Help us shape the future of Go! Take the 2026 Go Developer Survey

config

package
v0.156.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 21, 2026 License: Apache-2.0 Imports: 19 Imported by: 0

Documentation

Overview

Package config loads beekeeper's machine configuration: where its state lives, which shared resources sessions lease, the GitHub budget floor, the thresholds of the machine watch and which installations' alerts it reads.

The file is $XDG_CONFIG_HOME/beekeeper/config.yaml (or --config, or $BEEKEEPER_CONFIG). Every field is optional; a missing file is the defaults. The defaults are neutral: memory thresholds are fractions of the machine's RAM, swap or filesystem, and every organisation or desk choice (the production installation, the installations, the lanes, the role names) is unset until configured. docs/examples/config.yaml is a complete desk's configuration.

Index

Constants

View Source 
const (
	// SinkPlanGrilling is a note for the guide's person admitted on a plan
	// pull request at its grill stage.
	SinkPlanGrilling = "plan.grilling"
	// SinkPlanReady is a note for the guide's person admitted on an open
	// plan pull request whose stage check is green: the plan awaits review.
	SinkPlanReady = "plan.ready"
	// SinkServe is a session's record of the issue it serves (sessions
	// serve), SinkBoardClaim one board next --claim records.
	SinkServe      = "session.serve"
	SinkBoardClaim = "board.claim"
	// SinkMerged is a pull request the merge gate merged, with its release.
	SinkMerged = "merged"
)

The events the sink may dispatch: those that carry the issue or pull request they concern (owner/repo#n) as their subject.

View Source 
const (
	AppInstallation = "{installation}"
	AppBaseDomain   = "{baseDomain}"
)

The placeholders a manifest template's strings may carry: the installation's name and its base domain.

View Source 
const (
	GlobsLiteral = "literal"
	GlobsShell   = "shell"
)

The values of agents.shell.globs.

View Source 
const (
	DefaultAvailMin        = 0.12
	DefaultSwapMax         = 0.6
	DefaultOOMDHeadroomMin = 0.06
	DefaultScopeAnonMax    = 0.32
	DefaultGTTMax          = 0.28
	DefaultTmpMax          = 0.45
	DefaultDiskMin         = 0.05
	DefaultDiskCritical    = 0.01
)

The fractions a memory or disk threshold defaults to: of RAM (available memory, the desktop scope, the iGPU GTT), of swap (its use and oomd's headroom) and of the filesystem (/tmp's use, /'s free space).

View Source 
const AppName = "{name}"

AppName is the placeholder of the App's name in Apps.Manifest, and of the purpose in Apps.Template.

View Source 
const Browser = "browser"

Browser is the resource every machine has: the one Chrome the Claude in Chrome extension drives.

View Source 
const DefaultDesktopApp = "claude-desktop"

DefaultDesktopApp is claude.desktopApp's default, the desktop app's executable on Linux.

View Source 
const DefaultMemcapCPUQuota = 0.5

DefaultMemcapCPUQuota is the fraction of the cores every capped run together may use.

View Source 
const DefaultMemcapCPUWeight = 50

DefaultMemcapCPUWeight is memcap.slice's CPUWeight: half a desktop slice's 100, a third of the cores while the desktop wants them too.

View Source 
const DefaultMemcapMax = 0.14

DefaultMemcapMax is the fraction of RAM a capped command may use.

View Source 
const DefaultPlansCheck = "plan-stages"

DefaultPlansCheck is the stage check's name unless plans.check says otherwise.

View Source 
const DefaultQueueTTL = 15 * time.Minute

DefaultQueueTTL is merge.queueTTL unless the configuration sets it.

View Source 
const MinSwapSpan = 5 * time.Minute

MinSwapSpan is the shortest span a swap growth rate is measured over, and the least Watch.SwapWindow may be: a shorter window would never rate one.

View Source 
const MinimalProfile = "minimal"

MinimalProfile is the name of the profile beekeeper ships.

View Source 
const ModelServer = "model-server"

ModelServer is the resource of the host's model server: a claim carries the GiB its models may hold.

Variables

View Source 
var DefaultIgnore = []string{"Watchdog"}

DefaultIgnore are the alerts that always fire: Alertmanager's dead man's switch.

View Source 
var DefaultModels = map[string]Model{
	"claude-fable-5-1":  {Input: 10, Output: 50, CacheWrite5m: 12.5, CacheWrite1h: 20, CacheRead: 0.25, ContextWindow: 1_000_000},
	"claude-fable-5":    {Input: 10, Output: 50, CacheWrite5m: 12.5, CacheWrite1h: 20, CacheRead: 1, ContextWindow: 1_000_000},
	"claude-opus-5-5":   {Input: 4, Output: 20, CacheWrite5m: 5, CacheWrite1h: 8, CacheRead: 0.2, ContextWindow: 1_000_000},
	"claude-opus-5":     {Input: 5, Output: 25, CacheWrite5m: 6.25, CacheWrite1h: 10, CacheRead: 0.5, ContextWindow: 1_000_000},
	"claude-opus-4-8":   {Input: 5, Output: 25, CacheWrite5m: 6.25, CacheWrite1h: 10, CacheRead: 0.5, ContextWindow: 1_000_000},
	"claude-opus-4-7":   {Input: 5, Output: 25, CacheWrite5m: 6.25, CacheWrite1h: 10, CacheRead: 0.5, ContextWindow: 1_000_000},
	"claude-opus-4-6":   {Input: 5, Output: 25, CacheWrite5m: 6.25, CacheWrite1h: 10, CacheRead: 0.5, ContextWindow: 1_000_000},
	"claude-sonnet-5-5": {Input: 2, Output: 10, CacheWrite5m: 2.5, CacheWrite1h: 4, CacheRead: 0.2, ContextWindow: 1_000_000},
	"claude-sonnet-5":   {Input: 2, Output: 10, CacheWrite5m: 2.5, CacheWrite1h: 4, CacheRead: 0.2, ContextWindow: 1_000_000},
	"claude-sonnet-4-6": {Input: 3, Output: 15, CacheWrite5m: 3.75, CacheWrite1h: 6, CacheRead: 0.3, ContextWindow: 1_000_000},
	"claude-haiku-4-5":  {Input: 1, Output: 5, CacheWrite5m: 1.25, CacheWrite1h: 2, CacheRead: 0.1, ContextWindow: 200_000},
}

DefaultModels are the Claude API list prices (platform.claude.com/docs/en/ about-claude/pricing): cache writes cost 1.25 times the input price for the 5-minute TTL and twice for the 1-hour TTL, cache reads a tenth, except where a model's own rate differs (Opus 5.5 $0.20, Fable 5.1 $0.25).

View Source 
var DefaultQuietSessions = []string{"test: *"}

DefaultQuietSessions are the sessions of beekeeper's own tests.

View Source 
var DefaultUnalias = []string{"grep", "find", "ls", "cp", "mv", "rm"}

DefaultUnalias are the commands an agent shell runs unshadowed by default.

View Source 
var ErrInvalid = errors.New("refused")

ErrInvalid refuses a Set whose result does not load.

View Source 
var GitHubHosts = []string{"github.com", "api.github.com", "uploads.github.com"}

GitHubHosts are the hosts the GitHub token goes to.

View Source 
var OtherTeamsNotify = alerts.Quiet{Severity: "notify"}

OtherTeamsNotify are other teams' and team-less notify alerts: notify pages nobody, and the rule never quiets the team's alerts, a page or an installation in play.

View Source 
var SinkVerbs = []string{SinkPlanGrilling, SinkPlanReady, SinkServe, SinkBoardClaim, SinkMerged}

SinkVerbs are the events the sink may dispatch, the default of sink.verbs.

Functions

func DefaultQuietFor added in v0.37.0 

func DefaultQuietFor(team string) []alerts.Quiet

DefaultQuietFor are the default quiet rules of team: OtherTeamsNotify once there is a team whose alerts it leaves out, else none.

func Loopback added in v0.91.0 

func Loopback(host string) bool

Loopback reports whether host is a loopback name or address.

func Path 

func Path(flag string) (string, error)

Path returns the configuration file beekeeper reads.

Types

type AgeIdentity added in v0.92.0 

type AgeIdentity struct {
	// Recipient is the age recipient (age1…) as the files' sops metadata
	// and .sops.yaml name it.
	Recipient string `yaml:"recipient"`
	// PathRegex matches a file's absolute path (unanchored), for the files
	// of a repository or an installation whatever their recipient.
	PathRegex string `yaml:"pathRegex"`
	// Ref is the op:// field of the shared vault (secret.vault) or of one
	// of secret.ageVaults, the file:/// identity file (an absolute path, comments allowed) or the
	// store:// entry of the person's own credential store (secret.store;
	// store:// alone searches it for the file's recipients) holding the
	// identity, AGE-SECRET-KEY-1….
	Ref string `yaml:"ref"`
}

AgeIdentity maps the SOPS files of an age recipient, or under a path, to the vault field or the identity file that holds the recipient's identity.

type AgentShell added in v0.60.0 

type AgentShell struct {
	// Unalias are the commands whose alias or shell function the prelude
	// removes, so the name runs the tool on PATH (default: grep, find, ls,
	// cp, mv, rm; an empty list removes none).
	Unalias []string `yaml:"unalias"`
	// Globs is what an unmatched glob does: GlobsLiteral (the default)
	// passes it on as written, GlobsShell leaves the shell's own behaviour
	// (zsh: "no matches found", the command does not run).
	Globs string `yaml:"globs"`
	// Path are directories the prelude puts first on PATH, in their order
	// (a leading ~/ is the home directory): the agent's own programs, such
	// as a gh link to devctl that acts with the GitHub App's short-lived
	// token, in place of the person's (default: none).
	Path []string `yaml:"path"`
}

AgentShell configures the prelude Claude Code runs before each Bash command of a session: the person's interactive shell setup (aliases, the harness's own tool shadows, zsh's nomatch) breaks the commands agents write for the plain tools.

type Agents added in v0.23.0 

type Agents struct {
	// RelayAt is an agent's session context, in tokens, at which the watch
	// says its hand-over due (default: supervisor.relayAt).
	RelayAt Tokens `yaml:"relayAt"`
	// LastStepGrace is how long the watch holds the hand-over of an agent
	// over RelayAt whose task is in its last step (its sessions serve record
	// waits on the report or says the merge landed, or the gate saw its
	// merge land), counted from that evidence, since its report is expected
	// before a hand-over would pay (30m).
	LastStepGrace Duration `yaml:"lastStepGrace"`
	// LastStepCeiling is the context, in tokens, at which the hand-over is
	// due whatever the agent's last step (default: a quarter above RelayAt).
	LastStepCeiling Tokens `yaml:"lastStepCeiling"`
	// NoteWait bounds how long `agents handover` waits for the agent's
	// note on what is in flight (3m).
	NoteWait Duration `yaml:"noteWait"`
	// StaleAfter is how long an idle agent whose CLI no longer runs stays on
	// the roster before the doctor takes it off (24h).
	StaleAfter Duration `yaml:"staleAfter"`
	// ArchiveAgreement says where the person agreed that the desktop
	// sessions of finished workers beekeeper started are archived without
	// asking, never a session the person started (their standing
	// instruction, quoted to a steward). Empty: beekeeper asks no steward to
	// archive, since a peer's message is not the person's agreement.
	ArchiveAgreement string `yaml:"archiveAgreement"`
	// AutoResume has the watch resume a parked agent (agents park) with
	// what settled its wait, once the note it parked on is closed or the
	// pull request merged or closed; off, the watch only says AGENT
	// RESUMABLE and agents resume does it by hand.
	AutoResume bool `yaml:"autoResume"`
	// Shell is the prelude of every agent shell (beekeeper hook
	// sessionstart).
	Shell AgentShell `yaml:"shell"`
	// Dir is the folder every agent beekeeper starts runs in (agents start,
	// agents handover, a role's successor): the desk's checkout, whose
	// project instructions every session loads. Empty: the caller's.
	Dir string `yaml:"dir"`
	// Roots are the folders under which an agent may run instead, with
	// --dir: the worktrees of the desk's repositories. Any other folder is
	// refused while Dir is set.
	Roots []string `yaml:"roots"`
	// Profile names the tool profile of the workers agents start creates
	// (Profiles, or the built-in minimal); empty: none, a worker gets the
	// person's whole tool surface and its task runs as a desktop turn.
	Profile string `yaml:"profile"`
	// Profiles are the desk's tool profiles by name; one named minimal
	// replaces the built-in one.
	Profiles map[string]Profile `yaml:"profiles"`
}

Agents configures the hand-over of registered agents.

func (Agents) ProfileFor added in v0.123.0 

func (a Agents) ProfileFor(name string) (Profile, bool)

ProfileFor resolves a profile name: the desk's profile of that name, else the built-in minimal. ok is false for an empty name (no profile) or one neither defines.

type Alerts added in v0.7.0 

type Alerts struct {
	// Installations are read always; the discovered ones (Discover) and a
	// held lease whose name resolves to a kube context are read too.
	Installations []Installation `yaml:"installations"`
	// Ignore are alert names that never appear; setting it replaces the
	// default (Watchdog).
	Ignore []string `yaml:"ignore"`
	// Tenant is the Mimir tenant (X-Scope-OrgID) whose Alertmanager is read
	// first; empty, only a plain Alertmanager is read.
	Tenant string `yaml:"tenant"`
	// Team is the team whose alerts are marked in capitals and counted.
	Team string `yaml:"team"`
	// Collapse is the number of changes of one alertname in one run above
	// which they are one line with a count.
	Collapse int `yaml:"collapse"`
	// Every is the watch's reading interval.
	Every Duration `yaml:"every"`
	// Timeout bounds the reading of one installation, port-forwards included.
	Timeout Duration `yaml:"timeout"`
	// Kubectl is the kubectl binary.
	Kubectl string `yaml:"kubectl"`
	// Kubeconfig lists the kubeconfig files (~/ allowed) the installations'
	// contexts are resolved and read in, passed to kubectl as KUBECONFIG:
	// a kubeconfig of the watch's own, logged into with KUBECONFIG=<file>
	// tsh kube login <cluster>, so an installation reads without a context
	// in the machine kubeconfig. The machine kubeconfig is merged first
	// unless the list names it. Empty, kubectl's own default.
	Kubeconfig []string `yaml:"kubeconfig"`
	// Flap is the flap damper.
	Flap Flap `yaml:"flap"`
	// Quiet are the rules whose alerts' changes are no wake-up: the watch
	// logs them (watch.quiet) instead of printing them. A rule never
	// quiets an alert of the team, one on an installation in play (leased,
	// claimed or merged into within the last half hour, or with a merge
	// settling), or a page unless it names a cluster. Setting it replaces
	// the default: once Team is set, every other team's and team-less
	// notify alert ({severity: notify}), else none. An alert back after a
	// reading that missed it, with its old start, is quiet too.
	Quiet []alerts.Quiet `yaml:"quiet"`
	// PageSeverity is the severity that pages the on-call person (default
	// page): a firing alert at it that no session owns (alerts own) for
	// OwnerGrace is a PAGE UNOWNED line, again every OwnerGrace.
	PageSeverity string `yaml:"pageSeverity"`
	// OwnerGrace is how long a page may go unowned (default 15m).
	OwnerGrace Duration `yaml:"ownerGrace"`
	// PagerDuty is the second alert source: the team's PagerDuty services'
	// open incidents.
	PagerDuty PagerDuty `yaml:"pagerduty"`
	// Discover adds every installation that carries the team's
	// HelmReleases.
	Discover Discover `yaml:"discover"`
}

Alerts configures the reading of the installations' Alertmanagers: watch reads them every Every and prints NEW and RESOLVED lines, snapshot adds the current set as a section.

type AppSecret added in v0.130.0 

type AppSecret struct {
	// File is the SOPS file, absolute (~/ allowed), under the creation
	// rules of the .sops.yaml nearest above it.
	File      string `yaml:"file"`
	Name      string `yaml:"name"`
	Namespace string `yaml:"namespace"`
}

AppSecret is the SOPS file of an installation's App Secret and, for a file absent so far, the Secret it starts as.

type Apps added in v0.124.0 

type Apps struct {
	// Repo is the declaring repository (owner/repo), read on its default
	// branch.
	Repo string `yaml:"repo"`
	// Manifest is an App's manifest's path in Repo, AppName standing for
	// the App's name.
	Manifest string `yaml:"manifest"`
	// Template is the path in Repo of the manifest template of a purpose
	// whose Apps exist once per installation, AppName standing for the
	// purpose; unset, Manifest's file with .template.json for .json.
	Template string `yaml:"template"`
	// Secrets are, by installation, the SOPS file of the Kubernetes Secret
	// an App's credentials go into (beekeeper secret github-app).
	Secrets map[string]AppSecret `yaml:"secrets"`
}

Apps is the repository that declares the organisation's GitHub Apps, one manifest each (GitHub's App manifest: name, callback_urls). Unset, `app allow` refuses: an App is recorded only once it is declared.

func (Apps) ManifestOf added in v0.124.0 

func (a Apps) ManifestOf(name string) string

ManifestOf is the path of the manifest of the App name in Repo, "" while the declaring repository is unset.

func (Apps) TemplateOf added in v0.150.0 

func (a Apps) TemplateOf(purpose string) string

TemplateOf is the path of the manifest template of purpose in Repo, "" while the declaring repository or the path is unset.

type Board added in v0.56.0 

type Board struct {
	// Owner is the organisation and Project the number of its board;
	// unset, the board commands refuse.
	Owner   string `yaml:"owner"`
	Project int    `yaml:"project"`
	// Team is the value of the board's Team field whose items are the
	// desk's; empty, every item is.
	Team string `yaml:"team"`
	// TeamLabel is the issue label of the team's epics (default team/ and
	// Team's first word, lower-cased: team/bumblebee): the priority list
	// keeps a ranked epic that carries it whatever its Team field says, so
	// a label sync that moves the Team never drops a rank.
	TeamLabel string `yaml:"teamLabel"`
	// People are the logins whose assigned items are free; an item
	// assigned to anybody else is skipped.
	People []string `yaml:"people"`
	// StaleAfter skips an item without activity for longer (default a
	// year).
	StaleAfter Duration `yaml:"staleAfter"`
	// Order is the picking order: the first free item of the first step
	// that offers one is picked.
	Order []BoardStep `yaml:"order"`
	// Epics is the epic gate, whatever the order says.
	Epics EpicGate `yaml:"epics"`
}

Board is a GitHub project board and the order its work is picked in.

type BoardStep added in v0.56.0 

type BoardStep struct {
	// Name says why an item of the step is picked.
	Name string `yaml:"name"`
	// Status and Kind are the board's Status and Kind values; an
	// unambiguous part of one ("up next") stands for it.
	Status []string `yaml:"status"`
	Kind   []string `yaml:"kind"`
	Labels []string `yaml:"labels"`
	// SubIssues offers the open sub-issues of a matching item that has
	// any (an epic's remainder) instead of the item, in their order.
	SubIssues bool `yaml:"subIssues"`
	// Unblocked offers only items with recorded blockers, all of them
	// closed, whose Status was set before the last of them closed: a
	// blocked item whose blocker cleared. A Status set after it holds the
	// item until it changes.
	Unblocked bool `yaml:"unblocked"`
	// CreatedWithin offers only items created within the duration.
	CreatedWithin Duration `yaml:"createdWithin"`
	// Search is a GitHub issue search whose open issues the step offers
	// (oldest first) instead of board items.
	Search string `yaml:"search"`
}

BoardStep is one step of the picking order: the open board items whose status, kind and labels match (each list matches any of its values, an empty one everything), or the open issues of a GitHub search.

type Capacity added in v0.72.0 

type Capacity struct {
	// Floor is the fewest busy agents the supervisor keeps (5); Ceiling
	// the most it starts (10).
	Floor   int `yaml:"floor"`
	Ceiling int `yaml:"ceiling"`
	// AvailMinMiB is the MemAvailable a start needs (20 GiB), and the floor
	// under which disk swap's growth refuses a start.
	AvailMinMiB int `yaml:"availMinMiB"`
	// SwapGrowthMaxMiB is disk swap's growth per hour, over the watch's
	// readings of Watch.SwapWindow, that counts (256): a growth over it
	// refuses a start under memory pressure (PSI over SwapPSIMax, or
	// MemAvailable under AvailMinMiB) and is a warning without.
	SwapGrowthMaxMiB int `yaml:"swapGrowthMaxMiB"`
	// SwapPSIMax is the memory pressure ("full avg60" of
	// /proc/pressure/memory, in percent) up to which disk swap's growth is
	// a warning rather than a refusal (0: any pressure refuses).
	SwapPSIMax float64 `yaml:"swapPSIMax"`
}

Capacity is the supervisor's target of busy agents and the memory guards that bound a new start (beekeeper capacity, the watch's CAPACITY lines).

type Central added in v0.80.0 

type Central struct {
	// Context is the muster context of the installation it runs on
	// (muster context list): its endpoint, and the person's token from
	// muster auth token, taken anew for each call.
	Context string `yaml:"context"`
	// Server is the name muster registered it under: its tools are
	// x_<server>_<tool> (default beekeeper).
	Server string `yaml:"server"`
	// Muster is the muster binary (default muster).
	Muster string `yaml:"muster"`
	// Timeout bounds one call (default 30s).
	Timeout Duration `yaml:"timeout"`
}

Central configures the central instance, reached through muster as the person.

func (Central) Enabled added in v0.80.0 

func (c Central) Enabled() bool

Enabled says whether a central instance is configured.

type Claude 

type Claude struct {
	ProjectsDir string `yaml:"projectsDir"`
	// DesktopApp is the desktop app's executable, which starts the app or
	// hands a claude:// link to the running one.
	DesktopApp string `yaml:"desktopApp"`
	// SessionsDir holds the record every running CLI keeps of the session
	// it runs (<pid>.json), what `claude agents` lists.
	SessionsDir string `yaml:"sessionsDir"`
	DesktopDir  string `yaml:"desktopDir"`
	// DesktopLog is the desktop app's main log: its latest focus change
	// says which session the main window shows.
	DesktopLog string `yaml:"desktopLog"`
}

Claude locates what Claude Code and the desktop app keep on disk.

type Config 

type Config struct {
	// StateDir holds state.json, events.jsonl and the last snapshot.
	StateDir string `yaml:"stateDir"`
	// LeaseDir holds one directory per held lease (mkdir is the lock).
	LeaseDir string `yaml:"leaseDir"`
	// Identity is whose agents run here: every party this machine's
	// commands record carries it.
	Identity Identity `yaml:"identity"`
	// Serve configures the central instance (beekeeper serve).
	Serve Serve `yaml:"serve"`
	// Resources are the environments sessions lease besides the browser:
	// kind labs and shared installations.
	Resources []string `yaml:"resources"`
	// Labs maps a lab lease (one of Resources) to the kind cluster it
	// stands for: `lease list`, a claim and `free` name the cluster, and a
	// running kind cluster no lab lease maps is reported as unmapped.
	Labs map[string]string `yaml:"labs"`
	// GrantTTL is how long a grant stays claimable once its resource is free.
	GrantTTL Duration `yaml:"grantTTL"`
	// Shell is the shell the hook runs a rewritten command in (default:
	// $SHELL, else sh).
	Shell string `yaml:"shell"`
	// MaxKindClusters is how many kind clusters the machine runs at most
	// (default: one per 40 GiB of RAM, at least one).
	MaxKindClusters int `yaml:"maxKindClusters"`

	Kube Kube `yaml:"kube"`
	// Teleport is the login the kube contexts reach the installations
	// through, and its keeper.
	Teleport Teleport `yaml:"teleport"`

	GitHub   GitHub   `yaml:"github"`
	Watch    Watch    `yaml:"watch"`
	Overlaps Overlaps `yaml:"overlaps"`
	Claude   Claude   `yaml:"claude"`
	Omp      Omp      `yaml:"omp"`
	Desktop  Desktop  `yaml:"desktop"`
	Memcap   Memcap   `yaml:"memcap"`
	Lanes    []Lane   `yaml:"lanes"`
	Merge    Merge    `yaml:"merge"`
	// Units configures the transient user services beekeeper starts.
	Units  Units  `yaml:"units"`
	Alerts Alerts `yaml:"alerts"`
	// Upgrades paces the reading of the installations' Cluster API
	// upgrades.
	Upgrades Upgrades `yaml:"upgrades"`
	Notify   Notify   `yaml:"notify"`
	Metrics  Metrics  `yaml:"metrics"`
	Ollama   Ollama   `yaml:"ollama"`
	// Lemonade is the host's Lemonade Server, a second model server under
	// the same model-server lease and ollama's budgets.
	Lemonade Lemonade `yaml:"lemonade"`
	// Supervisor is what `handover --prompt` tells a successor supervisor,
	// how long a relay to it stays open and at what context it is due.
	Supervisor Supervisor `yaml:"supervisor"`
	// Guide is the role that walks the person through the decisions
	// waiting on them, never in the supervisor's session.
	Guide Guide `yaml:"guide"`
	// Agents configures how a registered agent near its context limit is
	// handed over to a fresh session.
	Agents Agents `yaml:"agents"`
	// Capacity is how many agents the supervisor keeps busy and the
	// headroom a new start needs.
	Capacity Capacity `yaml:"capacity"`
	// Reporter is the one-off status reporter session the standby watch
	// starts once per interval.
	Reporter Reporter `yaml:"reporter"`
	// Doctor is what `beekeeper doctor` and the watch fix by themselves.
	Doctor Doctor `yaml:"doctor"`
	// Outbound is what the hook refuses to let leave the machine and where
	// the watch looks for credentials left exposed on disk.
	Outbound Outbound `yaml:"outbound"`
	// Hooks says where beekeeper's Claude Code hooks act.
	Hooks Hooks `yaml:"hooks"`
	// Scan is where the transcript value scanner's index takes its values
	// from.
	Scan Scan `yaml:"scan"`
	// Secret configures beekeeper secret.
	Secret Secret `yaml:"secret"`
	// Sandbox is the agent sandbox beekeeper renders into Claude Code's
	// managed settings (beekeeper sandbox).
	Sandbox Sandbox `yaml:"sandbox"`
	// Board is the project board `beekeeper board` picks work from.
	Board Board `yaml:"board"`
	// Apps is where the organisation declares the GitHub Apps whose
	// consent `beekeeper app allow` records.
	Apps Apps `yaml:"apps"`
	// Plans are the repositories whose pull requests a note for a person
	// names only once their stage check is green, and where an epic's plan
	// pull request is found.
	Plans Plans `yaml:"plans"`
	// Central is the central instance (beekeeper serve behind muster) that
	// holds the leases of the shared installations and the roster of every
	// machine's agents; without its context, all of it stays on the machine.
	Central Central `yaml:"central"`
	// Feedback is the Slack feedback watch: the person's replies in the
	// threads of the reporter's posts, read through muster as the person.
	Feedback Feedback `yaml:"feedback"`
	// Sink dispatches a GitHub workflow on selected events.
	Sink Sink `yaml:"sink"`
}

Config is the parsed configuration with the defaults applied.

func Load 

func Load(path string) (*Config, error)

Load reads the file at path and applies the defaults. A configuration that is only incomplete loads: Incomplete names what is missing.

func Set added in v0.104.0 

func Set(path string, settings []Setting) (*Config, error)

Set writes every setting into the file at path in one write: the result is validated before it replaces the file, which a reader sees either before or after, never between two settings. A key whose maps do not exist yet is created; comments and the order of the other keys stay. It returns the configuration written.

func (*Config) CentralLane added in v0.80.0 

func (c *Config) CentralLane(l Lane) bool

CentralLane says whether the lane's merges queue in the central instance: its installation is central.

func (*Config) Incomplete added in v0.104.0 

func (c *Config) Incomplete() []string

Incomplete names the references whose source section is missing: each fails the commands that follow it, and leaves every other command working, so an edit that adds a reference and its section one after the other never makes the configuration unloadable in between.

func (*Config) IsCentral added in v0.80.0 

func (c *Config) IsCentral(res string) bool

IsCentral says whether res is a central resource: a central instance is configured and res is none of the machine's own (Leasable), whose leases stay local. The central instance knows which names are its Environments.

func (*Config) IsLeasable 

func (c *Config) IsLeasable(name string) bool

IsLeasable reports whether name is a configured resource or the browser.

func (*Config) KindClusters added in v0.47.0 

func (c *Config) KindClusters(ramMiB int) int

KindClusters is the most kind clusters a machine of ramMiB runs: maxKindClusters, else one per 40 GiB, at least one.

func (*Config) LabCluster added in v0.46.0 

func (c *Config) LabCluster(res string) string

LabCluster is the kind cluster the lab lease res stands for, "" when res is no lab lease.

func (*Config) LabLease added in v0.46.0 

func (c *Config) LabLease(cluster string) string

LabLease is the lab lease that stands for the kind cluster cluster, "" when none maps it.

func (*Config) LaneNamed added in v0.6.0 

func (c *Config) LaneNamed(name string) (Lane, bool)

LaneNamed is the configured lane of that name.

func (*Config) LaneOf added in v0.6.0 

func (c *Config) LaneOf(repo string) Lane

LaneOf is the lane a repository's merges queue in: the configured lane that lists it, else a lane of its own named after it.

func (*Config) Leasable 

func (c *Config) Leasable() []string

Leasable returns every resource a session can lease: the configured ones, the model server when one is watched, the browser last.

func (*Config) MemcapCPUQuota added in v0.107.0 

func (c *Config) MemcapCPUQuota(cores int) string

MemcapCPUQuota is memcap.slice's CPUQuota on a machine of cores, a systemd quota (100% a core): memcap.cpuQuota, else DefaultMemcapCPUQuota of the cores; "" with the cores unknown: no quota.

func (*Config) MemcapMax added in v0.47.0 

func (c *Config) MemcapMax(ramMiB int) string

MemcapMax is a capped command's MemoryMax on a machine of ramMiB, a systemd size: memcap.max, else DefaultMemcapMax of the RAM.

type Desktop added in v0.55.0 

type Desktop struct {
	// TypingQuiet is how long the person's keyboards and pointers stay
	// idle before a claude:// link switches the desktop's window (the
	// import of agents start, a reopen): a stray keystroke goes into the
	// window the link opens. A negative value opens links without
	// watching the input.
	TypingQuiet Duration `yaml:"typingQuiet"`
}

Desktop is how beekeeper shares the person's desktop.

type Discover added in v0.150.0 

type Discover struct {
	// Every is the discovery's interval; unset, nothing is discovered.
	Every Duration `yaml:"every"`
	// Label is the HelmRelease label naming the team (default
	// application.giantswarm.io/team).
	Label string `yaml:"label"`
	// Exclude are the glob patterns of Teleport cluster names never read
	// (default "*-*", a workload cluster's <installation>-<cluster>, and
	// "*.*", the proxy's own).
	Exclude []string `yaml:"exclude"`
}

Discover finds the installations to read beyond alerts.installations: every cluster Teleport lists (tsh kube ls, teleport.tsh on teleport.home), but the excluded ones, that carries a HelmRelease labelled Label=alerts.team. One without a kube context is logged into the first file of alerts.kubeconfig that is not the machine kubeconfig (KUBECONFIG=<file> tsh kube login <cluster>), so its reads need no context in the person's kubeconfig. The watch discovers every Every and keeps the result (alerts-discovery.json in the state directory), which every reading of the alerts adds to its installations.

func (Discover) Enabled added in v0.150.0 

func (d Discover) Enabled() bool

Enabled says whether installations are discovered.

type Doctor added in v0.53.0 

type Doctor struct {
	Faults []Fault `yaml:"faults"`
	// GoCacheMaxGiB caps the Go build cache every session's builds share:
	// over it the watch trims the least recently used entries down to
	// three quarters of it, while no go build runs or once the cache is
	// past it by a quarter. Default 20; negative: off.
	GoCacheMaxGiB int `yaml:"goCacheMaxGiB"`
	// GoCacheEvery is how often the cache's size is read (default 1h);
	// a trim a build held back is tried again every five minutes.
	GoCacheEvery Duration `yaml:"goCacheEvery"`
	// FreeEvery is how often the watch frees what dead sessions and dead go
	// commands leave in the tmpfs /tmp (free --apply's automatic sections;
	// default 1h); negative: never.
	FreeEvery Duration `yaml:"freeEvery"`
	// DockerImagesMaxGiB caps the machine's Docker images: over it the
	// watch removes the unused images created longest ago down to three
	// quarters of it, never one a container or a kind lab's node uses, and
	// never while an image import or build runs or a lab lease is fresh.
	// Default 40; negative: off.
	DockerImagesMaxGiB int `yaml:"dockerImagesMaxGiB"`
	// DockerBuildCacheMaxGiB caps Docker's build cache likewise, pruned
	// by Docker's own least-recently-used order. Default 20; negative: off.
	DockerBuildCacheMaxGiB int `yaml:"dockerBuildCacheMaxGiB"`
	// DockerEvery is how often the watch reads Docker's sizes (default 1h);
	// a prune an import held back is tried again at the next sample.
	DockerEvery Duration `yaml:"dockerEvery"`
	// WorktreeRoots are the folders (~/ allowed) under which the watch
	// looks for the linked git worktrees of finished workers (default
	// ~/.local/state/klaus-lab/worktrees).
	WorktreeRoots []string `yaml:"worktreeRoots"`
	// WorktreesEvery is how often the watch removes the worktrees whose
	// pull request merged or closed, and the build output of those that
	// still hold uncommitted or unpushed work and of any other untouched
	// for six hours (default 6h); negative: never.
	WorktreesEvery Duration `yaml:"worktreesEvery"`
}

Doctor configures the known faults the doctor probes and remedies.

func (Doctor) DockerBuildCacheMax added in v0.141.0 

func (d Doctor) DockerBuildCacheMax() int64

DockerBuildCacheMax is the Docker build cache's cap in bytes; 0 is off.

func (Doctor) DockerImagesMax added in v0.141.0 

func (d Doctor) DockerImagesMax() int64

DockerImagesMax is the Docker images' cap in bytes; 0 is off.

func (Doctor) GoCacheMax added in v0.101.0 

func (d Doctor) GoCacheMax() int64

GoCacheMax is the Go build cache's cap in bytes; 0 is off.

type Duration 

type Duration struct{ time.Duration }

Duration is a time.Duration written as "30s", "10m" in YAML.

func (*Duration) UnmarshalYAML 

func (d *Duration) UnmarshalYAML(n *yaml.Node) error

UnmarshalYAML parses a Go duration string.

type EpicGate added in v0.127.0 

type EpicGate struct {
	// Kind are the Kind values of an epic (default epic).
	Kind []string `yaml:"kind"`
	// Planning are the statuses of an epic in planning (default up next).
	Planning []string `yaml:"planning"`
	// Go is the status of the go (default in progress).
	Go string `yaml:"go"`
}

EpicGate is the epic gate: an epic in a Planning status is in planning, neither it nor any issue under it offered; moving it to Go is the go, from which its open sub-issues are offered. Each value is the board's value or an unambiguous part of it; an unset one is its default, which turns the gate off on a board without the value.

type Fault added in v0.53.0 

type Fault struct {
	Name string `yaml:"name"`
	// Probe is a shell command that exits 0 while the fault is absent.
	Probe string `yaml:"probe"`
	// Remedy is the shell command that fixes the fault.
	Remedy string `yaml:"remedy"`
	// Unattended lets the watch run the remedy by itself; otherwise a
	// sighting is one note for guide.person.
	Unattended bool `yaml:"unattended"`
}

Fault is a known fault with a known remedy.

type Feedback added in v0.82.0 

type Feedback struct {
	// Context is the muster context whose Slack server it reads; unset, no
	// feedback watch runs. The binary and the call timeout are central's.
	Context string `yaml:"context"`
	// Server is the name muster registered the Slack MCP server under: its
	// tools are x_<server>_<tool> (default slack).
	Server string `yaml:"server"`
	// Every is how often the threads are read (default 5m).
	Every Duration `yaml:"every"`
	// Window is how long after its post a report's thread is read (default
	// 24h).
	Window Duration `yaml:"window"`
}

Feedback configures the Slack feedback watch of the standby watch. It reads the thread of every report the reporter posted, through the Slack MCP server behind muster as the person, and delivers each reply of the report's author to the supervisor, or to the agent the reply names first ("<agent>: <message>").

func (Feedback) Enabled added in v0.82.0 

func (f Feedback) Enabled() bool

Enabled says whether the feedback watch runs.

type Flap added in v0.12.0 

type Flap struct {
	Changes int      `yaml:"changes"`
	Window  Duration `yaml:"window"`
}

Flap holds back an alert that changes too often: its Changes-th NEW or RESOLVED within Window is one FLAPPING line, as is a re-fire within Window after it resolved, and its changes print nothing until it has been stable for Window.

type Gateway added in v0.77.0 

type Gateway struct {
	// URL is klaus-gateway's base URL.
	URL string `yaml:"url"`
	// TokenFile is the projected ServiceAccount token (audience
	// klaus-gateway) every request carries, read anew for each.
	TokenFile string `yaml:"tokenFile"`
	// AnswerTool is the muster tool a click calls as the person who
	// answers: beekeeper's note_answer behind muster.
	AnswerTool string `yaml:"answerTool"`
	// SendTool is the muster tool a person's reply in a conversation with
	// one of their agents calls as the person: beekeeper's send_message
	// behind muster, to the agent's local: address.
	SendTool string `yaml:"sendTool"`
}

Gateway configures the decisions' delivery through klaus-gateway's POST /decisions.

type GitHub 

type GitHub struct {
	// Floor is the remaining core budget under which GitHub work stops.
	Floor int `yaml:"floor"`
	// UrgentBound is the budget an urgent merge keeps for itself under the
	// floor (lanes urgent): it runs while at least this much remains.
	UrgentBound int `yaml:"urgentBound"`
	// ProbeRepo is the repository whose conditional GET reads the budget
	// headers; any repository the token can read (default: beekeeper's own).
	ProbeRepo string `yaml:"probeRepo"`
	// AllowedOrgs are the organizations and accounts whose repositories an
	// agent writes to (default giantswarm); the hook refuses every GitHub
	// write to any other repository. An empty list turns the guard off.
	AllowedOrgs []string `yaml:"allowedOrgs"`
	// UpstreamReview is where a change meant for an upstream project is
	// queued for a human's decision (an issue, owner/repo#n), named in the
	// refusal; unset, the refusal names the team's upstream review list.
	UpstreamReview string `yaml:"upstreamReview"`
}

GitHub configures the budget reading.

type Guide added in v0.21.1 

type Guide struct {
	Role `yaml:",inline"`
	// Person is the name the guide's notes are filed for (note add --for,
	// or an older note's "[for <person>]" prefix), matched without regard
	// to case. Its queue and feed show only that person's notes; empty,
	// they show every note filed --for anyone.
	Person string `yaml:"person"`
	// WaitingTTL is how long a stopped session that waits on the person
	// stays in the queue and the feed; older ones fold into one line.
	WaitingTTL Duration `yaml:"waitingTTL"`
}

Guide configures the guide: its role and the person it guides.

type HookScope added in v0.70.1 

type HookScope struct {
	// Dirs are the desk's directories (~/ allowed); empty, every session
	// is in scope.
	Dirs []string `yaml:"dirs"`
}

HookScope is where the hooks act: in a session beekeeper started or knows (an agents start, a role holder, an agent on the roster), and in a session whose working directory or project lies under one of Dirs.

type Hooks added in v0.70.1 

type Hooks struct {
	// Scope is the desk's part of the machine; out of it the hooks are
	// inert.
	Scope HookScope `yaml:"scope"`
}

Hooks configures where beekeeper's Claude Code hooks act.

type Identity added in v0.74.0 

type Identity struct {
	// Person is the person's verified email, stable across identity
	// providers.
	Person string `yaml:"person"`
	// Team is the person's team.
	Team string `yaml:"team"`
	// Host names the machine (default: its host name, without the domain).
	Host string `yaml:"host"`
}

Identity names the person, team and host this machine's sessions act for.

type Installation added in v0.7.0 

type Installation struct {
	Name    string `yaml:"name"`
	Context string `yaml:"context"`
	// Floor is the lowest severity printed (alerts.Severities: none, info,
	// warning, notify, critical, page); empty prints every alert.
	Floor string `yaml:"floor"`
}

Installation is an installation and, optionally, the kube context that reaches it and the lowest severity printed of its alerts; written as a name alone or as {name, context, floor}. Without a context it is kube.contextTemplate's, else <name>, else the one ending in @<name>.

func (*Installation) UnmarshalYAML added in v0.7.0 

func (i *Installation) UnmarshalYAML(n *yaml.Node) error

UnmarshalYAML accepts a plain name.

type Kube added in v0.47.0 

type Kube struct {
	// Production is the installation whose clusters agents never write to:
	// a context or cluster name with it as a component. Empty, the kube
	// guard is off.
	Production string `yaml:"production"`
	// ContextTemplate is the kube context of an installation, with
	// {installation} for its name ("login.example.com-{installation}");
	// empty, an installation's context is its name or the one ending in
	// @<name>.
	ContextTemplate string `yaml:"contextTemplate"`
	// Kubeconfig lists the kubeconfig files beekeeper's own reads resolve
	// a context in, merged as kubectl merges a KUBECONFIG list (~/
	// allowed): the k8s:// source of beekeeper secret, whose Secret read a
	// kind lab's context makes through kind instead. Empty, the files
	// KUBECONFIG lists, else the machine kubeconfig ~/.kube/config.
	Kubeconfig []string `yaml:"kubeconfig"`
}

Kube configures the kube guard and how an installation's name becomes its kube context.

func (Kube) Context added in v0.47.0 

func (k Kube) Context(installation string) string

Context is the templated context of installation, "" without a template.

type Lane added in v0.6.0 

type Lane struct {
	Name string `yaml:"name"`
	// Repositories are owner/repo; a bare name matches it under any owner.
	// A repository's name is also the chart name of its HelmReleases.
	Repositories []string `yaml:"repositories"`
	// Installation is where the lane's HelmReleases run; empty: none to wait for.
	Installation string `yaml:"installation"`
	// Context is the kubeconfig context of the installation (default: the
	// one named after it, or ending in -<installation>).
	Context string `yaml:"context"`
}

Lane is a set of repositories whose merges roll the same components of an installation: one merge at a time, the next once they rolled. A repository in no lane is a lane of its own, with no installation to wait for.

type Lemonade added in v0.45.0 

type Lemonade struct {
	// URL is its API (http://localhost:13305); unset, the machine runs
	// none and nothing watches or guards one.
	URL string `yaml:"url"`
}

Lemonade is the host's Lemonade Server, whose loaded models live in the iGPU's memory like ollama's.

type Memcap 

type Memcap struct {
	SlotDir string `yaml:"slotDir"`
	Slots   int    `yaml:"slots"`
	// Max is a command's MemoryMax, a systemd size ("12G"; default: a
	// fraction of RAM, DefaultMemcapMax).
	Max string `yaml:"max"`
	// CPUQuota is memcap.slice's CPUQuota, the cores every capped run
	// together may use, a systemd quota ("1200%" is twelve cores; default:
	// a fraction of the cores, DefaultMemcapCPUQuota). The slots share it
	// by equal weight.
	CPUQuota string `yaml:"cpuQuota"`
	// CPUWeight is memcap.slice's CPUWeight against the desktop's slices
	// (100 each): the runs' share of the cores while the desktop wants
	// them too (default DefaultMemcapCPUWeight).
	CPUWeight int `yaml:"cpuWeight"`
}

Memcap locates the build slots of the memcap wrapper and caps the commands `beekeeper run` runs.

type Merge added in v0.6.0 

type Merge struct {
	// Cap is the most devctl merges and promotes the machine runs when a
	// merge starts; the waits only poll and do not count.
	Cap int `yaml:"cap"`
	// SessionCap is the most merges and promotions one session runs at once:
	// each running devctl polls GitHub, so the rest of its queued merges wait
	// in their lanes without reading it, starting in the order they queued.
	// Negative: no cap.
	SessionCap int `yaml:"sessionCap"`
	// QueueTTL is how long a queued merge keeps its place after its run ended,
	// and how long after it the place holds up the merges behind it.
	QueueTTL Duration `yaml:"queueTTL"`
	// SeedTTL is how long a place queued on a session's behalf is kept from
	// its seeding or the session's last arrival, and a failed run's from the
	// failure.
	SeedTTL Duration `yaml:"seedTTL"`
	// Settle is how long a lane waits after a merge whose release is unknown.
	Settle Duration `yaml:"settle"`
	// SettleTimeout is how long a lane waits for a release to roll before
	// the next merge is refused.
	SettleTimeout Duration `yaml:"settleTimeout"`
	// BudgetFresh is how old the last budget reading may be to gate on.
	BudgetFresh Duration `yaml:"budgetFresh"`
	// ResetFirst is how long after the GitHub budget's reset the merges
	// queued under the floor for it go first: the gated waits, the watch's
	// GitHub timer checks and budget --gate wait for them, and only merges
	// count against Cap for them, the oldest queued first.
	ResetFirst Duration `yaml:"resetFirst"`
	// StallAfter is how long a lane's first arrived merge may wait behind
	// places whose merges are not in the gate before the lane is stalled.
	StallAfter Duration `yaml:"stallAfter"`
	// HungAfter is how long a running merge's devctl may outlive its pull
	// request's merge before the watch ends it: devctl confirms the release
	// within its own --timeout, so one running on past it hangs in its lane.
	HungAfter Duration `yaml:"hungAfter"`
	// CITimeout is devctl pr merge's --timeout, its wait for the CI outcome,
	// when the gated command names none: devctl's own 30m is shorter than a
	// repository's CI restarted from zero by --update-branch.
	CITimeout Duration `yaml:"ciTimeout"`
	// ToolLimit is how long a foreground gate call runs before it exits 76
	// and leaves the merge to run on outside it, its outcome waking the
	// caller: below a desktop Bash call's 10-minute limit, which stops the
	// call without an exit code. Negative: no limit.
	ToolLimit Duration `yaml:"toolLimit"`
	// DevctlOwners are the owners whose repositories devctl pr merge serves
	// (its GitHub App login reaches its own organisation only); a
	// repository of any other owner, and every repository while it is
	// empty, takes the plain squash merge as the gh login instead.
	DevctlOwners []string `yaml:"devctlOwners"`
}

Merge configures the gate on devctl pr merge.

func (Merge) DevctlServes added in v0.31.2 

func (m Merge) DevctlServes(repo string) bool

DevctlServes says whether devctl pr merge serves repo's owner.

type Metrics added in v0.14.0 

type Metrics struct {
	// Models maps a model id, or the prefix of one, to its price and context
	// window. A configured entry replaces the default of the same key; a
	// model no entry matches has no cost ("cost unknown").
	Models map[string]Model `yaml:"models"`
	// Runaway holds the watch's thresholds; a negative one turns its
	// figure off.
	Runaway Runaway `yaml:"runaway"`
}

Metrics prices the tokens of the sessions' transcripts and sets the thresholds at which the watch reports a runaway session.

func (Metrics) Model added in v0.14.0 

func (m Metrics) Model(model string) (Model, bool)

Model returns the entry of model: its id, or its dated snapshot ("claude-haiku-4-5-20251001"). Another model of the same family is not priced like it.

type Model added in v0.14.0 

type Model struct {
	Input        float64 `yaml:"input" json:"input"`
	Output       float64 `yaml:"output" json:"output"`
	CacheWrite5m float64 `yaml:"cacheWrite5m" json:"cacheWrite5m"`
	CacheWrite1h float64 `yaml:"cacheWrite1h" json:"cacheWrite1h"`
	CacheRead    float64 `yaml:"cacheRead" json:"cacheRead"`
	// Fast multiplies every price of a request in fast mode; zero (the
	// defaults): a fast request's cost is unknown.
	Fast          float64 `yaml:"fast" json:"fast,omitempty"`
	ContextWindow int     `yaml:"contextWindow" json:"contextWindow"`
}

Model is a model's price in US dollars per million tokens and its context window in tokens.

type Notify added in v0.13.0 

type Notify struct {
	// Kinds are the kinds that notify (notify.Kinds, the default: due,
	// budget, stale-lease, no-supervisor). The machine's lines never
	// notify: the supervisor's watch says them.
	Kinds []string `yaml:"kinds"`
	// QuietHours ("22:00-07:00", local time) hold every notification but a
	// critical one until they end.
	QuietHours string `yaml:"quietHours"`
	// Urgency is a kind's urgency (low, normal, critical); no-supervisor
	// is critical, the others normal.
	Urgency map[string]string `yaml:"urgency"`
	// Repeat is how often a lasting condition (budget, no-supervisor)
	// notifies again while it lasts.
	Repeat Duration `yaml:"repeat"`
}

Notify configures what `watch --notify` sends to the desktop.

func (Notify) Policy added in v0.13.0 

func (n Notify) Policy() notify.Policy

Policy is the notify package's view of the section.

type Ollama added in v0.38.0 

type Ollama struct {
	// URL is its API (http://localhost:11434); unset, the machine runs none
	// and nothing watches or guards one.
	URL string `yaml:"url"`
	// Unit is its systemd unit, whose journal names the client that
	// loaded a model.
	Unit string `yaml:"unit"`
	// BudgetGiB is what a model-server claim may load without --gib;
	// MaxBudgetGiB the most a claim may ask for.
	BudgetGiB    int `yaml:"budgetGiB"`
	MaxBudgetGiB int `yaml:"maxBudgetGiB"`
	// NameOnly keeps the watch from unloading a model no lease covers: it
	// only names it.
	NameOnly bool `yaml:"nameOnly"`
	// LabTests are the agentlab subcommands that run turns on the host's
	// models; the hook refuses them outside the model-server lease.
	LabTests []string `yaml:"labTests"`
}

Ollama is the host's ollama server, whose loaded models live in the iGPU's GTT.

type Omp added in v0.59.0 

type Omp struct {
	// SessionsDir holds omp's session files, one folder per working
	// directory.
	SessionsDir string `yaml:"sessionsDir"`
	// ModelsFile is omp's provider configuration (~/.omp/agent/models.yml):
	// the providers' endpoints and models, and for a provider of Providers
	// the name of the variable omp reads its key from.
	ModelsFile string `yaml:"modelsFile"`
	// Model is the model `agents start --harness omp` starts an agent on
	// without --model, an exact selector omp lists ("ollama/qwen3.5:9b");
	// empty: such a start is refused.
	Model string `yaml:"model"`
	// Providers are the providers of ModelsFile whose key lives in the
	// vault, by the provider's name there.
	Providers map[string]OmpProvider `yaml:"providers"`
}

Omp locates what omp (oh-my-pi), the second local harness, keeps on disk.

type OmpProvider added in v0.109.0 

type OmpProvider struct {
	// APIKey is the op:// reference of the provider's key, never the key:
	// `agents start --harness omp` reads it through beekeeper's secret
	// handling and puts it into the agent's environment under the variable
	// the provider's apiKey in ModelsFile names, so no file carries the
	// value.
	APIKey string `yaml:"apiKey"`
}

OmpProvider is a provider of omp's models file whose key beekeeper hands to the agents it starts on it.

type Outbound added in v0.55.0 

type Outbound struct {
	// Phrases never leave the machine: outbound text that contains one
	// (case-insensitive) is refused, naming its number, never the phrase.
	Phrases []string `yaml:"phrases"`
	// Paths are globs (~/ allowed) of files whose Write and Edit count as
	// outbound (plans, posts); a directory covers every file under it.
	Paths []string `yaml:"paths"`
	// StoreDeny are the secret-store writes the hook refuses.
	StoreDeny []StoreRule `yaml:"storeDeny"`
	// SweepRoots are the directories (~/ allowed; default: home) the watch
	// sweeps, SweepDepth levels deep (default 5), every SweepEvery (default
	// 15m), for world-readable key files and git remote URLs that carry a
	// credential.
	SweepRoots []string `yaml:"sweepRoots"`
	SweepDepth int      `yaml:"sweepDepth"`
	SweepEvery Duration `yaml:"sweepEvery"`
}

Outbound configures the outbound secret guard. The token patterns are built in; these add what is specific to the machine.

type Overlaps 

type Overlaps struct {
	// Ignore lists repositories whose issues and name form no overlap:
	// issue trackers and notebooks every session writes to.
	Ignore []string `yaml:"ignore"`
	// ActiveWithin leaves out sessions idle for longer.
	ActiveWithin Duration `yaml:"activeWithin"`
}

Overlaps tunes which sessions count as working on the same thing.

type PagerDuty added in v0.111.0 

type PagerDuty struct {
	// Context is the muster context whose PagerDuty server is read; unset,
	// PagerDuty is not read. The binary and the call timeout are central's.
	Context string `yaml:"context"`
	// Server is the name muster registered the PagerDuty MCP server under:
	// its tools are x_<server>_<tool> (default pd).
	Server string `yaml:"server"`
	// Services are the ids of the team's PagerDuty services.
	Services []string `yaml:"services"`
	// Every is the reading interval (default 1m): a page is a watch line
	// within it.
	Every Duration `yaml:"every"`
}

PagerDuty configures the reading of the open incidents of the team's PagerDuty services, through muster's read-only PagerDuty tools as the person, signed in to the muster context: beekeeper holds no PagerDuty token. The watch reads them every Every and prints PAGERDUTY NEW, ACKNOWLEDGED and RESOLVED lines; alerts.team marks them.

func (PagerDuty) Enabled added in v0.111.0 

func (p PagerDuty) Enabled() bool

Enabled says whether PagerDuty is read.

type Plans added in v0.58.0 

type Plans struct {
	// Repositories are owner/repo; empty, no note is checked and no epic
	// has a plan.
	Repositories []string `yaml:"repositories"`
	// Check is the name of the stage check (default plan-stages).
	Check string `yaml:"check"`
}

Plans configures the plans repositories: a note for the guide's person that links one of their pull requests is refused while the pull request is closed or its stage check is pending, missing or red for anything but missing stage outputs (the grill stage), and an epic's plan is the open or merged pull request of theirs whose description names it.

func (Plans) Covers added in v0.58.0 

func (p Plans) Covers(repo string) bool

Covers reports whether repo (owner/repo, any case) is a plans repository.

type Profile added in v0.123.0 

type Profile struct {
	// Tools are the built-in tools kept (--tools); every other one is off.
	// Empty: Claude Code's default set.
	Tools []string `yaml:"tools"`
	// Deny are further permission rules the session is refused
	// (permissions.deny); a bare tool or mcp__<server> name takes it off the
	// tool list.
	Deny []string `yaml:"deny"`
	// Plugins are the plugins kept, by name (beekeeper) or id
	// (beekeeper@beekeeper); every other installed plugin, of any
	// marketplace, is disabled (enabledPlugins), and its skills, agents,
	// MCP servers and hooks with it. Empty: every plugin stays.
	Plugins []string `yaml:"plugins"`
	// MCPServers are the MCP servers kept, by name (allowedMcpServers);
	// every other one, claude.ai connectors included, is off. Empty: every
	// server stays.
	MCPServers []string `yaml:"mcpServers"`
}

Profile is the tool surface of a session beekeeper starts: the headless turns it launches get it on their command line (--tools, and --settings, whose flag settings Claude Code ranks over the person's user and project settings for that process only), never through the person's settings files.

type Reporter added in v0.26.0 

type Reporter struct {
	// Every is the interval; the reports start on its multiples (on the
	// hour for 1h). Unset, no reporter runs.
	Every Duration `yaml:"every"`
	// Brief is the reporter's brief file (~/ allowed): what to report and
	// where to post it.
	Brief string `yaml:"brief"`
	// Model is the session's model (default: Claude Code's).
	Model string `yaml:"model"`
	// Person is who the report is for (default: guide.person).
	Person string `yaml:"person"`
	// Dir is the session's working directory (~/ allowed; default: home).
	Dir string `yaml:"dir"`
	// Timeout is how long a reporter may run without posting before it is
	// stopped (20m).
	Timeout Duration `yaml:"timeout"`
	// TZ is the report's time zone, an IANA name (default: the machine's).
	TZ string `yaml:"tz"`
	// Reviews are the repositories (owner/repo) whose open draft pull
	// requests wait for the person's review.
	Reviews []string `yaml:"reviews"`
}

Reporter configures the scheduled status reporter: once per Every the standby watch starts one headless session with Brief, which posts one report to Person and ends; beekeeper then takes it off the roster.

func (Reporter) Enabled added in v0.26.0 

func (r Reporter) Enabled() bool

Enabled reports whether a reporter is scheduled.

type Role added in v0.20.0 

type Role struct {
	// Skill is the name of the skill the successor runs (supervise, guide).
	Skill string `yaml:"skill"`
	// Instructions is a file (~/ allowed) whose content opens the prompt
	// instead.
	Instructions string `yaml:"instructions"`
	// RelayAt is the role's session context, in tokens, at which the watch
	// reports the relay due ("400k"; the guide's default is 150k, the
	// supervisor's 400k).
	RelayAt Tokens `yaml:"relayAt"`
	// RelayTTL is how long a relay stays open for the successor's start.
	RelayTTL Duration `yaml:"relayTTL"`
	// RelayGrace is how long a holder that stays over RelayAt has after
	// the relay due to relay itself; past it, the standby watch relays it.
	RelayGrace Duration `yaml:"relayGrace"`
	// RestartGrace is how long beekeeper waits after it first saw the
	// role's CLI gone: a CLI back under the same session within it is a
	// restart and keeps the role; past it, the watch says the supervisor
	// is gone and notifies. The grant rule holds throughout.
	RestartGrace Duration `yaml:"restartGrace"`
	// Dir is the folder a successor starts in (~/ allowed; default: the
	// folder its predecessor's desktop session started from, not the
	// worktree the desktop made for it, whose branch the desktop cannot
	// check out a second time).
	Dir string `yaml:"dir"`
	// Profile names the tool profile (agents.profiles, or the built-in
	// minimal) of the role's successors and its holder's headless wakes;
	// empty: none, they get the person's whole tool surface.
	Profile string `yaml:"profile"`
}

Role configures a relayed role, the supervisor's or the guide's: the successor's session prompt (the instructions it follows, a skill or a file, not both) and the relay.

type Runaway added in v0.14.0 

type Runaway struct {
	// GitHubCallsPerHour: gh and devctl commands and GitHub MCP tool calls
	// in the last hour.
	GitHubCallsPerHour int `yaml:"githubCallsPerHour"`
	// SameErrorRepeats: the same failing tool call in the last hour.
	SameErrorRepeats int `yaml:"sameErrorRepeats"`
	// ContextFill: the last request's context over the model's window.
	ContextFill float64 `yaml:"contextFill"`
}

Runaway are the per-session figures over which the watch prints one line.

type Sandbox added in v0.80.0 

type Sandbox struct {
	// AllowRead are the paths (~/ allowed) under the home directory
	// commands and file tools may read: the checkouts, toolchains and lab
	// kubeconfigs sessions need.
	AllowRead []string `yaml:"allowRead"`
	// AllowWrite are the paths (~/ allowed) they may write, readable too:
	// the checkouts and worktrees, build and module caches.
	AllowWrite []string `yaml:"allowWrite"`
	// Domains are the hosts commands reach besides GitHub's: muster, the
	// registries and module proxies builds need, the labs' API servers.
	Domains []string `yaml:"domains"`
	// ProxyPort is the port of the broker's egress proxy on the host's
	// loopback (default 3190): the sandbox's only way out, which holds it
	// to the domains and sets the GitHub token's header itself.
	ProxyPort int `yaml:"proxyPort"`
	// Devctl is the devctl binary the broker runs on the host (~/ allowed;
	// default: devctl on the broker's PATH): it renews the egress proxy's
	// GitHub token from devctl's App login and runs a sandboxed session's
	// gated devctl commands, which read the keychain the sandbox closes.
	Devctl string `yaml:"devctl"`
	// Required refuses every tool call of a Claude Code session the policy
	// does not hold (no BEEKEEPER_SANDBOX: the policy is not installed, or
	// the session started before it was), SendMessage aside, and tells the
	// session so at its start. Off by default: set it once the policy is
	// installed and sessions work under it.
	Required bool `yaml:"required"`
}

Sandbox is the agent sandbox: the paths and hosts an agent session's commands and file tools reach besides beekeeper's own. The home directory is denied, so a path nobody lists stays unreadable.

type Scan added in v0.64.0 

type Scan struct {
	// SOPS are globs (~/ allowed) of SOPS files whose values are indexed,
	// decrypted with the sops binary in beekeeper's own process.
	SOPS []string `yaml:"sops"`
	// Vaults are 1Password vaults whose concealed fields are indexed, read
	// with the op binary.
	Vaults []string `yaml:"vaults"`
	// MinLength is the shortest value indexed (default 12): shorter ones
	// would match ordinary output.
	MinLength int `yaml:"minLength"`
}

Scan configures the transcript value scanner: beekeeper scan index fingerprints the values of these sources into the index under the state directory (scan/), which the PostToolUse hook and beekeeper scan sweep match against.

type Secret added in v0.70.0 

type Secret struct {
	// Vault is the team's shared 1Password vault, the only one an op://
	// reference may name; unset, beekeeper secret reads SOPS files only.
	Vault string `yaml:"vault"`
	// Vaults are the shared vaults besides Vault that an op:// reference
	// is read from (copy, compare, fingerprint) through the same session
	// or service account, such as a team's shared vault; beekeeper writes
	// to Vault alone. The list is the person's policy.
	Vaults []string `yaml:"vaults"`
	// TokenFile (~/ allowed) holds the vault's service account token,
	// which beekeeper gives only to its own op calls. Agents reach it
	// nowhere: it lies outside every agent container's mounts.
	TokenFile string `yaml:"tokenFile"`
	// Session reads the vault through the person's own signed-in op
	// session instead of a service account (tokenFile then unused): for a
	// vault no service account can be granted, such as an Employee vault.
	// The broker signs in by itself (SigninCommand) and holds the session in
	// its memory alone; every call on an op:// reference runs there.
	Session bool `yaml:"session"`
	// UnlockCommands are the names of the person's own commands that sign
	// in to or unlock the vault (helpers around op signin): the hook
	// refuses them in agent sessions under any path, like op signin, and
	// the agent shell prelude removes their aliases and shell functions.
	UnlockCommands []string `yaml:"unlockCommands"`
	// FileRoots are the directories (~/ allowed) whose plain files beekeeper
	// secret reads one value of as a source, file://<absolute path>#<path>:
	// a CLI's own credential directory, for one. A file outside them is
	// refused; none configured refuses every file:// source.
	FileRoots []string `yaml:"fileRoots"`
	// Files are files known to hold secret values (~/ and globs allowed)
	// that the hook refuses to let an agent read whole, beside its built-in
	// list (omp's provider configuration and the like) and TokenFile.
	Files []string `yaml:"files"`
	// SigninCommand is the command the broker runs to sign in to the vault
	// without the person, when it starts and whenever a call waits while it
	// holds no session: it prints the session as op signin does
	// (export OP_SESSION_<id>="<token>") on stdout, its log on stderr. Empty
	// leaves the sign-in to the person's beekeeper secret unlock.
	SigninCommand []string `yaml:"signinCommand"`
	// UnlockWait is how long a call that needs the vault waits for the
	// broker's sign-in while it holds no session (8m, within the Bash tool's
	// 10 minutes).
	UnlockWait Duration `yaml:"unlockWait"`
	// SessionLifetime is how long the broker holds the session after the
	// person's unlock (12h): it keeps op's session from idling out until
	// then, and forgets it at the end.
	SessionLifetime Duration `yaml:"sessionLifetime"`
	// AgeIdentities are the age identities beekeeper reads from the shared
	// vault, an identity file or the person's own credential store for the
	// SOPS files that sops' own sources (SOPS_AGE_KEY, SOPS_AGE_KEY_FILE,
	// sops/age/keys.txt) hold none for: each read in beekeeper's process
	// (the broker's, with secret.session) and given to the one sops call
	// alone.
	AgeIdentities []AgeIdentity `yaml:"ageIdentities"`
	// AgeVaults are the 1Password vaults besides secret.vault that age
	// identities are read from, through the same session or service
	// account: an op:// entry of ageIdentities may name one, and a SOPS file
	// of installations/<name>/ no entry names finds its identity in the item
	// "<name>.agekey" of secret.vault or one of them.
	AgeVaults []string `yaml:"ageVaults"`
	// Store is the person's own credential store a store:// age identity
	// is read from.
	Store SecretStore `yaml:"store"`
	// Env are the names (globs, such as *_TOKEN) of the environment
	// variables that carry a secret: the producer of beekeeper secret
	// capture runs without them, as without the vault's credentials and
	// SOPS_AGE_KEY, which it never gets.
	Env []string `yaml:"env"`
}

Secret configures beekeeper secret, the credential operations beekeeper runs so that no agent reads a value.

type SecretStore added in v0.98.0 

type SecretStore struct {
	// Read prints the secret of the entry appended as its last argument on
	// stdout.
	Read []string `yaml:"read"`
	// Search prints the names of the entries matching the term appended as
	// its last argument (an age recipient), one per line, never a value.
	Search []string `yaml:"search"`
}

SecretStore reaches the person's own credential store through the person's own commands, run by the broker: beekeeper never handles the store's password, and the store shows whatever unlock prompt it shows.

type Serve added in v0.75.0 

type Serve struct {
	// Issuer is the Dex issuer URL every caller's ID token is checked
	// against (its JWKS).
	Issuer string `yaml:"issuer"`
	// ClientIDs are the audiences accepted: the client muster forwards the
	// person's token for, and the one the installations exchange tokens for.
	ClientIDs []string `yaml:"clientIDs"`
	// Organization is the Dex group every member of the organization
	// carries: a caller without it, and without any of Organizations, is
	// refused.
	Organization string `yaml:"organization"`
	// Organizations are further groups that make a caller a member: one per
	// Dex connector where the connectors spell the organization differently
	// (a GitHub org's <org>:<team>, a directory's group name).
	Organizations []string `yaml:"organizations"`
	// Teams maps a Dex group to the team its members belong to; a caller
	// in none is refused.
	Teams map[string]string `yaml:"teams"`
	// Supervisors maps a team to the Dex group of its supervisor role, which
	// may release the team's leases and lift its holds.
	Supervisors map[string]string `yaml:"supervisors"`
	// Muster is the URL of the muster (its /mcp) a send_message to a
	// kagent: address goes through, as the caller.
	Muster string `yaml:"muster"`
	// Kagent maps an installation to the muster tool of its kagent MCP
	// server's invoke_agent_instance, x_<server>_invoke_agent_instance: the
	// installations a kagent: address may name.
	Kagent map[string]string `yaml:"kagent"`
	// People maps the name a decision is filed for (note add --for <name>)
	// to the person's email: who may answer it, and whom Slack messages.
	// A --for that is an email needs no entry.
	People map[string]string `yaml:"people"`
	// Channels maps a team to the Slack channel ID its decisions (--for
	// team:<name>) are posted to; any member of the team's Dex group (teams)
	// may answer.
	Channels map[string]string `yaml:"channels"`
	// Gateway is the klaus-gateway that puts decisions to their addressee
	// in Slack; without its URL, decisions stay in beekeeper.
	Gateway Gateway `yaml:"gateway"`
}

Serve configures `beekeeper serve`, the central instance behind muster: whose Dex tokens it accepts and what their groups authorize.

type Setting added in v0.104.0 

type Setting struct {
	Key, Value string
}

Setting is one key of a Set: a dotted path of mapping keys (secret.store.read) and its value in YAML.

type Sink added in v0.150.0 

type Sink struct {
	// Repo is the workflow's repository, owner/repo.
	Repo string `yaml:"repo"`
	// Workflow is the workflow's file name or id, refresh.yaml.
	Workflow string `yaml:"workflow"`
	// Ref is the branch or tag the workflow runs on (default: the
	// repository's default branch).
	Ref string `yaml:"ref"`
	// Verbs are the events dispatched, of SinkVerbs (default: all of them).
	Verbs []string `yaml:"verbs"`
}

Sink dispatches Workflow of Repo (workflow_dispatch) for every event of Verbs, within a watch.interval of the event, with the inputs verb, subject (owner/repo#n) and time (RFC 3339, UTC), nothing else. Unset (no repo), nothing is dispatched.

func (Sink) Enabled added in v0.150.0 

func (s Sink) Enabled() bool

Enabled reports whether a workflow is configured.

func (Sink) Selects added in v0.150.0 

func (s Sink) Selects(verb string) bool

Selects reports whether an event of verb is dispatched.

type StoreRule added in v0.55.0 

type StoreRule struct {
	Vault string `yaml:"vault"`
	Item  string `yaml:"item"`
}

StoreRule refuses a secret-store write (op item or document create and edit, vault kv put and patch) whose vault and item match its globs (case-insensitive); an empty glob matches any, as does a write that names no vault.

type Supervisor added in v0.9.0 

type Supervisor struct {
	Role `yaml:",inline"`
	// Scope says what the supervisor watches, in a sentence or two; empty,
	// the prompt names the resources, lanes and installations configured.
	Scope string `yaml:"scope"`
}

Supervisor configures the supervisor: its role and the scope it supervises.

type Teleport added in v0.62.0 

type Teleport struct {
	// Proxy is tsh login's --proxy (login.example.com:443); empty, no
	// keeper runs and the watch reads no login.
	Proxy string `yaml:"proxy"`
	// Auth is tsh login's --auth, the SSO connector; empty, the cluster's
	// default.
	Auth string `yaml:"auth"`
	// Tsh is the tsh binary (default tsh).
	Tsh string `yaml:"tsh"`
	// Home is the profile directory the kube contexts' tsh reads (default
	// $TELEPORT_HOME, else ~/.tsh).
	Home string `yaml:"home"`
	// RenewBefore is how long before the expiry the keeper renews (default
	// 90m); WarnBefore is when the watch says the login is about to expire
	// (default 1h), at most RenewBefore.
	RenewBefore Duration `yaml:"renewBefore"`
	WarnBefore  Duration `yaml:"warnBefore"`
	// LoginTimeout bounds one login, the browser's round trip included
	// (default 3m).
	LoginTimeout Duration `yaml:"loginTimeout"`
	// Every is how often the keeper's timer checks the expiry (default 10m).
	Every Duration `yaml:"every"`
}

Teleport configures the Teleport login's keeper: a periodic user unit that renews the SSO login before it expires, under the browser lease.

func (Teleport) Enabled added in v0.62.0 

func (t Teleport) Enabled() bool

Enabled reports whether a keeper is configured.

type Tokens added in v0.16.0 

type Tokens int64

Tokens is a token count written as "400k", "1m" or "400000" in YAML.

func ParseTokens added in v0.16.0 

func ParseTokens(s string) (Tokens, error)

ParseTokens parses "400k", "1m" or "400000" (case-insensitive).

func (*Tokens) UnmarshalYAML added in v0.16.0 

func (t *Tokens) UnmarshalYAML(n *yaml.Node) error

UnmarshalYAML parses a count with an optional k or m suffix.

type Units added in v0.135.0 

type Units struct {
	// Quiet counts every end of such a unit as success, any exit status
	// and a kill by SIGKILL, SIGTERM or SIGABRT included: the run's own
	// files still record the real exit. It is for an isolated harness
	// state, whose stub tools and deliberate kills would otherwise fail
	// units in the person's user manager; the desk's own configuration
	// leaves it off, so a real tooling fault fails its unit.
	Quiet bool `yaml:"quiet"`
}

Units configures the transient user services beekeeper starts (a gated merge's child, a wake's turn, a reopen).

type Upgrades added in v0.80.0 

type Upgrades struct {
	// Every is how old an installation's last reading may grow before it is
	// read again (default 5m).
	Every Duration `yaml:"every"`
}

Upgrades paces the reading of alerts.installations' Cluster API clusters for running upgrades: each installation is read every Every, and every watch.interval while an upgrade runs on it or holds it.

type Watch 

type Watch struct {
	Interval Duration `yaml:"interval"`
	// Repeat paces how often a lasting condition is handed to the
	// notifier (which sends it again after notify.repeat); the watch
	// prints it once when it starts and once when it ends.
	Repeat      Duration `yaml:"repeat"`
	BudgetEvery Duration `yaml:"budgetEvery"`
	AvailMinMiB int      `yaml:"availMinMiB"`
	SwapMaxMiB  int      `yaml:"swapMaxMiB"`
	// SwapWindow is how far back swap's growth rate looks (10m, at least
	// 5m): a burst older than the window has left the rate, which the SWAP
	// and OOMD IMMINENT checks and capacity's swap guard read.
	SwapWindow Duration `yaml:"swapWindow"`
	// OOMDHeadroomMinMiB and OOMDWithin decide when systemd-oomd's swap
	// kill is imminent (OOMD IMMINENT), only while oomd watches a cgroup
	// for swap and disk swap grows as MemAvailable falls: less swap growth
	// left before its SwapUsedLimit than OOMDHeadroomMinMiB, or the trigger
	// reached within OOMDWithin at the window's growth rate.
	OOMDHeadroomMinMiB int      `yaml:"oomdHeadroomMinMiB"`
	OOMDWithin         Duration `yaml:"oomdWithin"`
	ScopeAnonMaxMiB    int      `yaml:"scopeAnonMaxMiB"`
	// GTTMaxMiB is the iGPU GTT (system RAM the GPU driver pins, which no
	// cgroup counts) above which the watch prints IGPU GTT and names it
	// with the host ollama's models as the cause of LOW RAM and OOMD
	// IMMINENT.
	GTTMaxMiB int `yaml:"gttMaxMiB"`
	// LoadMax is the 1-minute load average over which the watch says HIGH
	// LOAD; unset (0), it is LoadPerCoreMax × the machine's cores
	// (LoadLimit).
	LoadMax        float64 `yaml:"loadMax"`
	LoadPerCoreMax float64 `yaml:"loadPerCoreMax"`
	PSIMax         float64 `yaml:"psiMax"`
	// CPUPSIMax is the CPU pressure ("some avg10" of /proc/pressure/cpu,
	// in percent) over which the watch says CPU PRESSURE once two samples
	// in a row read it, and over which, like over LoadLimit, the machine is
	// strained: the installation reads (upgrades, alerts, lane settling)
	// then run four times less often and at nice 10 (READS SLOWED).
	CPUPSIMax float64 `yaml:"cpuPSIMax"`
	// ForkRateMax is how far the fork rate (processes started per second,
	// from /proc/stat) must exceed the machine's usual one for the watch to
	// say PROCESS STORM, once two samples in a row read it; StackMax the number of copies of one command line
	// (arguments included), each running over a minute, over which it says
	// STACKED. A negative value turns the line off.
	ForkRateMax float64 `yaml:"forkRateMax"`
	StackMax    int     `yaml:"stackMax"`
	// ToolProcsMax is how many processes of the CLIs named in Tools may run
	// machine-wide before the watch says LOAD with the commands and the
	// sessions that run them: thirty sessions' kubectl, helm and tsh load
	// the CPU while no memory line fires. A negative value turns it off.
	ToolProcsMax int      `yaml:"toolProcsMax"`
	Tools        []string `yaml:"tools"`
	TmpMaxMiB    int      `yaml:"tmpMaxMiB"`
	DiskMinMiB   int      `yaml:"diskMinMiB"`
	// DiskCriticalMiB is the free space on / under which the watch says
	// DISK NEARLY FULL; DiskFillWithin how soon / would run full at the
	// rate its free space fell over the last minutes for the watch to say
	// DISK FILLING with the commands and sessions that wrote.
	DiskCriticalMiB int      `yaml:"diskCriticalMiB"`
	DiskFillWithin  Duration `yaml:"diskFillWithin"`
	// QuietSessions are globs (* matches any run) of the names of
	// short-lived sessions whose start, end and restart are no wake-up:
	// the watch logs them (watch.quiet) instead of printing them. Setting
	// it replaces the default, beekeeper's own tests ("test: *").
	QuietSessions []string `yaml:"quietSessions"`
	// Notify says whether the standby watch beekeeper install writes sends
	// the events that need a person to the desktop (watch --notify
	// --standby); off, the default, it runs as watch --standby.
	Notify bool `yaml:"notify"`
}

Watch holds the thresholds of `beekeeper watch` (MiB unless noted). A memory or disk threshold left unset is a fraction of what the machine has (the Default* fractions): its absolute value is read with the method of the same name.

func (Watch) AvailMin added in v0.47.0 

func (w Watch) AvailMin(ramMiB int) int

AvailMin is the LOW RAM threshold on a machine of ramMiB.

func (Watch) DiskCritical added in v0.100.0 

func (w Watch) DiskCritical(diskMiB int) int

DiskCritical is the DISK NEARLY FULL threshold on a / of diskMiB.

func (Watch) DiskMin added in v0.47.0 

func (w Watch) DiskMin(diskMiB int) int

DiskMin is the LOW DISK threshold on a / of diskMiB.

func (Watch) GTTMax added in v0.47.0 

func (w Watch) GTTMax(ramMiB int) int

GTTMax is the IGPU GTT threshold on a machine of ramMiB.

func (Watch) LoadLimit added in v0.39.0 

func (w Watch) LoadLimit(cores int) float64

LoadLimit is the HIGH LOAD threshold on a machine of cores: LoadMax when set, LoadPerCoreMax × cores otherwise.

func (Watch) OOMDHeadroomMin added in v0.47.0 

func (w Watch) OOMDHeadroomMin(swapMiB int) int

OOMDHeadroomMin is the OOMD IMMINENT headroom on a machine of swapMiB.

func (Watch) ScopeAnonMax added in v0.47.0 

func (w Watch) ScopeAnonMax(ramMiB int) int

ScopeAnonMax is the DESKTOP SCOPE threshold on a machine of ramMiB.

func (Watch) SwapMax added in v0.47.0 

func (w Watch) SwapMax(swapMiB int) int

SwapMax is the SWAP threshold on a machine of swapMiB.

func (Watch) TmpMax added in v0.47.0 

func (w Watch) TmpMax(tmpMiB int) int

TmpMax is the TMPFS threshold on a /tmp of tmpMiB.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.