Configuration Reference

Loop is configured via HJSON files (JSON with comments and trailing commas). This document covers all configuration fields, their defaults, and the merge rules for project-level overrides.

Config files can be edited directly on disk, or through the HTTP API (GET/PUT /api/config for global, GET/PUT /api/config/project for per-project). The desktop app Settings panel uses the API to provide a schema-driven form editor and a raw JSON editor. See API Reference: Configuration for endpoint details.

See also: Docker Container Lifecycle , Task Scheduling .

Global Config

Location: ~/.loop/config.json

This is the primary configuration file, loaded at startup. All paths below are relative to the ~/.loop/ directory (referred to as loopDir).

All Fields

Platforms & Credentials

The "local" platform requires no external credentials – it runs with the Electron desktop app as the UI.

Authentication

Exactly one of these should be set. OAuth takes precedence if both are provided.

Claude & Agent

Both claude_model and claude_effort can additionally be overridden per channel/thread/worktree on demand from the chat composer’s model pill (persisted on the channel row, applied from the next run) — see Chat: Model / Effort Override . The per-channel override beats the merged config value. Subagents a run spawns use the same model unless the Agent call or the agent definition names another: Loop passes CLAUDE_CODE_SUBAGENT_MODEL=inherit through --settings, so a value in ~/.claude/settings.json (which agent containers mount) does not apply. | claude_batch_disallowed_tools | []string | ["ScheduleWakeup", "CronCreate", "CronDelete", "CronList", "Monitor", "ReportFindings"] | Claude Code tool names passed to --disallowedTools for batch (--print) agent runs only — the interactive terminal is unaffected. The defaults rely on a persistent harness that one-shot containers lack: ScheduleWakeup/Cron* schedule re-invocations that never fire, so they silently park work that never resumes; Monitor keeps the run, and so the channel, busy for as long as the watch lasts — Loop’s own monitor MCP tool waits outside the run instead. A live session drops Monitor from the list, since its process outlives the turn. ReportFindings reports code-review findings into a harness UI channel batch runs don’t render. Review runs are the exception: they drop ReportFindings from this list, because the built-in /code-review command only runs inline (rather than forking a silent subagent) when it can call that tool, and the daemon reads the findings off the stream. Override to tune the list (e.g. to re-enable a tool). | | claude_retry | object | see below | Automatic recovery from Claude API limits on batch agent runs. Keys: max_attempts (5) extra attempts after the first failure (0 disables), backoff_base_sec (5) first-retry delay that doubles each attempt, backoff_max_sec (120) per-attempt delay ceiling — these govern in-process exponential backoff for transient errors (rate limiting, overload, 5xx). session_limit_auto_continue (true) handles a session limit error (You've hit your session limit · resets <time>) by scheduling a one-shot retry at the announced reset time that resumes the session with continue; it is persisted via the scheduler so it survives daemon restarts. Terminal errors (usage/quota exhaustion, auth, billing) are never retried. | | keep_mcp_configs | bool | false | When true, preserves MCP config JSON files after container runs. Useful for debugging MCP server configuration. |

Storage & Logging

Container Settings

Browser Automation

Browser settings are grouped under "browser":

Networking & Scheduling

GitHub

GitLab

A row’s branch shows its GitLab merge request instead of a GitHub PR when the repo’s origin points at a GitLab host: one whose name contains gitlab, or one listed in the glab config’s hosts. That needs glab on the daemon’s PATH.

Plugins

Mounts

"mounts": [
  "~/.claude:~/.claude",
  "~/.gitconfig:~/.gitconfig:ro",
  "~/.ssh:~/.ssh:ro",
  "/var/run/docker.sock:/var/run/docker.sock",
  "loop-npmcache:~/.npm",  // Docker named volume
  "loop-gocache:/go"        // Docker named volume
]

Format: host_path:container_path[:mode]

• ~ is expanded to the host user’s home directory on both sides.
• Named volumes (no /, ~, or . prefix) are passed to Docker directly.
• Non-existent host paths are silently skipped.
• See Containers: Mount Processing for full details.

Copy Files

"copy_files": ["~/.claude.json"]

See Containers: File Copying .

Proxy

"proxies": {
  "http_proxy": "http://127.0.0.1:3128",
  "https_proxy": "http://127.0.0.1:3128",
  "no_proxy": ["my-service", "my-cache", "*.internal"]
}

Set per variable and resolved per container: config wins where it is set, the daemon’s environment fills the rest. Localhost addresses are rewritten to host.docker.internal on the way in, so the value here is the one you would use on the host.

The daemon’s own connections to Discord, Slack and other services, and the gh and git fetch calls it makes for pull request lookups and reviews, resolve the same settings per connection, so the proxy can be switched on or off in config with no restart. daemon:start does not copy the shell’s proxy variables into the service, so config is the place to set it. See Daemon — Proxy .

Prefer proxies.http_proxy/https_proxy over exporting the variables for the daemon. The daemon’s environment is fixed at loop serve start and a container’s is fixed at create, so a daemon started before the proxy was exported creates proxy-less containers until it restarts — and the containers it already created stay broken. Config is re-read per run. See Containers — Proxy Forwarding .

no_proxy is additive rather than a replacement: Loop’s own required bypasses and the daemon’s own NO_PROXY are kept, and these entries are appended. It is only consulted when a proxy is configured. Name every container the agent reaches by hostname — NO_PROXY is matched against the hostname before DNS resolves it, so the default 172.16.0.0/12 entry covers a container dialled by IP but never one dialled as http://my-service:8080. See Containers — Proxy Forwarding .

no_proxy_hosts, the key v2026.9.16 and v2026.9.17 shipped, is renamed to no_proxy by a filesystem migration on the first daemon start after the upgrade — in the global config and in the .loop/config.json of every project Loop has a channel for. The rename happens on the parsed document, so entries, ordering and comments survive it; a config carrying both keys has the old entries appended to the new list.

The three keys used to sit at the top level of the config. A later filesystem migration moves top-level http_proxy, https_proxy and no_proxy into the proxies block, in the same configs and keeping their comments. Where a proxies block already exists, its values win, keys it lacks are added, and the two no_proxy lists are joined.

Custom Environment Variables

"envs": {
  "BASH_ENV": "~/.bashrc",
  "ENABLE_LSP_TOOL": false
}

MCP Servers

"mcp": {
  "servers": {
    "github": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-github"],
      "env": {
        "GITHUB_PERSONAL_ACCESS_TOKEN": "ghp_your_token"
      }
    }
  }
}

Each server entry has:

A built-in "loop" server is always added unless the user defines one with the same name. See Containers: MCP Config Generation .

Task Templates

"task_templates": [
  {
    "name": "daily-summary",
    "description": "Generate a daily summary",
    "schedule": "0 17 * * *",
    "type": "cron",
    "prompt": "Summarize today's activity",
    "auto_delete_sec": 60
  },
  {
    "name": "heartbeat",
    "description": "Periodic health check",
    "schedule": "30m",
    "type": "interval",
    "prompt_path": "heartbeat.md"
  }
]

See Task Scheduling for full details.

Prompt Shortcuts

"prompt_shortcuts": [
  {
    "name": "coverage",
    "description": "Run coverage check",
    "prompt": "Run make coverage-check and report results"
  },
  {
    "name": "review",
    "description": "Review uncommitted and branch changes",
    "prompt_path": "review-code.md"
  }
]

Shortcuts appear in the chat input when the user types #. Selecting a shortcut sends its resolved prompt as a message. The API endpoint GET /api/shortcuts returns all shortcuts with resolved prompts; pass ?channel_id=<id> to merge project-level shortcuts. Agents can manage shortcuts via the prompt_shortcut MCP tool or the POST /api/shortcuts endpoint — add, update, or delete shortcuts in either global or project scope.

Bash Shortcuts

"bash_shortcuts": [
  {
    "name": "make lint",
    "description": "Run the linter",
    "command": "make lint"
  },
  {
    "name": "tests",
    "description": "Run unit tests",
    "command_path": "run-tests.sh"
  }
]

Shortcuts appear in the terminal footer $ picker. They mount on Docker Shell and Host Shell panes (raw bash, sent with a trailing newline) and on Chat Terminal panes (Claude TUI, sent as a bracketed paste + \r so multi-line scripts arrive as a single paste buffer). The # prompt picker and the $ bash picker are mutually exclusive on a given pane — Chat Terminal panes show #, raw-shell panes show $. The API endpoint GET /api/bash-shortcuts returns shortcuts with resolved command text; pass ?channel_id=<id> to merge project-level shortcuts. Agents can manage them via the bash_shortcut MCP tool or the POST /api/bash-shortcuts endpoint.

Chat Components

"chat_components": [
  {
    "name": "reaction",
    "description": "A chemical reaction, balanced step by step",
    "path": "reaction"
  }
]

A template is up to three files, each optional: shell.html, the markup the agent’s HTML goes into at its {{content}} slot; style.css; and guide.md, which tells the agent which classes and markup to use. A file is read from the project’s .loop/components/<path>/ first, then ~/.loop/components/<path>/, then from the built-in template of the same name. math (a squared math notebook page), canvas and react are built in; an entry with one of those names replaces it, keeping whichever built-in files it doesn’t supply. See Components . The API endpoint GET /api/components lists the templates; pass ?channel_id=<id> to merge project-level ones.

Review

Enables and configures the Review panel (see review.md ).

"review": {
  "enabled": true,
  "prompt_path": "review.md"
}

Both prompt fields empty (the default) uses the daemon’s built-in default prompt: the /code-review slash command with the run’s effort as its level (e.g. /code-review high; bare when no effort is set), with the output contract (report actionable findings via the built-in ReportFindings tool, each carrying a file and a 1-based line) carried in the system prompt. A configured non-slash prompt gets no system prompt, so it must carry its own contract — see review.md .

PR watching

How Loop watches a thread’s PR/MR checks (see pr.md ).

"pr": {
  "auto_fix": true,
  "max_attempts": 3,
  "merge_method": "squash",
  "poll_sec": 30,
  "idle_poll_sec": 300
}

Playground share

Gates the public playground-share feature — exposing a playground over the internet through a cloudflared quick tunnel.

"playground_share": {
  "enabled": true
}

When enabled, sharing a playground starts a cloudflared quick tunnel (anonymous — no Cloudflare account) that points at a dedicated, playground-only listener; the main API is never exposed. The cloudflared binary is downloaded lazily to ~/.loop/bin on first use and verified against a pinned sha256. Each share gets a unique opaque URL (https://<random>.trycloudflare.com/p/<token>), idempotent per playground; revoking it (Unshare, or the global Playground Shares panel) returns 404 immediately. Multiple playgrounds share in parallel over one tunnel, which stops when the last share is removed. See playground.md .

Learn

Configures the learn pass: after a chat run, a hidden forked session reviews it and proposes shortcuts, scheduled tasks, gate rules, mounts and a thread name or description for you to apply from the Learn view (see Chat: Learn from a run ).

"learn": {
  "enabled": true,
  "min_turns": 3,
  "model": "",
  "effort": "",
  "prompt": "Also look for commands that needed an approval click."
}

Layered global → project like review: each field overrides only when set in the project config. The Learn switch in the composer and the GET /api/channels/{id}/learn default read the global → project → worktree merge for the channel’s dir; the daemon deciding whether to run a pass (and with what model, effort and prompt) reads the same merge its runs use: global → root checkout → worktree for a worktree thread, global → the channel’s dir otherwise. Also editable from Settings → Learn.

Where learn proposals are written

Applying a proposal of a config kind appends to the project config, .loop/config.json in the channel’s directory. For a worktree thread, or a thread under one, that’s the root checkout’s .loop/config.json, not the worktree’s. The file (and its .loop folder) is created when missing. The edit keeps the file’s comments, key order and formatting, and the write is atomic. Edits of one file are serialized, so proposals applied at once (Apply all) each land. Before you apply one, its card in the Learn pane shows the edit as a diff of the file.

scheduled_task, rename, description and ticket_url proposals don’t touch config: they create an enabled task in the channel and update the channel’s name, description or ticket URL, as POST /api/tasks, /rename, /description and /ticket do.

Explain

Configures explanations: a hidden forked session writes up a chat turn (what changed, commands and results, decisions, risks, how to review it) for the Explain pane (see Chat: Explain a turn ). Any turn can be explained from its Explain button whatever enabled says.

"explain": {
  "enabled": false,
  "model": "",
  "effort": "",
  "prompt": "Call out any change to the public API."
}

Layered global → project like learn, and resolved for a channel the same way. Also editable from Settings → Explain.

Workflows

"workflows": [
  {
    "name": "fix-issue",
    "description": "Analyze an issue, plan, implement, and create a PR",
    "inputs": {
      "issue_url": { "description": "Issue URL", "required": true }
    },
    "nodes": [
      { "id": "analyze", "type": "bash", "script": "gh issue view {{.Inputs.issue_url}} --json title,body,labels" },
      { "id": "plan", "type": "prompt", "depends_on": ["analyze"], "prompt": "Create a plan:\n\n{{.NodeOutputs.analyze}}" },
      { "id": "implement", "type": "prompt", "depends_on": ["plan"], "prompt": "Implement:\n\n{{.NodeOutputs.plan}}" },
      { "id": "pr", "type": "prompt", "depends_on": ["implement"], "prompt": "Commit and create a PR" }
    ]
  }
]

Node fields:

See Workflows for architecture details and the DAG execution model.

Workflow Concurrency

"workflow_concurrency": {
  "max_concurrent_runs": 5,
  "max_concurrent_nodes": 10
}

Available at both global and project level. Project values override global values when > 0.

Memory

"memory": {
  "enabled": true,
  "paths": ["./memory", "!./memory/plans"],
  "max_chunk_chars": 5000,
  "reindex_interval_sec": 300,
  "embeddings": {
    "provider": "ollama",
    "model": "nomic-embed-text",
    "ollama_url": "http://localhost:11434"
  }
}

Quality

"quality": {
  "max_files": 25000,
  "exclude_paths": ["docs/**"],
  "complexity": {
    "cyclomatic_t": 10,
    "cognitive_t":  15,
    "nesting_t":    4,
    "params_t":     5,
    "loc_t":        60
  },
  "clones": {
    "min_loc":      5,
    "max_distance": 3
  },
  "rules": {
    "signal_floor":            { "enabled": true, "threshold": 5000 },
    "parse_fail":              { "enabled": true, "threshold": 0.01 },
    "no_import_cycles":        { "enabled": true },
    "complexity_ceiling":      { "enabled": true, "threshold": 10 },
    "complexity_score_floor":  { "enabled": true, "threshold": 0.5 },
    "duplication_ceiling":     { "enabled": true, "threshold": 0.10 }
  }
}

Scans are manual: panel “Scan now” button, loop quality:scan, or the quality_scan MCP tool.

Config changes drop the engine’s parser/graph cache for the affected channel but do not auto-trigger a rescan — the panel keeps rendering the previous snapshot until the next manual or live scan rebuilds with the new config. See Quality for the full surface.

Permissions (RBAC)

"permissions": {
  "owners": { "users": ["U12345678"], "roles": ["1234567890123456789"] },
  "members": { "users": [], "roles": [] }
}

If all config and DB permissions are empty, everyone is treated as an owner (bootstrap mode).

Security Gate

The gate runs a seccomp RET_USER_NOTIF filter inside each agent container and forwards approve-rule traps to Discord / Slack / the desktop. See HTTP API: Gate Approvals for the resolve endpoint and Events: gate.approval_requested for the WebSocket payload.

"gates": {
  "rate_limits": { "pending": 30, "per_minute": 60, "total": 500 },
  "audit":       { "retention_days": 30, "verbose": false },

  "agentgate": {
    "enabled": true,
    "default_decision": "allow",
    "path_rules":    [ /* unix-socket connect rules */ ],
    "command_rules": [ /* execve/execveat rules */ ],
    "file_rules":    [ /* openat/renameat2/unlinkat rules */ ]
  },

  "docker_proxy": {
    "enabled": true,
    "default_decision": "allow",
    "http_rules": [ /* per-method/path rules */ ],
    "body_rules": [ /* JSON-body inspection for container-create etc. */ ]
  }
}

gates is the single umbrella for both enforcement layers — the kernel-level agentgate (seccomp) and the application-level docker_proxy (Docker HTTP). Shared resources (rate_limits, audit) live at the umbrella level because both layers feed into the same agentgate.Manager for approvals.

Rule field shapes:

// PathRule
{ "pattern": "/var/run/docker.sock", "decision": "approve", "message": "agent wants to use docker" }

// CommandRule — empty commands or args_patterns means "match any"
{ "commands": ["git"], "args_patterns": ["^(push|remote add|reset --hard) .*"], "decision": "approve", "message": "git write op" }

// FileRule — empty paths or operations means "match any"
{ "paths": ["**/.ssh/**"], "operations": ["read","write","create","delete","chmod"], "decision": "deny", "message": "credentials blocked" }

decision is one of "allow", "deny", or "approve". approve blocks the syscall and broadcasts a gate.approval_requested event; the UI’s three-button card resolves it via POST /api/gate/approvals/{id} .

Desktop (Electron App)

"desktop": {
  "theme": "dark",
  "islands": true,
  "preview_tabs": true,
  "auto_save_on_blur": false,
  "stop_daemon_on_quit": false,
  "font_sizes": {
    "sidebar": 12,
    "chat": 13,
    "terminal": 13,
    "editor": 13,
    "panels": 12
  }
}

These settings are global-only (not available in project configs). Changes are applied live when saving the config — no restart required.

Project Config

Location: {workDir}/.loop/config.json

Project-level configs allow per-project overrides. They are loaded and merged with the global config whenever a container is created for a channel that has a custom work directory.

Available Fields

Not all global fields are available in project configs. The following fields can be set:

Project Config Merge Rules

The merge follows these principles:

• Replace: The project value completely replaces the global value (copy_files, permissions).
• Merge: Both global and project values are combined, with project taking precedence on conflicts (MCP servers, envs, task templates, workflows).
• Append: Project values are added to the global list (memory paths, proxies.no_proxy, and mounts, where one at the same container path replaces the global one).
• Override: A single scalar value replaces the global one (claude_model, container_image, etc.).
• Narrow merge: Security-sensitive fields under gates (agentgate, docker_proxy) have a locked-down merge: project rules go after the global denies (a trusted project’s go before the overridable default denies) and before the other global rules, enabled is the global setting’s, and default_decision / rate_limits / audit are ignored.
• Absent = inherit: If a field is not set in the project config, the global value is used unchanged.

Project Config Trust

The project config lives in the workspace, so an agent can edit it. The fields that reach past the agent’s container wait for you to trust them, like direnv allow:

• mounts, inherit_mounts, extra_dirs, copy_files, envs
• permissions, gates, bash_shortcuts
• workflows (their bash nodes run on the host under workflow_bash_local, and a project workflow replaces the global one of the same name)
• container_image, container_image_autobuild and the files in .loop/container, the image’s build context (the gate and the docker proxy run from inside the agent’s image, and its container gets the host’s docker socket). The diff shows each file by its digest; Loop builds the image only from files that match the digests you trusted
• anthropic_base_url (the global credentials are sent there)
• browser.mode, browser.host_cdp_port, browser.extensions, browser.cookie_import
• memory.paths
• github.mount_gh_config, gitlab.glab_config_dir, gitlab.mount_glab_config (they hand the host’s gh/glab credentials to the agent)
• ci (a failing check sends the agent a prompt, which starts a run unattended, and it picks how “merge when ready” merges)

Everything else (model, prompt shortcuts, MCP servers and so on) only shapes the agent’s own container and applies as written.

When those fields differ from the version you last trusted, Loop keeps using that version: none of the fields apply for a project you never trusted, and a project whose config sets none of them needs no trust, unless you trusted a version that did: removing them, or the whole file, keeps the trusted values until you trust again. The project’s row in the sidebar shows a trust pill, and its chats show a banner above the composer whose Review button opens Settings → Project. There, a Project config changed notice shows what changed as a diff from the last trusted version to the current one (from nothing, for a project you never trusted), with a Trust this config button. If the file changes again while you review it, trusting fails and the notice shows the new version.

Your own edits stay trusted. Saving the project config in Settings, adding a project shortcut, applying a learn proposal and loop onboard:local all keep a trusted project trusted. An edit you make to a project that’s waiting for review leaves it waiting, so it can’t approve what an agent changed elsewhere in the file. Edits in a text editor count like an agent’s: trust them in Settings afterwards.

Projects you set up before Loop asked for trust keep working: the upgrade trusts the config of every project with a channel as it is at that moment, once. A project that already has a trusted version keeps it. Workflows joined the trusted fields later, with a second upgrade step that works the same way: it adds each project’s workflows, as they are at that moment, to its trusted version, once, and leaves the project’s other trusted fields as you approved them. A project whose trusted version already has workflows keeps them. container_image, container_image_autobuild and the .loop/container files joined after that, with a third step that works the same way for them.

A worktree’s own .loop/config.json follows the same rule, except for the parent project dir Loop seeds into its extra_dirs, which always applies.

Symlinks in a project’s .loop dir can’t lead out of the project. Every read and write of a file there goes through the project dir, which refuses a link that leaves it at the moment of the call, so a link swapped in after a check is refused too:

• Shortcut, bash shortcut and component files that lead out are skipped as if missing.
• A project config write (Settings, a project shortcut or workflow, a learn proposal, a history restore) is refused with a 400 when .loop or .loop/config.json is a symlink out of the project, so it can’t change another file, such as the global config, as the project’s. The temp file a learn proposal is written through can’t be redirected either.
• A project config that leads out isn’t read. Runs in the project fail with a loading project config error, as they do when the file is malformed, and the Settings, history and trust views show nothing of the file it points to.

Relative links that stay inside the project work as before. An absolute link is refused, even one to a file in the project: point it at the file with a relative path instead. internal/osutil/within_spec_test.go checks this on random trees of links (out of the project, to a parent, out and back in, chains, loops, dangling) and names (., .., //, trailing slashes): nothing outside the project is read, created, changed or removed, and a relative link that stays inside still works.

Trusted versions are kept in loop/project-trust.json under your OS user config dir (~/Library/Application Support on macOS, ~/.config on Linux), next to the API token, where containers can’t reach them. The API routes are GET and POST /api/config/project/trust .

Example: aws and kubectl

Loop’s default file rules deny the credential dirs ~/.aws and ~/.kube, even when you mount them. A project that runs aws or kubectl can allow them in its own .loop/config.json; the rules apply once you trust the config:

{
  "mounts": ["~/.aws:~/.aws", "~/.kube:~/.kube"],
  "gates": {
    "agentgate": {
      "file_rules": [
        // Read the config and credentials, write the token caches.
        {"paths": ["**/.aws/**", "**/.kube/**"], "operations": ["read", "write", "create"], "decision": "allow"},
        // Clean up a cache temp file an interrupted write left behind.
        {"paths": ["**/.aws/**/tmp*.tmp"], "operations": ["delete"], "decision": "allow"}
      ]
    }
  }
}

The AWS CLI saves a token in ~/.aws/sso/cache or ~/.aws/cli/cache by writing a temp file (tmp<random>.tmp) and renaming it over the cache file, and kubectl writes ~/.kube/cache the same way. The gate checks a rename within one directory as a write of the temp file and a create of the cache file, so the first rule covers it. Deleting a file is a delete, which the second rule allows only for those temp files, so nothing else in ~/.aws or ~/.kube can be deleted. See Project config merge for where project rules go.

Complete Example Config

{
  // Required: platform(s) to run
  "platforms": ["local"],

  // Discord credentials (required when platform is "discord")
  "discord_token": "your-discord-bot-token-here",
  "discord_app_id": "your-discord-app-id-here",
  "discord_guild_id": "your-discord-guild-id-here",

  // Slack credentials (required when platform is "slack")
  //"slack_bot_token": "xoxb-your-slack-bot-token",
  //"slack_app_token": "xapp-your-slack-app-token",

  // Authentication (use one; OAuth takes precedence)
  //"claude_code_oauth_token": "sk-ant-your-oauth-token-here",
  //"anthropic_api_key": "sk-ant-your-api-key-here",
  // Route Claude's API calls through a gateway or proxy (localhost = this machine)
  //"anthropic_base_url": "https://llm-gateway.example.com",

  // Storage & logging
  //"db_path": "~/.loop/loop.db",
  //"log_file": "~/.loop/loop.log",
  //"log_level": "info",
  //"log_format": "text",

  // Container settings
  //"container_image": "loop-agent:latest",
  //"container_timeout_sec": 3600,
  //"container_memory_mb": 2048,
  //"container_cpus": 1.0,
  //"container_keep_alive_sec": 300,
  //"live_sessions": true, // run chat turns in one long-lived claude process per channel; false = a container per turn
  //"live_session_platforms": [], // platforms whose channels get live sessions ("local", "discord", "slack"); empty = all
  //"live_session_idle_sec": 600, // stop an idle live session after this long (the next message starts it again); 0 = never

  // Scheduling & networking
  //"poll_interval_sec": 30,
  //"api_addr": ":8222",

  // Agent settings
  //"claude_model": "",
  //"claude_bin_path": "claude",
  //"keep_mcp_configs": false, // preserve MCP config files after container runs for debugging

  // Browser automation
  //"browser": {
  //  "enabled": true,
  //  "chrome_image": "loop-chrome:latest",
  //  "host_cdp_port": 9222,
  //  "persist_profile": true,
  //  "memory_mb": 2048,                  // memory cap per sidecar; 0 for no cap
  //  "cpus": 1.0,                        // CPU cap per sidecar, in cores; 0 for no cap
  //  "extensions": ["/Users/me/chrome-extensions/ublock"],
  //  "cookie_import": {
  //    "source": "chrome:Default",       // browser profile to import cookies from
  //    "domains": ["github.com"],        // cookie scopes to bring over
  //    "auto": false                     // re-import into every new sidecar
  //  }
  //},

  // GitHub integration (used by the Git panel's PR chip)
  //"github": {
  //  "gh_user": "", // named gh CLI account; empty = gh's currently-active account
  //  "mount_gh_config": false // mount ~/.config/gh into agent containers
  //},

  // GitLab integration (MR lookups via glab)
  //"gitlab": {
  //  "glab_config_dir": "", // GLAB_CONFIG_DIR for lookups; empty = glab's default
  //  "mount_glab_config": false // mount the glab config dir into agent containers
  //},

  // RBAC permissions
  //"permissions": {
  //  "owners":  { "users": ["U12345678"], "roles": ["1234567890123456789"] },
  //  "members": { "users": [], "roles": [] }
  //},

  // Semantic memory search
  "memory": {
    "enabled": true,
    "paths": ["./memory", "!./memory/plans"],
    //"max_chunk_chars": 5000,
    //"reindex_interval_sec": 300,
    "embeddings": {
      "provider": "ollama",
      "model": "nomic-embed-text"
      //"ollama_url": "http://localhost:11434"
    }
  },

  // MCP servers
  "mcp": {
    //"servers": {
    //  "github": {
    //    "command": "npx",
    //    "args": ["-y", "@modelcontextprotocol/server-github"],
    //    "env": { "GITHUB_PERSONAL_ACCESS_TOKEN": "ghp_your_token" }
    //  }
    //}
  },

  // Custom environment variables for containers
  "envs": {
    "BASH_ENV": "~/.bashrc",
    "ENABLE_LSP_TOOL": false
  },

  // Files copied into containers (not mounted)
  "copy_files": ["~/.claude.json"],

  // Proxy for containers and image builds (empty inherits the daemon's own
  // environment, which is fixed when the daemon starts — these are re-read
  // per run)
  "proxies": {
    "http_proxy": "",
    "https_proxy": "",

    // Extra entries that bypass the proxy, added to loop's own bypasses. Name
    // every host reached by name: a hostname never matches a CIDR
    "no_proxy": []
  },

  // Container mounts
  "mounts": [
    "~/.claude:~/.claude",
    "~/.gitconfig:~/.gitconfig:ro",
    "~/.ssh:~/.ssh:ro",
    "~/.aws:~/.aws",
    "/var/run/docker.sock:/var/run/docker.sock",
    "~/.loop/.bashrc:~/.bashrc:ro",
    "loop-npmcache:~/.npm",
    "loop-uvcache:~/.local/share/uv",
    "loop-cache:~/.cache",
    "loop-gocache:/go",
    "loop-ollama:~/.ollama"
  ],

  // Task templates
  "task_templates": [
    {
      "name": "daily-summary",
      "description": "Generate a daily summary of completed tickets",
      "schedule": "0 17 * * *",
      "type": "cron",
      "prompt": "Generate a summary of all tickets closed today."
    },
    {
      "name": "heartbeat",
      "description": "Periodic health check",
      "schedule": "30m",
      "type": "interval",
      "prompt_path": "heartbeat.md",
      "auto_delete_sec": 60
    }
  ],

  // Prompt shortcuts (triggered via # in chat)
  "prompt_shortcuts": [
    {
      "name": "coverage",
      "description": "Run coverage check",
      "prompt": "Run make coverage-check and report the results"
    },
    {
      "name": "review",
      "description": "Review uncommitted and branch changes",
      "prompt_path": "review-code.md"
    }
  ],

  // Chat component templates (the chat_component MCP tool); math, canvas and react are built in
  "chat_components": [
    {
      "name": "reaction",
      "description": "A chemical reaction, balanced step by step"
    }
  ],

  // Workflows — declarative DAG pipelines
  "workflows": [],

  // Workflow concurrency limits (0 = unlimited)
  "workflow_concurrency": {
    "max_concurrent_runs": 0,
    "max_concurrent_nodes": 0
  },

  // Security gates umbrella. Both layers enabled by default with a baseline
  // deny-list; uncomment to extend. User rules append to the shipped baseline.
  //"gates": {
  //  //"rate_limits": { "pending": 30, "per_minute": 60, "total": 500 },
  //  //"audit":       { "retention_days": 30, "verbose": false },
  //
  //  // Kernel-level seccomp gate.
  //  //"agentgate": {
  //  //  "enabled": true,
  //  //  "default_decision": "allow",
  //  //  //"path_rules":    [ { "pattern": "/custom/socket", "decision": "deny" } ],
  //  //  //"command_rules": [ { "commands": ["curl"], "args_patterns": ["evil\\.com"], "decision": "deny" } ],
  //  //  //"file_rules":    [ { "paths": ["/project-secret/**"], "operations": ["read","write"], "decision": "deny" } ]
  //  //},
  //
  //  // Docker HTTP proxy (enabled automatically when agentgate.enabled). Replaces the
  //  // direct docker.sock bind with an in-container proxy that enforces per-method
  //  // and body-level rules.
  //  //"docker_proxy": {
  //  //  "enabled": true,
  //  //  "default_decision": "approve"
  //  //  //"http_rules": [ { "methods": ["POST"], "paths": ["^/my/route$"], "decision": "deny" } ]
  //  //}
  //}
}

Project Example Config

{
  // Claude model override for this project
  //"claude_model": "claude-opus-5",

  // Claude binary path override
  //"claude_bin_path": "/usr/local/bin/claude",

  // Auth override (overrides global auth entirely)
  //"claude_code_oauth_token": "sk-ant-project-oauth-token",
  //"anthropic_api_key": "sk-ant-project-api-key",
  // Gateway for this project's Claude API calls (needs trust)
  //"anthropic_base_url": "https://llm-gateway.example.com",

  // Container overrides
  //"container_image": "loop-agent:latest",
  //"container_memory_mb": 2048,
  //"container_cpus": 2.0,

  // Preserve MCP config files after container runs for debugging
  //"keep_mcp_configs": false,

  // Browser automation override
  //"browser": {
  //  "enabled": false,
  //  "chrome_image": "loop-chrome:latest",
  //  "persist_profile": true,
  //  "memory_mb": 2048,                  // memory cap per sidecar; 0 for no cap
  //  "cpus": 1.0,                        // CPU cap per sidecar, in cores; 0 for no cap
  //  "extensions": ["/Users/me/chrome-extensions/ublock"],
  //  "cookie_import": {
  //    "source": "chrome:Default",       // browser profile to import cookies from
  //    "domains": ["github.com"],        // cookie scopes to bring over
  //    "auto": false                     // re-import into every new sidecar
  //  }
  //},

  // GitHub override (per-project gh CLI account; mount_gh_config needs trust)
  //"github": {
  //  "gh_user": "",
  //  "mount_gh_config": false
  //},

  // GitLab override (needs trust)
  //"gitlab": {
  //  "glab_config_dir": "",
  //  "mount_glab_config": false
  //},

  // Memory config (paths appended to global; embeddings override global)
  //"memory": {
  //  "paths": ["./docs/architecture.md", "!./docs/wip"],
  //  "max_chunk_chars": 5000,
  //  "embeddings": { "provider": "ollama", "model": "nomic-embed-text" }
  //},

  // Files copied into containers (replaces global when set)
  //"copy_files": ["~/.claude.json"],

  // Project-specific MCP servers (merged with global; project overrides by name)
  //"mcp": {
  //  "servers": {
  //    "my-tool": {
  //      "command": "/path/to/binary",
  //      "args": ["--flag"],
  //      "env": { "API_KEY": "secret" }
  //    }
  //  }
  //},

  // Extra env vars (merged with global; project overrides by key)
  //"envs": {},

  // Project mounts (added to the global mounts; one at the same container
  // path replaces the global one; relative paths resolved to project dir)
  //"mounts": [
  //  "~/dev/shared-lib:~/dev/shared-lib:ro",
  //  "./fixtures:/fixtures:ro"
  //],
  // Make the mounts above replace the global list instead
  //"inherit_mounts": false,

  // Proxy for this project (replaces the global one when set)
  //"proxies": {
  //  "http_proxy": "http://127.0.0.1:3128",
  //  "https_proxy": "http://127.0.0.1:3128",
  //  // Extra no-proxy entries for this project (appended to the global list).
  //  // Name the compose services the agent talks to: a sibling reached as
  //  // http://my-service:8080 is matched by name, which no IP range covers.
  //  "no_proxy": ["my-service", "my-cache"]
  //},

  // Permissions override (replaces global permissions when set)
  //"permissions": {
  //  "owners":  { "users": [], "roles": [] },
  //  "members": { "users": [], "roles": [] }
  //},

  // Task templates (merged by name; project overrides global templates with same name)
  //"task_templates": [
  //  {
  //    "name": "daily-summary",
  //    "description": "Project-specific daily summary",
  //    "schedule": "0 18 * * *",
  //    "type": "cron",
  //    "prompt": "Summarize today's project activity"
  //  }
  //],

  // Prompt shortcuts (merged by name; project overrides global shortcuts with same name)
  //"prompt_shortcuts": [
  //  {
  //    "name": "lint",
  //    "description": "Run linter",
  //    "prompt": "Run make lint and fix any issues"
  //  }
  //],

  // Chat component templates (merged by name; project overrides global and built-in templates with same name)
  // Files load from .loop/components/<path>/, falling back to ~/.loop/components/<path>/
  //"chat_components": [
  //  {
  //    "name": "reaction",
  //    "description": "A chemical reaction, balanced step by step"
  //  }
  //],

  // Workflows (merged by name; project overrides global workflows with same name)
  //"workflows": [
  //  {
  //    "name": "code-review",
  //    "description": "Review branch changes",
  //    "nodes": [
  //      { "id": "diff", "type": "bash", "script": "git diff main...HEAD" },
  //      { "id": "review", "type": "prompt", "depends_on": ["diff"], "prompt": "Review:\n\n{{.NodeOutputs.diff}}" }
  //    ]
  //  }
  //],

  // Workflow concurrency limits (overrides global values)
  //"workflow_concurrency": {
  //  "max_concurrent_runs": 5,
  //  "max_concurrent_nodes": 10
  //},

  // Security gate rules for this project, applied once you trust the config.
  // Rules may use any decision (allow/deny/approve) and go after the global
  // denies, before the other global rules (first-match-wins). "enabled" and
  // "default_decision" are ignored: the global config decides.
  //"gates": {
  //  //"agentgate": {
  //  //  //"command_rules": [ { "commands": ["npm"], "args_patterns": ["^publish"], "decision": "deny" } ],
  //  //  //"file_rules":    [ { "paths": ["./secret-vault/**"], "operations": ["read"], "decision": "deny" } ]
  //  //  // Let aws and kubectl use the mounted ~/.aws and ~/.kube, and clean up
  //  //  // the cache temp files the AWS CLI renames into place:
  //  //  //"file_rules":    [
  //  //  //  { "paths": ["**/.aws/**", "**/.kube/**"], "operations": ["read", "write", "create"], "decision": "allow" },
  //  //  //  { "paths": ["**/.aws/**/tmp*.tmp"], "operations": ["delete"], "decision": "allow" }
  //  //  //]
  //  //},
  //
  //  //"docker_proxy": {
  //  //  //"http_rules": [ /* project-specific Docker API restrictions */ ]
  //  //}
  //}
}