0\" to listen on all IPv4 addresses.\n#http = \":2242\"\n\n# Public base URL. \"auto\" locks the hostname from the first FQDN request. Set an\n# explicit URL for OAuth login and webhooks.\n#external_url = \"auto\"  # e.g. \"https://caic.example.com\"\n\n# MaxMind MMDB file for country-code resolution and logging. Relative paths\n# resolve against the config directory. Empty defaults to\n# \"~/.config/caic/GeoLite2-Country.mmdb\" if present, otherwise geoip is disabled.\n# https://dev.maxmind.com/geoip/geolite2-free-geolocation-data\n#geo_db = \"\"  # e.g. \"~/.config/caic/GeoLite2-Country.mmdb\"\n\n# Allowed origins; requests from non-matching IPs are rejected with HTTP 403.\n# Named: \"local\" (loopback/private), \"tailscale\" (100.64.0.0/10),\n#   \"anthropic\" (published Anthropic outbound IPs), \"github\" (GitHub webhook\n#   IPs), \"openai\" (published ChatGPT integration and Codex cloud IPs). Dynamic\n#   named origins are cached in ~/.cache/caic/ip-origins.json and refreshed after\n#   24h. CIDR: \"203.0.113.0/24\". Country codes: ISO 3166-1 alpha-2 (e.g. \"CA\"),\n#   which require geo_db.\n#allow_origins = [\"local\", \"tailscale\", \"github\"]\n\n# ── Voice Gateway ────────────────────────────────────────────────────────────\n# Voice support is derived automatically:\n#   url set                       advertise that standalone gateway.\n#   no url and GEMINI_API_KEY set  host the embedded gateway in-process.\n#   no url and no GEMINI_API_KEY   disabled.\n\n[voice-gateway]\n# Standalone voice gateway URL.\n#url = \"\"  # e.g. \"https://voice.example.com\"\n\n# Embedded gateway runtime config, used only when caic hosts the gateway\n# in-process. Same shape as contrib/voice-gateway-config.toml. The API key is\n# always read from GEMINI_API_KEY.\n[voice-gateway.config]\n#model = \"gemini-3.1-flash-live-preview\"\n#backend = \"gemini-live\"\n\n[voice-gateway.config.server]\n# UDP port for WebRTC ICE (single-port mux). 0 = OS-assigned ephemeral port;\n# >0 = a static port (open it for UDP in your firewall). Requires GEMINI_API_KEY.\n# The gateway HTTP port is not configurable here; use server.http.\n#webrtc_udp_port = 0\n\n# Local model stack (set backend = \"local-stack\"). Omit these to let caic manage\n# llama.cpp with the default Gemma model; set them to point at servers you run.\n# [voice-gateway.config.local_stack.asr]\n# provider = \"llamacpp\"\n# remote = \"http://127.0.0.1:8081\"\n# model = \"...\"\n# [voice-gateway.config.local_stack.llm]\n# provider = \"llamacpp\"\n# remote = \"http://127.0.0.1:8080\"\n# model = \"unsloth/gemma-4-E2B-it-GGUF:UD-Q4_K_XL\"\n\n# ── AI ───────────────────────────────────────────────────────────────────────\n\n[ai]\n# LLM provider for title generation, commit descriptions, etc. Empty =\n# auto-detect in order: codex, opencode, claudecode, then any available.\n# https://pkg.go.dev/github.com/maruel/genai/providers\n#provider = \"\"  # e.g. \"codex\"\n\n# Model name or alias. Empty = the provider's auto-detected cheapest model.\n#model = \"\"  # e.g. \"claude-haiku-4-5-20251001\"\n\n# ── Harness ──────────────────────────────────────────────────────────────────\n# Per-harness environment variables injected into containers. They supplement\n# the automatic *_API_KEY forwarding from the host and feed the startup model\n# list fetch. Uncomment a section and add KEY = \"value\" pairs.\n#\n# [harness.claude.env]\n# Warning: ANTHROPIC_API_KEY makes Claude Code use API billing and ignore your subscription.\n# ANTHROPIC_API_KEY = \"sk-...\"\n#\n# [harness.codex.env]    — see https://developers.openai.com/codex/config-reference\n# [harness.opencode.env] — see https://opencode.ai/docs/config/\n#\n# [harness.pi.env]\n# See https://github.com/badlogic/pi-mono/blob/main/packages/coding-agent/docs/providers.md\n# DEEPSEEK_API_KEY = \"...\"\n# GEMINI_API_KEY = \"AIza...\"\n# OPENROUTER_API_KEY = \"sk-or-...\"\n# OPENAI_API_KEY = \"sk-...\"\n\n# ── GitHub ───────────────────────────────────────────────────────────────────\n\n[github]\n# PAT for server-level API access (forges, container token fallback).\n# https://github.com/settings/personal-access-tokens/new\n# Required permissions: pull_requests:write, checks:read. If empty and the gh\n# CLI is in PATH, caic uses `gh auth token` automatically.\n#token = \"\"  # e.g. \"ghp_...\"\n\n# OAuth multi-user login. https://docs.caic.xyz/caic/github\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitHub users allowed to log in (highly recommended).\n# oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitHub App — org-wide webhooks and automatic task creation; layered on top of\n# PAT or OAuth. https://docs.caic.xyz/caic/\n#app_id = 0  # e.g. 12345\n# PEM file path (relative paths resolve against the config directory).\n#app_private_key_pem = \"\"  # e.g. \"private-key.pem\"\n# Owners/orgs allowed to install the app (highly recommended).\n# app_allowed_owners = [\"my-org\", \"my-username\"]\n\n# HMAC-SHA256 secret for webhook verification (openssl rand -hex 32).\n#webhook_secret = \"\"\n\n# ── GitLab ───────────────────────────────────────────────────────────────────\n# Choose one of PAT (token) or OAuth.\n\n[gitlab]\n# PAT — single-user / headless, mutually exclusive with OAuth. Scope: api.\n# https://gitlab.com/-/user_settings/personal_access_tokens\n#token = \"\"  # e.g. \"glpat-...\"\n\n# OAuth multi-user login, mutually exclusive with token.\n# https://docs.caic.xyz/caic/gitlab\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitLab instance URL. Empty targets gitlab.com (the REST API always does); set\n# only for self-hosted OAuth login.\n#url = \"\"  # e.g. \"https://gitlab.example.com\"\n\n# Webhook verification secret (openssl rand -hex 32).\n#webhook_secret = \"\"\n\n# ── Debug ────────────────────────────────────────────────────────────────────\n\n[debug]\n# Log level: debug, info, warn, error.\n#log_level = \"info\"\n\n# Omit timestamps from log output.\n#no_log_time = false\n\n# Expose /debug/pprof/* profiling endpoints.\n#pprof = false\n\n# Profiling output files; empty disables each.\n#cpuprofile = \"\"  # e.g. \"~/.cache/caic/cpu.prof\"\n#memprofile = \"\"  # e.g. \"~/.cache/caic/mem.prof\"\n#trace = \"\"       # e.g. \"~/.cache/caic/trace.out\"\n"}, "7f208fdf01afacea3b94fc3606763d3b3c9ebe8f": {"t": 1785750204.169461, "n": 7129, "h": "a30fdfb155236a6e", "c": "# caic configuration\n# Copy to ~/.config/caic/config.toml and edit as needed.\n\n# ── Core ─────────────────────────────────────────────────────────────────────\n\n[core]\n# Parent directory containing the git repositories managed by caic.\n#root = \".\"\n\n# Container runtime. \"\" auto-detects (docker preferred, then podman); set\n# \"docker\" or \"podman\" to pin one. sudo is unsupported with rootless podman, so\n# use docker if you need sudo-enabled containers.\n#runtime = \"\"\n\n# Auto-update schedule (cron expression, local time). Checks GitHub Releases and\n# replaces the binary on a match. Unset = daily at 04:50; \"\" disables.\n# e.g. auto_update = \"50 4 * * *\"\n\n# Environment variables added to those inherited by the server process. Each key\n# falls back to the host environment when omitted here.\n[core.env]\n# Tailscale API key — required for the Tailscale ephemeral node.\n# https://login.tailscale.com/admin/settings/keys\n# TAILSCALE_API_KEY = \"tskey-...\"\n# Gemini API key — required for the Gemini Live voice agent and for title\n# generation when provider is \"gemini\". https://aistudio.google.com/app/apikey\n# GEMINI_API_KEY = \"AIza...\"\n\n# ── Server ───────────────────────────────────────────────────────────────────\n\n[server]\n# HTTP listen address for the web UI. Defaults to localhost only; prefix with\n# \"0.0.0.0\" to listen on all IPv4 addresses.\n#http = \":2242\"\n\n# Public base URL. \"auto\" locks the hostname from the first FQDN request. Set an\n# explicit URL for OAuth login and webhooks.\n#external_url = \"auto\"  # e.g. \"https://caic.example.com\"\n\n# MaxMind MMDB file for country-code resolution and logging. Relative paths\n# resolve against the config directory. Empty defaults to\n# \"~/.config/caic/GeoLite2-Country.mmdb\" if present, otherwise geoip is disabled.\n# https://dev.maxmind.com/geoip/geolite2-free-geolocation-data\n#geo_db = \"\"  # e.g. \"~/.config/caic/GeoLite2-Country.mmdb\"\n\n# Allowed origins; requests from non-matching IPs are rejected with HTTP 403.\n# Named: \"local\" (loopback/private), \"tailscale\" (100.64.0.0/10), \"github\"\n#   (GitHub webhook IPs). CIDR: \"203.0.113.0/24\". Country codes: ISO 3166-1\n#   alpha-2 (e.g. \"CA\"), which require geo_db.\n#allow_origins = [\"local\", \"tailscale\", \"github\"]\n\n# ── Voice Gateway ────────────────────────────────────────────────────────────\n# Voice support is derived automatically:\n#   url set                       advertise that standalone gateway.\n#   no url and GEMINI_API_KEY set  host the embedded gateway in-process.\n#   no url and no GEMINI_API_KEY   disabled.\n\n[voice-gateway]\n# Standalone voice gateway URL.\n#url = \"\"  # e.g. \"https://voice.example.com\"\n\n# Embedded gateway runtime config, used only when caic hosts the gateway\n# in-process. Same shape as contrib/voice-gateway-config.toml. The API key is\n# always read from GEMINI_API_KEY.\n[voice-gateway.config]\n#model = \"gemini-3.1-flash-live-preview\"\n#backend = \"gemini-live\"\n\n[voice-gateway.config.server]\n# UDP port for WebRTC ICE (single-port mux). 0 = OS-assigned ephemeral port;\n# >0 = a static port (open it for UDP in your firewall). Requires GEMINI_API_KEY.\n# The gateway HTTP port is not configurable here; use server.http.\n#webrtc_udp_port = 0\n\n# Local model stack (set backend = \"local-stack\"). Omit these to let caic manage\n# llama.cpp with the default Gemma model; set them to point at servers you run.\n# [voice-gateway.config.local_stack.asr]\n# provider = \"llamacpp\"\n# remote = \"http://127.0.0.1:8081\"\n# model = \"...\"\n# [voice-gateway.config.local_stack.llm]\n# provider = \"llamacpp\"\n# remote = \"http://127.0.0.1:8080\"\n# model = \"unsloth/gemma-4-E2B-it-GGUF:UD-Q4_K_XL\"\n\n# ── AI ───────────────────────────────────────────────────────────────────────\n\n[ai]\n# LLM provider for title generation, commit descriptions, etc. Empty =\n# auto-detect in order: codex, opencode, claudecode, then any available.\n# https://pkg.go.dev/github.com/maruel/genai/providers\n#provider = \"\"  # e.g. \"codex\"\n\n# Model name or alias. Empty = the provider's auto-detected cheapest model.\n#model = \"\"  # e.g. \"claude-haiku-4-5-20251001\"\n\n# ── Harness ──────────────────────────────────────────────────────────────────\n# Per-harness environment variables injected into containers. They supplement\n# the automatic *_API_KEY forwarding from the host and feed the startup model\n# list fetch. Uncomment a section and add KEY = \"value\" pairs.\n#\n# [harness.claude.env]\n# Warning: ANTHROPIC_API_KEY makes Claude Code use API billing and ignore your subscription.\n# ANTHROPIC_API_KEY = \"sk-...\"\n#\n# [harness.codex.env]    — see https://developers.openai.com/codex/config-reference\n# [harness.opencode.env] — see https://opencode.ai/docs/config/\n#\n# [harness.pi.env]\n# See https://github.com/badlogic/pi-mono/blob/main/packages/coding-agent/docs/providers.md\n# DEEPSEEK_API_KEY = \"...\"\n# GEMINI_API_KEY = \"AIza...\"\n# OPENROUTER_API_KEY = \"sk-or-...\"\n# OPENAI_API_KEY = \"sk-...\"\n\n# ── GitHub ───────────────────────────────────────────────────────────────────\n\n[github]\n# PAT for server-level API access (forges, container token fallback).\n# https://github.com/settings/personal-access-tokens/new\n# Required permissions: pull_requests:write, checks:read. If empty and the gh\n# CLI is in PATH, caic uses `gh auth token` automatically.\n#token = \"\"  # e.g. \"ghp_...\"\n\n# OAuth multi-user login. https://docs.caic.xyz/caic/github\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitHub users allowed to log in (highly recommended).\n# oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitHub App — org-wide webhooks and automatic task creation; layered on top of\n# PAT or OAuth. https://docs.caic.xyz/caic/\n#app_id = 0  # e.g. 12345\n# PEM file path (relative paths resolve against the config directory).\n#app_private_key_pem = \"\"  # e.g. \"private-key.pem\"\n# Owners/orgs allowed to install the app (highly recommended).\n# app_allowed_owners = [\"my-org\", \"my-username\"]\n\n# HMAC-SHA256 secret for webhook verification (openssl rand -hex 32).\n#webhook_secret = \"\"\n\n# ── GitLab ───────────────────────────────────────────────────────────────────\n# Choose one of PAT (token) or OAuth.\n\n[gitlab]\n# PAT — single-user / headless, mutually exclusive with OAuth. Scope: api.\n# https://gitlab.com/-/user_settings/personal_access_tokens\n#token = \"\"  # e.g. \"glpat-...\"\n\n# OAuth multi-user login, mutually exclusive with token.\n# https://docs.caic.xyz/caic/gitlab\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitLab instance URL. Empty targets gitlab.com (the REST API always does); set\n# only for self-hosted OAuth login.\n#url = \"\"  # e.g. \"https://gitlab.example.com\"\n\n# Webhook verification secret (openssl rand -hex 32).\n#webhook_secret = \"\"\n\n# ── Debug ────────────────────────────────────────────────────────────────────\n\n[debug]\n# Log level: debug, info, warn, error.\n#log_level = \"info\"\n\n# Omit timestamps from log output.\n#no_log_time = false\n\n# Expose /debug/pprof/* profiling endpoints.\n#pprof = false\n\n# Profiling output files; empty disables each.\n#cpuprofile = \"\"  # e.g. \"~/.cache/caic/cpu.prof\"\n#memprofile = \"\"  # e.g. \"~/.cache/caic/mem.prof\"\n#trace = \"\"       # e.g. \"~/.cache/caic/trace.out\"\n"}, "eccc2a9ffa68d9c34789465b6ba4eb78cf29d6f0": {"t": 1785750205.244286, "n": 7138, "h": "d279b501387ab786", "c": "# caic configuration\n# Copy to ~/.config/caic/config.toml and edit as needed.\n\n# ── Core ─────────────────────────────────────────────────────────────────────\n\n[core]\n# Parent directory containing the git repositories managed by caic.\n#root = \".\"\n\n# Container runtime. \"\" auto-detects (docker preferred, then podman); set\n# \"docker\" or \"podman\" to pin one. sudo is unsupported with rootless podman, so\n# use docker if you need sudo-enabled containers.\n#runtime = \"\"\n\n# Auto-update schedule (cron expression, local time). Checks GitHub Releases and\n# replaces the binary on a match. Unset = daily at 04:50; \"\" disables.\n# e.g. auto_update = \"50 4 * * *\"\n\n# Environment variables added to those inherited by the server process. Each key\n# falls back to the host environment when omitted here.\n[core.env]\n# Tailscale API key — required for the Tailscale ephemeral node.\n# https://login.tailscale.com/admin/settings/keys\n# TAILSCALE_API_KEY = \"tskey-...\"\n# Gemini API key — required for the Gemini Live voice agent and for title\n# generation when provider is \"gemini\". https://aistudio.google.com/app/apikey\n# GEMINI_API_KEY = \"AIza...\"\n\n# ── Server ───────────────────────────────────────────────────────────────────\n\n[server]\n# HTTP listen address for the web UI. Defaults to localhost only; prefix with\n# \"0.0.0.0\" to listen on all IPv4 addresses.\n#http = \":2242\"\n\n# Public base URL. \"auto\" locks the hostname from the first FQDN request. Set an\n# explicit URL for OAuth login and webhooks.\n#external_url = \"auto\"  # e.g. \"https://caic.example.com\"\n\n# MaxMind MMDB file for country-code resolution and logging. Relative paths\n# resolve against the config directory. Empty defaults to\n# \"~/.config/caic/GeoLite2-Country.mmdb\" if present, otherwise geoip is disabled.\n# https://dev.maxmind.com/geoip/geolite2-free-geolocation-data\n#geo_db = \"\"  # e.g. \"~/.config/caic/GeoLite2-Country.mmdb\"\n\n# Allowed origins; requests from non-matching IPs are rejected with HTTP 403.\n# Named: \"local\" (loopback/private), \"tailscale\" (100.64.0.0/10), \"github\"\n#   (GitHub webhook IPs). CIDR: \"203.0.113.0/24\". Country codes: ISO 3166-1\n#   alpha-2 (e.g. \"CA\"), which require geo_db.\n#allow_origins = [\"local\", \"tailscale\", \"github\"]\n\n# ── Voice Gateway ────────────────────────────────────────────────────────────\n# Voice support is derived automatically:\n#   url set                       advertise that standalone gateway.\n#   no url and GEMINI_API_KEY set  host the embedded gateway in-process.\n#   no url and no GEMINI_API_KEY   disabled.\n\n[voice-gateway]\n# Standalone voice gateway URL.\n#url = \"\"  # e.g. \"https://voice.example.com\"\n\n# Embedded gateway runtime config, used only when caic hosts the gateway\n# in-process. Same shape as contrib/voice-gateway-config.toml. The API key is\n# always read from GEMINI_API_KEY.\n[voice-gateway.config]\n#model = \"gemini-3.1-flash-live-preview\"\n#backend = \"gemini-live\"\n\n[voice-gateway.config.server]\n# UDP port for WebRTC ICE (single-port mux). 0 = OS-assigned ephemeral port;\n# >0 = a static port (open it for UDP in your firewall). Requires GEMINI_API_KEY.\n# The gateway HTTP port is not configurable here; use server.http.\n#webrtc_udp_port = 0\n\n# Local model stack (set backend = \"local-stack\"). Omit these to let caic manage\n# llama.cpp with the default Gemma model; set them to point at servers you run.\n# [voice-gateway.config.local_stack.asr]\n# provider = \"llamacpp\"\n# remote = \"http://127.0.0.1:8081\"\n# model = \"...\"\n# [voice-gateway.config.local_stack.llm]\n# provider = \"llamacpp\"\n# remote = \"http://127.0.0.1:8080\"\n# model = \"unsloth/gemma-4-E2B-it-GGUF:UD-Q4_K_XL\"\n\n# ── AI ───────────────────────────────────────────────────────────────────────\n\n[ai]\n# LLM provider for title generation, commit descriptions, etc. Empty =\n# auto-detect in order: codex, opencode, claudecode, gemini, then any available.\n# https://pkg.go.dev/github.com/maruel/genai/providers\n#provider = \"\"  # e.g. \"gemini\"\n\n# Model name or alias. Empty = the provider's auto-detected cheapest model.\n#model = \"\"  # e.g. \"claude-haiku-4-5-20251001\"\n\n# ── Harness ──────────────────────────────────────────────────────────────────\n# Per-harness environment variables injected into containers. They supplement\n# the automatic *_API_KEY forwarding from the host and feed the startup model\n# list fetch. Uncomment a section and add KEY = \"value\" pairs.\n#\n# [harness.claude.env]\n# Warning: ANTHROPIC_API_KEY makes Claude Code use API billing and ignore your subscription.\n# ANTHROPIC_API_KEY = \"sk-...\"\n#\n# [harness.codex.env]    — see https://developers.openai.com/codex/config-reference\n# [harness.opencode.env] — see https://opencode.ai/docs/config/\n#\n# [harness.pi.env]\n# See https://github.com/badlogic/pi-mono/blob/main/packages/coding-agent/docs/providers.md\n# DEEPSEEK_API_KEY = \"...\"\n# GEMINI_API_KEY = \"AIza...\"\n# OPENROUTER_API_KEY = \"sk-or-...\"\n# OPENAI_API_KEY = \"sk-...\"\n\n# ── GitHub ───────────────────────────────────────────────────────────────────\n\n[github]\n# PAT for server-level API access (forges, container token fallback).\n# https://github.com/settings/personal-access-tokens/new\n# Required permissions: pull_requests:write, checks:read. If empty and the gh\n# CLI is in PATH, caic uses `gh auth token` automatically.\n#token = \"\"  # e.g. \"ghp_...\"\n\n# OAuth multi-user login. https://docs.caic.xyz/caic/github\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitHub users allowed to log in (highly recommended).\n# oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitHub App — org-wide webhooks and automatic task creation; layered on top of\n# PAT or OAuth. https://docs.caic.xyz/caic/\n#app_id = 0  # e.g. 12345\n# PEM file path (relative paths resolve against the config directory).\n#app_private_key_pem = \"\"  # e.g. \"private-key.pem\"\n# Owners/orgs allowed to install the app (highly recommended).\n# app_allowed_owners = [\"my-org\", \"my-username\"]\n\n# HMAC-SHA256 secret for webhook verification (openssl rand -hex 32).\n#webhook_secret = \"\"\n\n# ── GitLab ───────────────────────────────────────────────────────────────────\n# Choose one of PAT (token) or OAuth.\n\n[gitlab]\n# PAT — single-user / headless, mutually exclusive with OAuth. Scope: api.\n# https://gitlab.com/-/user_settings/personal_access_tokens\n#token = \"\"  # e.g. \"glpat-...\"\n\n# OAuth multi-user login, mutually exclusive with token.\n# https://docs.caic.xyz/caic/gitlab\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitLab instance URL. Empty targets gitlab.com (the REST API always does); set\n# only for self-hosted OAuth login.\n#url = \"\"  # e.g. \"https://gitlab.example.com\"\n\n# Webhook verification secret (openssl rand -hex 32).\n#webhook_secret = \"\"\n\n# ── Debug ────────────────────────────────────────────────────────────────────\n\n[debug]\n# Log level: debug, info, warn, error.\n#log_level = \"info\"\n\n# Omit timestamps from log output.\n#no_log_time = false\n\n# Expose /debug/pprof/* profiling endpoints.\n#pprof = false\n\n# Profiling output files; empty disables each.\n#cpuprofile = \"\"  # e.g. \"~/.cache/caic/cpu.prof\"\n#memprofile = \"\"  # e.g. \"~/.cache/caic/mem.prof\"\n#trace = \"\"       # e.g. \"~/.cache/caic/trace.out\"\n"}, "599bc4ada0d66dcbb3a791dd06ad5adfc1358c53": {"t": 1785750206.3448648, "n": 7925, "h": "5a6f3ad532adab04", "c": "# caic configuration\n# Copy to ~/.config/caic/config.toml and edit as needed.\n\n# ── Core ─────────────────────────────────────────────────────────────────────\n\n[core]\n# Parent directory containing git repositories managed by caic.\n#root = \".\"\n\n# Container runtime: \"docker\" or \"podman\". Default: \"docker\".\n# When set to \"podman\", caic uses podman for all container operations.\n# Note: sudo is not supported with rootless podman (running as non-root user).\n# Use docker if you need sudo-enabled containers.\n#runtime = \"docker\"\n\n# Auto-update schedule (cron expression, local time). Checks GitHub Releases\n# and replaces the binary on match. Set to \"\" to disable.\n# When not set, defaults to daily at 04:50.\n#auto_update = \"\"\n\n# Add environment variables to the ones inherited by the server process.\n# Falls back to the host environment if not set.\n[core.env]\n# Tailscale API key — required for Tailscale ephemeral node.\n# Obtain from https://login.tailscale.com/admin/settings/keys\n#TAILSCALE_API_KEY = \"\"\n\n# Gemini API key: required for Gemini Live voice agent via WebRTC, and title generation\n# when provider is \"gemini\". Obtain from https://aistudio.google.com/app/apikey\n#GEMINI_API_KEY = \"\"\n\n# ── Server ───────────────────────────────────────────────────────────────────\n\n[server]\n# HTTP listen address for the web UI. By default only listens to localhost. To listen to all IPv4 addreses,\n# prefix with \"0.0.0.0\".\n#http = \":2242\"\n\n# Public base URL. \"auto\" locks the hostname from the first FQDN request.\n# Set an explicit URL for OAuth login and webhooks.\n# Example: \"https://caic.example.com\" or \"https://caic.my-tailnet.ts.net\"\n#external_url = \"auto\"\n\n# Path to a MaxMind MMDB file for country-code resolution and logging.\n# Download GeoLite2-Country.mmdb from https://dev.maxmind.com/geoip/geolite2-free-geolocation-data\n# Relative paths are resolved against the config directory.\n#geo_db = \"GeoLite2-Country.mmdb\"\n\n# Allowed origins. Requests from IPs that do not match are rejected with\n# HTTP 403.\n# Named origins: \"local\" (loopback/private), \"tailscale\" (100.64.0.0/10),\n#   \"github\" (GitHub webhook IPs fetched from api.github.com/meta).\n# CIDR ranges: e.g. \"203.0.113.0/24\".\n# Country codes: ISO 3166-1 alpha-2 (e.g. \"CA\", \"US\", \"DE\"); requires geo_db.\n#allow_origins = [\"local\", \"tailscale\", \"github\"]\n\n# ── Voice Gateway ────────────────────────────────────────────────────────────\n\n[voice-gateway]\n# Voice gateway support is derived automatically:\n#   url set = advertise that standalone voice gateway URL.\n#   no url and GEMINI_API_KEY available = host the embedded voice gateway.\n#   no url and no GEMINI_API_KEY = disabled.\n\n# Standalone voice gateway URL.\n#url = \"https://voice.example.com\"\n\n# Optional embedded gateway runtime config. This uses the same shape as the\n# standalone ~/.config/voice-gateway/config.toml template in\n# contrib/voice-gateway-config.toml. Only set this when caic is hosting the\n# gateway protocol in-process.\n#[voice-gateway.config]\n# The API key is always read from GEMINI_API_KEY.\n#model = \"gemini-3.1-flash-live-preview\"\n\n# Local stack backend. Omit [voice-gateway.config.local_stack.llm] to let\n# caic manage llama.cpp with the default Gemma GGUF model.\n#backend = \"local-stack\"\n#\n# Use this only when you run llama-server yourself.\n#[voice-gateway.config.local_stack.llm]\n#provider = \"llamacpp\"\n#remote = \"http://127.0.0.1:8080\"\n#model = \"unsloth/gemma-4-E2B-it-GGUF:UD-Q4_K_XL\"\n\n#[voice-gateway.config.server]\n# UDP port for WebRTC ICE (single-port mux).\n# 0 (default) = enabled with OS-assigned ephemeral port.\n# >0 = enabled on that static port (open it in your firewall for UDP traffic).\n# GEMINI_API_KEY is required.\n#webrtc_udp_port = 0\n\n# ── AI ───────────────────────────────────────────────────────────────────────\n\n[ai]\n# LLM provider for title generation, commit descriptions, etc.\n# When unset, auto-detects the best available provider in this order:\n#   1. codex (Codex)\n#   2. opencode (OpenCode)\n#   3. claudecode (Claude Code)\n#   4. gemini (Gemini)\n#   5. Any other available provider\n# Available providers: https://pkg.go.dev/github.com/maruel/genai/providers\n#provider = \"\"\n\n# Model name or alias. When unset, uses the provider's auto-detected cheapest model.\n#model = \"\"\n\n# ── Harness ──────────────────────────────────────────────────────────────────\n# Per-harness environment variables injected into containers. Each harness\n# section supports an [env] table of KEY = \"VALUE\" pairs. These supplement the\n# automatic *_API_KEY forwarding from the host environment and are also used\n# when fetching the model list at startup.\n[harness.claude.env]\n# Warning: setting this environment variable will cause Claude Code to use API costs and ignore your\n# subscription.\n#ANTHROPIC_API_KEY = \"sk-...\"\n\n[harness.codex.env]\n# Most of codex configuration is via its configuration described at\n# https://developers.openai.com/codex/config-reference\n\n[harness.opencode.env]\n# Most of opencode configuration is via its configuration described at\n# https://opencode.ai/docs/config/\n\n[harness.pi.env]\n# See https://github.com/badlogic/pi-mono/blob/main/packages/coding-agent/docs/providers.md\n# Here's example keys, you can set any environment variable you want.\n#DEEPSEEK_API_KEY= \"\"\n#GEMINI_API_KEY = \"AIza...\"\n#OPENROUTER_API_KEY = \"sk-or-...\"\n#OPENAI_API_KEY = \"sk-...\"\n\n# ── GitHub ───────────────────────────────────────────────────────────────────\n# PAT for server-level API access (forges, autoupdate). OAuth for user login.\n# GitHub App is independent and can be layered on either or both.\n\n[github]\n# PAT — server-level API access (forges, container token fallback).\n# Create at https://github.com/settings/personal-access-tokens/new\n# Required permissions: pull_requests:write, checks:read\n# If unset and gh CLI is in PATH, caic uses the token from `gh auth token`\n# automatically.\n#token = \"\"\n\n# OAuth — multi-user login.\n# See https://docs.caic.xyz/caic/github for OAuth app setup instructions.\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitHub users allowed to login. Highly recommended.\n#oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitHub App — org-wide webhooks and automatic task creation.\n# Layered on top of PAT or OAuth; not mutually exclusive with either.\n# See https://docs.caic.xyz/caic/ for GitHub App setup instructions.\n#app_id = 0\n# Path to PEM file (relative paths resolve against the config directory).\n#app_private_key_pem = \"private-key.pem\"\n# Owners/orgs allowed to install the app. Installs from other accounts are\n# rejected automatically. Highly recommended.\n#app_allowed_owners = [\"my-org\", \"my-username\"]\n\n# HMAC-SHA256 secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── GitLab ───────────────────────────────────────────────────────────────────\n# Choose one of PAT (token) or OAuth.\n\n[gitlab]\n# PAT — single-user / headless. Mutually exclusive with OAuth.\n# Create at https://gitlab.com/-/user_settings/personal_access_tokens\n# Required scope: api\n#token = \"\"\n\n# OAuth — multi-user login. Mutually exclusive with token.\n# See https://docs.caic.xyz/caic/gitlab for OAuth app setup instructions.\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitLab users allowed to login. Highly recommended.\n#oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitLab instance URL.\n#url = \"https://gitlab.com\"\n\n# Shared secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── Debug ────────────────────────────────────────────────────────────────────\n\n[debug]\n# Log level: debug, info, warn, error.\n#log_level = \"info\"\n\n# Omit timestamps from log output.\n#no_log_time = false\n\n# Expose /debug/pprof/* profiling endpoints.\n#pprof = false\n\n# Write CPU profile to file.\n#cpuprofile = \"~/.cache/caic/cpu.prof\"\n\n# Write heap profile to file on shutdown.\n#memprofile = \"~/.cache/caic/mem.prof\"\n\n# Write execution trace to file.\n#trace = \"~/.cache/caic/trace.out\"\n"}, "e747cd809cd4c4cbe1afa2967f713b3761083993": {"t": 1785750207.5692775, "n": 7565, "h": "21a384103c2a6720", "c": "# caic configuration\n# Copy to ~/.config/caic/config.toml and edit as needed.\n\n# ── Core ─────────────────────────────────────────────────────────────────────\n\n[core]\n# Parent directory containing git repositories managed by caic.\n#root = \".\"\n\n# Container runtime: \"docker\" or \"podman\". Default: \"docker\".\n# When set to \"podman\", caic uses podman for all container operations.\n# Note: sudo is not supported with rootless podman (running as non-root user).\n# Use docker if you need sudo-enabled containers.\n#runtime = \"docker\"\n\n# Auto-update schedule (cron expression, local time). Checks GitHub Releases\n# and replaces the binary on match. Set to \"\" to disable.\n# When not set, defaults to daily at 04:50.\n#auto_update = \"\"\n\n# Add environment variables to the ones inherited by the server process.\n# Falls back to the host environment if not set.\n[core.env]\n# Tailscale API key — required for Tailscale ephemeral node.\n# Obtain from https://login.tailscale.com/admin/settings/keys\n#TAILSCALE_API_KEY = \"\"\n\n# Gemini API key: required for Gemini Live voice agent via WebRTC, and title generation\n# when provider is \"gemini\". Obtain from https://aistudio.google.com/app/apikey\n#GEMINI_API_KEY = \"\"\n\n# ── Server ───────────────────────────────────────────────────────────────────\n\n[server]\n# HTTP listen address for the web UI. By default only listens to localhost. To listen to all IPv4 addreses,\n# prefix with \"0.0.0.0\".\n#http = \":2242\"\n\n# Public base URL. \"auto\" locks the hostname from the first FQDN request.\n# Set an explicit URL for OAuth login and webhooks.\n# Example: \"https://caic.example.com\" or \"https://caic.my-tailnet.ts.net\"\n#external_url = \"auto\"\n\n# Path to a MaxMind MMDB file for country-code resolution and logging.\n# Download GeoLite2-Country.mmdb from https://dev.maxmind.com/geoip/geolite2-free-geolocation-data\n# Relative paths are resolved against the config directory.\n#geo_db = \"GeoLite2-Country.mmdb\"\n\n# Allowed origins. Requests from IPs that do not match are rejected with\n# HTTP 403.\n# Named origins: \"local\" (loopback/private), \"tailscale\" (100.64.0.0/10),\n#   \"github\" (GitHub webhook IPs fetched from api.github.com/meta).\n# CIDR ranges: e.g. \"203.0.113.0/24\".\n# Country codes: ISO 3166-1 alpha-2 (e.g. \"CA\", \"US\", \"DE\"); requires geo_db.\n#allow_origins = [\"local\", \"tailscale\", \"github\"]\n\n# ── Voice Gateway ────────────────────────────────────────────────────────────\n\n[voice-gateway]\n# Voice gateway support is derived automatically:\n#   url set = advertise that standalone voice gateway URL.\n#   no url and GEMINI_API_KEY available = host the embedded voice gateway.\n#   no url and no GEMINI_API_KEY = disabled.\n\n# Standalone voice gateway URL.\n#url = \"https://voice.example.com\"\n\n# Optional embedded gateway runtime config. This uses the same shape as the\n# standalone ~/.config/voice-gateway/config.toml template in\n# contrib/voice-gateway-config.toml. Only set this when caic is hosting the\n# gateway protocol in-process.\n#[voice-gateway.config]\n# The API key is always read from GEMINI_API_KEY.\n#model = \"gemini-3.1-flash-live-preview\"\n\n#[voice-gateway.config.server]\n# UDP port for WebRTC ICE (single-port mux).\n# 0 (default) = enabled with OS-assigned ephemeral port.\n# >0 = enabled on that static port (open it in your firewall for UDP traffic).\n# GEMINI_API_KEY is required.\n#webrtc_udp_port = 0\n\n# ── AI ───────────────────────────────────────────────────────────────────────\n\n[ai]\n# LLM provider for title generation, commit descriptions, etc.\n# When unset, auto-detects the best available provider in this order:\n#   1. codex (Codex)\n#   2. opencode (OpenCode)\n#   3. claudecode (Claude Code)\n#   4. gemini (Gemini)\n#   5. Any other available provider\n# Available providers: https://pkg.go.dev/github.com/maruel/genai/providers\n#provider = \"\"\n\n# Model name or alias. When unset, uses the provider's auto-detected cheapest model.\n#model = \"\"\n\n# ── Harness ──────────────────────────────────────────────────────────────────\n# Per-harness environment variables injected into containers. Each harness\n# section supports an [env] table of KEY = \"VALUE\" pairs. These supplement the\n# automatic *_API_KEY forwarding from the host environment and are also used\n# when fetching the model list at startup.\n[harness.claude.env]\n# Warning: setting this environment variable will cause Claude Code to use API costs and ignore your\n# subscription.\n#ANTHROPIC_API_KEY = \"sk-...\"\n\n[harness.codex.env]\n# Most of codex configuration is via its configuration described at\n# https://developers.openai.com/codex/config-reference\n\n[harness.opencode.env]\n# Most of opencode configuration is via its configuration described at\n# https://opencode.ai/docs/config/\n\n[harness.pi.env]\n# See https://github.com/badlogic/pi-mono/blob/main/packages/coding-agent/docs/providers.md\n# Here's example keys, you can set any environment variable you want.\n#DEEPSEEK_API_KEY= \"\"\n#GEMINI_API_KEY = \"AIza...\"\n#OPENROUTER_API_KEY = \"sk-or-...\"\n#OPENAI_API_KEY = \"sk-...\"\n\n# ── GitHub ───────────────────────────────────────────────────────────────────\n# PAT for server-level API access (forges, autoupdate). OAuth for user login.\n# GitHub App is independent and can be layered on either or both.\n\n[github]\n# PAT — server-level API access (forges, container token fallback).\n# Create at https://github.com/settings/personal-access-tokens/new\n# Required permissions: pull_requests:write, checks:read\n# If unset and gh CLI is in PATH, caic uses the token from `gh auth token`\n# automatically.\n#token = \"\"\n\n# OAuth — multi-user login.\n# See https://docs.caic.xyz/caic/github for OAuth app setup instructions.\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitHub users allowed to login. Highly recommended.\n#oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitHub App — org-wide webhooks and automatic task creation.\n# Layered on top of PAT or OAuth; not mutually exclusive with either.\n# See https://docs.caic.xyz/caic/ for GitHub App setup instructions.\n#app_id = 0\n# Path to PEM file (relative paths resolve against the config directory).\n#app_private_key_pem = \"private-key.pem\"\n# Owners/orgs allowed to install the app. Installs from other accounts are\n# rejected automatically. Highly recommended.\n#app_allowed_owners = [\"my-org\", \"my-username\"]\n\n# HMAC-SHA256 secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── GitLab ───────────────────────────────────────────────────────────────────\n# Choose one of PAT (token) or OAuth.\n\n[gitlab]\n# PAT — single-user / headless. Mutually exclusive with OAuth.\n# Create at https://gitlab.com/-/user_settings/personal_access_tokens\n# Required scope: api\n#token = \"\"\n\n# OAuth — multi-user login. Mutually exclusive with token.\n# See https://docs.caic.xyz/caic/gitlab for OAuth app setup instructions.\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitLab users allowed to login. Highly recommended.\n#oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitLab instance URL.\n#url = \"https://gitlab.com\"\n\n# Shared secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── Debug ────────────────────────────────────────────────────────────────────\n\n[debug]\n# Log level: debug, info, warn, error.\n#log_level = \"info\"\n\n# Omit timestamps from log output.\n#no_log_time = false\n\n# Expose /debug/pprof/* profiling endpoints.\n#pprof = false\n\n# Write CPU profile to file.\n#cpuprofile = \"~/.cache/caic/cpu.prof\"\n\n# Write heap profile to file on shutdown.\n#memprofile = \"~/.cache/caic/mem.prof\"\n\n# Write execution trace to file.\n#trace = \"~/.cache/caic/trace.out\"\n"}, "0ce5e4dd462b70ea5487abb066b0ca61144b6e51": {"t": 1785750208.9179096, "n": 6891, "h": "ccf8603d70a9dbb0", "c": "# caic configuration\n# Copy to ~/.config/caic/config.toml and edit as needed.\n\n# ── Core ─────────────────────────────────────────────────────────────────────\n\n[core]\n# Parent directory containing git repositories managed by caic.\n#root = \".\"\n\n# Container runtime: \"docker\" or \"podman\". Default: \"docker\".\n# When set to \"podman\", caic uses podman for all container operations.\n# Note: sudo is not supported with rootless podman (running as non-root user).\n# Use docker if you need sudo-enabled containers.\n#runtime = \"docker\"\n\n# Auto-update schedule (cron expression, local time). Checks GitHub Releases\n# and replaces the binary on match. Set to \"\" to disable.\n# When not set, defaults to daily at 04:50.\n#auto_update = \"\"\n\n# Add environment variables to the ones inherited by the server process.\n# Falls back to the host environment if not set.\n[core.env]\n# Tailscale API key — required for Tailscale ephemeral node.\n# Obtain from https://login.tailscale.com/admin/settings/keys\n#TAILSCALE_API_KEY = \"\"\n\n# Gemini API key: required for Gemini Live voice agent via WebRTC, and title generation\n# when provider is \"gemini\". Obtain from https://aistudio.google.com/app/apikey\n#GEMINI_API_KEY = \"\"\n\n# ── Server ───────────────────────────────────────────────────────────────────\n\n[server]\n# HTTP listen address for the web UI. By default only listens to localhost. To listen to all IPv4 addreses,\n# prefix with \"0.0.0.0\".\n#http = \":2242\"\n\n# Public base URL. \"auto\" locks the hostname from the first FQDN request.\n# Set an explicit URL for OAuth login and webhooks.\n# Example: \"https://caic.example.com\" or \"https://caic.my-tailnet.ts.net\"\n#external_url = \"auto\"\n\n# UDP port for WebRTC ICE (single-port mux).\n# 0 (default) = enabled with OS-assigned ephemeral port.\n# >0 = enabled on that static port (open it in your firewall for UDP traffic).\n# -1 = disabled.\n# When GEMINI_API_KEY is not set in core.env, the voice bridge is disabled\n# regardless of this setting (effective default: -1).\n#webrtc_port = 0\n\n# Path to a MaxMind MMDB file for country-code resolution and logging.\n# Download GeoLite2-Country.mmdb from https://dev.maxmind.com/geoip/geolite2-free-geolocation-data\n# Relative paths are resolved against the config directory.\n#geo_db = \"GeoLite2-Country.mmdb\"\n\n# Allowed origins. Requests from IPs that do not match are rejected with\n# HTTP 403.\n# Named origins: \"local\" (loopback/private), \"tailscale\" (100.64.0.0/10),\n#   \"github\" (GitHub webhook IPs fetched from api.github.com/meta).\n# CIDR ranges: e.g. \"203.0.113.0/24\".\n# Country codes: ISO 3166-1 alpha-2 (e.g. \"CA\", \"US\", \"DE\"); requires geo_db.\n#allow_origins = [\"local\", \"tailscale\", \"github\"]\n\n# ── AI ───────────────────────────────────────────────────────────────────────\n\n[ai]\n# LLM provider for title generation, commit descriptions, etc.\n# When unset, auto-detects the best available provider in this order:\n#   1. codex (Codex)\n#   2. opencode (OpenCode)\n#   3. claudecode (Claude Code)\n#   4. gemini (Gemini)\n#   5. Any other available provider\n# Available providers: https://pkg.go.dev/github.com/maruel/genai/providers\n#provider = \"\"\n\n# Model name or alias. When unset, uses the provider's auto-detected cheapest model.\n#model = \"\"\n\n# ── Harness ──────────────────────────────────────────────────────────────────\n# Per-harness environment variables injected into containers. Each harness\n# section supports an [env] table of KEY = \"VALUE\" pairs. These supplement the\n# automatic *_API_KEY forwarding from the host environment and are also used\n# when fetching the model list at startup.\n[harness.claude.env]\n# Warning: setting this environment variable will cause Claude Code to use API costs and ignore your\n# subscription.\n#ANTHROPIC_API_KEY = \"sk-...\"\n\n[harness.codex.env]\n# Most of codex configuration is via its configuration described at\n# https://developers.openai.com/codex/config-reference\n\n[harness.opencode.env]\n# Most of opencode configuration is via its configuration described at\n# https://opencode.ai/docs/config/\n\n[harness.pi.env]\n# See https://github.com/badlogic/pi-mono/blob/main/packages/coding-agent/docs/providers.md\n# Here's example keys, you can set any environment variable you want.\n#DEEPSEEK_API_KEY= \"\"\n#GEMINI_API_KEY = \"AIza...\"\n#OPENROUTER_API_KEY = \"sk-or-...\"\n#OPENAI_API_KEY = \"sk-...\"\n\n# ── GitHub ───────────────────────────────────────────────────────────────────\n# PAT for server-level API access (forges, autoupdate). OAuth for user login.\n# GitHub App is independent and can be layered on either or both.\n\n[github]\n# PAT — server-level API access (forges, container token fallback).\n# Create at https://github.com/settings/personal-access-tokens/new\n# Required permissions: pull_requests:write, checks:read\n# If unset and gh CLI is in PATH, caic uses the token from `gh auth token`\n# automatically.\n#token = \"\"\n\n# OAuth — multi-user login.\n# See https://docs.caic.xyz/caic/github for OAuth app setup instructions.\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitHub users allowed to login. Highly recommended.\n#oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitHub App — org-wide webhooks and automatic task creation.\n# Layered on top of PAT or OAuth; not mutually exclusive with either.\n# See https://docs.caic.xyz/caic/ for GitHub App setup instructions.\n#app_id = 0\n# Path to PEM file (relative paths resolve against the config directory).\n#app_private_key_pem = \"private-key.pem\"\n# Owners/orgs allowed to install the app. Installs from other accounts are\n# rejected automatically. Highly recommended.\n#app_allowed_owners = [\"my-org\", \"my-username\"]\n\n# HMAC-SHA256 secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── GitLab ───────────────────────────────────────────────────────────────────\n# Choose one of PAT (token) or OAuth.\n\n[gitlab]\n# PAT — single-user / headless. Mutually exclusive with OAuth.\n# Create at https://gitlab.com/-/user_settings/personal_access_tokens\n# Required scope: api\n#token = \"\"\n\n# OAuth — multi-user login. Mutually exclusive with token.\n# See https://docs.caic.xyz/caic/gitlab for OAuth app setup instructions.\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitLab users allowed to login. Highly recommended.\n#oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitLab instance URL.\n#url = \"https://gitlab.com\"\n\n# Shared secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── Debug ────────────────────────────────────────────────────────────────────\n\n[debug]\n# Log level: debug, info, warn, error.\n#log_level = \"info\"\n\n# Omit timestamps from log output.\n#no_log_time = false\n\n# Expose /debug/pprof/* profiling endpoints.\n#pprof = false\n\n# Write CPU profile to file.\n#cpuprofile = \"~/.cache/caic/cpu.prof\"\n\n# Write heap profile to file on shutdown.\n#memprofile = \"~/.cache/caic/mem.prof\"\n\n# Write execution trace to file.\n#trace = \"~/.cache/caic/trace.out\"\n"}, "17ab583038f89dc6d49cef50f0e2a7376c5dd193": {"t": 1785750210.203123, "n": 6608, "h": "06daf61d7a153827", "c": "# caic configuration\n# Copy to ~/.config/caic/config.toml and edit as needed.\n\n# ── Core ─────────────────────────────────────────────────────────────────────\n\n[core]\n# Parent directory containing git repositories managed by caic.\n#root = \".\"\n\n# Auto-update schedule (cron expression, local time). Checks GitHub Releases\n# and replaces the binary on match. Set to \"\" to disable.\n# When not set, defaults to daily at 04:50.\n#auto_update = \"\"\n\n# Add environment variables to the ones inherited by the server process.\n# Falls back to the host environment if not set.\n[core.env]\n# Tailscale API key — required for Tailscale ephemeral node.\n# Obtain from https://login.tailscale.com/admin/settings/keys\n#TAILSCALE_API_KEY = \"\"\n\n# Gemini API key: required for Gemini Live voice agent via WebRTC, and title generation\n# when provider is \"gemini\". Obtain from https://aistudio.google.com/app/apikey\n#GEMINI_API_KEY = \"\"\n\n# ── Server ───────────────────────────────────────────────────────────────────\n\n[server]\n# HTTP listen address for the web UI. By default only listens to localhost. To listen to all IPv4 addreses,\n# prefix with \"0.0.0.0\".\n#http = \":2242\"\n\n# Public base URL. \"auto\" locks the hostname from the first FQDN request.\n# Set an explicit URL for OAuth login and webhooks.\n# Example: \"https://caic.example.com\" or \"https://caic.my-tailnet.ts.net\"\n#external_url = \"auto\"\n\n# UDP port for WebRTC ICE (single-port mux).\n# 0 (default) = enabled with OS-assigned ephemeral port.\n# >0 = enabled on that static port (open it in your firewall for UDP traffic).\n# -1 = disabled.\n# When GEMINI_API_KEY is not set in core.env, the voice bridge is disabled\n# regardless of this setting (effective default: -1).\n#webrtc_port = 0\n\n# Path to a MaxMind MMDB file for country-code resolution and logging.\n# Download GeoLite2-Country.mmdb from https://dev.maxmind.com/geoip/geolite2-free-geolocation-data\n# Relative paths are resolved against the config directory.\n#geo_db = \"GeoLite2-Country.mmdb\"\n\n# Allowed origins. Requests from IPs that do not match are rejected with\n# HTTP 403.\n# Named origins: \"local\" (loopback/private), \"tailscale\" (100.64.0.0/10),\n#   \"github\" (GitHub webhook IPs fetched from api.github.com/meta).\n# CIDR ranges: e.g. \"203.0.113.0/24\".\n# Country codes: ISO 3166-1 alpha-2 (e.g. \"CA\", \"US\", \"DE\"); requires geo_db.\n#allow_origins = [\"local\", \"tailscale\", \"github\"]\n\n# ── AI ───────────────────────────────────────────────────────────────────────\n\n[ai]\n# LLM provider for title generation, commit descriptions, etc.\n# When unset, auto-detects the best available provider in this order:\n#   1. codex (Codex)\n#   2. opencode (OpenCode)\n#   3. claudecode (Claude Code)\n#   4. gemini (Gemini)\n#   5. Any other available provider\n# Available providers: https://pkg.go.dev/github.com/maruel/genai/providers\n#provider = \"\"\n\n# Model name or alias. When unset, uses the provider's auto-detected cheapest model.\n#model = \"\"\n\n# ── Harness ──────────────────────────────────────────────────────────────────\n# Per-harness environment variables injected into containers. Each harness\n# section supports an [env] table of KEY = \"VALUE\" pairs. These supplement the\n# automatic *_API_KEY forwarding from the host environment and are also used\n# when fetching the model list at startup.\n[harness.claude.env]\n# Warning: setting this environment variable will cause Claude Code to use API costs and ignore your\n# subscription.\n#ANTHROPIC_API_KEY = \"sk-...\"\n\n[harness.codex.env]\n# Most of codex configuration is via its configuration described at\n# https://developers.openai.com/codex/config-reference\n\n[harness.opencode.env]\n# Most of opencode configuration is via its configuration described at\n# https://opencode.ai/docs/config/\n\n[harness.pi.env]\n# See https://github.com/badlogic/pi-mono/blob/main/packages/coding-agent/docs/providers.md\n# Here's example keys, you can set any environment variable you want.\n#DEEPSEEK_API_KEY= \"\"\n#GEMINI_API_KEY = \"AIza...\"\n#OPENROUTER_API_KEY = \"sk-or-...\"\n#OPENAI_API_KEY = \"sk-...\"\n\n# ── GitHub ───────────────────────────────────────────────────────────────────\n# PAT for server-level API access (forges, autoupdate). OAuth for user login.\n# GitHub App is independent and can be layered on either or both.\n\n[github]\n# PAT — server-level API access (forges, container token fallback).\n# Create at https://github.com/settings/personal-access-tokens/new\n# Required permissions: pull_requests:write, checks:read\n# If unset and gh CLI is in PATH, caic uses the token from `gh auth token`\n# automatically.\n#token = \"\"\n\n# OAuth — multi-user login.\n# See https://docs.caic.xyz/caic/github for OAuth app setup instructions.\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitHub users allowed to login. Highly recommended.\n#oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitHub App — org-wide webhooks and automatic task creation.\n# Layered on top of PAT or OAuth; not mutually exclusive with either.\n# See https://docs.caic.xyz/caic/ for GitHub App setup instructions.\n#app_id = 0\n# Path to PEM file (relative paths resolve against the config directory).\n#app_private_key_pem = \"private-key.pem\"\n# Owners/orgs allowed to install the app. Installs from other accounts are\n# rejected automatically. Highly recommended.\n#app_allowed_owners = [\"my-org\", \"my-username\"]\n\n# HMAC-SHA256 secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── GitLab ───────────────────────────────────────────────────────────────────\n# Choose one of PAT (token) or OAuth.\n\n[gitlab]\n# PAT — single-user / headless. Mutually exclusive with OAuth.\n# Create at https://gitlab.com/-/user_settings/personal_access_tokens\n# Required scope: api\n#token = \"\"\n\n# OAuth — multi-user login. Mutually exclusive with token.\n# See https://docs.caic.xyz/caic/gitlab for OAuth app setup instructions.\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitLab users allowed to login. Highly recommended.\n#oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitLab instance URL.\n#url = \"https://gitlab.com\"\n\n# Shared secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── Debug ────────────────────────────────────────────────────────────────────\n\n[debug]\n# Log level: debug, info, warn, error.\n#log_level = \"info\"\n\n# Omit timestamps from log output.\n#no_log_time = false\n\n# Expose /debug/pprof/* profiling endpoints.\n#pprof = false\n\n# Write CPU profile to file.\n#cpuprofile = \"~/.cache/caic/cpu.prof\"\n\n# Write heap profile to file on shutdown.\n#memprofile = \"~/.cache/caic/mem.prof\"\n\n# Write execution trace to file.\n#trace = \"~/.cache/caic/trace.out\"\n"}, "9da07bb8bdbdda787f0cfa77fd820bad9e0506f6": {"t": 1785750211.3066792, "n": 6585, "h": "0583ba5558b932b6", "c": "# caic configuration\n# Copy to ~/.config/caic/config.toml and edit as needed.\n\n# ── Core ─────────────────────────────────────────────────────────────────────\n\n[core]\n# Parent directory containing git repositories managed by caic.\n#root = \".\"\n\n# Auto-update schedule (cron expression, local time). Checks GitHub Releases\n# and replaces the binary on match. Set to \"\" to disable.\n# When not set, defaults to daily at 04:50.\n#auto_update = \"\"\n\n# Add environment variables to the ones inherited by the server process.\n# Falls back to the host environment if not set.\n[core.env]\n# Tailscale API key — required for Tailscale ephemeral node.\n# Obtain from https://login.tailscale.com/admin/settings/keys\n#TAILSCALE_API_KEY = \"\"\n\n# Gemini API key: required for Gemini Live voice agent via WebRTC, and title generation\n# when provider is \"gemini\". Obtain from https://aistudio.google.com/app/apikey\n#GEMINI_API_KEY = \"\"\n\n# ── Server ───────────────────────────────────────────────────────────────────\n\n[server]\n# HTTP listen address for the web UI. By default only listens to localhost. To listen to all IPv4 addreses,\n# prefix with \"0.0.0.0\".\n#http = \":2242\"\n\n# Public base URL. \"auto\" locks the hostname from the first FQDN request.\n# Set an explicit URL for OAuth login and webhooks.\n# Example: \"https://caic.example.com\" or \"https://caic.my-tailnet.ts.net\"\n#external_url = \"auto\"\n\n# UDP port for WebRTC ICE (single-port mux).\n# 0 (default) = enabled with OS-assigned ephemeral port.\n# >0 = enabled on that static port (open it in your firewall for UDP traffic).\n# -1 = disabled.\n# When GEMINI_API_KEY is not set in core.env, the voice bridge is disabled\n# regardless of this setting (effective default: -1).\n#webrtc_port = 0\n\n# Path to a MaxMind MMDB file for country-code resolution and logging.\n# Download GeoLite2-Country.mmdb from https://dev.maxmind.com/geoip/geolite2-free-geolocation-data\n# Relative paths are resolved against the config directory.\n#geo_db = \"GeoLite2-Country.mmdb\"\n\n# Allowed origins. Requests from IPs that do not match are rejected with\n# HTTP 403.\n# Named origins: \"local\" (loopback/private), \"tailscale\" (100.64.0.0/10),\n#   \"github\" (GitHub webhook IPs fetched from api.github.com/meta).\n# CIDR ranges: e.g. \"203.0.113.0/24\".\n# Country codes: ISO 3166-1 alpha-2 (e.g. \"CA\", \"US\", \"DE\"); requires geo_db.\n#allow_origins = [\"local\", \"tailscale\", \"github\"]\n\n# ── AI ───────────────────────────────────────────────────────────────────────\n\n[ai]\n# LLM provider for title generation, commit descriptions, etc.\n# When unset, auto-detects the best available provider in this order:\n#   1. codex (Codex)\n#   2. opencode (OpenCode)\n#   3. claudecode (Claude Code)\n#   4. gemini (Gemini)\n#   5. Any other available provider\n# Available providers: https://pkg.go.dev/github.com/maruel/genai/providers\n#provider = \"\"\n\n# Model name or alias. When unset, uses the provider's auto-detected cheapest model.\n#model = \"\"\n\n# ── Harness ──────────────────────────────────────────────────────────────────\n# Per-harness environment variables injected into containers. Each harness\n# section supports an [env] table of KEY = \"VALUE\" pairs. These supplement the\n# automatic *_API_KEY forwarding from the host environment and are also used\n# when fetching the model list at startup.\n[harness.claude.env]\n# Warning: setting this environment variable will cause Claude Code to use API costs and ignore your\n# subscription.\n#ANTHROPIC_API_KEY = \"sk-...\"\n\n[harness.codex.env]\n# Most of codex configuration is via its configuration described at\n# https://developers.openai.com/codex/config-reference\n\n[harness.opencode.env]\n# Most of opencode configuration is via its configuration described at\n# https://opencode.ai/docs/config/\n\n[harness.pi.env]\n# See https://github.com/badlogic/pi-mono/blob/main/packages/coding-agent/docs/providers.md\n# Here's example keys, you can set any environment variable you want.\n#DEEPSEEK_API_KEY= \"\"\n#GEMINI_API_KEY = \"AIza...\"\n#OPENROUTER_API_KEY = \"sk-or-...\"\n#OPENAI_API_KEY = \"sk-...\"\n\n# ── GitHub ───────────────────────────────────────────────────────────────────\n# Choose one of PAT (token) or OAuth; GitHub App is independent.\n\n[github]\n# PAT — single-user / headless. Mutually exclusive with OAuth.\n# Create at https://github.com/settings/personal-access-tokens/new\n# Required permissions: pull_requests:write, checks:read\n# If unset and gh CLI is in PATH (and OAuth is not configured), caic uses\n# the token from `gh auth token` automatically.\n#token = \"\"\n\n# OAuth — multi-user login. Mutually exclusive with token.\n# See https://docs.caic.xyz/caic/github for OAuth app setup instructions.\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitHub users allowed to login. Highly recommended.\n#oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitHub App — org-wide webhooks and automatic task creation.\n# Layered on top of PAT or OAuth; not mutually exclusive with either.\n# See https://docs.caic.xyz/caic/ for GitHub App setup instructions.\n#app_id = 0\n# Path to PEM file (relative paths resolve against the config directory).\n#app_private_key_pem = \"private-key.pem\"\n# Owners/orgs allowed to install the app. Installs from other accounts are\n# rejected automatically. Highly recommended.\n#app_allowed_owners = [\"my-org\", \"my-username\"]\n\n# HMAC-SHA256 secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── GitLab ───────────────────────────────────────────────────────────────────\n# Choose one of PAT (token) or OAuth.\n\n[gitlab]\n# PAT — single-user / headless. Mutually exclusive with OAuth.\n# Create at https://gitlab.com/-/user_settings/personal_access_tokens\n# Required scope: api\n#token = \"\"\n\n# OAuth — multi-user login. Mutually exclusive with token.\n# See https://docs.caic.xyz/caic/gitlab for OAuth app setup instructions.\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitLab users allowed to login. Highly recommended.\n#oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitLab instance URL.\n#url = \"https://gitlab.com\"\n\n# Shared secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── Debug ────────────────────────────────────────────────────────────────────\n\n[debug]\n# Log level: debug, info, warn, error.\n#log_level = \"info\"\n\n# Omit timestamps from log output.\n#no_log_time = false\n\n# Expose /debug/pprof/* profiling endpoints.\n#pprof = false\n\n# Write CPU profile to file.\n#cpuprofile = \"~/.cache/caic/cpu.prof\"\n\n# Write heap profile to file on shutdown.\n#memprofile = \"~/.cache/caic/mem.prof\"\n\n# Write execution trace to file.\n#trace = \"~/.cache/caic/trace.out\"\n"}, "28d7f832f27019215756a930bb180ca76f1ec732": {"t": 1785750212.391677, "n": 6639, "h": "797341bbe5acf9d4", "c": "# caic configuration\n# Copy to ~/.config/caic/config.toml and edit as needed.\n\n# ── Core ─────────────────────────────────────────────────────────────────────\n\n[core]\n# Parent directory containing git repositories managed by caic.\n#root = \".\"\n\n# Auto-update schedule (cron expression, local time). Checks GitHub Releases\n# and replaces the binary on match. Set to \"\" to disable.\n# When not set, defaults to daily at 04:50.\n#auto_update = \"\"\n\n# Add environment variables to the ones inherited by the server process.\n# Falls back to the host environment if not set.\n[core.env]\n# Tailscale API key — required for Tailscale ephemeral node.\n# Obtain from https://login.tailscale.com/admin/settings/keys\n#TAILSCALE_API_KEY = \"\"\n\n# Gemini API key: required for Gemini Live voice agent via WebRTC, and title generation\n# when provider is \"gemini\". Obtain from https://aistudio.google.com/app/apikey\n#GEMINI_API_KEY = \"\"\n\n# ── Server ───────────────────────────────────────────────────────────────────\n\n[server]\n# HTTP listen address for the web UI. By default only listens to localhost. To listen to all IPv4 addreses,\n# prefix with \"0.0.0.0\".\n#http = \":2242\"\n\n# Public base URL. \"auto\" locks the hostname from the first FQDN request.\n# Set an explicit URL for OAuth login and webhooks.\n# Example: \"https://caic.example.com\" or \"https://caic.my-tailnet.ts.net\"\n#external_url = \"auto\"\n\n# UDP port for WebRTC ICE (single-port mux).\n# 0 (default) = enabled with OS-assigned ephemeral port.\n# >0 = enabled on that static port (open it in your firewall for UDP traffic).\n# -1 = disabled.\n# Requires libopus-dev at build time (CGO_ENABLED=1).\n# When GEMINI_API_KEY is not set in core.env, the voice bridge is disabled\n# regardless of this setting (effective default: -1).\n#webrtc_port = 0\n\n# Path to a MaxMind MMDB file for country-code resolution and logging.\n# Download GeoLite2-Country.mmdb from https://dev.maxmind.com/geoip/geolite2-free-geolocation-data\n# Relative paths are resolved against the config directory.\n#geo_db = \"GeoLite2-Country.mmdb\"\n\n# Allowed origins. Requests from IPs that do not match are rejected with\n# HTTP 403.\n# Named origins: \"local\" (loopback/private), \"tailscale\" (100.64.0.0/10),\n#   \"github\" (GitHub webhook IPs fetched from api.github.com/meta).\n# CIDR ranges: e.g. \"203.0.113.0/24\".\n# Country codes: ISO 3166-1 alpha-2 (e.g. \"CA\", \"US\", \"DE\"); requires geo_db.\n#allow_origins = [\"local\", \"tailscale\", \"github\"]\n\n# ── AI ───────────────────────────────────────────────────────────────────────\n\n[ai]\n# LLM provider for title generation, commit descriptions, etc.\n# When unset, auto-detects the best available provider in this order:\n#   1. codex (Codex)\n#   2. opencode (OpenCode)\n#   3. claudecode (Claude Code)\n#   4. gemini (Gemini)\n#   5. Any other available provider\n# Available providers: https://pkg.go.dev/github.com/maruel/genai/providers\n#provider = \"\"\n\n# Model name or alias. When unset, uses the provider's auto-detected cheapest model.\n#model = \"\"\n\n# ── Harness ──────────────────────────────────────────────────────────────────\n# Per-harness environment variables injected into containers. Each harness\n# section supports an [env] table of KEY = \"VALUE\" pairs. These supplement the\n# automatic *_API_KEY forwarding from the host environment and are also used\n# when fetching the model list at startup.\n[harness.claude.env]\n# Warning: setting this environment variable will cause Claude Code to use API costs and ignore your\n# subscription.\n#ANTHROPIC_API_KEY = \"sk-...\"\n\n[harness.codex.env]\n# Most of codex configuration is via its configuration described at\n# https://developers.openai.com/codex/config-reference\n\n[harness.opencode.env]\n# Most of opencode configuration is via its configuration described at\n# https://opencode.ai/docs/config/\n\n[harness.pi.env]\n# See https://github.com/badlogic/pi-mono/blob/main/packages/coding-agent/docs/providers.md\n# Here's example keys, you can set any environment variable you want.\n#DEEPSEEK_API_KEY= \"\"\n#GEMINI_API_KEY = \"AIza...\"\n#OPENROUTER_API_KEY = \"sk-or-...\"\n#OPENAI_API_KEY = \"sk-...\"\n\n# ── GitHub ───────────────────────────────────────────────────────────────────\n# Choose one of PAT (token) or OAuth; GitHub App is independent.\n\n[github]\n# PAT — single-user / headless. Mutually exclusive with OAuth.\n# Create at https://github.com/settings/personal-access-tokens/new\n# Required permissions: pull_requests:write, checks:read\n# If unset and gh CLI is in PATH (and OAuth is not configured), caic uses\n# the token from `gh auth token` automatically.\n#token = \"\"\n\n# OAuth — multi-user login. Mutually exclusive with token.\n# See https://docs.caic.xyz/caic/github for OAuth app setup instructions.\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitHub users allowed to login. Highly recommended.\n#oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitHub App — org-wide webhooks and automatic task creation.\n# Layered on top of PAT or OAuth; not mutually exclusive with either.\n# See https://docs.caic.xyz/caic/ for GitHub App setup instructions.\n#app_id = 0\n# Path to PEM file (relative paths resolve against the config directory).\n#app_private_key_pem = \"private-key.pem\"\n# Owners/orgs allowed to install the app. Installs from other accounts are\n# rejected automatically. Highly recommended.\n#app_allowed_owners = [\"my-org\", \"my-username\"]\n\n# HMAC-SHA256 secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── GitLab ───────────────────────────────────────────────────────────────────\n# Choose one of PAT (token) or OAuth.\n\n[gitlab]\n# PAT — single-user / headless. Mutually exclusive with OAuth.\n# Create at https://gitlab.com/-/user_settings/personal_access_tokens\n# Required scope: api\n#token = \"\"\n\n# OAuth — multi-user login. Mutually exclusive with token.\n# See https://docs.caic.xyz/caic/gitlab for OAuth app setup instructions.\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitLab users allowed to login. Highly recommended.\n#oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitLab instance URL.\n#url = \"https://gitlab.com\"\n\n# Shared secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── Debug ────────────────────────────────────────────────────────────────────\n\n[debug]\n# Log level: debug, info, warn, error.\n#log_level = \"info\"\n\n# Omit timestamps from log output.\n#no_log_time = false\n\n# Expose /debug/pprof/* profiling endpoints.\n#pprof = false\n\n# Write CPU profile to file.\n#cpuprofile = \"~/.cache/caic/cpu.prof\"\n\n# Write heap profile to file on shutdown.\n#memprofile = \"~/.cache/caic/mem.prof\"\n\n# Write execution trace to file.\n#trace = \"~/.cache/caic/trace.out\"\n"}, "3a1d0da64a42a06469afa6f443de4d2eef8095aa": {"t": 1785750213.5969136, "n": 6321, "h": "edafba1eac01d8ab", "c": "# caic configuration\n# Copy to ~/.config/caic/config.toml and edit as needed.\n\n# ── Core ─────────────────────────────────────────────────────────────────────\n\n[core]\n# Parent directory containing git repositories managed by caic.\n#root = \".\"\n\n# Auto-update schedule (cron expression, local time). Checks GitHub Releases\n# and replaces the binary on match. Set to \"\" to disable.\n# When not set, defaults to daily at 04:50.\n#auto_update = \"\"\n\n# Tailscale API key — required for Tailscale ephemeral node.\n# Obtain from https://login.tailscale.com/admin/settings/keys\n#tailscale_api_key = \"\"\n\n# ── Server ───────────────────────────────────────────────────────────────────\n\n[server]\n# HTTP listen address for the web UI.\n#http = \":2242\"\n\n# Public base URL. \"auto\" locks the hostname from the first FQDN request.\n# Set an explicit URL for OAuth login and webhooks.\n# Example: \"https://caic.example.com\" or \"https://caic.my-tailnet.ts.net\"\n#external_url = \"auto\"\n\n# UDP port for WebRTC ICE (single-port mux).\n# 0 (default) = enabled with OS-assigned ephemeral port.\n# >0 = enabled on that static port (open it in your firewall for UDP traffic).\n# -1 = disabled.\n# Requires libopus-dev at build time (CGO_ENABLED=1).\n#webrtc_port = 0\n\n# Path to a MaxMind MMDB file for country-code resolution and logging.\n# Download GeoLite2-Country.mmdb from https://dev.maxmind.com/geoip/geolite2-free-geolocation-data\n# Relative paths are resolved against the config directory.\n#geo_db = \"GeoLite2-Country.mmdb\"\n\n# Allowed origins. Requests from IPs that do not match are rejected with\n# HTTP 403.\n# Named origins: \"local\" (loopback/private), \"tailscale\" (100.64.0.0/10),\n#   \"github\" (GitHub webhook IPs fetched from api.github.com/meta).\n# CIDR ranges: e.g. \"203.0.113.0/24\".\n# Country codes: ISO 3166-1 alpha-2 (e.g. \"CA\", \"US\", \"DE\"); requires geo_db.\n#allow_origins = [\"local\", \"tailscale\", \"github\"]\n\n# ── AI ───────────────────────────────────────────────────────────────────────\n\n[ai]\n# LLM provider for title generation, commit descriptions, etc.\n# When unset, auto-detects the best available provider in this order:\n#   1. codex (Codex)\n#   2. opencode (OpenCode)\n#   3. claudecode (Claude Code)\n#   4. gemini (Gemini)\n#   5. Any other available provider\n# Available providers: https://pkg.go.dev/github.com/maruel/genai/providers\n#provider = \"\"\n\n# Model name or alias. When unset, uses the provider's cheapest model.\n#model = \"\"\n\n# Gemini API key — required for Gemini Live voice agent and title generation\n# when provider is \"gemini\". Falls back to GEMINI_API_KEY environment variable\n# if not set. Obtain from https://aistudio.google.com/app/apikey\n#gemini_api_key = \"\"\n\n# ── Harness ──────────────────────────────────────────────────────────────────\n# Per-harness environment variables injected into containers. Each harness\n# section supports an [env] table of KEY = \"VALUE\" pairs. These supplement the\n# automatic *_API_KEY forwarding from the host environment and are also used\n# when fetching the model list at startup.\n[harness.claude.env]\n# Warning: setting this environment variable will cause Claude Code to use API costs and ignore your\n# subscription.\n#ANTHROPIC_API_KEY = \"sk-...\"\n\n[harness.codex.env]\n# Most of codex configuration is via its configuration described at\n# https://developers.openai.com/codex/config-reference\n\n[harness.opencode.env]\n# Most of opencode configuration is via its configuration described at\n# https://opencode.ai/docs/config/\n\n[harness.pi.env]\n# See https://github.com/badlogic/pi-mono/blob/main/packages/coding-agent/docs/providers.md\n# Here's example keys, you can set any environment variable you want.\n#DEEPSEEK_API_KEY= \"\"\n#GEMINI_API_KEY = \"AIza...\"\n#OPENROUTER_API_KEY = \"sk-or-...\"\n#OPENAI_API_KEY = \"sk-...\"\n\n# ── GitHub ───────────────────────────────────────────────────────────────────\n# Choose one of PAT (token) or OAuth; GitHub App is independent.\n\n[github]\n# PAT — single-user / headless. Mutually exclusive with OAuth.\n# Create at https://github.com/settings/personal-access-tokens/new\n# Required permissions: pull_requests:write, checks:read\n# If unset and gh CLI is in PATH (and OAuth is not configured), caic uses\n# the token from `gh auth token` automatically.\n#token = \"\"\n\n# OAuth — multi-user login. Mutually exclusive with token.\n# See https://docs.caic.xyz/caic/github for OAuth app setup instructions.\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitHub users allowed to login. Highly recommended.\n#oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitHub App — org-wide webhooks and automatic task creation.\n# Layered on top of PAT or OAuth; not mutually exclusive with either.\n# See https://docs.caic.xyz/caic/ for GitHub App setup instructions.\n#app_id = 0\n# Path to PEM file (relative paths resolve against the config directory).\n#app_private_key_pem = \"private-key.pem\"\n# Owners/orgs allowed to install the app. Installs from other accounts are\n# rejected automatically. Highly recommended.\n#app_allowed_owners = [\"my-org\", \"my-username\"]\n\n# HMAC-SHA256 secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── GitLab ───────────────────────────────────────────────────────────────────\n# Choose one of PAT (token) or OAuth.\n\n[gitlab]\n# PAT — single-user / headless. Mutually exclusive with OAuth.\n# Create at https://gitlab.com/-/user_settings/personal_access_tokens\n# Required scope: api\n#token = \"\"\n\n# OAuth — multi-user login. Mutually exclusive with token.\n# See https://docs.caic.xyz/caic/gitlab for OAuth app setup instructions.\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitLab users allowed to login. Highly recommended.\n#oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitLab instance URL.\n#url = \"https://gitlab.com\"\n\n# Shared secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── Debug ────────────────────────────────────────────────────────────────────\n\n[debug]\n# Log level: debug, info, warn, error.\n#log_level = \"info\"\n\n# Omit timestamps from log output.\n#no_log_time = false\n\n# Expose /debug/pprof/* profiling endpoints.\n#pprof = false\n\n# Write CPU profile to file.\n#cpuprofile = \"~/.cache/caic/cpu.prof\"\n\n# Write heap profile to file on shutdown.\n#memprofile = \"~/.cache/caic/mem.prof\"\n\n# Write execution trace to file.\n#trace = \"~/.cache/caic/trace.out\"\n"}, "bf4cc47ddfdf079fb07321f9ee338f61613402fa": {"t": 1785750214.8161516, "n": 6229, "h": "84854ac2c547cf4e", "c": "# caic configuration\n# Copy to ~/.config/caic/config.toml and edit as needed.\n\n# ── Core ─────────────────────────────────────────────────────────────────────\n\n[core]\n# Parent directory containing git repositories managed by caic.\n#root = \".\"\n\n# Auto-update schedule (cron expression, local time). Checks GitHub Releases\n# and replaces the binary on match. Set to \"\" to disable.\n# When not set, defaults to daily at 04:50.\n#auto_update = \"\"\n\n# Tailscale API key — required for Tailscale ephemeral node.\n# Obtain from https://login.tailscale.com/admin/settings/keys\n#tailscale_api_key = \"\"\n\n# ── Server ───────────────────────────────────────────────────────────────────\n\n[server]\n# HTTP listen address for the web UI.\n#http = \":2242\"\n\n# Public base URL. \"auto\" locks the hostname from the first FQDN request.\n# Set an explicit URL for OAuth login and webhooks.\n# Example: \"https://caic.example.com\" or \"https://caic.my-tailnet.ts.net\"\n#external_url = \"auto\"\n\n# UDP port for WebRTC ICE (single-port mux).\n# 0 (default) = enabled with OS-assigned ephemeral port.\n# >0 = enabled on that static port (open it in your firewall for UDP traffic).\n# -1 = disabled.\n# Requires libopus-dev at build time (CGO_ENABLED=1).\n#webrtc_port = 0\n\n# Path to a MaxMind MMDB file for country-code resolution and logging.\n# Download GeoLite2-Country.mmdb from https://dev.maxmind.com/geoip/geolite2-free-geolocation-data\n# Relative paths are resolved against the config directory.\n#geo_db = \"GeoLite2-Country.mmdb\"\n\n# Allowed origins. Requests from IPs that do not match are rejected with\n# HTTP 403.\n# Named origins: \"local\" (loopback/private), \"tailscale\" (100.64.0.0/10),\n#   \"github\" (GitHub webhook IPs fetched from api.github.com/meta).\n# CIDR ranges: e.g. \"203.0.113.0/24\".\n# Country codes: ISO 3166-1 alpha-2 (e.g. \"CA\", \"US\", \"DE\"); requires geo_db.\n#allow_origins = [\"local\", \"tailscale\", \"github\"]\n\n# ── AI ───────────────────────────────────────────────────────────────────────\n\n[ai]\n# LLM provider for title generation, commit descriptions, etc.\n# When unset, auto-detects the best available provider in this order:\n#   1. codex (Codex)\n#   2. opencode (OpenCode)\n#   3. claudecode (Claude Code)\n#   4. gemini (Gemini)\n#   5. Any other available provider\n# Available providers: https://pkg.go.dev/github.com/maruel/genai/providers\n#provider = \"\"\n\n# Model name or alias. When unset, uses the provider's cheapest model.\n#model = \"\"\n\n# Gemini API key — required for Gemini Live voice agent and title generation\n# when provider is \"gemini\". Falls back to GEMINI_API_KEY environment variable\n# if not set. Obtain from https://aistudio.google.com/app/apikey\n#gemini_api_key = \"\"\n\n# ── Harness ──────────────────────────────────────────────────────────────────\n# Per-harness environment variables injected into containers. Each harness\n# section supports an [env] table of KEY = \"VALUE\" pairs. These supplement the\n# automatic *_API_KEY forwarding from the host environment and are also used\n# when fetching the model list at startup.\n[harness.claude.env]\n# Warning: setting this environment variable will cause Claude Code to use API costs and ignore your\n# subscription.\n#ANTHROPIC_API_KEY = \"sk-...\"\n\n[harness.codex.env]\n# Most of codex configuration is via its configuration described at\n# https://developers.openai.com/codex/config-reference\n\n[harness.opencode.env]\n# Most of opencode configuration is via its configuration described at\n# https://opencode.ai/docs/config/\n\n[harness.pi.env]\n# See https://github.com/badlogic/pi-mono/blob/main/packages/coding-agent/docs/providers.md\n#GEMINI_API_KEY = \"AIza...\"\n#OPENROUTER_API_KEY = \"sk-or-...\"\n#OPENAI_API_KEY = \"sk-...\"\n\n# ── GitHub ───────────────────────────────────────────────────────────────────\n# Choose one of PAT (token) or OAuth; GitHub App is independent.\n\n[github]\n# PAT — single-user / headless. Mutually exclusive with OAuth.\n# Create at https://github.com/settings/personal-access-tokens/new\n# Required permissions: pull_requests:write, checks:read\n# If unset and gh CLI is in PATH (and OAuth is not configured), caic uses\n# the token from `gh auth token` automatically.\n#token = \"\"\n\n# OAuth — multi-user login. Mutually exclusive with token.\n# See https://docs.caic.xyz/caic/github for OAuth app setup instructions.\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitHub users allowed to login. Highly recommended.\n#oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitHub App — org-wide webhooks and automatic task creation.\n# Layered on top of PAT or OAuth; not mutually exclusive with either.\n# See https://docs.caic.xyz/caic/ for GitHub App setup instructions.\n#app_id = 0\n# Path to PEM file (relative paths resolve against the config directory).\n#app_private_key_pem = \"private-key.pem\"\n# Owners/orgs allowed to install the app. Installs from other accounts are\n# rejected automatically. Highly recommended.\n#app_allowed_owners = [\"my-org\", \"my-username\"]\n\n# HMAC-SHA256 secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── GitLab ───────────────────────────────────────────────────────────────────\n# Choose one of PAT (token) or OAuth.\n\n[gitlab]\n# PAT — single-user / headless. Mutually exclusive with OAuth.\n# Create at https://gitlab.com/-/user_settings/personal_access_tokens\n# Required scope: api\n#token = \"\"\n\n# OAuth — multi-user login. Mutually exclusive with token.\n# See https://docs.caic.xyz/caic/gitlab for OAuth app setup instructions.\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitLab users allowed to login. Highly recommended.\n#oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitLab instance URL.\n#url = \"https://gitlab.com\"\n\n# Shared secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── Debug ────────────────────────────────────────────────────────────────────\n\n[debug]\n# Log level: debug, info, warn, error.\n#log_level = \"info\"\n\n# Omit timestamps from log output.\n#no_log_time = false\n\n# Expose /debug/pprof/* profiling endpoints.\n#pprof = false\n\n# Write CPU profile to file.\n#cpuprofile = \"~/.cache/caic/cpu.prof\"\n\n# Write heap profile to file on shutdown.\n#memprofile = \"~/.cache/caic/mem.prof\"\n\n# Write execution trace to file.\n#trace = \"~/.cache/caic/trace.out\"\n"}, "8c8e37ff541595e6f3e4bb4e858f85b017b47f52": {"t": 1785750216.0300736, "n": 6152, "h": "7622146a9eb69e56", "c": "# caic configuration\n# Copy to ~/.config/caic/config.toml and edit as needed.\n\n# ── Core ─────────────────────────────────────────────────────────────────────\n\n[core]\n# Parent directory containing git repositories managed by caic.\n#root = \".\"\n\n# Auto-update schedule (cron expression, local time). Checks GitHub Releases\n# and replaces the binary on match. Set to \"\" to disable.\n# When not set, defaults to daily at 04:50.\n#auto_update = \"\"\n\n# Tailscale API key — required for Tailscale ephemeral node.\n# Obtain from https://login.tailscale.com/admin/settings/keys\n#tailscale_api_key = \"\"\n\n# ── Server ───────────────────────────────────────────────────────────────────\n\n[server]\n# HTTP listen address for the web UI.\n#http = \":2242\"\n\n# Public base URL. \"auto\" locks the hostname from the first FQDN request.\n# Set an explicit URL for OAuth login and webhooks.\n# Example: \"https://caic.example.com\" or \"https://caic.my-tailnet.ts.net\"\n#external_url = \"auto\"\n\n# UDP port for WebRTC ICE (single-port mux). 0 disables WebRTC voice.\n# Requires libopus-dev at build time (CGO_ENABLED=1).\n# Open this port in your firewall for UDP traffic.\n#webrtc_port = 0\n\n# Path to a MaxMind MMDB file for country-code resolution and logging.\n# Download GeoLite2-Country.mmdb from https://dev.maxmind.com/geoip/geolite2-free-geolocation-data\n# Relative paths are resolved against the config directory.\n#geo_db = \"GeoLite2-Country.mmdb\"\n\n# Allowed origins. Requests from IPs that do not match are rejected with\n# HTTP 403.\n# Named origins: \"local\" (loopback/private), \"tailscale\" (100.64.0.0/10),\n#   \"github\" (GitHub webhook IPs fetched from api.github.com/meta).\n# CIDR ranges: e.g. \"203.0.113.0/24\".\n# Country codes: ISO 3166-1 alpha-2 (e.g. \"CA\", \"US\", \"DE\"); requires geo_db.\n#allow_origins = [\"local\", \"tailscale\", \"github\"]\n\n# ── AI ───────────────────────────────────────────────────────────────────────\n\n[ai]\n# LLM provider for title generation, commit descriptions, etc.\n# When unset, auto-detects the best available provider in this order:\n#   1. codex (Codex)\n#   2. opencode (OpenCode)\n#   3. claudecode (Claude Code)\n#   4. gemini (Gemini)\n#   5. Any other available provider\n# Available providers: https://pkg.go.dev/github.com/maruel/genai/providers\n#provider = \"\"\n\n# Model name or alias. When unset, uses the provider's cheapest model.\n#model = \"\"\n\n# Gemini API key — required for Gemini Live voice agent and title generation\n# when provider is \"gemini\". Falls back to GEMINI_API_KEY environment variable\n# if not set. Obtain from https://aistudio.google.com/app/apikey\n#gemini_api_key = \"\"\n\n# ── Harness ──────────────────────────────────────────────────────────────────\n# Per-harness environment variables injected into containers. Each harness\n# section supports an [env] table of KEY = \"VALUE\" pairs. These supplement the\n# automatic *_API_KEY forwarding from the host environment and are also used\n# when fetching the model list at startup.\n[harness.claude.env]\n# Warning: setting this environment variable will cause Claude Code to use API costs and ignore your\n# subscription.\n#ANTHROPIC_API_KEY = \"sk-...\"\n\n[harness.codex.env]\n# Most of codex configuration is via its configuration described at\n# https://developers.openai.com/codex/config-reference\n\n[harness.opencode.env]\n# Most of opencode configuration is via its configuration described at\n# https://opencode.ai/docs/config/\n\n[harness.pi.env]\n# See https://github.com/badlogic/pi-mono/blob/main/packages/coding-agent/docs/providers.md\n#GEMINI_API_KEY = \"AIza...\"\n#OPENROUTER_API_KEY = \"sk-or-...\"\n#OPENAI_API_KEY = \"sk-...\"\n\n# ── GitHub ───────────────────────────────────────────────────────────────────\n# Choose one of PAT (token) or OAuth; GitHub App is independent.\n\n[github]\n# PAT — single-user / headless. Mutually exclusive with OAuth.\n# Create at https://github.com/settings/personal-access-tokens/new\n# Required permissions: pull_requests:write, checks:read\n# If unset and gh CLI is in PATH (and OAuth is not configured), caic uses\n# the token from `gh auth token` automatically.\n#token = \"\"\n\n# OAuth — multi-user login. Mutually exclusive with token.\n# See https://docs.caic.xyz/caic/github for OAuth app setup instructions.\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitHub users allowed to login. Highly recommended.\n#oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitHub App — org-wide webhooks and automatic task creation.\n# Layered on top of PAT or OAuth; not mutually exclusive with either.\n# See https://docs.caic.xyz/caic/ for GitHub App setup instructions.\n#app_id = 0\n# Path to PEM file (relative paths resolve against the config directory).\n#app_private_key_pem = \"private-key.pem\"\n# Owners/orgs allowed to install the app. Installs from other accounts are\n# rejected automatically. Highly recommended.\n#app_allowed_owners = [\"my-org\", \"my-username\"]\n\n# HMAC-SHA256 secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── GitLab ───────────────────────────────────────────────────────────────────\n# Choose one of PAT (token) or OAuth.\n\n[gitlab]\n# PAT — single-user / headless. Mutually exclusive with OAuth.\n# Create at https://gitlab.com/-/user_settings/personal_access_tokens\n# Required scope: api\n#token = \"\"\n\n# OAuth — multi-user login. Mutually exclusive with token.\n# See https://docs.caic.xyz/caic/gitlab for OAuth app setup instructions.\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitLab users allowed to login. Highly recommended.\n#oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitLab instance URL.\n#url = \"https://gitlab.com\"\n\n# Shared secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── Debug ────────────────────────────────────────────────────────────────────\n\n[debug]\n# Log level: debug, info, warn, error.\n#log_level = \"info\"\n\n# Omit timestamps from log output.\n#no_log_time = false\n\n# Expose /debug/pprof/* profiling endpoints.\n#pprof = false\n\n# Write CPU profile to file.\n#cpuprofile = \"~/.cache/caic/cpu.prof\"\n\n# Write heap profile to file on shutdown.\n#memprofile = \"~/.cache/caic/mem.prof\"\n\n# Write execution trace to file.\n#trace = \"~/.cache/caic/trace.out\"\n"}, "70daf4412095bad0f9383d77604c3b99ed459e48": {"t": 1785750217.9137774, "n": 6085, "h": "a0ab066f54b35421", "c": "# caic configuration\n# Copy to ~/.config/caic/config.toml and edit as needed.\n\n# ── Core ─────────────────────────────────────────────────────────────────────\n\n[core]\n# Parent directory containing git repositories managed by caic.\n#root = \".\"\n\n# Auto-update schedule (cron expression, local time). Checks GitHub Releases\n# and replaces the binary on match. Set to \"\" to disable.\n# When not set, defaults to daily at 04:50.\n#auto_update = \"\"\n\n# Tailscale API key — required for Tailscale ephemeral node.\n# Obtain from https://login.tailscale.com/admin/settings/keys\n#tailscale_api_key = \"\"\n\n# ── Server ───────────────────────────────────────────────────────────────────\n\n[server]\n# HTTP listen address for the web UI.\n#http = \":2242\"\n\n# Public base URL. \"auto\" locks the hostname from the first FQDN request.\n# Set an explicit URL for OAuth login and webhooks.\n# Example: \"https://caic.example.com\" or \"https://caic.my-tailnet.ts.net\"\n#external_url = \"auto\"\n\n# UDP port for WebRTC ICE (single-port mux). 0 disables WebRTC voice.\n# Requires libopus-dev at build time (CGO_ENABLED=1).\n# Open this port in your firewall for UDP traffic.\n#webrtc_port = 0\n\n# Path to a MaxMind MMDB file for country-code resolution and logging.\n# Download GeoLite2-Country.mmdb from https://dev.maxmind.com/geoip/geolite2-free-geolocation-data\n# Relative paths are resolved against the config directory.\n#geo_db = \"GeoLite2-Country.mmdb\"\n\n# Allowed origins. Requests from IPs that do not match are rejected with\n# HTTP 403.\n# Named origins: \"local\" (loopback/private), \"tailscale\" (100.64.0.0/10),\n#   \"github\" (GitHub webhook IPs fetched from api.github.com/meta).\n# CIDR ranges: e.g. \"203.0.113.0/24\".\n# Country codes: ISO 3166-1 alpha-2 (e.g. \"CA\", \"US\", \"DE\"); requires geo_db.\n#allow_origins = [\"local\", \"tailscale\", \"github\"]\n\n# ── AI ───────────────────────────────────────────────────────────────────────\n\n[ai]\n# LLM provider for title generation, commit descriptions, etc.\n# When unset, auto-detects the best available provider in this order:\n#   1. codex (Codex)\n#   2. opencode (OpenCode)\n#   3. claudecode (Claude Code)\n#   4. gemini (Gemini)\n#   5. Any other available provider\n# Available providers: https://pkg.go.dev/github.com/maruel/genai/providers\n#provider = \"\"\n\n# Model name or alias. When unset, uses the provider's cheapest model.\n#model = \"\"\n\n# Gemini API key — required for Gemini Live voice agent and title generation\n# when provider is \"gemini\". Falls back to GEMINI_API_KEY environment variable\n# if not set. Obtain from https://aistudio.google.com/app/apikey\n#gemini_api_key = \"\"\n\n# ── Harness ──────────────────────────────────────────────────────────────────\n# Per-harness environment variables injected into containers. Each harness\n# section supports an [env] table of KEY = \"VALUE\" pairs. These supplement the\n# automatic *_API_KEY forwarding from the host environment and are also used\n# when fetching the model list at startup.\n[harness.claude.env]\n# Warning: setting this environment variable will cause Claude Code to use API costs and ignore your\n# subscription.\n#ANTHROPIC_API_KEY = \"sk-...\"\n\n[harness.codex.env]\n# Most of codex configuration is via its configuration described at\n# https://developers.openai.com/codex/config-reference\n\n[harness.opencode.env]\n# Most of opencode configuration is via its configuration described at\n# https://opencode.ai/docs/config/\n\n[harness.pi.env]\n# See https://github.com/badlogic/pi-mono/blob/main/packages/coding-agent/docs/providers.md\n#GEMINI_API_KEY = \"AIza...\"\n#OPENROUTER_API_KEY = \"sk-or-...\"\n#OPENAI_API_KEY = \"sk-...\"\n\n# ── GitHub ───────────────────────────────────────────────────────────────────\n# Choose one of PAT (token) or OAuth; GitHub App is independent.\n\n[github]\n# PAT — single-user / headless. Mutually exclusive with OAuth.\n# Create at https://github.com/settings/personal-access-tokens/new\n# Required permissions: pull_requests:write, checks:read\n# If unset and gh CLI is in PATH (and OAuth is not configured), caic uses\n# the token from `gh auth token` automatically.\n#token = \"\"\n\n# OAuth — multi-user login. Mutually exclusive with token.\n# See https://docs.caic.xyz/caic/github for OAuth app setup instructions.\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitHub users allowed to login. Highly recommended.\n#oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitHub App — org-wide webhooks and automatic task creation.\n# Layered on top of PAT or OAuth; not mutually exclusive with either.\n# See https://docs.caic.xyz/caic/ for GitHub App setup instructions.\n#app_id = 0\n# Path to PEM file (relative paths resolve against the config directory).\n#app_private_key_pem = \"private-key.pem\"\n# Owners/orgs allowed to install the app. Installs from other accounts are\n# rejected automatically. Highly recommended.\n#app_allowed_owners = [\"my-org\", \"my-username\"]\n\n# HMAC-SHA256 secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── GitLab ───────────────────────────────────────────────────────────────────\n# Choose one of PAT (token) or OAuth.\n\n[gitlab]\n# PAT — single-user / headless. Mutually exclusive with OAuth.\n# Create at https://gitlab.com/-/user_settings/personal_access_tokens\n# Required scope: api\n#token = \"\"\n\n# OAuth — multi-user login. Mutually exclusive with token.\n# See https://docs.caic.xyz/caic/gitlab for OAuth app setup instructions.\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitLab users allowed to login. Highly recommended.\n#oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitLab instance URL.\n#url = \"https://gitlab.com\"\n\n# Shared secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── Debug ────────────────────────────────────────────────────────────────────\n\n[debug]\n# Log level: debug, info, warn, error.\n#log_level = \"info\"\n\n# Omit timestamps from log output.\n#no_log_time = false\n\n# Expose /debug/pprof/* profiling endpoints.\n#pprof = false\n\n# Write CPU profile to file.\n#cpuprofile = \"\"\n\n# Write heap profile to file on shutdown.\n#memprofile = \"\"\n\n# Write execution trace to file.\n#trace = \"\"\n"}, "c4fffc72e8d3a313a417e414d6e16e94ed338898": {"t": 1785750219.9621184, "n": 5089, "h": "ca86c6e12baa0c23", "c": "# caic configuration\n# Copy to ~/.config/caic/config.toml and edit as needed.\n\n# ── Core ─────────────────────────────────────────────────────────────────────\n\n[core]\n# Parent directory containing git repositories managed by caic.\n#root = \".\"\n\n# Auto-update schedule (cron expression, local time). Checks GitHub Releases\n# and replaces the binary on match. Set to \"\" to disable.\n# When not set, defaults to daily at 04:50.\n#auto_update = \"\"\n\n# Tailscale API key — required for Tailscale ephemeral node.\n# Obtain from https://login.tailscale.com/admin/settings/keys\n#tailscale_api_key = \"\"\n\n# ── Server ───────────────────────────────────────────────────────────────────\n\n[server]\n# HTTP listen address for the web UI.\n#http = \":2242\"\n\n# Public base URL. \"auto\" locks the hostname from the first FQDN request.\n# Set an explicit URL for OAuth login and webhooks.\n# Example: \"https://caic.example.com\" or \"https://caic.my-tailnet.ts.net\"\n#external_url = \"auto\"\n\n# UDP port for WebRTC ICE (single-port mux). 0 disables WebRTC voice.\n# Requires libopus-dev at build time (CGO_ENABLED=1).\n# Open this port in your firewall for UDP traffic.\n#webrtc_port = 0\n\n# Path to a MaxMind MMDB file for country-code resolution and logging.\n# Download GeoLite2-Country.mmdb from https://dev.maxmind.com/geoip/geolite2-free-geolocation-data\n# Relative paths are resolved against the config directory.\n#geo_db = \"GeoLite2-Country.mmdb\"\n\n# Allowed origins. Requests from IPs that do not match are rejected with\n# HTTP 403.\n# Named origins: \"local\" (loopback/private), \"tailscale\" (100.64.0.0/10),\n#   \"github\" (GitHub webhook IPs fetched from api.github.com/meta).\n# CIDR ranges: e.g. \"203.0.113.0/24\".\n# Country codes: ISO 3166-1 alpha-2 (e.g. \"CA\", \"US\", \"DE\"); requires geo_db.\n#allow_origins = [\"local\", \"tailscale\", \"github\"]\n\n# ── AI ───────────────────────────────────────────────────────────────────────\n\n[ai]\n# LLM provider for title generation, commit descriptions, etc.\n# When unset, auto-detects the best available provider in this order:\n#   1. codex (Codex)\n#   2. opencode (OpenCode)\n#   3. claudecode (Claude Code)\n#   4. gemini (Gemini)\n#   5. Any other available provider\n# Available providers: https://pkg.go.dev/github.com/maruel/genai/providers\n#provider = \"\"\n\n# Model name or alias. When unset, uses the provider's cheapest model.\n#model = \"\"\n\n# Gemini API key — required for Gemini Live voice agent and title generation\n# when provider is \"gemini\". Falls back to GEMINI_API_KEY environment variable\n# if not set. Obtain from https://aistudio.google.com/app/apikey\n#gemini_api_key = \"\"\n\n# ── GitHub ───────────────────────────────────────────────────────────────────\n# Choose one of PAT (token) or OAuth; GitHub App is independent.\n\n[github]\n# PAT — single-user / headless. Mutually exclusive with OAuth.\n# Create at https://github.com/settings/personal-access-tokens/new\n# Required permissions: pull_requests:write, checks:read\n# If unset and gh CLI is in PATH (and OAuth is not configured), caic uses\n# the token from `gh auth token` automatically.\n#token = \"\"\n\n# OAuth — multi-user login. Mutually exclusive with token.\n# See https://docs.caic.xyz/caic/github for OAuth app setup instructions.\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitHub users allowed to login. Highly recommended.\n#oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitHub App — org-wide webhooks and automatic task creation.\n# Layered on top of PAT or OAuth; not mutually exclusive with either.\n# See https://docs.caic.xyz/caic/ for GitHub App setup instructions.\n#app_id = 0\n# Path to PEM file (relative paths resolve against the config directory).\n#app_private_key_pem = \"private-key.pem\"\n# Owners/orgs allowed to install the app. Installs from other accounts are\n# rejected automatically. Highly recommended.\n#app_allowed_owners = [\"my-org\", \"my-username\"]\n\n# HMAC-SHA256 secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── GitLab ───────────────────────────────────────────────────────────────────\n# Choose one of PAT (token) or OAuth.\n\n[gitlab]\n# PAT — single-user / headless. Mutually exclusive with OAuth.\n# Create at https://gitlab.com/-/user_settings/personal_access_tokens\n# Required scope: api\n#token = \"\"\n\n# OAuth — multi-user login. Mutually exclusive with token.\n# See https://docs.caic.xyz/caic/gitlab for OAuth app setup instructions.\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitLab users allowed to login. Highly recommended.\n#oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitLab instance URL.\n#url = \"https://gitlab.com\"\n\n# Shared secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── Debug ────────────────────────────────────────────────────────────────────\n\n[debug]\n# Log level: debug, info, warn, error.\n#log_level = \"info\"\n\n# Omit timestamps from log output.\n#no_log_time = false\n\n# Expose /debug/pprof/* profiling endpoints.\n#pprof = false\n\n# Write CPU profile to file.\n#cpuprofile = \"\"\n\n# Write heap profile to file on shutdown.\n#memprofile = \"\"\n\n# Write execution trace to file.\n#trace = \"\"\n"}, "eb7aa7673dcdb114c86bf233992a00f30fa47a70": {"t": 1785750221.2566507, "n": 5100, "h": "87c387088c0933ca", "c": "# caic configuration\n# Copy to ~/.config/caic/config.toml and edit as needed.\n\n# ── Core ─────────────────────────────────────────────────────────────────────\n\n[core]\n# Parent directory containing git repositories managed by caic.\n#root = \".\"\n\n# Auto-update schedule (cron expression, local time). Checks GitHub Releases\n# and replaces the binary on match. Set to \"off\" to disable.\n# Default: \"50 4 * * *\" (daily at 04:50).\n#auto_update = \"50 4 * * *\"\n\n# Tailscale API key — required for Tailscale ephemeral node.\n# Obtain from https://login.tailscale.com/admin/settings/keys\n#tailscale_api_key = \"\"\n\n# ── Server ───────────────────────────────────────────────────────────────────\n\n[server]\n# HTTP listen address for the web UI.\n#http = \":2242\"\n\n# Public base URL. \"auto\" locks the hostname from the first FQDN request.\n# Set an explicit URL for OAuth login and webhooks.\n# Example: \"https://caic.example.com\" or \"https://caic.my-tailnet.ts.net\"\n#external_url = \"auto\"\n\n# UDP port for WebRTC ICE (single-port mux). 0 disables WebRTC voice.\n# Requires libopus-dev at build time (CGO_ENABLED=1).\n# Open this port in your firewall for UDP traffic.\n#webrtc_port = 0\n\n# Path to a MaxMind MMDB file for country-code resolution and logging.\n# Download GeoLite2-Country.mmdb from https://dev.maxmind.com/geoip/geolite2-free-geolocation-data\n# Relative paths are resolved against the config directory.\n#geo_db = \"GeoLite2-Country.mmdb\"\n\n# Allowed origins. Requests from IPs that do not match are rejected with\n# HTTP 403.\n# Named origins: \"local\" (loopback/private), \"tailscale\" (100.64.0.0/10),\n#   \"github\" (GitHub webhook IPs fetched from api.github.com/meta).\n# CIDR ranges: e.g. \"203.0.113.0/24\".\n# Country codes: ISO 3166-1 alpha-2 (e.g. \"CA\", \"US\", \"DE\"); requires geo_db.\n#allow_origins = [\"local\", \"tailscale\", \"github\"]\n\n# ── AI ───────────────────────────────────────────────────────────────────────\n\n[ai]\n# LLM provider for title generation, commit descriptions, etc.\n# When unset, auto-detects the best available provider in this order:\n#   1. codex (Codex)\n#   2. opencode (OpenCode)\n#   3. claudecode (Claude Code)\n#   4. gemini (Gemini)\n#   5. Any other available provider\n# Available providers: https://pkg.go.dev/github.com/maruel/genai/providers\n#provider = \"\"\n\n# Model name or alias. When unset, uses the provider's cheapest model.\n#model = \"\"\n\n# Gemini API key — required for Gemini Live voice agent and title generation\n# when provider is \"gemini\". Falls back to GEMINI_API_KEY environment variable\n# if not set. Obtain from https://aistudio.google.com/app/apikey\n#gemini_api_key = \"\"\n\n# ── GitHub ───────────────────────────────────────────────────────────────────\n# Choose one of PAT (token) or OAuth; GitHub App is independent.\n\n[github]\n# PAT — single-user / headless. Mutually exclusive with OAuth.\n# Create at https://github.com/settings/personal-access-tokens/new\n# Required permissions: pull_requests:write, checks:read\n# If unset and gh CLI is in PATH (and OAuth is not configured), caic uses\n# the token from `gh auth token` automatically.\n#token = \"\"\n\n# OAuth — multi-user login. Mutually exclusive with token.\n# See https://docs.caic.xyz/caic/github for OAuth app setup instructions.\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitHub users allowed to login. Highly recommended.\n#oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitHub App — org-wide webhooks and automatic task creation.\n# Layered on top of PAT or OAuth; not mutually exclusive with either.\n# See https://docs.caic.xyz/caic/ for GitHub App setup instructions.\n#app_id = 0\n# Path to PEM file (relative paths resolve against the config directory).\n#app_private_key_pem = \"private-key.pem\"\n# Owners/orgs allowed to install the app. Installs from other accounts are\n# rejected automatically. Highly recommended.\n#app_allowed_owners = [\"my-org\", \"my-username\"]\n\n# HMAC-SHA256 secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── GitLab ───────────────────────────────────────────────────────────────────\n# Choose one of PAT (token) or OAuth.\n\n[gitlab]\n# PAT — single-user / headless. Mutually exclusive with OAuth.\n# Create at https://gitlab.com/-/user_settings/personal_access_tokens\n# Required scope: api\n#token = \"\"\n\n# OAuth — multi-user login. Mutually exclusive with token.\n# See https://docs.caic.xyz/caic/gitlab for OAuth app setup instructions.\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitLab users allowed to login. Highly recommended.\n#oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitLab instance URL.\n#url = \"https://gitlab.com\"\n\n# Shared secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── Debug ────────────────────────────────────────────────────────────────────\n\n[debug]\n# Log level: debug, info, warn, error.\n#log_level = \"info\"\n\n# Omit timestamps from log output.\n#no_log_time = false\n\n# Expose /debug/pprof/* profiling endpoints.\n#pprof = false\n\n# Write CPU profile to file.\n#cpuprofile = \"\"\n\n# Write heap profile to file on shutdown.\n#memprofile = \"\"\n\n# Write execution trace to file.\n#trace = \"\"\n"}, "2f4a7ab32d6041880aa537ad6bc98adbadc58149": {"t": 1785750222.6025176, "n": 5100, "h": "f20c6112f414f8ea", "c": "# caic configuration\n# Copy to ~/.config/caic/config.toml and edit as needed.\n\n# ── Core ─────────────────────────────────────────────────────────────────────\n\n[core]\n# Parent directory containing git repositories managed by caic.\n#root = \".\"\n\n# Auto-update schedule (cron expression, local time). Checks GitHub Releases\n# and replaces the binary on match. Set to \"off\" to disable.\n# Default: \"50 4 * * *\" (daily at 04:50).\n#auto_update = \"50 4 * * *\"\n\n# Tailscale API key — required for Tailscale ephemeral node.\n# Obtain from https://login.tailscale.com/admin/settings/keys\n#tailscale_api_key = \"\"\n\n# ── Server ───────────────────────────────────────────────────────────────────\n\n[server]\n# HTTP listen address for the web UI.\n#http = \":8080\"\n\n# Public base URL. \"auto\" locks the hostname from the first FQDN request.\n# Set an explicit URL for OAuth login and webhooks.\n# Example: \"https://caic.example.com\" or \"https://caic.my-tailnet.ts.net\"\n#external_url = \"auto\"\n\n# UDP port for WebRTC ICE (single-port mux). 0 disables WebRTC voice.\n# Requires libopus-dev at build time (CGO_ENABLED=1).\n# Open this port in your firewall for UDP traffic.\n#webrtc_port = 0\n\n# Path to a MaxMind MMDB file for country-code resolution and logging.\n# Download GeoLite2-Country.mmdb from https://dev.maxmind.com/geoip/geolite2-free-geolocation-data\n# Relative paths are resolved against the config directory.\n#geo_db = \"GeoLite2-Country.mmdb\"\n\n# Allowed origins. Requests from IPs that do not match are rejected with\n# HTTP 403.\n# Named origins: \"local\" (loopback/private), \"tailscale\" (100.64.0.0/10),\n#   \"github\" (GitHub webhook IPs fetched from api.github.com/meta).\n# CIDR ranges: e.g. \"203.0.113.0/24\".\n# Country codes: ISO 3166-1 alpha-2 (e.g. \"CA\", \"US\", \"DE\"); requires geo_db.\n#allow_origins = [\"local\", \"tailscale\", \"github\"]\n\n# ── AI ───────────────────────────────────────────────────────────────────────\n\n[ai]\n# LLM provider for title generation, commit descriptions, etc.\n# When unset, auto-detects the best available provider in this order:\n#   1. codex (Codex)\n#   2. opencode (OpenCode)\n#   3. claudecode (Claude Code)\n#   4. gemini (Gemini)\n#   5. Any other available provider\n# Available providers: https://pkg.go.dev/github.com/maruel/genai/providers\n#provider = \"\"\n\n# Model name or alias. When unset, uses the provider's cheapest model.\n#model = \"\"\n\n# Gemini API key — required for Gemini Live voice agent and title generation\n# when provider is \"gemini\". Falls back to GEMINI_API_KEY environment variable\n# if not set. Obtain from https://aistudio.google.com/app/apikey\n#gemini_api_key = \"\"\n\n# ── GitHub ───────────────────────────────────────────────────────────────────\n# Choose one of PAT (token) or OAuth; GitHub App is independent.\n\n[github]\n# PAT — single-user / headless. Mutually exclusive with OAuth.\n# Create at https://github.com/settings/personal-access-tokens/new\n# Required permissions: pull_requests:write, checks:read\n# If unset and gh CLI is in PATH (and OAuth is not configured), caic uses\n# the token from `gh auth token` automatically.\n#token = \"\"\n\n# OAuth — multi-user login. Mutually exclusive with token.\n# See https://docs.caic.xyz/caic/github for OAuth app setup instructions.\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitHub users allowed to login. Highly recommended.\n#oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitHub App — org-wide webhooks and automatic task creation.\n# Layered on top of PAT or OAuth; not mutually exclusive with either.\n# See https://docs.caic.xyz/caic/ for GitHub App setup instructions.\n#app_id = 0\n# Path to PEM file (relative paths resolve against the config directory).\n#app_private_key_pem = \"private-key.pem\"\n# Owners/orgs allowed to install the app. Installs from other accounts are\n# rejected automatically. Highly recommended.\n#app_allowed_owners = [\"my-org\", \"my-username\"]\n\n# HMAC-SHA256 secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── GitLab ───────────────────────────────────────────────────────────────────\n# Choose one of PAT (token) or OAuth.\n\n[gitlab]\n# PAT — single-user / headless. Mutually exclusive with OAuth.\n# Create at https://gitlab.com/-/user_settings/personal_access_tokens\n# Required scope: api\n#token = \"\"\n\n# OAuth — multi-user login. Mutually exclusive with token.\n# See https://docs.caic.xyz/caic/gitlab for OAuth app setup instructions.\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitLab users allowed to login. Highly recommended.\n#oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitLab instance URL.\n#url = \"https://gitlab.com\"\n\n# Shared secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── Debug ────────────────────────────────────────────────────────────────────\n\n[debug]\n# Log level: debug, info, warn, error.\n#log_level = \"info\"\n\n# Omit timestamps from log output.\n#no_log_time = false\n\n# Expose /debug/pprof/* profiling endpoints.\n#pprof = false\n\n# Write CPU profile to file.\n#cpuprofile = \"\"\n\n# Write heap profile to file on shutdown.\n#memprofile = \"\"\n\n# Write execution trace to file.\n#trace = \"\"\n"}, "4cda4fe384d938e58ac39a7032c50011168e2206": {"t": 1785750223.7707918, "n": 4802, "h": "2be746ba709c6f7b", "c": "# caic configuration\n# Copy to ~/.config/caic/config.toml and edit as needed.\n\n# ── Core ─────────────────────────────────────────────────────────────────────\n\n[core]\n# Parent directory containing git repositories managed by caic.\n#root = \".\"\n\n# Auto-update schedule (cron expression, local time). Checks GitHub Releases\n# and replaces the binary on match. Set to \"off\" to disable.\n# Default: \"50 4 * * *\" (daily at 04:50).\n#auto_update = \"50 4 * * *\"\n\n# Tailscale API key — required for Tailscale ephemeral node.\n# Obtain from https://login.tailscale.com/admin/settings/keys\n#tailscale_api_key = \"\"\n\n# ── Server ───────────────────────────────────────────────────────────────────\n\n[server]\n# HTTP listen address for the web UI.\n#http = \":8080\"\n\n# Public base URL. \"auto\" locks the hostname from the first FQDN request.\n# Set an explicit URL for OAuth login and webhooks.\n# Example: \"https://caic.example.com\" or \"https://caic.my-tailnet.ts.net\"\n#external_url = \"auto\"\n\n# UDP port for WebRTC ICE (single-port mux). 0 disables WebRTC voice.\n# Requires libopus-dev at build time (CGO_ENABLED=1).\n# Open this port in your firewall for UDP traffic.\n#webrtc_port = 0\n\n# Path to a MaxMind MMDB file for country-code resolution and logging.\n# Download GeoLite2-Country.mmdb from https://dev.maxmind.com/geoip/geolite2-free-geolocation-data\n# Relative paths are resolved against the config directory.\n#geo_db = \"GeoLite2-Country.mmdb\"\n\n# Allowed origins. Requests from IPs that do not match are rejected with\n# HTTP 403.\n# Named origins: \"local\" (loopback/private), \"tailscale\" (100.64.0.0/10),\n#   \"github\" (GitHub webhook IPs fetched from api.github.com/meta).\n# CIDR ranges: e.g. \"203.0.113.0/24\".\n# Country codes: ISO 3166-1 alpha-2 (e.g. \"CA\", \"US\", \"DE\"); requires geo_db.\n#allow_origins = [\"local\", \"tailscale\", \"github\"]\n\n# ── AI ───────────────────────────────────────────────────────────────────────\n\n[ai]\n# LLM provider for title generation, commit descriptions, etc.\n# See https://pkg.go.dev/github.com/maruel/genai/providers\n#provider = \"\"\n#model = \"\"\n\n# Gemini API key — required for Gemini Live voice agent and title generation\n# when provider is \"gemini\". Falls back to GEMINI_API_KEY environment variable\n# if not set. Obtain from https://aistudio.google.com/app/apikey\n#gemini_api_key = \"\"\n\n# ── GitHub ───────────────────────────────────────────────────────────────────\n# Choose one of PAT (token) or OAuth; GitHub App is independent.\n\n[github]\n# PAT — single-user / headless. Mutually exclusive with OAuth.\n# Create at https://github.com/settings/personal-access-tokens/new\n# Required permissions: pull_requests:write, checks:read\n# If unset and gh CLI is in PATH (and OAuth is not configured), caic uses\n# the token from `gh auth token` automatically.\n#token = \"\"\n\n# OAuth — multi-user login. Mutually exclusive with token.\n# See https://docs.caic.xyz/caic/github for OAuth app setup instructions.\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitHub users allowed to login. Highly recommended.\n#oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitHub App — org-wide webhooks and automatic task creation.\n# Layered on top of PAT or OAuth; not mutually exclusive with either.\n# See https://docs.caic.xyz/caic/ for GitHub App setup instructions.\n#app_id = 0\n# Path to PEM file (relative paths resolve against the config directory).\n#app_private_key_pem = \"private-key.pem\"\n# Owners/orgs allowed to install the app. Installs from other accounts are\n# rejected automatically. Highly recommended.\n#app_allowed_owners = [\"my-org\", \"my-username\"]\n\n# HMAC-SHA256 secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── GitLab ───────────────────────────────────────────────────────────────────\n# Choose one of PAT (token) or OAuth.\n\n[gitlab]\n# PAT — single-user / headless. Mutually exclusive with OAuth.\n# Create at https://gitlab.com/-/user_settings/personal_access_tokens\n# Required scope: api\n#token = \"\"\n\n# OAuth — multi-user login. Mutually exclusive with token.\n# See https://docs.caic.xyz/caic/gitlab for OAuth app setup instructions.\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitLab users allowed to login. Highly recommended.\n#oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitLab instance URL.\n#url = \"https://gitlab.com\"\n\n# Shared secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── Debug ────────────────────────────────────────────────────────────────────\n\n[debug]\n# Log level: debug, info, warn, error.\n#log_level = \"info\"\n\n# Omit timestamps from log output.\n#no_log_time = false\n\n# Expose /debug/pprof/* profiling endpoints.\n#pprof = false\n\n# Write CPU profile to file.\n#cpuprofile = \"\"\n\n# Write heap profile to file on shutdown.\n#memprofile = \"\"\n\n# Write execution trace to file.\n#trace = \"\"\n"}, "3c69c8232b8657d5aeb817ee280c6a9833ef5c67": {"t": 1785750224.8460546, "n": 4781, "h": "b9d0d46c5dcfd947", "c": "# caic configuration\n# Copy to ~/.config/caic/config.toml and edit as needed.\n\n# ── Core ─────────────────────────────────────────────────────────────────────\n\n[core]\n# Parent directory containing git repositories managed by caic.\n#root = \".\"\n\n# Auto-update schedule (cron expression, local time). Checks GitHub Releases\n# and replaces the binary on match. Set to \"off\" to disable.\n# Default: \"50 4 * * *\" (daily at 04:50).\n#auto_update = \"50 4 * * *\"\n\n# Tailscale API key — required for Tailscale ephemeral node.\n# Obtain from https://login.tailscale.com/admin/settings/keys\n#tailscale_api_key = \"\"\n\n# ── Server ───────────────────────────────────────────────────────────────────\n\n[server]\n# HTTP listen address for the web UI.\n#http = \":8080\"\n\n# Public base URL. \"auto\" locks the hostname from the first FQDN request.\n# Set an explicit URL for OAuth login and webhooks.\n# Example: \"https://caic.example.com\" or \"https://caic.my-tailnet.ts.net\"\n#external_url = \"auto\"\n\n# UDP port for WebRTC ICE (single-port mux). 0 disables WebRTC voice.\n# Requires libopus-dev at build time (CGO_ENABLED=1).\n# Open this port in your firewall for UDP traffic.\n#webrtc_port = 0\n\n# Path to a MaxMind MMDB file for country-code resolution and logging.\n# Download GeoLite2-Country.mmdb from https://dev.maxmind.com/geoip/geolite2-free-geolocation-data\n# Relative paths are resolved against the config directory.\n#geo_db = \"\"\n\n# Allowed origins. Requests from IPs that do not match are rejected with\n# HTTP 403.\n# Named origins: \"local\" (loopback/private), \"tailscale\" (100.64.0.0/10),\n#   \"github\" (GitHub webhook IPs fetched from api.github.com/meta).\n# CIDR ranges: e.g. \"203.0.113.0/24\".\n# Country codes: ISO 3166-1 alpha-2 (e.g. \"CA\", \"US\", \"DE\"); requires geo_db.\n#allow_origins = [\"local\", \"tailscale\", \"github\"]\n\n# ── AI ───────────────────────────────────────────────────────────────────────\n\n[ai]\n# LLM provider for title generation, commit descriptions, etc.\n# See https://pkg.go.dev/github.com/maruel/genai/providers\n#provider = \"\"\n#model = \"\"\n\n# Gemini API key — required for Gemini Live voice agent and title generation\n# when provider is \"gemini\". Falls back to GEMINI_API_KEY environment variable\n# if not set. Obtain from https://aistudio.google.com/app/apikey\n#gemini_api_key = \"\"\n\n# ── GitHub ───────────────────────────────────────────────────────────────────\n# Choose one of PAT (token) or OAuth; GitHub App is independent.\n\n[github]\n# PAT — single-user / headless. Mutually exclusive with OAuth.\n# Create at https://github.com/settings/personal-access-tokens/new\n# Required permissions: pull_requests:write, checks:read\n# If unset and gh CLI is in PATH (and OAuth is not configured), caic uses\n# the token from `gh auth token` automatically.\n#token = \"\"\n\n# OAuth — multi-user login. Mutually exclusive with token.\n# See https://docs.caic.xyz/caic/github for OAuth app setup instructions.\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitHub users allowed to login. Highly recommended.\n#oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitHub App — org-wide webhooks and automatic task creation.\n# Layered on top of PAT or OAuth; not mutually exclusive with either.\n# See https://docs.caic.xyz/caic/ for GitHub App setup instructions.\n#app_id = 0\n# Path to PEM file (relative paths resolve against the config directory).\n#app_private_key_pem = \"private-key.pem\"\n# Owners/orgs allowed to install the app. Installs from other accounts are\n# rejected automatically. Highly recommended.\n#app_allowed_owners = [\"my-org\", \"my-username\"]\n\n# HMAC-SHA256 secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── GitLab ───────────────────────────────────────────────────────────────────\n# Choose one of PAT (token) or OAuth.\n\n[gitlab]\n# PAT — single-user / headless. Mutually exclusive with OAuth.\n# Create at https://gitlab.com/-/user_settings/personal_access_tokens\n# Required scope: api\n#token = \"\"\n\n# OAuth — multi-user login. Mutually exclusive with token.\n# See https://docs.caic.xyz/caic/gitlab for OAuth app setup instructions.\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitLab users allowed to login. Highly recommended.\n#oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitLab instance URL.\n#url = \"https://gitlab.com\"\n\n# Shared secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── Debug ────────────────────────────────────────────────────────────────────\n\n[debug]\n# Log level: debug, info, warn, error.\n#log_level = \"info\"\n\n# Omit timestamps from log output.\n#no_log_time = false\n\n# Expose /debug/pprof/* profiling endpoints.\n#pprof = false\n\n# Write CPU profile to file.\n#cpuprofile = \"\"\n\n# Write heap profile to file on shutdown.\n#memprofile = \"\"\n\n# Write execution trace to file.\n#trace = \"\"\n"}, "74759f5cb4abd58f18d48531cfdf7d03ad70a7d6": {"t": 1785750226.0604334, "n": 4674, "h": "3112b8a83ab1c4ba", "c": "# caic configuration\n# Copy to ~/.config/caic/config.toml and edit as needed.\n\n# ── Core ─────────────────────────────────────────────────────────────────────\n\n[core]\n# Parent directory containing git repositories managed by caic.\n#root = \".\"\n\n# Auto-update schedule (cron expression, local time). Checks GitHub Releases\n# and replaces the binary on match. Set to \"off\" to disable.\n# Default: \"50 4 * * *\" (daily at 04:50).\n#auto_update = \"50 4 * * *\"\n\n# Tailscale API key — required for Tailscale ephemeral node.\n# Obtain from https://login.tailscale.com/admin/settings/keys\n#tailscale_api_key = \"\"\n\n# ── Server ───────────────────────────────────────────────────────────────────\n\n[server]\n# HTTP listen address for the web UI.\n#http = \":8080\"\n\n# Public base URL. \"auto\" locks the hostname from the first FQDN request.\n# Set an explicit URL for OAuth login and webhooks.\n# Example: \"https://caic.example.com\" or \"https://caic.my-tailnet.ts.net\"\n#external_url = \"auto\"\n\n# UDP port for WebRTC ICE (single-port mux). 0 disables WebRTC voice.\n# Requires libopus-dev at build time (CGO_ENABLED=1).\n# Open this port in your firewall for UDP traffic.\n#webrtc_port = 0\n\n# Path to a MaxMind MMDB file for country-code resolution and logging.\n# Download GeoLite2-Country.mmdb from https://dev.maxmind.com/geoip/geolite2-free-geolocation-data\n# Relative paths are resolved against the config directory.\n#geo_db = \"\"\n\n# Allowed origins. Requests from IPs that do not match are rejected with\n# HTTP 403.\n# Named origins: \"local\" (loopback/private), \"tailscale\" (100.64.0.0/10),\n#   \"github\" (GitHub webhook IPs fetched from api.github.com/meta).\n# CIDR ranges: e.g. \"203.0.113.0/24\".\n# Country codes: ISO 3166-1 alpha-2 (e.g. \"CA\", \"US\", \"DE\"); requires geo_db.\n#allow_origins = [\"local\", \"tailscale\", \"github\"]\n\n# ── AI ───────────────────────────────────────────────────────────────────────\n\n[ai]\n# LLM provider for title generation, commit descriptions, etc.\n# See https://pkg.go.dev/github.com/maruel/genai/providers\n#provider = \"\"\n#model = \"\"\n\n# Gemini API key — required for the Gemini Live voice agent.\n# Obtain from https://aistudio.google.com/app/apikey\n#gemini_api_key = \"\"\n\n# ── GitHub ───────────────────────────────────────────────────────────────────\n# Choose one of PAT (token) or OAuth; GitHub App is independent.\n\n[github]\n# PAT — single-user / headless. Mutually exclusive with OAuth.\n# Create at https://github.com/settings/personal-access-tokens/new\n# Required permissions: pull_requests:write, checks:read\n# If unset and gh CLI is in PATH (and OAuth is not configured), caic uses\n# the token from `gh auth token` automatically.\n#token = \"\"\n\n# OAuth — multi-user login. Mutually exclusive with token.\n# See https://docs.caic.xyz/caic/github for OAuth app setup instructions.\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitHub users allowed to login. Highly recommended.\n#oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitHub App — org-wide webhooks and automatic task creation.\n# Layered on top of PAT or OAuth; not mutually exclusive with either.\n# See https://docs.caic.xyz/caic/ for GitHub App setup instructions.\n#app_id = 0\n# Path to PEM file (relative paths resolve against the config directory).\n#app_private_key_pem = \"private-key.pem\"\n# Owners/orgs allowed to install the app. Installs from other accounts are\n# rejected automatically. Highly recommended.\n#app_allowed_owners = [\"my-org\", \"my-username\"]\n\n# HMAC-SHA256 secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── GitLab ───────────────────────────────────────────────────────────────────\n# Choose one of PAT (token) or OAuth.\n\n[gitlab]\n# PAT — single-user / headless. Mutually exclusive with OAuth.\n# Create at https://gitlab.com/-/user_settings/personal_access_tokens\n# Required scope: api\n#token = \"\"\n\n# OAuth — multi-user login. Mutually exclusive with token.\n# See https://docs.caic.xyz/caic/gitlab for OAuth app setup instructions.\n#oauth_client_id = \"\"\n#oauth_client_secret = \"\"\n# GitLab users allowed to login. Highly recommended.\n#oauth_allowed_users = [\"alice\", \"bob\"]\n\n# GitLab instance URL.\n#url = \"https://gitlab.com\"\n\n# Shared secret for webhook verification.\n# Generate with: openssl rand -hex 32\n#webhook_secret = \"\"\n\n# ── Debug ────────────────────────────────────────────────────────────────────\n\n[debug]\n# Log level: debug, info, warn, error.\n#log_level = \"info\"\n\n# Omit timestamps from log output.\n#no_log_time = false\n\n# Expose /debug/pprof/* profiling endpoints.\n#pprof = false\n\n# Write CPU profile to file.\n#cpuprofile = \"\"\n\n# Write heap profile to file on shutdown.\n#memprofile = \"\"\n\n# Write execution trace to file.\n#trace = \"\"\n"}}}}