model:
  default: deepseek-v4-flash
  provider: custom
  base_url: https://api.fmode.cn/v1
  api_key: "SK-REDACTED"
database:
  journal_mode: wal
agent:
  max_turns: 150
  verify_on_stop: false
  session_reset:
    mode: none
  memory_enabled: true
  user_profile_enabled: true
terminal:
  backend: local
display:
  tool_progress: all
dashboard:
  theme: cyberpunk
delegation:
  child_timeout_seconds: 3600
timezone: Asia/Shanghai
approvals:
  mode: 'off'
  destructive_slash_confirm: false
kanban:
  dispatch_interval_seconds: 15
  max_in_progress: 3
  max_in_progress_per_profile: 1
  dispatch_tick_seconds: 15
  max_spawn: 2
  max_retries_per_task: 2
  task_ttl_seconds: 1800
onboarding:
  seen:
    busy_input_prompt: true
_config_version: 39
platforms:
  wecom:
    enabled: true
    extra:
      bot_id: aibwUXKd36GSU53koiTkmy8rk5Ohn5-YIjD
      secret: vd4s4dnpkaZqrjT1YI6BOjgtvKAc04FcYXUWsJBSynS
      websocket_url: wss://openws.work.weixin.qq.com
      dm_policy: open
      group_policy: open
    home_channel:
      platform: wecom
      chat_id: ''
  email:
    enabled: true
plugins:
  enabled: []
language: zh
locale: zh-CN
system_prompt: 你是一个中文AI助手，所有回复必须使用简体中文。所有工具提示、错误信息、确认信息都必须是中文。与用户对话全程使用中文，不允许使用英文作为日常沟通语言。

# ── Security ──────────────────────────────────────────────────────────
# Secret redaction is ON by default — strings that look like API keys,
# tokens, and passwords are masked in tool output, logs, and chat
# responses before the model or user ever sees them. Set redact_secrets
# to false to disable (e.g. when developing the redactor itself).
# tirith pre-exec scanning is enabled by default when the tirith binary
# is available. Configure via security.tirith_* keys or env vars
# (TIRITH_ENABLED, TIRITH_BIN, TIRITH_TIMEOUT, TIRITH_FAIL_OPEN).
#
# security:
#   redact_secrets: true
#   tirith_enabled: true
#   tirith_path: "tirith"
#   tirith_timeout: 5
#   tirith_fail_open: true

# ── Fallback Model ────────────────────────────────────────────────────
# Automatic provider failover when primary is unavailable.
# Uncomment and configure to enable. Triggers on rate limits (429),
# overload (529), service errors (503), or connection failures.
#
# Supported providers:
#   openrouter   (OPENROUTER_API_KEY)  — routes to any model
#   openai-codex (OAuth — hermes auth) — OpenAI Codex
#   nous         (OAuth — hermes auth) — Nous Portal
#   zai          (ZAI_API_KEY)         — Z.AI / GLM
#   kimi-coding  (KIMI_API_KEY)        — Kimi / Moonshot
#   kimi-coding-cn (KIMI_CN_API_KEY)   — Kimi / Moonshot (China)
#   minimax      (MINIMAX_API_KEY)     — MiniMax
#   minimax-cn   (MINIMAX_CN_API_KEY)  — MiniMax (China)
#   bedrock      (AWS IAM / boto3)     — AWS Bedrock (Converse API)
#
# For custom OpenAI-compatible endpoints, add base_url and key_env.
#
# fallback_model:
#   provider: openrouter
#   model: anthropic/claude-sonnet-4