[{"data":1,"prerenderedAt":3150},["ShallowReactive",2],{"docs-nav":3,"docs-\u002Fdocs\u002Fconfiguration":78},[4,9,13,16,21,26,30,34,38,42,46,50,53,58,62,66,69,74],{"path":5,"title":6,"navTitle":6,"group":7,"order":8},"\u002Fdocs\u002Fcommands","Other commands","Guide",999,{"path":10,"title":11,"navTitle":12,"group":7,"order":8},"\u002Fdocs\u002Fcompaction","Context and compaction","Context & compaction",{"path":14,"title":15,"navTitle":15,"group":7,"order":8},"\u002Fdocs\u002Fconfiguration","Configuration",{"path":17,"title":18,"navTitle":18,"group":19,"order":20},"\u002Fdocs\u002Fenvironment","Environment variables","Reference",11,{"path":22,"title":23,"navTitle":23,"group":24,"order":25},"\u002Fdocs\u002Fflags","Flag reference","CLI",8,{"path":27,"title":28,"navTitle":28,"group":7,"order":29},"\u002Fdocs","Introduction",1,{"path":31,"title":32,"navTitle":32,"group":7,"order":33},"\u002Fdocs\u002Finstallation","Installation",2,{"path":35,"title":36,"navTitle":36,"group":19,"order":37},"\u002Fdocs\u002Fproviders","Providers",10,{"path":39,"title":40,"navTitle":40,"group":7,"order":41},"\u002Fdocs\u002Fquickstart","Quickstart",3,{"path":43,"title":44,"navTitle":45,"group":7,"order":8},"\u002Fdocs\u002Freleases","Releases and upgrading","Releases",{"path":47,"title":48,"navTitle":49,"group":7,"order":8},"\u002Fdocs\u002Frun","The run command","Running an audit",{"path":51,"title":52,"navTitle":52,"group":7,"order":8},"\u002Fdocs\u002Fsecurity","Security model",{"path":54,"title":55,"navTitle":56,"group":24,"order":57},"\u002Fdocs\u002Fsessions","Sessions and forking","Sessions",6,{"path":59,"title":60,"navTitle":61,"group":7,"order":8},"\u002Fdocs\u002Fskills-roles","Skills and roles","Skills & roles",{"path":63,"title":64,"navTitle":64,"group":19,"order":65},"\u002Fdocs\u002Ftools","Tool reference",12,{"path":67,"title":68,"navTitle":68,"group":7,"order":8},"\u002Fdocs\u002Ftroubleshooting","Troubleshooting",{"path":70,"title":71,"navTitle":72,"group":24,"order":73},"\u002Fdocs\u002Ftui","The interactive TUI","Interactive TUI",9,{"path":75,"title":76,"navTitle":77,"group":7,"order":8},"\u002Fdocs\u002Fweb-eval","Dashboard and evaluation","Dashboard & evaluation",{"id":79,"title":15,"body":80,"description":3139,"extension":3140,"group":7,"meta":3141,"navTitle":15,"navigation":3142,"order":8,"path":14,"seo":3143,"stem":3148,"__hash__":3149},"docs\u002Fdocs\u002Fconfiguration.md",{"type":81,"value":82,"toc":3122},"minimark",[83,87,91,96,150,202,215,225,229,232,240,251,266,269,295,299,415,757,760,764,767,821,824,826,832,925,978,1005,1007,1010,1122,1216,1230,1233,1243,1606,1611,1704,1709,1815,1818,1821,1875,1878,1881,1888,2032,2057,2065,2069,2074,2080,2083,2090,2099,2102,2213,2280,2290,2302,2304,2310,2489,2537,2542,2554,2558,2568,2707,2746,2760,2764,3102,3106,3118],[84,85,15],"h1",{"id":86},"configuration",[88,89,90],"p",{},"locac reads one JSON file. Everything in it is optional; CLI flags override it; and it never comes\nfrom the repository under audit.",[92,93,95],"h2",{"id":94},"where-the-file-lives","Where the file lives",[97,98,99,111],"table",{},[100,101,102],"thead",{},[103,104,105,108],"tr",{},[106,107],"th",{},[106,109,110],{},"Path",[112,113,114,126,140],"tbody",{},[103,115,116,120],{},[117,118,119],"td",{},"Default",[117,121,122],{},[123,124,125],"code",{},"~\u002F.locac\u002Fconfig.json",[103,127,128,135],{},[117,129,130,131,134],{},"With ",[123,132,133],{},"LOCAC_HOME"," set",[117,136,137],{},[123,138,139],{},"$LOCAC_HOME\u002Fconfig.json",[103,141,142,145],{},[117,143,144],{},"Explicit",[117,146,147],{},[123,148,149],{},"--config \u003Cpath>",[151,152,157],"pre",{"className":153,"code":154,"language":155,"meta":156,"style":156},"language-bash shiki shiki-themes vitesse-dark","locac config path     # print the resolved path\nlocac config init     # write a template there (never overwrites)\nlocac config show     # print the effective settings for this directory\n","bash","",[123,158,159,178,190],{"__ignoreMap":156},[160,161,163,167,171,174],"span",{"class":162,"line":29},"line",[160,164,166],{"class":165},"sCK9x","locac",[160,168,170],{"class":169},"s7rlk"," config",[160,172,173],{"class":169}," path",[160,175,177],{"class":176},"sux-A","     # print the resolved path\n",[160,179,180,182,184,187],{"class":162,"line":33},[160,181,166],{"class":165},[160,183,170],{"class":169},[160,185,186],{"class":169}," init",[160,188,189],{"class":176},"     # write a template there (never overwrites)\n",[160,191,192,194,196,199],{"class":162,"line":41},[160,193,166],{"class":165},[160,195,170],{"class":169},[160,197,198],{"class":169}," show",[160,200,201],{"class":176},"     # print the effective settings for this directory\n",[88,203,204,206,207,210,211,214],{},[123,205,133],{}," also holds the per-project session databases (",[123,208,209],{},"projects\u002F","), installed skills\n(",[123,212,213],{},"skills\u002F","), keybindings, and on Windows the extracted sandbox broker.",[216,217,218],"blockquote",{},[88,219,220,224],{},[221,222,223],"strong",{},"This path is a security boundary."," The repository under audit is treated as attacker-authored.\nA config read from it could choose your provider, your base URL, and your API key, so locac never\nlooks there: not for config, not for skills, not for roles, not for prompt text.",[92,226,228],{"id":227},"precedence","Precedence",[88,230,231],{},"For each individual field, the last layer that sets it wins:",[151,233,238],{"className":234,"code":236,"language":237,"meta":156},[235],"language-text","built-in default  →  global config  →  matching `projects` entry  →  CLI flag\n","text",[123,239,236],{"__ignoreMap":156},[88,241,242,243,246,247,250],{},"The project entry is chosen by path: an exact match on the resolved ",[123,244,245],{},"--cwd",", otherwise the ",[221,248,249],{},"deepest\nconfigured ancestor",", so a subdirectory inherits its repository's settings. Paths are compared\nresolved and, on Windows only where the filesystem is case-insensitive, case-folded.",[88,252,253,254,258,259,262,263,265],{},"If the working directory matches no project entry ",[255,256,257],"em",{},"and"," the global config has no ",[123,260,261],{},"model",", locac falls\nback to the most recently added project entry. That is what makes a bare ",[123,264,166],{}," in a fresh directory\nstill pick up the model you last configured.",[88,267,268],{},"Two extra rules apply to the model source, because a stale API key paired with the wrong endpoint is\nthe one configuration error that leaks a secret to a third party:",[270,271,272,284],"ul",{},[273,274,275,276,279,280,283],"li",{},"Naming a ",[123,277,278],{},"provider"," on the command line clears an inherited ",[123,281,282],{},"customProvider",", and vice versa.",[273,285,286,287,290,291,294],{},"An API key is only inherited from a layer if that layer did not name a ",[255,288,289],{},"different"," provider beside\nit. A key saved next to ",[123,292,293],{},"\"provider\": \"zai\""," will never be sent to an Anthropic endpoint.",[92,296,298],{"id":297},"top-level-fields","Top-level fields",[151,300,304],{"className":301,"code":302,"language":303,"meta":156,"style":156},"language-json shiki shiki-themes vitesse-dark","{\n  \"provider\": \"anthropic\",\n  \"model\": \"claude-opus-4-8\",\n  \"apiKey\": \"$ANTHROPIC_API_KEY\",\n  \"budget\": { \"maxTokens\": 500000 }\n}\n","json",[123,305,306,312,339,358,379,410],{"__ignoreMap":156},[160,307,308],{"class":162,"line":29},[160,309,311],{"class":310},"s_pn2","{\n",[160,313,314,318,321,324,327,331,334,336],{"class":162,"line":33},[160,315,317],{"class":316},"s6USN","  \"",[160,319,278],{"class":320},"sm68I",[160,322,323],{"class":316},"\"",[160,325,326],{"class":310},":",[160,328,330],{"class":329},"sNJcY"," \"",[160,332,333],{"class":169},"anthropic",[160,335,323],{"class":329},[160,337,338],{"class":310},",\n",[160,340,341,343,345,347,349,351,354,356],{"class":162,"line":41},[160,342,317],{"class":316},[160,344,261],{"class":320},[160,346,323],{"class":316},[160,348,326],{"class":310},[160,350,330],{"class":329},[160,352,353],{"class":169},"claude-opus-4-8",[160,355,323],{"class":329},[160,357,338],{"class":310},[160,359,361,363,366,368,370,372,375,377],{"class":162,"line":360},4,[160,362,317],{"class":316},[160,364,365],{"class":320},"apiKey",[160,367,323],{"class":316},[160,369,326],{"class":310},[160,371,330],{"class":329},[160,373,374],{"class":169},"$ANTHROPIC_API_KEY",[160,376,323],{"class":329},[160,378,338],{"class":310},[160,380,382,384,387,389,391,394,396,399,401,403,407],{"class":162,"line":381},5,[160,383,317],{"class":316},[160,385,386],{"class":320},"budget",[160,388,323],{"class":316},[160,390,326],{"class":310},[160,392,393],{"class":310}," {",[160,395,330],{"class":316},[160,397,398],{"class":320},"maxTokens",[160,400,323],{"class":316},[160,402,326],{"class":310},[160,404,406],{"class":405},"sxA9i"," 500000",[160,408,409],{"class":310}," }\n",[160,411,412],{"class":162,"line":57},[160,413,414],{"class":310},"}\n",[97,416,417,430],{},[100,418,419],{},[103,420,421,424,427],{},[106,422,423],{},"Field",[106,425,426],{},"Type",[106,428,429],{},"Notes",[112,431,432,461,478,500,511,523,542,559,574,589,605,619,631,648,662,679,695,711,727,741],{},[103,433,434,438,441],{},[117,435,436],{},[123,437,278],{},[117,439,440],{},"string",[117,442,443,444,446,447,446,450,446,453,456,457,460],{},"A built-in provider name: ",[123,445,333],{},", ",[123,448,449],{},"openai",[123,451,452],{},"groq",[123,454,455],{},"ollama",", … See ",[458,459,36],"a",{"href":35},".",[103,462,463,467,469],{},[117,464,465],{},[123,466,282],{},[117,468,440],{},[117,470,471,472,475,476,460],{},"Name of an entry in ",[123,473,474],{},"providers[]",". Mutually exclusive with ",[123,477,278],{},[103,479,480,485,487],{},[117,481,482],{},[123,483,484],{},"api",[117,486,440],{},[117,488,489,490,446,493,446,496,499],{},"Wire protocol: ",[123,491,492],{},"anthropic-messages",[123,494,495],{},"openai-completions",[123,497,498],{},"ollama-chat",". Only needed for a generic endpoint.",[103,501,502,506,508],{},[117,503,504],{},[123,505,261],{},[117,507,440],{},[117,509,510],{},"Model id. Required for a run, but may come from a project entry instead.",[103,512,513,518,520],{},[117,514,515],{},[123,516,517],{},"baseUrl",[117,519,440],{},[117,521,522],{},"Endpoint base URL for the generic path.",[103,524,525,529,531],{},[117,526,527],{},[123,528,365],{},[117,530,440],{},[117,532,533,534,537,538,541],{},"A literal key, or ",[123,535,536],{},"\"$VAR\""," \u002F ",[123,539,540],{},"\"${VAR}\""," to read one from the environment.",[103,543,544,549,554],{},[117,545,546],{},[123,547,548],{},"authScheme",[117,550,551],{},[123,552,553],{},"\"x-api-key\" | \"bearer\"",[117,555,556,558],{},[123,557,492],{}," only.",[103,560,561,566,568],{},[117,562,563],{},[123,564,565],{},"systemPrompt",[117,567,440],{},[117,569,570,573],{},[221,571,572],{},"Replaces"," the default vulnerability-research system prompt.",[103,575,576,581,583],{},[117,577,578],{},[123,579,580],{},"appendSystemPrompt",[117,582,440],{},[117,584,585,588],{},[221,586,587],{},"Appends"," to whichever prompt is in force, a role's included, so operator guidance survives a subagent spawn.",[103,590,591,596,598],{},[117,592,593],{},[123,594,595],{},"outputStyle",[117,597,440],{},[117,599,600,601,604],{},"Prose style for the model's own text. Built-in: ",[123,602,603],{},"direct",". Off unless set.",[103,606,607,612,614],{},[117,608,609],{},[123,610,611],{},"db",[117,613,440],{},[117,615,616,617,460],{},"Session database path. Defaults to a per-project path under ",[123,618,133],{},[103,620,621,626,628],{},[117,622,623],{},[123,624,625],{},"shellPath",[117,627,440],{},[117,629,630],{},"Path to a bash-compatible shell for exec and the sandbox. Auto-discovered when unset.",[103,632,633,638,641],{},[117,634,635],{},[123,636,637],{},"compaction",[117,639,640],{},"object",[117,642,643,644,460],{},"See ",[458,645,647],{"href":646},"#compaction","Compaction",[103,649,650,654,656],{},[117,651,652],{},[123,653,386],{},[117,655,640],{},[117,657,643,658,460],{},[458,659,661],{"href":660},"#budget","Budget",[103,663,664,669,672],{},[117,665,666],{},[123,667,668],{},"providers",[117,670,671],{},"array",[117,673,674,675,460],{},"Saved custom endpoints. See ",[458,676,678],{"href":677},"#custom-providers","Custom providers",[103,680,681,686,688],{},[117,682,683],{},[123,684,685],{},"models",[117,687,640],{},[117,689,690,691,460],{},"Per-model settings keyed by model id. See ",[458,692,694],{"href":693},"#per-model-settings","Per-model settings",[103,696,697,702,704],{},[117,698,699],{},[123,700,701],{},"projects",[117,703,640],{},[117,705,706,707,460],{},"Per-repository overrides keyed by absolute path. See ",[458,708,710],{"href":709},"#per-project-overrides","Per-project overrides",[103,712,713,718,720],{},[117,714,715],{},[123,716,717],{},"web",[117,719,640],{},[117,721,722,723,460],{},"Dashboard bind settings. See ",[458,724,726],{"href":725},"#dashboard","Dashboard",[103,728,729,734,736],{},[117,730,731],{},[123,732,733],{},"auth",[117,735,640],{},[117,737,738,739,460],{},"Dashboard credentials. See ",[458,740,726],{"href":725},[103,742,743,748,750],{},[117,744,745],{},[123,746,747],{},"roles",[117,749,640],{},[117,751,752,753,460],{},"Subagent role overrides. See ",[458,754,756],{"href":755},"#roles","Roles",[88,758,759],{},"Unknown keys are discarded, never persisted.",[92,761,763],{"id":762},"api-keys","API keys",[88,765,766],{},"Three ways to supply one, in increasing order of how much you are trusting the file:",[768,769,770,786,808],"ol",{},[273,771,772,775,776,778,779,446,782,785],{},[221,773,774],{},"Environment variable only."," Leave ",[123,777,365],{}," unset and export the provider's variable\n(",[123,780,781],{},"ANTHROPIC_API_KEY",[123,783,784],{},"OPENAI_API_KEY",", …). locac reads it at run time.",[273,787,788,791,792,795,796,799,800,803,804,807],{},[221,789,790],{},"Reference from config."," ",[123,793,794],{},"\"apiKey\": \"$ANTHROPIC_API_KEY\"",". Both ",[123,797,798],{},"$VAR"," and ",[123,801,802],{},"${VAR}"," are\nexpanded through a single choke point. An unset variable resolves to ",[255,805,806],{},"nothing"," and the run fails\nloudly, because locac never sends an empty key.",[273,809,810,791,813,816,817,820],{},[221,811,812],{},"Literal in config.",[123,814,815],{},"\"apiKey\": \"sk-...\"",". ",[123,818,819],{},"config init"," writes the file with tightened\npermissions precisely because this is the next thing an operator does.",[88,822,823],{},"However you supply it, the key never reaches the browser: the dashboard is served a redaction\nsentinel, and every key present anywhere in the config, whether global, per-provider or per-project, is\nregistered with the output guard so it is scrubbed from tool output even for runs that did not select\nit.",[92,825,661],{"id":386},[88,827,828,829,460],{},"Caps that stop a run before it stops itself. A run halted by a cap exits with code ",[123,830,831],{},"2",[151,833,835],{"className":301,"code":834,"language":303,"meta":156,"style":156},"{\n  \"budget\": {\n    \"maxIterations\": 0,\n    \"maxToolCalls\": 400,\n    \"maxTokens\": 500000,\n    \"maxWallClockMs\": 3600000\n  }\n}\n",[123,836,837,841,854,871,887,901,915,921],{"__ignoreMap":156},[160,838,839],{"class":162,"line":29},[160,840,311],{"class":310},[160,842,843,845,847,849,851],{"class":162,"line":33},[160,844,317],{"class":316},[160,846,386],{"class":320},[160,848,323],{"class":316},[160,850,326],{"class":310},[160,852,853],{"class":310}," {\n",[160,855,856,859,862,864,866,869],{"class":162,"line":41},[160,857,858],{"class":316},"    \"",[160,860,861],{"class":320},"maxIterations",[160,863,323],{"class":316},[160,865,326],{"class":310},[160,867,868],{"class":405}," 0",[160,870,338],{"class":310},[160,872,873,875,878,880,882,885],{"class":162,"line":360},[160,874,858],{"class":316},[160,876,877],{"class":320},"maxToolCalls",[160,879,323],{"class":316},[160,881,326],{"class":310},[160,883,884],{"class":405}," 400",[160,886,338],{"class":310},[160,888,889,891,893,895,897,899],{"class":162,"line":381},[160,890,858],{"class":316},[160,892,398],{"class":320},[160,894,323],{"class":316},[160,896,326],{"class":310},[160,898,406],{"class":405},[160,900,338],{"class":310},[160,902,903,905,908,910,912],{"class":162,"line":57},[160,904,858],{"class":316},[160,906,907],{"class":320},"maxWallClockMs",[160,909,323],{"class":316},[160,911,326],{"class":310},[160,913,914],{"class":405}," 3600000\n",[160,916,918],{"class":162,"line":917},7,[160,919,920],{"class":310},"  }\n",[160,922,923],{"class":162,"line":25},[160,924,414],{"class":310},[97,926,927,936],{},[100,928,929],{},[103,930,931,933],{},[106,932,423],{},[106,934,935],{},"Meaning",[112,937,938,951,960,969],{},[103,939,940,944],{},[117,941,942],{},[123,943,861],{},[117,945,946,947,950],{},"Agent turns. ",[123,948,949],{},"0"," or unset means unlimited.",[103,952,953,957],{},[117,954,955],{},[123,956,877],{},[117,958,959],{},"Total tool invocations across the run.",[103,961,962,966],{},[117,963,964],{},[123,965,398],{},[117,967,968],{},"Total tokens.",[103,970,971,975],{},[117,972,973],{},[123,974,907],{},[117,976,977],{},"Wall-clock milliseconds.",[88,979,980,981,446,984,446,987,338,990,993,994,997,998,799,1001,1004],{},"Each has a CLI equivalent: ",[123,982,983],{},"--max-iterations",[123,985,986],{},"--max-tool-calls",[123,988,989],{},"--max-tokens",[123,991,992],{},"--max-wall-clock-ms",". All four must be ",[221,995,996],{},"positive integers"," on the command line, so ",[123,999,1000],{},"8k",[123,1002,1003],{},"80.5","\nare rejected rather than silently coerced.",[92,1006,647],{"id":637},[88,1008,1009],{},"Context shrinking is on by default and is deterministic: a rule-based elision pass, not an LLM\nsummarisation call.",[151,1011,1013],{"className":301,"code":1012,"language":303,"meta":156,"style":156},"{\n  \"compaction\": {\n    \"enabled\": true,\n    \"mode\": \"elide\",\n    \"reserveTokens\": 40000,\n    \"keepRecent\": 8,\n    \"evidenceBudgetTokens\": 20000\n  }\n}\n",[123,1014,1015,1019,1031,1048,1068,1084,1100,1114,1118],{"__ignoreMap":156},[160,1016,1017],{"class":162,"line":29},[160,1018,311],{"class":310},[160,1020,1021,1023,1025,1027,1029],{"class":162,"line":33},[160,1022,317],{"class":316},[160,1024,637],{"class":320},[160,1026,323],{"class":316},[160,1028,326],{"class":310},[160,1030,853],{"class":310},[160,1032,1033,1035,1038,1040,1042,1046],{"class":162,"line":41},[160,1034,858],{"class":316},[160,1036,1037],{"class":320},"enabled",[160,1039,323],{"class":316},[160,1041,326],{"class":310},[160,1043,1045],{"class":1044},"s3QIE"," true",[160,1047,338],{"class":310},[160,1049,1050,1052,1055,1057,1059,1061,1064,1066],{"class":162,"line":360},[160,1051,858],{"class":316},[160,1053,1054],{"class":320},"mode",[160,1056,323],{"class":316},[160,1058,326],{"class":310},[160,1060,330],{"class":329},[160,1062,1063],{"class":169},"elide",[160,1065,323],{"class":329},[160,1067,338],{"class":310},[160,1069,1070,1072,1075,1077,1079,1082],{"class":162,"line":381},[160,1071,858],{"class":316},[160,1073,1074],{"class":320},"reserveTokens",[160,1076,323],{"class":316},[160,1078,326],{"class":310},[160,1080,1081],{"class":405}," 40000",[160,1083,338],{"class":310},[160,1085,1086,1088,1091,1093,1095,1098],{"class":162,"line":57},[160,1087,858],{"class":316},[160,1089,1090],{"class":320},"keepRecent",[160,1092,323],{"class":316},[160,1094,326],{"class":310},[160,1096,1097],{"class":405}," 8",[160,1099,338],{"class":310},[160,1101,1102,1104,1107,1109,1111],{"class":162,"line":917},[160,1103,858],{"class":316},[160,1105,1106],{"class":320},"evidenceBudgetTokens",[160,1108,323],{"class":316},[160,1110,326],{"class":310},[160,1112,1113],{"class":405}," 20000\n",[160,1115,1116],{"class":162,"line":25},[160,1117,920],{"class":310},[160,1119,1120],{"class":162,"line":73},[160,1121,414],{"class":310},[97,1123,1124,1134],{},[100,1125,1126],{},[103,1127,1128,1130,1132],{},[106,1129,423],{},[106,1131,119],{},[106,1133,935],{},[112,1135,1136,1154,1174,1186,1200],{},[103,1137,1138,1142,1147],{},[117,1139,1140],{},[123,1141,1037],{},[117,1143,1144],{},[123,1145,1146],{},"true",[117,1148,1149,1150,1153],{},"Set ",[123,1151,1152],{},"false"," to disable. A long run will then overflow the context window.",[103,1155,1156,1160,1165],{},[117,1157,1158],{},[123,1159,1054],{},[117,1161,1162],{},[123,1163,1164],{},"\"elide\"",[117,1166,1167,1169,1170,1173],{},[123,1168,1063],{}," is the LLM-free default. ",[123,1171,1172],{},"summarize"," is reserved.",[103,1175,1176,1180,1183],{},[117,1177,1178],{},[123,1179,1074],{},[117,1181,1182],{},"20% of the window",[117,1184,1185],{},"Headroom left for the response.",[103,1187,1188,1192,1197],{},[117,1189,1190],{},[123,1191,1090],{},[117,1193,1194],{},[123,1195,1196],{},"8",[117,1198,1199],{},"Trailing messages kept verbatim.",[103,1201,1202,1206,1209],{},[117,1203,1204],{},[123,1205,1106],{},[117,1207,1208],{},"half the reserve",[117,1210,1211,1212,1215],{},"Budget for ",[255,1213,1214],{},"old"," sink \u002F finding \u002F PoC evidence.",[88,1217,1218,1219,1222,1223,1226,1227,1229],{},"Elision is non-destructive: the full body stays in the transcript store, and an elided result renders\nas ",[123,1220,1221],{},"[elided \u003Cn> chars of \u003Ctool> output — recall seq=\u003CN>]",", which the agent can restore verbatim with\nthe ",[123,1224,1225],{},"recall"," tool instead of re-running an expensive command. Full details on the\n",[458,1228,12],{"href":10}," page.",[92,1231,678],{"id":1232},"custom-providers",[88,1234,1235,1236,1239,1240,1242],{},"Any endpoint that speaks one of the supported wire protocols. Saved by name, then selected with\n",[123,1237,1238],{},"--custom-provider \u003Cname>"," or the config's ",[123,1241,282],{}," field.",[151,1244,1246],{"className":301,"code":1245,"language":303,"meta":156,"style":156},"{\n  \"providers\": [\n    {\n      \"name\": \"corp-gateway\",\n      \"api\": \"openai-completions\",\n      \"baseUrl\": \"https:\u002F\u002Fllm.corp.internal\u002Fv1\",\n      \"apiKey\": \"$CORP_LLM_KEY\",\n      \"models\": [\n        {\n          \"id\": \"corp-large\",\n          \"contextWindow\": 262144,\n          \"maxTokens\": 32000,\n          \"reasoning\": true,\n          \"reasoningEffort\": \"high\",\n          \"finishReasonOptional\": true,\n          \"cost\": { \"input\": 3, \"output\": 15, \"cacheRead\": 0.3, \"cacheWrite\": 3.75 }\n        }\n      ]\n    }\n  ],\n  \"customProvider\": \"corp-gateway\",\n  \"model\": \"corp-large\"\n}\n",[123,1247,1248,1252,1265,1270,1291,1309,1328,1347,1359,1364,1385,1401,1416,1432,1453,1469,1540,1546,1552,1558,1564,1583,1601],{"__ignoreMap":156},[160,1249,1250],{"class":162,"line":29},[160,1251,311],{"class":310},[160,1253,1254,1256,1258,1260,1262],{"class":162,"line":33},[160,1255,317],{"class":316},[160,1257,668],{"class":320},[160,1259,323],{"class":316},[160,1261,326],{"class":310},[160,1263,1264],{"class":310}," [\n",[160,1266,1267],{"class":162,"line":41},[160,1268,1269],{"class":310},"    {\n",[160,1271,1272,1275,1278,1280,1282,1284,1287,1289],{"class":162,"line":360},[160,1273,1274],{"class":316},"      \"",[160,1276,1277],{"class":320},"name",[160,1279,323],{"class":316},[160,1281,326],{"class":310},[160,1283,330],{"class":329},[160,1285,1286],{"class":169},"corp-gateway",[160,1288,323],{"class":329},[160,1290,338],{"class":310},[160,1292,1293,1295,1297,1299,1301,1303,1305,1307],{"class":162,"line":381},[160,1294,1274],{"class":316},[160,1296,484],{"class":320},[160,1298,323],{"class":316},[160,1300,326],{"class":310},[160,1302,330],{"class":329},[160,1304,495],{"class":169},[160,1306,323],{"class":329},[160,1308,338],{"class":310},[160,1310,1311,1313,1315,1317,1319,1321,1324,1326],{"class":162,"line":57},[160,1312,1274],{"class":316},[160,1314,517],{"class":320},[160,1316,323],{"class":316},[160,1318,326],{"class":310},[160,1320,330],{"class":329},[160,1322,1323],{"class":169},"https:\u002F\u002Fllm.corp.internal\u002Fv1",[160,1325,323],{"class":329},[160,1327,338],{"class":310},[160,1329,1330,1332,1334,1336,1338,1340,1343,1345],{"class":162,"line":917},[160,1331,1274],{"class":316},[160,1333,365],{"class":320},[160,1335,323],{"class":316},[160,1337,326],{"class":310},[160,1339,330],{"class":329},[160,1341,1342],{"class":169},"$CORP_LLM_KEY",[160,1344,323],{"class":329},[160,1346,338],{"class":310},[160,1348,1349,1351,1353,1355,1357],{"class":162,"line":25},[160,1350,1274],{"class":316},[160,1352,685],{"class":320},[160,1354,323],{"class":316},[160,1356,326],{"class":310},[160,1358,1264],{"class":310},[160,1360,1361],{"class":162,"line":73},[160,1362,1363],{"class":310},"        {\n",[160,1365,1366,1369,1372,1374,1376,1378,1381,1383],{"class":162,"line":37},[160,1367,1368],{"class":316},"          \"",[160,1370,1371],{"class":320},"id",[160,1373,323],{"class":316},[160,1375,326],{"class":310},[160,1377,330],{"class":329},[160,1379,1380],{"class":169},"corp-large",[160,1382,323],{"class":329},[160,1384,338],{"class":310},[160,1386,1387,1389,1392,1394,1396,1399],{"class":162,"line":20},[160,1388,1368],{"class":316},[160,1390,1391],{"class":320},"contextWindow",[160,1393,323],{"class":316},[160,1395,326],{"class":310},[160,1397,1398],{"class":405}," 262144",[160,1400,338],{"class":310},[160,1402,1403,1405,1407,1409,1411,1414],{"class":162,"line":65},[160,1404,1368],{"class":316},[160,1406,398],{"class":320},[160,1408,323],{"class":316},[160,1410,326],{"class":310},[160,1412,1413],{"class":405}," 32000",[160,1415,338],{"class":310},[160,1417,1419,1421,1424,1426,1428,1430],{"class":162,"line":1418},13,[160,1420,1368],{"class":316},[160,1422,1423],{"class":320},"reasoning",[160,1425,323],{"class":316},[160,1427,326],{"class":310},[160,1429,1045],{"class":1044},[160,1431,338],{"class":310},[160,1433,1435,1437,1440,1442,1444,1446,1449,1451],{"class":162,"line":1434},14,[160,1436,1368],{"class":316},[160,1438,1439],{"class":320},"reasoningEffort",[160,1441,323],{"class":316},[160,1443,326],{"class":310},[160,1445,330],{"class":329},[160,1447,1448],{"class":169},"high",[160,1450,323],{"class":329},[160,1452,338],{"class":310},[160,1454,1456,1458,1461,1463,1465,1467],{"class":162,"line":1455},15,[160,1457,1368],{"class":316},[160,1459,1460],{"class":320},"finishReasonOptional",[160,1462,323],{"class":316},[160,1464,326],{"class":310},[160,1466,1045],{"class":1044},[160,1468,338],{"class":310},[160,1470,1472,1474,1477,1479,1481,1483,1485,1488,1490,1492,1495,1498,1500,1503,1505,1507,1510,1512,1514,1517,1519,1521,1524,1526,1528,1531,1533,1535,1538],{"class":162,"line":1471},16,[160,1473,1368],{"class":316},[160,1475,1476],{"class":320},"cost",[160,1478,323],{"class":316},[160,1480,326],{"class":310},[160,1482,393],{"class":310},[160,1484,330],{"class":316},[160,1486,1487],{"class":320},"input",[160,1489,323],{"class":316},[160,1491,326],{"class":310},[160,1493,1494],{"class":405}," 3",[160,1496,1497],{"class":310},",",[160,1499,330],{"class":316},[160,1501,1502],{"class":320},"output",[160,1504,323],{"class":316},[160,1506,326],{"class":310},[160,1508,1509],{"class":405}," 15",[160,1511,1497],{"class":310},[160,1513,330],{"class":316},[160,1515,1516],{"class":320},"cacheRead",[160,1518,323],{"class":316},[160,1520,326],{"class":310},[160,1522,1523],{"class":405}," 0.3",[160,1525,1497],{"class":310},[160,1527,330],{"class":316},[160,1529,1530],{"class":320},"cacheWrite",[160,1532,323],{"class":316},[160,1534,326],{"class":310},[160,1536,1537],{"class":405}," 3.75",[160,1539,409],{"class":310},[160,1541,1543],{"class":162,"line":1542},17,[160,1544,1545],{"class":310},"        }\n",[160,1547,1549],{"class":162,"line":1548},18,[160,1550,1551],{"class":310},"      ]\n",[160,1553,1555],{"class":162,"line":1554},19,[160,1556,1557],{"class":310},"    }\n",[160,1559,1561],{"class":162,"line":1560},20,[160,1562,1563],{"class":310},"  ],\n",[160,1565,1567,1569,1571,1573,1575,1577,1579,1581],{"class":162,"line":1566},21,[160,1568,317],{"class":316},[160,1570,282],{"class":320},[160,1572,323],{"class":316},[160,1574,326],{"class":310},[160,1576,330],{"class":329},[160,1578,1286],{"class":169},[160,1580,323],{"class":329},[160,1582,338],{"class":310},[160,1584,1586,1588,1590,1592,1594,1596,1598],{"class":162,"line":1585},22,[160,1587,317],{"class":316},[160,1589,261],{"class":320},[160,1591,323],{"class":316},[160,1593,326],{"class":310},[160,1595,330],{"class":329},[160,1597,1380],{"class":169},[160,1599,1600],{"class":329},"\"\n",[160,1602,1604],{"class":162,"line":1603},23,[160,1605,414],{"class":310},[88,1607,1608],{},[221,1609,1610],{},"Provider fields",[97,1612,1613,1621],{},[100,1614,1615],{},[103,1616,1617,1619],{},[106,1618,423],{},[106,1620,429],{},[112,1622,1623,1638,1654,1666,1677,1694],{},[103,1624,1625,1629],{},[117,1626,1627],{},[123,1628,1277],{},[117,1630,1631,1632,446,1635,460],{},"Selection key and display name. Letters, digits, ",[123,1633,1634],{},"_",[123,1636,1637],{},"-",[103,1639,1640,1644],{},[117,1641,1642],{},[123,1643,484],{},[117,1645,1646,446,1648,1650,1651,460],{},[123,1647,492],{},[123,1649,495],{},", or ",[123,1652,1653],{},"openai-responses",[103,1655,1656,1660],{},[117,1657,1658],{},[123,1659,517],{},[117,1661,1662,1663,460],{},"Must already include the version segment the protocol appends onto, e.g. ",[123,1664,1665],{},"...\u002Fv1",[103,1667,1668,1672],{},[117,1669,1670],{},[123,1671,365],{},[117,1673,1674,1675,460],{},"Literal or ",[123,1676,798],{},[103,1678,1679,1683],{},[117,1680,1681],{},[123,1682,548],{},[117,1684,1685,1688,1689,816,1692,558],{},[123,1686,1687],{},"x-api-key"," or ",[123,1690,1691],{},"bearer",[123,1693,492],{},[103,1695,1696,1701],{},[117,1697,1698],{},[123,1699,1700],{},"models[]",[117,1702,1703],{},"The models this endpoint serves.",[88,1705,1706],{},[221,1707,1708],{},"Model fields",[97,1710,1711,1719],{},[100,1712,1713],{},[103,1714,1715,1717],{},[106,1716,423],{},[106,1718,429],{},[112,1720,1721,1730,1743,1752,1761,1790,1803],{},[103,1722,1723,1727],{},[117,1724,1725],{},[123,1726,1371],{},[117,1728,1729],{},"Model id sent on the wire.",[103,1731,1732,1736],{},[117,1733,1734],{},[123,1735,1391],{},[117,1737,1738,1739,1742],{},"Tokens. ",[221,1740,1741],{},"Set this."," locac cannot infer it for a custom endpoint, and an over-claimed window is the one error that kills a run: compaction believes it has headroom it does not, never fires, and the provider rejects the request.",[103,1744,1745,1749],{},[117,1746,1747],{},[123,1748,398],{},[117,1750,1751],{},"Per-response output cap.",[103,1753,1754,1758],{},[117,1755,1756],{},[123,1757,1423],{},[117,1759,1760],{},"Whether the model is a reasoning model.",[103,1762,1763,1767],{},[117,1764,1765],{},[123,1766,1439],{},[117,1768,1769,1770,1773,1774,1776,1777,1780,1781,446,1784,1688,1787,460],{},"Sent as ",[123,1771,1772],{},"reasoning_effort"," on ",[123,1775,495],{},". This field takes any token your endpoint accepts, including spellings the ",[123,1778,1779],{},"--effort"," menu never offers, like ",[123,1782,1783],{},"minimal",[123,1785,1786],{},"xhigh",[123,1788,1789],{},"max",[103,1791,1792,1796],{},[117,1793,1794],{},[123,1795,1460],{},[117,1797,1798,1799,1802],{},"Set when the endpoint never sends ",[123,1800,1801],{},"finish_reason",", so its absence is not read as a truncated stream.",[103,1804,1805,1809],{},[117,1806,1807],{},[123,1808,1476],{},[117,1810,1811,1814],{},[123,1812,1813],{},"{ input, output, cacheRead, cacheWrite }"," per million tokens, for the run's cost accounting. Defaults to all-zero.",[92,1816,694],{"id":1817},"per-model-settings",[88,1819,1820],{},"For built-in providers you usually only need to override the context window. Keyed by model id:",[151,1822,1824],{"className":301,"code":1823,"language":303,"meta":156,"style":156},"{\n  \"models\": {\n    \"claude-opus-4-8\": { \"contextWindow\": 1000000 }\n  }\n}\n",[123,1825,1826,1830,1842,1867,1871],{"__ignoreMap":156},[160,1827,1828],{"class":162,"line":29},[160,1829,311],{"class":310},[160,1831,1832,1834,1836,1838,1840],{"class":162,"line":33},[160,1833,317],{"class":316},[160,1835,685],{"class":320},[160,1837,323],{"class":316},[160,1839,326],{"class":310},[160,1841,853],{"class":310},[160,1843,1844,1846,1848,1850,1852,1854,1856,1858,1860,1862,1865],{"class":162,"line":41},[160,1845,858],{"class":316},[160,1847,353],{"class":320},[160,1849,323],{"class":316},[160,1851,326],{"class":310},[160,1853,393],{"class":310},[160,1855,330],{"class":316},[160,1857,1391],{"class":320},[160,1859,323],{"class":316},[160,1861,326],{"class":310},[160,1863,1864],{"class":405}," 1000000",[160,1866,409],{"class":310},[160,1868,1869],{"class":162,"line":360},[160,1870,920],{"class":310},[160,1872,1873],{"class":162,"line":381},[160,1874,414],{"class":310},[88,1876,1877],{},"A custom provider's own model entry is more specific and wins over this map.",[92,1879,710],{"id":1880},"per-project-overrides",[88,1882,1883,1884,1887],{},"Keyed by the ",[221,1885,1886],{},"absolute, resolved"," path of the repository root:",[151,1889,1891],{"className":301,"code":1890,"language":303,"meta":156,"style":156},"{\n  \"projects\": {\n    \"\u002Fhome\u002Fme\u002Faudits\u002Facme-api\": {\n      \"provider\": \"anthropic\",\n      \"model\": \"claude-opus-4-8\",\n      \"appendSystemPrompt\": \"This service is behind an authenticating gateway; treat only the \u002Fpublic prefix as unauthenticated.\",\n      \"budget\": { \"maxToolCalls\": 600 },\n      \"shellPath\": \"\u002Fusr\u002Fbin\u002Fbash\"\n    }\n  }\n}\n",[123,1892,1893,1897,1909,1922,1940,1958,1977,2003,2020,2024,2028],{"__ignoreMap":156},[160,1894,1895],{"class":162,"line":29},[160,1896,311],{"class":310},[160,1898,1899,1901,1903,1905,1907],{"class":162,"line":33},[160,1900,317],{"class":316},[160,1902,701],{"class":320},[160,1904,323],{"class":316},[160,1906,326],{"class":310},[160,1908,853],{"class":310},[160,1910,1911,1913,1916,1918,1920],{"class":162,"line":41},[160,1912,858],{"class":316},[160,1914,1915],{"class":320},"\u002Fhome\u002Fme\u002Faudits\u002Facme-api",[160,1917,323],{"class":316},[160,1919,326],{"class":310},[160,1921,853],{"class":310},[160,1923,1924,1926,1928,1930,1932,1934,1936,1938],{"class":162,"line":360},[160,1925,1274],{"class":316},[160,1927,278],{"class":320},[160,1929,323],{"class":316},[160,1931,326],{"class":310},[160,1933,330],{"class":329},[160,1935,333],{"class":169},[160,1937,323],{"class":329},[160,1939,338],{"class":310},[160,1941,1942,1944,1946,1948,1950,1952,1954,1956],{"class":162,"line":381},[160,1943,1274],{"class":316},[160,1945,261],{"class":320},[160,1947,323],{"class":316},[160,1949,326],{"class":310},[160,1951,330],{"class":329},[160,1953,353],{"class":169},[160,1955,323],{"class":329},[160,1957,338],{"class":310},[160,1959,1960,1962,1964,1966,1968,1970,1973,1975],{"class":162,"line":57},[160,1961,1274],{"class":316},[160,1963,580],{"class":320},[160,1965,323],{"class":316},[160,1967,326],{"class":310},[160,1969,330],{"class":329},[160,1971,1972],{"class":169},"This service is behind an authenticating gateway; treat only the \u002Fpublic prefix as unauthenticated.",[160,1974,323],{"class":329},[160,1976,338],{"class":310},[160,1978,1979,1981,1983,1985,1987,1989,1991,1993,1995,1997,2000],{"class":162,"line":917},[160,1980,1274],{"class":316},[160,1982,386],{"class":320},[160,1984,323],{"class":316},[160,1986,326],{"class":310},[160,1988,393],{"class":310},[160,1990,330],{"class":316},[160,1992,877],{"class":320},[160,1994,323],{"class":316},[160,1996,326],{"class":310},[160,1998,1999],{"class":405}," 600",[160,2001,2002],{"class":310}," },\n",[160,2004,2005,2007,2009,2011,2013,2015,2018],{"class":162,"line":25},[160,2006,1274],{"class":316},[160,2008,625],{"class":320},[160,2010,323],{"class":316},[160,2012,326],{"class":310},[160,2014,330],{"class":329},[160,2016,2017],{"class":169},"\u002Fusr\u002Fbin\u002Fbash",[160,2019,1600],{"class":329},[160,2021,2022],{"class":162,"line":73},[160,2023,1557],{"class":310},[160,2025,2026],{"class":162,"line":37},[160,2027,920],{"class":310},[160,2029,2030],{"class":162,"line":20},[160,2031,414],{"class":310},[88,2033,2034,2035,446,2037,446,2039,446,2041,446,2043,446,2045,338,2047,446,2049,446,2051,446,2053,446,2055,460],{},"A project entry may set: ",[123,2036,278],{},[123,2038,282],{},[123,2040,261],{},[123,2042,484],{},[123,2044,517],{},[123,2046,365],{},[123,2048,548],{},[123,2050,565],{},[123,2052,580],{},[123,2054,386],{},[123,2056,625],{},[88,2058,2059,2061,2062,2064],{},[123,2060,580],{}," is the field to reach for when you want per-repository guidance. Unlike\n",[123,2063,565],{}," it does not replace the vulnerability-research prompt, and it survives a subagent\nspawn: a role's prompt replaces the default, but your appended text is still joined onto it.",[92,2066,2068],{"id":2067},"session-database","Session database",[88,2070,2071,2072,326],{},"The database holds the transcript, the evidence artifacts, and the cross-verify verdicts. It lives\nper project, under ",[123,2073,133],{},[151,2075,2078],{"className":2076,"code":2077,"language":237,"meta":156},[235],"~\u002F.locac\u002Fprojects\u002F\u003Cbasename>-\u003Csha256-prefix>\u002Fsessions.db\n",[123,2079,2077],{"__ignoreMap":156},[88,2081,2082],{},"The directory name is derived deterministically from the resolved root: a readable basename so you\ncan find your own sessions, plus a twelve-character hash that does the actual disambiguation.",[88,2084,2085,2086,2089],{},"It is ",[221,2087,2088],{},"outside the target repository by design",". Sandboxed target code has write access to the\ntarget root, and that database is the trust anchor every High\u002FCritical gate reads. A single inserted\nverdict row would let the code under audit satisfy the quorum that exists to judge it. It would also\nplace the full transcript inside a tree the target's own build and CI can read.",[88,2091,2092,2095,2096,2098],{},[123,2093,2094],{},"--db \u003Cpath>"," or the ",[123,2097,611],{}," config field overrides the location, which is also the migration path for\nan older in-repository database.",[92,2100,726],{"id":2101},"dashboard",[151,2103,2105],{"className":301,"code":2104,"language":303,"meta":156,"style":156},"{\n  \"web\": { \"host\": \"127.0.0.1\", \"port\": 4173 },\n  \"auth\": {\n    \"passwordHash\": \"$argon2id$...\",\n    \"jwtSecret\": \"...\"\n  }\n}\n",[123,2106,2107,2111,2155,2167,2187,2205,2209],{"__ignoreMap":156},[160,2108,2109],{"class":162,"line":29},[160,2110,311],{"class":310},[160,2112,2113,2115,2117,2119,2121,2123,2125,2128,2130,2132,2134,2137,2139,2141,2143,2146,2148,2150,2153],{"class":162,"line":33},[160,2114,317],{"class":316},[160,2116,717],{"class":320},[160,2118,323],{"class":316},[160,2120,326],{"class":310},[160,2122,393],{"class":310},[160,2124,330],{"class":316},[160,2126,2127],{"class":320},"host",[160,2129,323],{"class":316},[160,2131,326],{"class":310},[160,2133,330],{"class":329},[160,2135,2136],{"class":169},"127.0.0.1",[160,2138,323],{"class":329},[160,2140,1497],{"class":310},[160,2142,330],{"class":316},[160,2144,2145],{"class":320},"port",[160,2147,323],{"class":316},[160,2149,326],{"class":310},[160,2151,2152],{"class":405}," 4173",[160,2154,2002],{"class":310},[160,2156,2157,2159,2161,2163,2165],{"class":162,"line":41},[160,2158,317],{"class":316},[160,2160,733],{"class":320},[160,2162,323],{"class":316},[160,2164,326],{"class":310},[160,2166,853],{"class":310},[160,2168,2169,2171,2174,2176,2178,2180,2183,2185],{"class":162,"line":360},[160,2170,858],{"class":316},[160,2172,2173],{"class":320},"passwordHash",[160,2175,323],{"class":316},[160,2177,326],{"class":310},[160,2179,330],{"class":329},[160,2181,2182],{"class":169},"$argon2id$...",[160,2184,323],{"class":329},[160,2186,338],{"class":310},[160,2188,2189,2191,2194,2196,2198,2200,2203],{"class":162,"line":381},[160,2190,858],{"class":316},[160,2192,2193],{"class":320},"jwtSecret",[160,2195,323],{"class":316},[160,2197,326],{"class":310},[160,2199,330],{"class":329},[160,2201,2202],{"class":169},"...",[160,2204,1600],{"class":329},[160,2206,2207],{"class":162,"line":57},[160,2208,920],{"class":310},[160,2210,2211],{"class":162,"line":917},[160,2212,414],{"class":310},[97,2214,2215,2225],{},[100,2216,2217],{},[103,2218,2219,2221,2223],{},[106,2220,423],{},[106,2222,119],{},[106,2224,429],{},[112,2226,2227,2241,2255,2268],{},[103,2228,2229,2234,2238],{},[117,2230,2231],{},[123,2232,2233],{},"web.host",[117,2235,2236],{},[123,2237,2136],{},[117,2239,2240],{},"Loopback only.",[103,2242,2243,2248,2253],{},[117,2244,2245],{},[123,2246,2247],{},"web.port",[117,2249,2250],{},[123,2251,2252],{},"4173",[117,2254],{},[103,2256,2257,2262,2265],{},[117,2258,2259],{},[123,2260,2261],{},"auth.passwordHash",[117,2263,2264],{},"none",[117,2266,2267],{},"argon2 hash of the dashboard password.",[103,2269,2270,2275,2277],{},[117,2271,2272],{},[123,2273,2274],{},"auth.jwtSecret",[117,2276,2264],{},[117,2278,2279],{},"HS256 signing secret for the session cookie.",[88,2281,2282,2283,2286,2287,2289],{},"Binding a non-loopback host ",[221,2284,2285],{},"without both auth fields is refused",", fail-closed. The dashboard can\nlaunch bash; it is never exposed unauthenticated. Both ",[123,2288,733],{}," fields are secrets and are redacted\nbefore anything reaches the browser.",[88,2291,2292,799,2295,1773,2298,2301],{},[123,2293,2294],{},"--host",[123,2296,2297],{},"--port",[123,2299,2300],{},"locac web"," override the config block.",[92,2303,756],{"id":747},[88,2305,2306,2307,2309],{},"Subagents are spawned as typed ",[221,2308,747],{},", each carrying its own system prompt, tool allow-list, and\ntask\u002Freport schemas. Built-in roles live in code; this map overrides their tunable fields or defines\nnew ones.",[151,2311,2313],{"className":301,"code":2312,"language":303,"meta":156,"style":156},"{\n  \"roles\": {\n    \"exploit-verifier\": {\n      \"model\": \"claude-opus-4-8\"\n    },\n    \"docs-reader\": {\n      \"description\": \"Read the vendor's changelog and advisories for the version under test.\",\n      \"systemPrompt\": \"You read documentation only. Never modify files.\",\n      \"tools\": [\"read\", \"search\", \"find\", \"ls\", \"submit_report\"]\n    }\n  }\n}\n",[123,2314,2315,2319,2331,2344,2360,2365,2378,2398,2417,2477,2481,2485],{"__ignoreMap":156},[160,2316,2317],{"class":162,"line":29},[160,2318,311],{"class":310},[160,2320,2321,2323,2325,2327,2329],{"class":162,"line":33},[160,2322,317],{"class":316},[160,2324,747],{"class":320},[160,2326,323],{"class":316},[160,2328,326],{"class":310},[160,2330,853],{"class":310},[160,2332,2333,2335,2338,2340,2342],{"class":162,"line":41},[160,2334,858],{"class":316},[160,2336,2337],{"class":320},"exploit-verifier",[160,2339,323],{"class":316},[160,2341,326],{"class":310},[160,2343,853],{"class":310},[160,2345,2346,2348,2350,2352,2354,2356,2358],{"class":162,"line":360},[160,2347,1274],{"class":316},[160,2349,261],{"class":320},[160,2351,323],{"class":316},[160,2353,326],{"class":310},[160,2355,330],{"class":329},[160,2357,353],{"class":169},[160,2359,1600],{"class":329},[160,2361,2362],{"class":162,"line":381},[160,2363,2364],{"class":310},"    },\n",[160,2366,2367,2369,2372,2374,2376],{"class":162,"line":57},[160,2368,858],{"class":316},[160,2370,2371],{"class":320},"docs-reader",[160,2373,323],{"class":316},[160,2375,326],{"class":310},[160,2377,853],{"class":310},[160,2379,2380,2382,2385,2387,2389,2391,2394,2396],{"class":162,"line":917},[160,2381,1274],{"class":316},[160,2383,2384],{"class":320},"description",[160,2386,323],{"class":316},[160,2388,326],{"class":310},[160,2390,330],{"class":329},[160,2392,2393],{"class":169},"Read the vendor's changelog and advisories for the version under test.",[160,2395,323],{"class":329},[160,2397,338],{"class":310},[160,2399,2400,2402,2404,2406,2408,2410,2413,2415],{"class":162,"line":25},[160,2401,1274],{"class":316},[160,2403,565],{"class":320},[160,2405,323],{"class":316},[160,2407,326],{"class":310},[160,2409,330],{"class":329},[160,2411,2412],{"class":169},"You read documentation only. Never modify files.",[160,2414,323],{"class":329},[160,2416,338],{"class":310},[160,2418,2419,2421,2424,2426,2428,2431,2433,2436,2438,2440,2442,2445,2447,2449,2451,2454,2456,2458,2460,2463,2465,2467,2469,2472,2474],{"class":162,"line":73},[160,2420,1274],{"class":316},[160,2422,2423],{"class":320},"tools",[160,2425,323],{"class":316},[160,2427,326],{"class":310},[160,2429,2430],{"class":310}," [",[160,2432,323],{"class":329},[160,2434,2435],{"class":169},"read",[160,2437,323],{"class":329},[160,2439,1497],{"class":310},[160,2441,330],{"class":329},[160,2443,2444],{"class":169},"search",[160,2446,323],{"class":329},[160,2448,1497],{"class":310},[160,2450,330],{"class":329},[160,2452,2453],{"class":169},"find",[160,2455,323],{"class":329},[160,2457,1497],{"class":310},[160,2459,330],{"class":329},[160,2461,2462],{"class":169},"ls",[160,2464,323],{"class":329},[160,2466,1497],{"class":310},[160,2468,330],{"class":329},[160,2470,2471],{"class":169},"submit_report",[160,2473,323],{"class":329},[160,2475,2476],{"class":310},"]\n",[160,2478,2479],{"class":162,"line":37},[160,2480,1557],{"class":310},[160,2482,2483],{"class":162,"line":20},[160,2484,920],{"class":310},[160,2486,2487],{"class":162,"line":65},[160,2488,414],{"class":310},[97,2490,2491,2499],{},[100,2492,2493],{},[103,2494,2495,2497],{},[106,2496,423],{},[106,2498,429],{},[112,2500,2501,2510,2519,2528],{},[103,2502,2503,2507],{},[117,2504,2505],{},[123,2506,2384],{},[117,2508,2509],{},"One line telling the orchestrator when to spawn this role.",[103,2511,2512,2516],{},[117,2513,2514],{},[123,2515,565],{},[117,2517,2518],{},"Replaces the default prompt for the child.",[103,2520,2521,2525],{},[117,2522,2523],{},[123,2524,2423],{},[117,2526,2527],{},"Allow-list of tool names, validated against the registry at load.",[103,2529,2530,2534],{},[117,2531,2532],{},[123,2533,261],{},[117,2535,2536],{},"Per-role model id. Unset means the child inherits the parent's model.",[88,2538,2539,2540,1229],{},"A role defined here that does not match a built-in name gets generic task and report schemas, because zod\nschemas cannot come from JSON. See the ",[458,2541,61],{"href":59},[216,2543,2544],{},[88,2545,2546,2547,2550,2551,2553],{},"Roles are ",[221,2548,2549],{},"trusted"," input, which is exactly why they are only ever read from ",[123,2552,133],{},". A role\nis a system prompt plus a tool allow-list; letting the repository under audit define one would let\nit rewrite the instructions of the agent auditing it.",[92,2555,2557],{"id":2556},"dast-authenticated-scans","DAST authenticated scans",[88,2559,2560,2563,2564,2567],{},[123,2561,2562],{},"dast.auth"," supplies static credentials so a DAST run can probe behind a login. Credentials are\nattached only to a request whose host is in ",[123,2565,2566],{},"hosts"," - an off-host redirect or SSRF target never\nreceives them - and a request's own header wins over a configured default.",[151,2569,2571],{"className":301,"code":2570,"language":303,"meta":156,"style":156},"{\n  \"dast\": {\n    \"auth\": {\n      \"hosts\": [\"api.example.com\", \"app.example.com\"],\n      \"headers\": { \"Authorization\": \"Bearer eyJhbGciOi...\" },\n      \"cookies\": { \"session\": \"s%3A9xI...\" }\n    }\n  }\n}\n",[123,2572,2573,2577,2590,2602,2633,2664,2695,2699,2703],{"__ignoreMap":156},[160,2574,2575],{"class":162,"line":29},[160,2576,311],{"class":310},[160,2578,2579,2581,2584,2586,2588],{"class":162,"line":33},[160,2580,317],{"class":316},[160,2582,2583],{"class":320},"dast",[160,2585,323],{"class":316},[160,2587,326],{"class":310},[160,2589,853],{"class":310},[160,2591,2592,2594,2596,2598,2600],{"class":162,"line":41},[160,2593,858],{"class":316},[160,2595,733],{"class":320},[160,2597,323],{"class":316},[160,2599,326],{"class":310},[160,2601,853],{"class":310},[160,2603,2604,2606,2608,2610,2612,2614,2616,2619,2621,2623,2625,2628,2630],{"class":162,"line":360},[160,2605,1274],{"class":316},[160,2607,2566],{"class":320},[160,2609,323],{"class":316},[160,2611,326],{"class":310},[160,2613,2430],{"class":310},[160,2615,323],{"class":329},[160,2617,2618],{"class":169},"api.example.com",[160,2620,323],{"class":329},[160,2622,1497],{"class":310},[160,2624,330],{"class":329},[160,2626,2627],{"class":169},"app.example.com",[160,2629,323],{"class":329},[160,2631,2632],{"class":310},"],\n",[160,2634,2635,2637,2640,2642,2644,2646,2648,2651,2653,2655,2657,2660,2662],{"class":162,"line":381},[160,2636,1274],{"class":316},[160,2638,2639],{"class":320},"headers",[160,2641,323],{"class":316},[160,2643,326],{"class":310},[160,2645,393],{"class":310},[160,2647,330],{"class":316},[160,2649,2650],{"class":320},"Authorization",[160,2652,323],{"class":316},[160,2654,326],{"class":310},[160,2656,330],{"class":329},[160,2658,2659],{"class":169},"Bearer eyJhbGciOi...",[160,2661,323],{"class":329},[160,2663,2002],{"class":310},[160,2665,2666,2668,2671,2673,2675,2677,2679,2682,2684,2686,2688,2691,2693],{"class":162,"line":57},[160,2667,1274],{"class":316},[160,2669,2670],{"class":320},"cookies",[160,2672,323],{"class":316},[160,2674,326],{"class":310},[160,2676,393],{"class":310},[160,2678,330],{"class":316},[160,2680,2681],{"class":320},"session",[160,2683,323],{"class":316},[160,2685,326],{"class":310},[160,2687,330],{"class":329},[160,2689,2690],{"class":169},"s%3A9xI...",[160,2692,323],{"class":329},[160,2694,409],{"class":310},[160,2696,2697],{"class":162,"line":917},[160,2698,1557],{"class":310},[160,2700,2701],{"class":162,"line":25},[160,2702,920],{"class":310},[160,2704,2705],{"class":162,"line":73},[160,2706,414],{"class":310},[97,2708,2709,2717],{},[100,2710,2711],{},[103,2712,2713,2715],{},[106,2714,423],{},[106,2716,429],{},[112,2718,2719,2728,2737],{},[103,2720,2721,2725],{},[117,2722,2723],{},[123,2724,2566],{},[117,2726,2727],{},"Only a request bound for one of these hosts receives the credentials. Required.",[103,2729,2730,2734],{},[117,2731,2732],{},[123,2733,2639],{},[117,2735,2736],{},"Static request headers (e.g. a bearer token) attached to same-host requests.",[103,2738,2739,2743],{},[117,2740,2741],{},[123,2742,2670],{},[117,2744,2745],{},"Cookie name\u002Fvalue pairs attached to same-host requests.",[216,2747,2748],{},[88,2749,2750,2751,2753,2754,2756,2757,2759],{},"Like roles and API keys, ",[123,2752,2562],{}," is ",[221,2755,2549],{}," input read only from ",[123,2758,133],{},", never from\nthe repository under audit. Every header and cookie value is registered as an operator secret, so\nthe output guard scrubs it from probe evidence and the transcript before either reaches the model.",[92,2761,2763],{"id":2762},"full-example","Full example",[151,2765,2767],{"className":301,"code":2766,"language":303,"meta":156,"style":156},"{\n  \"provider\": \"anthropic\",\n  \"model\": \"claude-opus-4-8\",\n  \"apiKey\": \"$ANTHROPIC_API_KEY\",\n  \"appendSystemPrompt\": \"Prefer memory-safety and injection classes; skip client-side issues.\",\n  \"shellPath\": \"C:\\\\Program Files\\\\Git\\\\bin\\\\bash.exe\",\n  \"budget\": { \"maxTokens\": 2000000, \"maxWallClockMs\": 7200000 },\n  \"compaction\": { \"keepRecent\": 12 },\n  \"models\": { \"claude-opus-4-8\": { \"contextWindow\": 1000000 } },\n  \"projects\": {\n    \"D:\\\\audits\\\\acme-api\": {\n      \"model\": \"claude-opus-4-8\",\n      \"budget\": { \"maxToolCalls\": 800 }\n    }\n  },\n  \"web\": { \"port\": 4173 }\n}\n",[123,2768,2769,2773,2791,2809,2827,2846,2887,2925,2950,2987,2999,3022,3040,3065,3069,3074,3098],{"__ignoreMap":156},[160,2770,2771],{"class":162,"line":29},[160,2772,311],{"class":310},[160,2774,2775,2777,2779,2781,2783,2785,2787,2789],{"class":162,"line":33},[160,2776,317],{"class":316},[160,2778,278],{"class":320},[160,2780,323],{"class":316},[160,2782,326],{"class":310},[160,2784,330],{"class":329},[160,2786,333],{"class":169},[160,2788,323],{"class":329},[160,2790,338],{"class":310},[160,2792,2793,2795,2797,2799,2801,2803,2805,2807],{"class":162,"line":41},[160,2794,317],{"class":316},[160,2796,261],{"class":320},[160,2798,323],{"class":316},[160,2800,326],{"class":310},[160,2802,330],{"class":329},[160,2804,353],{"class":169},[160,2806,323],{"class":329},[160,2808,338],{"class":310},[160,2810,2811,2813,2815,2817,2819,2821,2823,2825],{"class":162,"line":360},[160,2812,317],{"class":316},[160,2814,365],{"class":320},[160,2816,323],{"class":316},[160,2818,326],{"class":310},[160,2820,330],{"class":329},[160,2822,374],{"class":169},[160,2824,323],{"class":329},[160,2826,338],{"class":310},[160,2828,2829,2831,2833,2835,2837,2839,2842,2844],{"class":162,"line":381},[160,2830,317],{"class":316},[160,2832,580],{"class":320},[160,2834,323],{"class":316},[160,2836,326],{"class":310},[160,2838,330],{"class":329},[160,2840,2841],{"class":169},"Prefer memory-safety and injection classes; skip client-side issues.",[160,2843,323],{"class":329},[160,2845,338],{"class":310},[160,2847,2848,2850,2852,2854,2856,2858,2861,2865,2868,2870,2873,2875,2878,2880,2883,2885],{"class":162,"line":57},[160,2849,317],{"class":316},[160,2851,625],{"class":320},[160,2853,323],{"class":316},[160,2855,326],{"class":310},[160,2857,330],{"class":329},[160,2859,2860],{"class":169},"C:",[160,2862,2864],{"class":2863},"sXjYR","\\\\",[160,2866,2867],{"class":169},"Program Files",[160,2869,2864],{"class":2863},[160,2871,2872],{"class":169},"Git",[160,2874,2864],{"class":2863},[160,2876,2877],{"class":169},"bin",[160,2879,2864],{"class":2863},[160,2881,2882],{"class":169},"bash.exe",[160,2884,323],{"class":329},[160,2886,338],{"class":310},[160,2888,2889,2891,2893,2895,2897,2899,2901,2903,2905,2907,2910,2912,2914,2916,2918,2920,2923],{"class":162,"line":917},[160,2890,317],{"class":316},[160,2892,386],{"class":320},[160,2894,323],{"class":316},[160,2896,326],{"class":310},[160,2898,393],{"class":310},[160,2900,330],{"class":316},[160,2902,398],{"class":320},[160,2904,323],{"class":316},[160,2906,326],{"class":310},[160,2908,2909],{"class":405}," 2000000",[160,2911,1497],{"class":310},[160,2913,330],{"class":316},[160,2915,907],{"class":320},[160,2917,323],{"class":316},[160,2919,326],{"class":310},[160,2921,2922],{"class":405}," 7200000",[160,2924,2002],{"class":310},[160,2926,2927,2929,2931,2933,2935,2937,2939,2941,2943,2945,2948],{"class":162,"line":25},[160,2928,317],{"class":316},[160,2930,637],{"class":320},[160,2932,323],{"class":316},[160,2934,326],{"class":310},[160,2936,393],{"class":310},[160,2938,330],{"class":316},[160,2940,1090],{"class":320},[160,2942,323],{"class":316},[160,2944,326],{"class":310},[160,2946,2947],{"class":405}," 12",[160,2949,2002],{"class":310},[160,2951,2952,2954,2956,2958,2960,2962,2964,2966,2968,2970,2972,2974,2976,2978,2980,2982,2985],{"class":162,"line":73},[160,2953,317],{"class":316},[160,2955,685],{"class":320},[160,2957,323],{"class":316},[160,2959,326],{"class":310},[160,2961,393],{"class":310},[160,2963,330],{"class":316},[160,2965,353],{"class":320},[160,2967,323],{"class":316},[160,2969,326],{"class":310},[160,2971,393],{"class":310},[160,2973,330],{"class":316},[160,2975,1391],{"class":320},[160,2977,323],{"class":316},[160,2979,326],{"class":310},[160,2981,1864],{"class":405},[160,2983,2984],{"class":310}," }",[160,2986,2002],{"class":310},[160,2988,2989,2991,2993,2995,2997],{"class":162,"line":37},[160,2990,317],{"class":316},[160,2992,701],{"class":320},[160,2994,323],{"class":316},[160,2996,326],{"class":310},[160,2998,853],{"class":310},[160,3000,3001,3003,3006,3008,3011,3013,3016,3018,3020],{"class":162,"line":20},[160,3002,858],{"class":316},[160,3004,3005],{"class":320},"D:",[160,3007,2864],{"class":2863},[160,3009,3010],{"class":320},"audits",[160,3012,2864],{"class":2863},[160,3014,3015],{"class":320},"acme-api",[160,3017,323],{"class":316},[160,3019,326],{"class":310},[160,3021,853],{"class":310},[160,3023,3024,3026,3028,3030,3032,3034,3036,3038],{"class":162,"line":65},[160,3025,1274],{"class":316},[160,3027,261],{"class":320},[160,3029,323],{"class":316},[160,3031,326],{"class":310},[160,3033,330],{"class":329},[160,3035,353],{"class":169},[160,3037,323],{"class":329},[160,3039,338],{"class":310},[160,3041,3042,3044,3046,3048,3050,3052,3054,3056,3058,3060,3063],{"class":162,"line":1418},[160,3043,1274],{"class":316},[160,3045,386],{"class":320},[160,3047,323],{"class":316},[160,3049,326],{"class":310},[160,3051,393],{"class":310},[160,3053,330],{"class":316},[160,3055,877],{"class":320},[160,3057,323],{"class":316},[160,3059,326],{"class":310},[160,3061,3062],{"class":405}," 800",[160,3064,409],{"class":310},[160,3066,3067],{"class":162,"line":1434},[160,3068,1557],{"class":310},[160,3070,3071],{"class":162,"line":1455},[160,3072,3073],{"class":310},"  },\n",[160,3075,3076,3078,3080,3082,3084,3086,3088,3090,3092,3094,3096],{"class":162,"line":1471},[160,3077,317],{"class":316},[160,3079,717],{"class":320},[160,3081,323],{"class":316},[160,3083,326],{"class":310},[160,3085,393],{"class":310},[160,3087,330],{"class":316},[160,3089,2145],{"class":320},[160,3091,323],{"class":316},[160,3093,326],{"class":310},[160,3095,2152],{"class":405},[160,3097,409],{"class":310},[160,3099,3100],{"class":162,"line":1542},[160,3101,414],{"class":310},[92,3103,3105],{"id":3104},"next","Next",[88,3107,3108,3109,3111,3112,3114,3115,3117],{},"The ",[458,3110,23],{"href":22}," lists every flag referenced above, with its default and the\nvalidation rules that apply. ",[458,3113,36],{"href":35}," and\n",[458,3116,18],{"href":17}," break down every endpoint and variable.",[3119,3120,3121],"style",{},"html pre.shiki code .sCK9x, html code.shiki .sCK9x{--shiki-default:#80A665}html pre.shiki code .s7rlk, html code.shiki .s7rlk{--shiki-default:#C98A7D}html pre.shiki code .sux-A, html code.shiki .sux-A{--shiki-default:#758575DD}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .s_pn2, html code.shiki .s_pn2{--shiki-default:#666666}html pre.shiki code .s6USN, html code.shiki .s6USN{--shiki-default:#B8A96577}html pre.shiki code .sm68I, html code.shiki .sm68I{--shiki-default:#B8A965}html pre.shiki code .sNJcY, html code.shiki .sNJcY{--shiki-default:#C98A7D77}html pre.shiki code .sxA9i, html code.shiki .sxA9i{--shiki-default:#4C9A91}html pre.shiki code .s3QIE, html code.shiki .s3QIE{--shiki-default:#4D9375}html pre.shiki code .sXjYR, html code.shiki .sXjYR{--shiki-default:#C99076}",{"title":156,"searchDepth":41,"depth":41,"links":3123},[3124,3125,3126,3127,3128,3129,3130,3131,3132,3133,3134,3135,3136,3137,3138],{"id":94,"depth":33,"text":95},{"id":227,"depth":33,"text":228},{"id":297,"depth":33,"text":298},{"id":762,"depth":33,"text":763},{"id":386,"depth":33,"text":661},{"id":637,"depth":33,"text":647},{"id":1232,"depth":33,"text":678},{"id":1817,"depth":33,"text":694},{"id":1880,"depth":33,"text":710},{"id":2067,"depth":33,"text":2068},{"id":2101,"depth":33,"text":726},{"id":747,"depth":33,"text":756},{"id":2556,"depth":33,"text":2557},{"id":2762,"depth":33,"text":2763},{"id":3104,"depth":33,"text":3105},"[object Object]","md",{},true,{"title":15,"description":3144},{"Every field of ~\u002F":3145,"group":7,"order":360},{"locac\u002Fconfig":3146},{"json":3147},"providers, per-project overrides, budgets, compaction, roles and dashboard auth, plus the precedence rules that decide which one wins.","docs\u002Fconfiguration","5wNeryXpfHqP7BM9G7LoV8WnGGQi2L0Ca9sVoHvPLw4",1786794387119]