Merge remote-tracking branch 'origin/main' into feat/gemini-cli-oauth

src/config/agent.rs

@@ -29,6 +29,8 @@ pub struct AgentConfig {
     pub auto_approve_tools: bool,
     /// Default timezone for new sessions (IANA name, e.g. "America/New_York").
     pub default_timezone: String,
+    /// Maximum tokens per job (0 = unlimited).
+    pub max_tokens_per_job: u64,
 }
 
 impl AgentConfig {
@@ -50,6 +52,7 @@ impl AgentConfig {
             max_tool_iterations: 10,
             auto_approve_tools: true,
             default_timezone: "UTC".to_string(),
+            max_tokens_per_job: 0,
         }
     }
 
@@ -105,6 +108,10 @@ impl AgentConfig {
                 }
                 tz
             },
+            max_tokens_per_job: parse_optional_env(
+                "AGENT_MAX_TOKENS_PER_JOB",
+                settings.agent.max_tokens_per_job,
+            )?,
         })
     }
 }

src/config/builder.rs

@@ -32,13 +32,16 @@ impl Default for BuilderModeConfig {
 }
 
 impl BuilderModeConfig {
-    pub(crate) fn resolve() -> Result<Self, ConfigError> {
+    pub(crate) fn resolve(settings: &crate::settings::Settings) -> Result<Self, ConfigError> {
+        let bs = &settings.builder;
         Ok(Self {
-            enabled: parse_bool_env("BUILDER_ENABLED", true)?,
-            build_dir: optional_env("BUILDER_DIR")?.map(PathBuf::from),
-            max_iterations: parse_optional_env("BUILDER_MAX_ITERATIONS", 20)?,
-            timeout_secs: parse_optional_env("BUILDER_TIMEOUT_SECS", 600)?,
-            auto_register: parse_bool_env("BUILDER_AUTO_REGISTER", true)?,
+            enabled: parse_bool_env("BUILDER_ENABLED", bs.enabled)?,
+            build_dir: optional_env("BUILDER_DIR")?
+                .map(PathBuf::from)
+                .or_else(|| bs.build_dir.clone()),
+            max_iterations: parse_optional_env("BUILDER_MAX_ITERATIONS", bs.max_iterations)?,
+            timeout_secs: parse_optional_env("BUILDER_TIMEOUT_SECS", bs.timeout_secs)?,
+            auto_register: parse_bool_env("BUILDER_AUTO_REGISTER", bs.auto_register)?,
         })
     }
 
@@ -56,3 +59,36 @@ impl BuilderModeConfig {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::config::helpers::ENV_MUTEX;
+    use crate::settings::Settings;
+
+    #[test]
+    fn resolve_falls_back_to_settings() {
+        let _guard = ENV_MUTEX.lock().expect("env mutex poisoned");
+        let mut settings = Settings::default();
+        settings.builder.max_iterations = 99;
+        settings.builder.auto_register = false;
+
+        let cfg = BuilderModeConfig::resolve(&settings).expect("resolve");
+        assert_eq!(cfg.max_iterations, 99);
+        assert!(!cfg.auto_register);
+    }
+
+    #[test]
+    fn env_overrides_settings() {
+        let _guard = ENV_MUTEX.lock().expect("env mutex poisoned");
+        let mut settings = Settings::default();
+        settings.builder.timeout_secs = 123;
+
+        // SAFETY: Under ENV_MUTEX, no concurrent env access.
+        unsafe { std::env::set_var("BUILDER_TIMEOUT_SECS", "3") };
+        let cfg = BuilderModeConfig::resolve(&settings).expect("resolve");
+        unsafe { std::env::remove_var("BUILDER_TIMEOUT_SECS") };
+
+        assert_eq!(cfg.timeout_secs, 3);
+    }
+}

src/config/channels.rs

@@ -91,54 +91,71 @@ pub struct SignalConfig {
 }
 
 impl ChannelsConfig {
-    pub(crate) fn resolve(settings: &Settings) -> Result<Self, ConfigError> {
-        let http = if optional_env("HTTP_PORT")?.is_some() || optional_env("HTTP_HOST")?.is_some() {
+    pub(crate) fn resolve(settings: &Settings, owner_id: &str) -> Result<Self, ConfigError> {
+        let cs = &settings.channels;
+
+        let http_enabled_by_env =
+            optional_env("HTTP_PORT")?.is_some() || optional_env("HTTP_HOST")?.is_some();
+        let http = if http_enabled_by_env || cs.http_enabled {
             Some(HttpConfig {
-                host: optional_env("HTTP_HOST")?.unwrap_or_else(|| "0.0.0.0".to_string()),
-                port: parse_optional_env("HTTP_PORT", 8080)?,
+                host: optional_env("HTTP_HOST")?
+                    .or_else(|| cs.http_host.clone())
+                    .unwrap_or_else(|| "0.0.0.0".to_string()),
+                port: parse_optional_env("HTTP_PORT", cs.http_port.unwrap_or(8080))?,
                 webhook_secret: optional_env("HTTP_WEBHOOK_SECRET")?.map(SecretString::from),
-                user_id: optional_env("HTTP_USER_ID")?.unwrap_or_else(|| "http".to_string()),
+                user_id: owner_id.to_string(),
             })
         } else {
             None
         };
 
-        let gateway_enabled = parse_bool_env("GATEWAY_ENABLED", true)?;
+        let gateway_enabled = parse_bool_env("GATEWAY_ENABLED", cs.gateway_enabled)?;
         let gateway = if gateway_enabled {
             Some(GatewayConfig {
-                host: optional_env("GATEWAY_HOST")?.unwrap_or_else(|| "127.0.0.1".to_string()),
-                port: parse_optional_env("GATEWAY_PORT", 3000)?,
-                auth_token: optional_env("GATEWAY_AUTH_TOKEN")?,
-                user_id: optional_env("GATEWAY_USER_ID")?.unwrap_or_else(|| "default".to_string()),
+                host: optional_env("GATEWAY_HOST")?
+                    .or_else(|| cs.gateway_host.clone())
+                    .unwrap_or_else(|| "127.0.0.1".to_string()),
+                port: parse_optional_env(
+                    "GATEWAY_PORT",
+                    cs.gateway_port.unwrap_or(DEFAULT_GATEWAY_PORT),
+                )?,
+                auth_token: optional_env("GATEWAY_AUTH_TOKEN")?
+                    .or_else(|| cs.gateway_auth_token.clone()),
+                user_id: owner_id.to_string(),
             })
         } else {
             None
         };
 
-        let signal = if let Some(http_url) = optional_env("SIGNAL_HTTP_URL")? {
-            let account = optional_env("SIGNAL_ACCOUNT")?.ok_or(ConfigError::InvalidValue {
-                key: "SIGNAL_ACCOUNT".to_string(),
-                message: "SIGNAL_ACCOUNT is required when SIGNAL_HTTP_URL is set".to_string(),
-            })?;
-            let allow_from = match std::env::var_os("SIGNAL_ALLOW_FROM") {
-                None => vec![account.clone()],
-                Some(val) => {
-                    let s = val.to_string_lossy();
-                    s.split(',')
+        let signal_url = optional_env("SIGNAL_HTTP_URL")?.or_else(|| cs.signal_http_url.clone());
+        let signal = if let Some(http_url) = signal_url {
+            let account = optional_env("SIGNAL_ACCOUNT")?
+                .or_else(|| cs.signal_account.clone())
+                .ok_or(ConfigError::InvalidValue {
+                    key: "SIGNAL_ACCOUNT".to_string(),
+                    message: "SIGNAL_ACCOUNT is required when SIGNAL_HTTP_URL is set".to_string(),
+                })?;
+            let allow_from =
+                match optional_env("SIGNAL_ALLOW_FROM")?.or_else(|| cs.signal_allow_from.clone()) {
+                    None => vec![account.clone()],
+                    Some(s) => s
+                        .split(',')
                         .map(|e| e.trim().to_string())
                         .filter(|s| !s.is_empty())
-                        .collect()
-                }
-            };
-            let dm_policy =
-                optional_env("SIGNAL_DM_POLICY")?.unwrap_or_else(|| "pairing".to_string());
-            let group_policy =
-                optional_env("SIGNAL_GROUP_POLICY")?.unwrap_or_else(|| "allowlist".to_string());
+                        .collect(),
+                };
+            let dm_policy = optional_env("SIGNAL_DM_POLICY")?
+                .or_else(|| cs.signal_dm_policy.clone())
+                .unwrap_or_else(|| "pairing".to_string());
+            let group_policy = optional_env("SIGNAL_GROUP_POLICY")?
+                .or_else(|| cs.signal_group_policy.clone())
+                .unwrap_or_else(|| "allowlist".to_string());
             Some(SignalConfig {
                 http_url,
                 account,
                 allow_from,
                 allow_from_groups: optional_env("SIGNAL_ALLOW_FROM_GROUPS")?
+                    .or_else(|| cs.signal_allow_from_groups.clone())
                     .map(|s| {
                         s.split(',')
                             .map(|e| e.trim().to_string())
@@ -149,6 +166,7 @@ impl ChannelsConfig {
                 dm_policy,
                 group_policy,
                 group_allow_from: optional_env("SIGNAL_GROUP_ALLOW_FROM")?
+                    .or_else(|| cs.signal_group_allow_from.clone())
                     .map(|s| {
                         s.split(',')
                             .map(|e| e.trim().to_string())
@@ -167,9 +185,7 @@ impl ChannelsConfig {
             None
         };
 
-        let cli_enabled = optional_env("CLI_ENABLED")?
-            .map(|s| s.to_lowercase() != "false" && s != "0")
-            .unwrap_or(true);
+        let cli_enabled = parse_bool_env("CLI_ENABLED", cs.cli_enabled)?;
 
         Ok(Self {
             cli: CliConfig {
@@ -180,10 +196,14 @@ impl ChannelsConfig {
             signal,
             wasm_channels_dir: optional_env("WASM_CHANNELS_DIR")?
                 .map(PathBuf::from)
+                .or_else(|| cs.wasm_channels_dir.clone())
                 .unwrap_or_else(default_channels_dir),
-            wasm_channels_enabled: parse_bool_env("WASM_CHANNELS_ENABLED", true)?,
+            wasm_channels_enabled: parse_bool_env(
+                "WASM_CHANNELS_ENABLED",
+                cs.wasm_channels_enabled,
+            )?,
             wasm_channel_owner_ids: {
-                let mut ids = settings.channels.wasm_channel_owner_ids.clone();
+                let mut ids = cs.wasm_channel_owner_ids.clone();
                 // Backwards compat: TELEGRAM_OWNER_ID env var
                 if let Some(id_str) = optional_env("TELEGRAM_OWNER_ID")? {
                     let id: i64 = id_str.parse().map_err(|e: std::num::ParseIntError| {
@@ -200,6 +220,10 @@ impl ChannelsConfig {
     }
 }
 
+/// Default gateway port — used both in `resolve()` and as the fallback in
+/// other modules that need to construct a gateway URL.
+pub const DEFAULT_GATEWAY_PORT: u16 = 3000;
+
 /// Get the default channels directory (~/.ironclaw/channels/).
 fn default_channels_dir() -> PathBuf {
     ironclaw_base_dir().join("channels")
@@ -208,6 +232,8 @@ fn default_channels_dir() -> PathBuf {
 #[cfg(test)]
 mod tests {
     use crate::config::channels::*;
+    use crate::config::helpers::ENV_MUTEX;
+    use crate::settings::Settings;
 
     #[test]
     fn cli_config_fields() {
@@ -362,4 +388,45 @@ mod tests {
             "expected path ending in 'channels', got: {dir:?}"
         );
     }
+
+    #[test]
+    fn resolve_uses_settings_channel_values_with_owner_scope_user_ids() {
+        let _guard = ENV_MUTEX.lock().unwrap_or_else(|e| e.into_inner());
+        let mut settings = Settings::default();
+        settings.channels.http_enabled = true;
+        settings.channels.http_host = Some("127.0.0.2".to_string());
+        settings.channels.http_port = Some(8181);
+        settings.channels.gateway_enabled = true;
+        settings.channels.gateway_host = Some("127.0.0.3".to_string());
+        settings.channels.gateway_port = Some(9191);
+        settings.channels.gateway_auth_token = Some("tok".to_string());
+        settings.channels.signal_http_url = Some("http://127.0.0.1:8080".to_string());
+        settings.channels.signal_account = Some("+15551234567".to_string());
+        settings.channels.signal_allow_from = Some("+15551234567,+15557654321".to_string());
+        settings.channels.wasm_channels_dir = Some(PathBuf::from("/tmp/settings-channels"));
+        settings.channels.wasm_channels_enabled = false;
+
+        let cfg = ChannelsConfig::resolve(&settings, "owner-scope").expect("resolve");
+
+        let http = cfg.http.expect("http config");
+        assert_eq!(http.host, "127.0.0.2");
+        assert_eq!(http.port, 8181);
+        assert_eq!(http.user_id, "owner-scope");
+
+        let gateway = cfg.gateway.expect("gateway config");
+        assert_eq!(gateway.host, "127.0.0.3");
+        assert_eq!(gateway.port, 9191);
+        assert_eq!(gateway.auth_token.as_deref(), Some("tok"));
+        assert_eq!(gateway.user_id, "owner-scope");
+
+        let signal = cfg.signal.expect("signal config");
+        assert_eq!(signal.account, "+15551234567");
+        assert_eq!(signal.allow_from, vec!["+15551234567", "+15557654321"]);
+
+        assert_eq!(
+            cfg.wasm_channels_dir,
+            PathBuf::from("/tmp/settings-channels")
+        );
+        assert!(!cfg.wasm_channels_enabled);
+    }
 }

src/config/database.rs

@@ -170,6 +170,40 @@ impl DatabaseConfig {
         })
     }
 
+    /// Create a config from a raw PostgreSQL URL (for wizard/testing).
+    pub fn from_postgres_url(url: &str, pool_size: usize) -> Self {
+        Self {
+            backend: DatabaseBackend::Postgres,
+            url: SecretString::from(url.to_string()),
+            pool_size,
+            ssl_mode: SslMode::from_env(),
+            libsql_path: None,
+            libsql_url: None,
+            libsql_auth_token: None,
+        }
+    }
+
+    /// Create a config for a libSQL database (for wizard/testing).
+    ///
+    /// Empty strings for `turso_url` and `turso_token` are treated as `None`.
+    pub fn from_libsql_path(
+        path: &str,
+        turso_url: Option<&str>,
+        turso_token: Option<&str>,
+    ) -> Self {
+        let turso_url = turso_url.filter(|s| !s.is_empty());
+        let turso_token = turso_token.filter(|s| !s.is_empty());
+        Self {
+            backend: DatabaseBackend::LibSql,
+            url: SecretString::from("unused://libsql".to_string()),
+            pool_size: 1,
+            ssl_mode: SslMode::default(),
+            libsql_path: Some(PathBuf::from(path)),
+            libsql_url: turso_url.map(String::from),
+            libsql_auth_token: turso_token.map(|t| SecretString::from(t.to_string())),
+        }
+    }
+
     /// Get the database URL (exposes the secret).
     pub fn url(&self) -> &str {
         self.url.expose_secret()

src/config/embeddings.rs

@@ -23,6 +23,9 @@ pub struct EmbeddingsConfig {
     pub ollama_base_url: String,
     /// Embedding vector dimension. Inferred from the model name when not set explicitly.
     pub dimension: usize,
+    /// Custom base URL for OpenAI-compatible embedding providers.
+    /// When set, overrides the default `https://api.openai.com`.
+    pub openai_base_url: Option<String>,
 }
 
 impl Default for EmbeddingsConfig {
@@ -36,6 +39,7 @@ impl Default for EmbeddingsConfig {
             model,
             ollama_base_url: "http://localhost:11434".to_string(),
             dimension,
+            openai_base_url: None,
         }
     }
 }
@@ -74,6 +78,8 @@ impl EmbeddingsConfig {
 
         let enabled = parse_bool_env("EMBEDDING_ENABLED", settings.embeddings.enabled)?;
 
+        let openai_base_url = optional_env("EMBEDDING_BASE_URL")?;
+
         Ok(Self {
             enabled,
             provider,
@@ -81,6 +87,7 @@ impl EmbeddingsConfig {
             model,
             ollama_base_url,
             dimension,
+            openai_base_url,
         })
     }
 
@@ -100,13 +107,13 @@ impl EmbeddingsConfig {
         session: Arc<SessionManager>,
     ) -> Option<Arc<dyn EmbeddingProvider>> {
         if !self.enabled {
-            tracing::info!("Embeddings disabled (set EMBEDDING_ENABLED=true to enable)");
+            tracing::debug!("Embeddings disabled (set EMBEDDING_ENABLED=true to enable)");
             return None;
         }
 
         match self.provider.as_str() {
             "nearai" => {
-                tracing::info!(
+                tracing::debug!(
                     "Embeddings enabled via NEAR AI (model: {}, dim: {})",
                     self.model,
                     self.dimension,
@@ -117,7 +124,7 @@ impl EmbeddingsConfig {
                 ))
             }
             "ollama" => {
-                tracing::info!(
+                tracing::debug!(
                     "Embeddings enabled via Ollama (model: {}, url: {}, dim: {})",
                     self.model,
                     self.ollama_base_url,
@@ -130,16 +137,27 @@ impl EmbeddingsConfig {
             }
             _ => {
                 if let Some(api_key) = self.openai_api_key() {
-                    tracing::info!(
-                        "Embeddings enabled via OpenAI (model: {}, dim: {})",
-                        self.model,
-                        self.dimension,
-                    );
-                    Some(Arc::new(crate::workspace::OpenAiEmbeddings::with_model(
+                    let mut provider = crate::workspace::OpenAiEmbeddings::with_model(
                         api_key,
                         &self.model,
                         self.dimension,
-                    )))
+                    );
+                    if let Some(ref base_url) = self.openai_base_url {
+                        tracing::debug!(
+                            "Embeddings enabled via OpenAI (model: {}, base_url: {}, dim: {})",
+                            self.model,
+                            base_url,
+                            self.dimension,
+                        );
+                        provider = provider.with_base_url(base_url);
+                    } else {
+                        tracing::debug!(
+                            "Embeddings enabled via OpenAI (model: {}, dim: {})",
+                            self.model,
+                            self.dimension,
+                        );
+                    }
+                    Some(Arc::new(provider))
                 } else {
                     tracing::warn!("Embeddings configured but OPENAI_API_KEY not set");
                     None
@@ -154,6 +172,7 @@ mod tests {
     use super::*;
     use crate::config::helpers::ENV_MUTEX;
     use crate::settings::{EmbeddingsSettings, Settings};
+    use crate::testing::credentials::*;
 
     /// Clear all embedding-related env vars.
     fn clear_embedding_env() {
@@ -163,6 +182,7 @@ mod tests {
             std::env::remove_var("EMBEDDING_PROVIDER");
             std::env::remove_var("EMBEDDING_MODEL");
             std::env::remove_var("OPENAI_API_KEY");
+            std::env::remove_var("EMBEDDING_BASE_URL");
         }
     }
 
@@ -173,7 +193,7 @@ mod tests {
         clear_embedding_env();
         // SAFETY: Under ENV_MUTEX, no concurrent env access.
         unsafe {
-            std::env::set_var("OPENAI_API_KEY", "sk-test-key-for-issue-129");
+            std::env::set_var("OPENAI_API_KEY", TEST_OPENAI_API_KEY_ISSUE_129);
         }
 
         let settings = Settings {
@@ -246,4 +266,41 @@ mod tests {
             std::env::remove_var("EMBEDDING_ENABLED");
         }
     }
+
+    #[test]
+    fn embedding_base_url_parsed_from_env() {
+        let _guard = ENV_MUTEX.lock().expect("env mutex poisoned");
+        clear_embedding_env();
+
+        // SAFETY: Under ENV_MUTEX, no concurrent env access.
+        unsafe {
+            std::env::set_var("EMBEDDING_BASE_URL", "https://custom.example.com");
+        }
+
+        let settings = Settings::default();
+        let config = EmbeddingsConfig::resolve(&settings).expect("resolve should succeed");
+        assert_eq!(
+            config.openai_base_url.as_deref(),
+            Some("https://custom.example.com"),
+            "EMBEDDING_BASE_URL env var should be parsed into openai_base_url"
+        );
+
+        // SAFETY: Under ENV_MUTEX.
+        unsafe {
+            std::env::remove_var("EMBEDDING_BASE_URL");
+        }
+    }
+
+    #[test]
+    fn embedding_base_url_defaults_to_none() {
+        let _guard = ENV_MUTEX.lock().expect("env mutex poisoned");
+        clear_embedding_env();
+
+        let settings = Settings::default();
+        let config = EmbeddingsConfig::resolve(&settings).expect("resolve should succeed");
+        assert!(
+            config.openai_base_url.is_none(),
+            "openai_base_url should be None when EMBEDDING_BASE_URL is not set"
+        );
+    }
 }

src/config/heartbeat.rs

@@ -7,17 +7,19 @@ use crate::settings::Settings;
 pub struct HeartbeatConfig {
     /// Whether heartbeat is enabled.
     pub enabled: bool,
-    /// Interval between heartbeat checks in seconds.
+    /// Interval between heartbeat checks in seconds (used when fire_at is not set).
     pub interval_secs: u64,
     /// Channel to notify on heartbeat findings.
     pub notify_channel: Option<String>,
     /// User ID to notify on heartbeat findings.
     pub notify_user: Option<String>,
+    /// Fixed time-of-day to fire (HH:MM, 24h). When set, interval_secs is ignored.
+    pub fire_at: Option<chrono::NaiveTime>,
     /// Hour (0-23) when quiet hours start.
     pub quiet_hours_start: Option<u32>,
     /// Hour (0-23) when quiet hours end.
     pub quiet_hours_end: Option<u32>,
-    /// Timezone for quiet hours evaluation (IANA name).
+    /// Timezone for fire_at and quiet hours evaluation (IANA name).
     pub timezone: Option<String>,
 }
 
@@ -28,6 +30,7 @@ impl Default for HeartbeatConfig {
             interval_secs: 1800, // 30 minutes
             notify_channel: None,
             notify_user: None,
+            fire_at: None,
             quiet_hours_start: None,
             quiet_hours_end: None,
             timezone: None,
@@ -37,6 +40,19 @@ impl Default for HeartbeatConfig {
 
 impl HeartbeatConfig {
     pub(crate) fn resolve(settings: &Settings) -> Result<Self, ConfigError> {
+        let fire_at_str =
+            optional_env("HEARTBEAT_FIRE_AT")?.or_else(|| settings.heartbeat.fire_at.clone());
+        let fire_at = fire_at_str
+            .map(|s| {
+                chrono::NaiveTime::parse_from_str(&s, "%H:%M").map_err(|e| {
+                    ConfigError::InvalidValue {
+                        key: "HEARTBEAT_FIRE_AT".to_string(),
+                        message: format!("must be HH:MM (24h), e.g. '14:00': {e}"),
+                    }
+                })
+            })
+            .transpose()?;
+
         Ok(Self {
             enabled: parse_bool_env("HEARTBEAT_ENABLED", settings.heartbeat.enabled)?,
             interval_secs: parse_optional_env(
@@ -47,6 +63,7 @@ impl HeartbeatConfig {
                 .or_else(|| settings.heartbeat.notify_channel.clone()),
             notify_user: optional_env("HEARTBEAT_NOTIFY_USER")?
                 .or_else(|| settings.heartbeat.notify_user.clone()),
+            fire_at,
             quiet_hours_start: parse_option_env::<u32>("HEARTBEAT_QUIET_START")?
                 .or(settings.heartbeat.quiet_hours_start)
                 .map(|h| {

src/config/helpers.rs

@@ -1,6 +1,9 @@
+use std::collections::HashMap;
+use std::sync::{Mutex, OnceLock};
+
 use crate::error::ConfigError;
 
-use super::INJECTED_VARS;
+use crate::config::INJECTED_VARS;
 
 /// Crate-wide mutex for tests that mutate process environment variables.
 ///
@@ -11,6 +14,73 @@ use super::INJECTED_VARS;
 #[cfg(test)]
 pub(crate) static ENV_MUTEX: std::sync::Mutex<()> = std::sync::Mutex::new(());
 
+/// Thread-safe mutable overlay for env vars set at runtime.
+///
+/// Unlike `INJECTED_VARS` (which is set once at startup from the secrets
+/// store), this map supports writes at any point during the process
+/// lifetime. It replaces unsafe `std::env::set_var` calls that would
+/// otherwise be UB in multi-threaded programs (Rust 1.82+).
+///
+/// Priority: real env vars > `RUNTIME_ENV_OVERRIDES` > `INJECTED_VARS`.
+static RUNTIME_ENV_OVERRIDES: OnceLock<Mutex<HashMap<String, String>>> = OnceLock::new();
+
+fn runtime_overrides() -> &'static Mutex<HashMap<String, String>> {
+    RUNTIME_ENV_OVERRIDES.get_or_init(|| Mutex::new(HashMap::new()))
+}
+
+/// Set a runtime environment override (thread-safe alternative to `std::env::set_var`).
+///
+/// Values set here are visible to `optional_env()`, `env_or_override()`, and
+/// all config resolution that goes through those helpers. This avoids the UB
+/// of `std::env::set_var` in multi-threaded programs.
+pub fn set_runtime_env(key: &str, value: &str) {
+    runtime_overrides()
+        .lock()
+        .unwrap_or_else(|e| e.into_inner())
+        .insert(key.to_string(), value.to_string());
+}
+
+/// Read an env var, checking the real environment first, then runtime overrides.
+///
+/// Priority: real env vars > runtime overrides > `INJECTED_VARS`.
+/// Empty values are treated as unset at every layer for consistency with
+/// `optional_env()`.
+///
+/// Use this instead of `std::env::var()` when the value might have been set
+/// via `set_runtime_env()` (e.g., `NEARAI_API_KEY` during interactive login).
+pub fn env_or_override(key: &str) -> Option<String> {
+    // Real env vars always win
+    if let Ok(val) = std::env::var(key)
+        && !val.is_empty()
+    {
+        return Some(val);
+    }
+
+    // Check runtime overrides (skip empty values for consistency with optional_env)
+    if let Some(val) = runtime_overrides()
+        .lock()
+        .unwrap_or_else(|e| e.into_inner())
+        .get(key)
+        .filter(|v| !v.is_empty())
+        .cloned()
+    {
+        return Some(val);
+    }
+
+    // Check INJECTED_VARS (secrets from DB, set once at startup)
+    if let Some(val) = INJECTED_VARS
+        .lock()
+        .unwrap_or_else(|e| e.into_inner())
+        .get(key)
+        .filter(|v| !v.is_empty())
+        .cloned()
+    {
+        return Some(val);
+    }
+
+    None
+}
+
 pub(crate) fn optional_env(key: &str) -> Result<Option<String>, ConfigError> {
     // Check real env vars first (always win over injected secrets)
     match std::env::var(key) {
@@ -24,6 +94,17 @@ pub(crate) fn optional_env(key: &str) -> Result<Option<String>, ConfigError> {
         }
     }
 
+    // Fall back to runtime overrides (set via set_runtime_env)
+    if let Some(val) = runtime_overrides()
+        .lock()
+        .unwrap_or_else(|e| e.into_inner())
+        .get(key)
+        .filter(|v| !v.is_empty())
+        .cloned()
+    {
+        return Ok(Some(val));
+    }
+
     // Fall back to thread-safe overlay (secrets injected from DB)
     if let Some(val) = INJECTED_VARS
         .lock()
@@ -94,3 +175,55 @@ pub(crate) fn parse_string_env(
 ) -> Result<String, ConfigError> {
     Ok(optional_env(key)?.unwrap_or_else(|| default.into()))
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn runtime_env_override_is_visible_to_env_or_override() {
+        // Use a unique key that won't collide with real env vars.
+        let key = "IRONCLAW_TEST_RUNTIME_OVERRIDE_42";
+
+        // Not set initially
+        assert!(env_or_override(key).is_none());
+
+        // Set via the thread-safe overlay
+        set_runtime_env(key, "test_value");
+
+        // Now visible
+        assert_eq!(env_or_override(key), Some("test_value".to_string()));
+    }
+
+    #[test]
+    fn runtime_env_override_is_visible_to_optional_env() {
+        let key = "IRONCLAW_TEST_OPTIONAL_ENV_OVERRIDE_42";
+
+        assert_eq!(optional_env(key).unwrap(), None);
+
+        set_runtime_env(key, "hello");
+
+        assert_eq!(optional_env(key).unwrap(), Some("hello".to_string()));
+    }
+
+    #[test]
+    fn real_env_var_takes_priority_over_runtime_override() {
+        let _guard = ENV_MUTEX.lock().unwrap();
+        let key = "IRONCLAW_TEST_ENV_PRIORITY_42";
+
+        // Set runtime override
+        set_runtime_env(key, "override_value");
+
+        // Set real env var (should win)
+        // SAFETY: test runs under ENV_MUTEX
+        unsafe { std::env::set_var(key, "real_value") };
+
+        assert_eq!(env_or_override(key), Some("real_value".to_string()));
+
+        // Clean up
+        unsafe { std::env::remove_var(key) };
+
+        // Now the runtime override is visible again
+        assert_eq!(env_or_override(key), Some("override_value".to_string()));
+    }
+}

src/config/llm.rs

@@ -5,173 +5,11 @@ use secrecy::SecretString;
 use crate::bootstrap::ironclaw_base_dir;
 use crate::config::helpers::{optional_env, parse_optional_env};
 use crate::error::ConfigError;
+use crate::llm::config::*;
 use crate::llm::registry::{ProviderProtocol, ProviderRegistry};
 use crate::llm::session::SessionConfig;
 use crate::settings::Settings;
 
-/// Sentinel value used as `api_key` when only an OAuth token is present.
-///
-/// When we only have an OAuth token the provider factory in `llm/mod.rs`
-/// checks for this value and routes to `AnthropicOAuthProvider`, so this
-/// placeholder is never sent over the wire.
-pub const OAUTH_PLACEHOLDER: &str = "oauth-placeholder";
-
-/// Prompt cache retention policy for Anthropic.
-///
-/// Controls Anthropic's automatic prompt caching via a top-level
-/// `cache_control` field injected through rig-core's `additional_params`.
-/// - `None` — caching disabled, no `cache_control` injected.
-/// - `Short` — 5-minute TTL (default), `{"type": "ephemeral"}`, 1.25× write surcharge.
-/// - `Long` — 1-hour TTL, `{"type": "ephemeral", "ttl": "1h"}`, 2× write surcharge.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
-pub enum CacheRetention {
-    /// No prompt caching.
-    None,
-    /// 5-minute TTL (default). Write cost: 1.25× base input.
-    #[default]
-    Short,
-    /// 1-hour TTL. Write cost: 2× base input.
-    Long,
-}
-
-impl std::str::FromStr for CacheRetention {
-    type Err = String;
-
-    fn from_str(s: &str) -> Result<Self, Self::Err> {
-        match s.to_lowercase().as_str() {
-            "none" | "off" | "disabled" => Ok(Self::None),
-            "short" | "5m" | "ephemeral" => Ok(Self::Short),
-            "long" | "1h" => Ok(Self::Long),
-            _ => Err(format!(
-                "invalid cache retention '{}', expected one of: none, short, long",
-                s
-            )),
-        }
-    }
-}
-
-impl std::fmt::Display for CacheRetention {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            Self::None => write!(f, "none"),
-            Self::Short => write!(f, "short"),
-            Self::Long => write!(f, "long"),
-        }
-    }
-}
-
-/// Resolved configuration for a registry-based provider.
-///
-/// This single struct replaces what used to be five separate config types
-/// (`OpenAiDirectConfig`, `AnthropicDirectConfig`, `OllamaConfig`,
-/// `OpenAiCompatibleConfig`, `TinfoilConfig`). The `protocol` field
-/// determines which rig-core client constructor to use.
-#[derive(Debug, Clone)]
-pub struct RegistryProviderConfig {
-    /// Which API protocol to use (determines the rig-core client).
-    pub protocol: ProviderProtocol,
-    /// Provider identifier (e.g., "groq", "openai", "tinfoil").
-    pub provider_id: String,
-    /// API key (optional for some providers like Ollama).
-    /// For Anthropic OAuth, this is set to `OAUTH_PLACEHOLDER`.
-    pub api_key: Option<SecretString>,
-    /// Base URL for the API endpoint.
-    pub base_url: String,
-    /// Model identifier.
-    pub model: String,
-    /// Extra HTTP headers injected into every request.
-    pub extra_headers: Vec<(String, String)>,
-    /// OAuth token for providers that support Bearer auth (e.g. Anthropic via `claude login`).
-    /// When set, the provider factory routes to the OAuth-specific provider implementation.
-    pub oauth_token: Option<SecretString>,
-}
-
-/// Configuration for AWS Bedrock (native Converse API).
-#[derive(Debug, Clone)]
-pub struct BedrockConfig {
-    /// AWS region (e.g. "us-east-1").
-    pub region: String,
-    /// Bedrock model ID (e.g. "anthropic.claude-opus-4-6-v1").
-    pub model: String,
-    /// Cross-region inference prefix: "us", "eu", "apac", "global", or None.
-    pub cross_region: Option<String>,
-    /// AWS named profile (for SSO / assume-role workflows).
-    pub profile: Option<String>,
-}
-
-/// LLM provider configuration.
-///
-/// NearAI remains the default backend with its own config struct (session auth).
-/// All other providers are resolved through the provider registry, producing
-/// a generic `RegistryProviderConfig`.
-#[derive(Debug, Clone)]
-pub struct LlmConfig {
-    /// Backend identifier (e.g., "nearai", "openai", "groq", "tinfoil").
-    pub backend: String,
-    /// Session manager configuration (auth URL, token persistence path).
-    /// Used by the NearAI provider for OAuth/session-token auth.
-    pub session: SessionConfig,
-    /// NEAR AI config (always populated, also used for embeddings).
-    pub nearai: NearAiConfig,
-    /// Resolved provider config for registry-based providers.
-    /// `None` when backend is "nearai" or "bedrock".
-    pub provider: Option<RegistryProviderConfig>,
-    /// AWS Bedrock config (populated when backend=bedrock, requires --features bedrock).
-    pub bedrock: Option<BedrockConfig>,
-    /// Gemini OAuth config (populated when backend=gemini_oauth)
-    pub gemini_oauth: Option<GeminiOauthConfig>,
-    /// HTTP request timeout in seconds for LLM API calls.
-    pub request_timeout_secs: u64,
-}
-
-/// Configuration for Gemini OAuth integration.
-#[derive(Debug, Clone)]
-pub struct GeminiOauthConfig {
-    pub model: String,
-    pub credentials_path: PathBuf,
-}
-
-impl GeminiOauthConfig {
-    pub fn default_credentials_path() -> PathBuf {
-        dirs::home_dir()
-            .unwrap_or_else(|| PathBuf::from("."))
-            .join(".gemini")
-            .join("oauth_creds.json")
-    }
-}
-
-/// NEAR AI configuration.
-#[derive(Debug, Clone)]
-pub struct NearAiConfig {
-    /// Model to use (e.g., "claude-3-5-sonnet-20241022", "gpt-4o")
-    pub model: String,
-    /// Cheap/fast model for lightweight tasks (heartbeat, routing, evaluation).
-    pub cheap_model: Option<String>,
-    /// Base URL for the NEAR AI API.
-    pub base_url: String,
-    /// API key for NEAR AI Cloud.
-    pub api_key: Option<SecretString>,
-    /// Optional fallback model for failover.
-    pub fallback_model: Option<String>,
-    /// Maximum number of retries for transient errors (default: 3).
-    pub max_retries: u32,
-    /// Consecutive failures before circuit breaker opens. None = disabled.
-    pub circuit_breaker_threshold: Option<u32>,
-    /// Seconds the circuit stays open before probing (default: 30).
-    pub circuit_breaker_recovery_secs: u64,
-    /// Enable in-memory response caching. Default: false.
-    pub response_cache_enabled: bool,
-    /// TTL in seconds for cached responses (default: 3600).
-    pub response_cache_ttl_secs: u64,
-    /// Max cached responses before LRU eviction (default: 1000).
-    pub response_cache_max_entries: usize,
-    /// Cooldown duration in seconds for failover (default: 300).
-    pub failover_cooldown_secs: u64,
-    /// Consecutive failures before failover cooldown (default: 3).
-    pub failover_cooldown_threshold: u32,
-    /// Enable cascade mode for smart routing. Default: true.
-    pub smart_routing_cascade: bool,
-}
 
 impl LlmConfig {
     /// Create a test-friendly config without reading env vars.
@@ -203,6 +41,8 @@ impl LlmConfig {
             bedrock: None,
             gemini_oauth: None,
             request_timeout_secs: 120,
+            cheap_model: None,
+            smart_routing_cascade: false,
         }
     }
 
@@ -346,6 +186,14 @@ impl LlmConfig {
             None
         };
 
+        // Generic cheap model (works with any backend).
+        // Falls back to NearAI-specific cheap_model in provider chain logic.
+        let cheap_model = optional_env("LLM_CHEAP_MODEL")?;
+
+        // Generic smart routing cascade flag.
+        // Defaults to true. Overrides NearAI-specific smart_routing_cascade.
+        let smart_routing_cascade = parse_optional_env("SMART_ROUTING_CASCADE", true)?;
+
         Ok(Self {
             backend: if is_nearai {
                 "nearai".to_string()
@@ -362,6 +210,8 @@ impl LlmConfig {
             bedrock,
             gemini_oauth,
             request_timeout_secs,
+            cheap_model,
+            smart_routing_cascade,
         })
     }
 
@@ -387,6 +237,7 @@ impl LlmConfig {
             extra_headers_env,
             api_key_required,
             base_url_required,
+            unsupported_params,
         ) = if let Some(def) = def {
             (
                 def.id.as_str(),
@@ -399,6 +250,7 @@ impl LlmConfig {
                 def.extra_headers_env.as_deref(),
                 def.api_key_required,
                 def.base_url_required,
+                def.unsupported_params.clone(),
             )
         } else {
             // Absolute fallback: treat as generic openai_completions
@@ -413,11 +265,34 @@ impl LlmConfig {
                 Some("LLM_EXTRA_HEADERS"),
                 false,
                 true,
+                Vec::new(),
             )
         };
 
-        // Resolve API key from env
-        let api_key = if let Some(env_var) = api_key_env {
+        // Codex auth.json override: when LLM_USE_CODEX_AUTH=true,
+        // credentials from the Codex CLI's auth.json take highest priority
+        // (over env vars AND secrets store). In ChatGPT mode, the base URL
+        // is also overridden to the private ChatGPT backend endpoint.
+        let mut codex_base_url_override: Option<String> = None;
+        let codex_creds = if parse_optional_env("LLM_USE_CODEX_AUTH", false)? {
+            let path = optional_env("CODEX_AUTH_PATH")?
+                .map(std::path::PathBuf::from)
+                .unwrap_or_else(crate::llm::codex_auth::default_codex_auth_path);
+            crate::llm::codex_auth::load_codex_credentials(&path)
+        } else {
+            None
+        };
+
+        let codex_refresh_token = codex_creds.as_ref().and_then(|c| c.refresh_token.clone());
+        let codex_auth_path = codex_creds.as_ref().and_then(|c| c.auth_path.clone());
+
+        let api_key = if let Some(creds) = codex_creds {
+            if creds.is_chatgpt_mode {
+                codex_base_url_override = Some(creds.base_url().to_string());
+            }
+            Some(creds.token)
+        } else if let Some(env_var) = api_key_env {
+            // Resolve API key from env (including secrets store overlay)
             optional_env(env_var)?.map(SecretString::from)
         } else {
             None
@@ -434,22 +309,28 @@ impl LlmConfig {
             }
         }
 
-        // Resolve base URL: env var > settings (backward compat) > registry default
-        let base_url = if let Some(env_var) = base_url_env {
-            optional_env(env_var)?
-        } else {
-            None
-        }
-        .or_else(|| {
-            // Backward compat: check legacy settings fields
-            match backend {
-                "ollama" => settings.ollama_base_url.clone(),
-                "openai_compatible" | "openrouter" => settings.openai_compatible_base_url.clone(),
-                _ => None,
-            }
-        })
-        .or_else(|| default_base_url.map(String::from))
-        .unwrap_or_default();
+        // Resolve base URL: codex override > env var > settings (backward compat) > registry default
+        let is_codex_chatgpt = codex_base_url_override.is_some();
+        let base_url = codex_base_url_override
+            .or_else(|| {
+                if let Some(env_var) = base_url_env {
+                    optional_env(env_var).ok().flatten()
+                } else {
+                    None
+                }
+            })
+            .or_else(|| {
+                // Backward compat: check legacy settings fields
+                match backend {
+                    "ollama" => settings.ollama_base_url.clone(),
+                    "openai_compatible" | "openrouter" => {
+                        settings.openai_compatible_base_url.clone()
+                    }
+                    _ => None,
+                }
+            })
+            .or_else(|| default_base_url.map(String::from))
+            .unwrap_or_default();
 
         if base_url_required
             && base_url.is_empty()
@@ -490,6 +371,23 @@ impl LlmConfig {
             api_key
         };
 
+        // Resolve Anthropic prompt cache retention from env (default: Short).
+        let cache_retention: CacheRetention = if canonical_id == "anthropic" {
+            optional_env("ANTHROPIC_CACHE_RETENTION")?
+                .and_then(|val| match val.parse::<CacheRetention>() {
+                    Ok(r) => Some(r),
+                    Err(e) => {
+                        tracing::warn!(
+                            "Invalid ANTHROPIC_CACHE_RETENTION: {e}; defaulting to short"
+                        );
+                        None
+                    }
+                })
+                .unwrap_or_default()
+        } else {
+            CacheRetention::default()
+        };
+
         Ok(RegistryProviderConfig {
             protocol,
             provider_id: canonical_id.to_string(),
@@ -498,6 +396,11 @@ impl LlmConfig {
             model,
             extra_headers,
             oauth_token,
+            is_codex_chatgpt,
+            refresh_token: codex_refresh_token,
+            auth_path: codex_auth_path,
+            cache_retention,
+            unsupported_params,
         })
     }
 }
@@ -536,7 +439,7 @@ fn parse_extra_headers(val: &str) -> Result<Vec<(String, String)>, ConfigError>
 }
 
 /// Get the default session file path (~/.ironclaw/session.json).
-fn default_session_path() -> PathBuf {
+pub fn default_session_path() -> PathBuf {
     ironclaw_base_dir().join("session.json")
 }
 
@@ -545,6 +448,7 @@ mod tests {
     use super::*;
     use crate::config::helpers::ENV_MUTEX;
     use crate::settings::Settings;
+    use crate::testing::credentials::*;
 
     /// Clear all openai-compatible-related env vars.
     fn clear_openai_compatible_env() {
@@ -784,6 +688,37 @@ mod tests {
         let provider = cfg.provider.expect("provider config should be present");
         assert_eq!(provider.base_url, "https://inference.tinfoil.sh/v1");
         assert_eq!(provider.model, "kimi-k2-5");
+        assert!(
+            provider
+                .unsupported_params
+                .contains(&"temperature".to_string()),
+            "tinfoil should propagate unsupported_params from registry"
+        );
+    }
+
+    #[test]
+    fn registry_provider_alias_resolves_zai() {
+        let _guard = ENV_MUTEX.lock().expect("env mutex poisoned");
+        // SAFETY: Under ENV_MUTEX.
+        unsafe {
+            std::env::remove_var("LLM_BACKEND");
+            std::env::remove_var("ZAI_API_KEY");
+            std::env::remove_var("ZAI_MODEL");
+        }
+
+        let settings = Settings {
+            llm_backend: Some("bigmodel".to_string()),
+            selected_model: Some("glm-5".to_string()),
+            ..Default::default()
+        };
+
+        let cfg = LlmConfig::resolve(&settings).expect("resolve should succeed");
+        assert_eq!(cfg.backend, "zai");
+        let provider = cfg.provider.expect("provider config should be present");
+        assert_eq!(provider.provider_id, "zai");
+        assert_eq!(provider.model, "glm-5");
+        assert_eq!(provider.base_url, "https://api.z.ai/api/paas/v4");
+        assert_eq!(provider.protocol, ProviderProtocol::OpenAiCompletions);
     }
 
     #[test]
@@ -807,7 +742,7 @@ mod tests {
         // SAFETY: Under ENV_MUTEX.
         unsafe {
             std::env::set_var("LLM_BACKEND", "open_ai");
-            std::env::set_var("OPENAI_API_KEY", "test-key");
+            std::env::set_var("OPENAI_API_KEY", TEST_API_KEY);
         }
 
         let settings = Settings::default();
@@ -941,7 +876,7 @@ mod tests {
         clear_anthropic_env();
         // SAFETY: Under ENV_MUTEX.
         unsafe {
-            std::env::set_var("ANTHROPIC_OAUTH_TOKEN", "sk-ant-oat01-test-token");
+            std::env::set_var("ANTHROPIC_OAUTH_TOKEN", TEST_ANTHROPIC_OAUTH_TOKEN);
         }
 
         let settings = Settings {
@@ -965,7 +900,7 @@ mod tests {
         );
         assert_eq!(
             provider.oauth_token.as_ref().unwrap().expose_secret(),
-            "sk-ant-oat01-test-token"
+            TEST_ANTHROPIC_OAUTH_TOKEN
         );
 
         clear_anthropic_env();
@@ -979,8 +914,8 @@ mod tests {
         clear_anthropic_env();
         // SAFETY: Under ENV_MUTEX.
         unsafe {
-            std::env::set_var("ANTHROPIC_API_KEY", "sk-ant-real-key");
-            std::env::set_var("ANTHROPIC_OAUTH_TOKEN", "sk-ant-oat01-test-token");
+            std::env::set_var("ANTHROPIC_API_KEY", TEST_ANTHROPIC_API_KEY);
+            std::env::set_var("ANTHROPIC_OAUTH_TOKEN", TEST_ANTHROPIC_OAUTH_TOKEN);
         }
 
         let settings = Settings {
@@ -995,7 +930,7 @@ mod tests {
                 .api_key
                 .as_ref()
                 .map(|k| k.expose_secret().to_string()),
-            Some("sk-ant-real-key".to_string()),
+            Some(TEST_ANTHROPIC_API_KEY.to_string()),
             "real API key should take priority over OAuth placeholder"
         );
         assert!(
@@ -1012,7 +947,7 @@ mod tests {
         clear_anthropic_env();
         // SAFETY: Under ENV_MUTEX.
         unsafe {
-            std::env::set_var("ANTHROPIC_OAUTH_TOKEN", "sk-ant-oat01-test-token");
+            std::env::set_var("ANTHROPIC_OAUTH_TOKEN", TEST_ANTHROPIC_OAUTH_TOKEN);
         }
 
         let settings = Settings {

src/config/mod.rs

@@ -14,9 +14,11 @@ mod heartbeat;
 pub(crate) mod helpers;
 mod hygiene;
 pub(crate) mod llm;
+pub mod relay;
 mod routines;
 mod safety;
 mod sandbox;
+mod search;
 mod secrets;
 mod skills;
 mod transcription;
@@ -24,7 +26,7 @@ mod tunnel;
 mod wasm;
 
 use std::collections::HashMap;
-use std::sync::{LazyLock, Mutex};
+use std::sync::{LazyLock, Mutex, Once};
 
 use crate::error::ConfigError;
 use crate::settings::Settings;
@@ -32,25 +34,35 @@ use crate::settings::Settings;
 // Re-export all public types so `crate::config::FooConfig` continues to work.
 pub use self::agent::AgentConfig;
 pub use self::builder::BuilderModeConfig;
-pub use self::channels::{ChannelsConfig, CliConfig, GatewayConfig, HttpConfig, SignalConfig};
+pub use self::channels::{
+    ChannelsConfig, CliConfig, DEFAULT_GATEWAY_PORT, GatewayConfig, HttpConfig, SignalConfig,
+};
 pub use self::database::{DatabaseBackend, DatabaseConfig, SslMode, default_libsql_path};
 pub use self::embeddings::EmbeddingsConfig;
 pub use self::heartbeat::HeartbeatConfig;
 pub use self::hygiene::HygieneConfig;
-pub use self::llm::{
-    BedrockConfig, CacheRetention, GeminiOauthConfig, LlmConfig, NearAiConfig,
-    RegistryProviderConfig,
-};
+pub use self::llm::default_session_path;
+pub use self::relay::RelayConfig;
 pub use self::routines::RoutineConfig;
 pub use self::safety::SafetyConfig;
+use self::safety::resolve_safety_config;
 pub use self::sandbox::{ClaudeCodeConfig, SandboxModeConfig};
+pub use self::search::WorkspaceSearchConfig;
 pub use self::secrets::SecretsConfig;
 pub use self::skills::SkillsConfig;
 pub use self::transcription::TranscriptionConfig;
 pub use self::tunnel::TunnelConfig;
 pub use self::wasm::WasmConfig;
+pub use crate::llm::config::{
+    BedrockConfig, CacheRetention, GeminiOauthConfig, LlmConfig, NearAiConfig, OAUTH_PLACEHOLDER,
+    RegistryProviderConfig,
+};
 pub use crate::llm::session::SessionConfig;
 
+// Thread-safe env var override helpers (replaces unsafe `std::env::set_var`
+// for mid-process env mutations in multi-threaded contexts).
+pub use self::helpers::{env_or_override, set_runtime_env};
+
 /// Thread-safe overlay for injected env vars (secrets loaded from DB).
 ///
 /// Used by `inject_llm_keys_from_secrets()` to make API keys available to
@@ -62,10 +74,12 @@ pub use crate::llm::session::SessionConfig;
 /// their data. Whichever runs first initialises the map; the second merges in.
 static INJECTED_VARS: LazyLock<Mutex<HashMap<String, String>>> =
     LazyLock::new(|| Mutex::new(HashMap::new()));
+static WARNED_EXPLICIT_DEFAULT_OWNER_ID: Once = Once::new();
 
 /// Main configuration for the agent.
 #[derive(Debug, Clone)]
 pub struct Config {
+    pub owner_id: String,
     pub database: DatabaseConfig,
     pub llm: LlmConfig,
     pub embeddings: EmbeddingsConfig,
@@ -83,7 +97,11 @@ pub struct Config {
     pub claude_code: ClaudeCodeConfig,
     pub skills: SkillsConfig,
     pub transcription: TranscriptionConfig,
+    pub search: WorkspaceSearchConfig,
     pub observability: crate::observability::ObservabilityConfig,
+    /// Channel-relay integration (Slack via external relay service).
+    /// Present only when both `CHANNEL_RELAY_URL` and `CHANNEL_RELAY_API_KEY` are set.
+    pub relay: Option<RelayConfig>,
 }
 
 impl Config {
@@ -102,6 +120,7 @@ impl Config {
         installed_skills_dir: std::path::PathBuf,
     ) -> Self {
         Self {
+            owner_id: "default".to_string(),
             database: DatabaseConfig {
                 backend: DatabaseBackend::LibSql,
                 url: secrecy::SecretString::from("unused://test".to_string()),
@@ -155,7 +174,9 @@ impl Config {
                 ..SkillsConfig::default()
             },
             transcription: TranscriptionConfig::default(),
+            search: WorkspaceSearchConfig::default(),
             observability: crate::observability::ObservabilityConfig::default(),
+            relay: None,
         }
     }
 
@@ -210,13 +231,7 @@ impl Config {
     pub async fn from_env_with_toml(
         toml_path: Option<&std::path::Path>,
     ) -> Result<Self, ConfigError> {
-        let _ = dotenvy::dotenv();
-        crate::bootstrap::load_ironclaw_env();
-        let mut settings = Settings::load();
-
-        // Overlay TOML config file (values win over JSON settings)
-        Self::apply_toml_overlay(&mut settings, toml_path)?;
-
+        let settings = load_bootstrap_settings(toml_path)?;
         Self::build(&settings).await
     }
 
@@ -288,31 +303,73 @@ impl Config {
 
     /// Build config from settings (shared by from_env and from_db).
     async fn build(settings: &Settings) -> Result<Self, ConfigError> {
+        let owner_id = resolve_owner_id(settings)?;
+
         Ok(Self {
+            owner_id: owner_id.clone(),
             database: DatabaseConfig::resolve()?,
             llm: LlmConfig::resolve(settings)?,
             embeddings: EmbeddingsConfig::resolve(settings)?,
             tunnel: TunnelConfig::resolve(settings)?,
-            channels: ChannelsConfig::resolve(settings)?,
+            channels: ChannelsConfig::resolve(settings, &owner_id)?,
             agent: AgentConfig::resolve(settings)?,
-            safety: SafetyConfig::resolve()?,
-            wasm: WasmConfig::resolve()?,
+            safety: resolve_safety_config(settings)?,
+            wasm: WasmConfig::resolve(settings)?,
             secrets: SecretsConfig::resolve().await?,
-            builder: BuilderModeConfig::resolve()?,
+            builder: BuilderModeConfig::resolve(settings)?,
             heartbeat: HeartbeatConfig::resolve(settings)?,
             hygiene: HygieneConfig::resolve()?,
             routines: RoutineConfig::resolve()?,
-            sandbox: SandboxModeConfig::resolve()?,
-            claude_code: ClaudeCodeConfig::resolve()?,
+            sandbox: SandboxModeConfig::resolve(settings)?,
+            claude_code: ClaudeCodeConfig::resolve(settings)?,
             skills: SkillsConfig::resolve()?,
             transcription: TranscriptionConfig::resolve(settings)?,
+            search: WorkspaceSearchConfig::resolve()?,
             observability: crate::observability::ObservabilityConfig {
                 backend: std::env::var("OBSERVABILITY_BACKEND").unwrap_or_else(|_| "none".into()),
             },
+            relay: RelayConfig::from_env(),
         })
     }
 }
 
+pub(crate) fn load_bootstrap_settings(
+    toml_path: Option<&std::path::Path>,
+) -> Result<Settings, ConfigError> {
+    let _ = dotenvy::dotenv();
+    crate::bootstrap::load_ironclaw_env();
+
+    let mut settings = Settings::load();
+    Config::apply_toml_overlay(&mut settings, toml_path)?;
+    Ok(settings)
+}
+
+pub(crate) fn resolve_owner_id(settings: &Settings) -> Result<String, ConfigError> {
+    let env_owner_id = self::helpers::optional_env("IRONCLAW_OWNER_ID")?;
+    let settings_owner_id = settings.owner_id.clone();
+    let configured_owner_id = env_owner_id.clone().or(settings_owner_id.clone());
+
+    let owner_id = configured_owner_id
+        .map(|value| value.trim().to_string())
+        .filter(|value| !value.is_empty())
+        .unwrap_or_else(|| "default".to_string());
+
+    if owner_id == "default"
+        && (env_owner_id.is_some()
+            || settings_owner_id
+                .as_deref()
+                .is_some_and(|value| !value.trim().is_empty()))
+    {
+        WARNED_EXPLICIT_DEFAULT_OWNER_ID.call_once(|| {
+            tracing::warn!(
+                "IRONCLAW_OWNER_ID resolved to the legacy 'default' scope explicitly; durable state will keep legacy owner behavior"
+            );
+        });
+    }
+
+    Ok(owner_id)
+}
+
 /// Load API keys from the encrypted secrets store into a thread-safe overlay.
 ///
 /// This bridges the gap between secrets stored during onboarding and the

src/config/relay.rs

@@ -0,0 +1,157 @@
+//! Channel-relay service configuration.
+
+use secrecy::SecretString;
+
+/// Configuration for connecting to a channel-relay service.
+#[derive(Clone)]
+pub struct RelayConfig {
+    /// Base URL of the channel-relay service (e.g., `http://localhost:3001`).
+    pub url: String,
+    /// API key for authenticated channel-relay endpoints.
+    pub api_key: SecretString,
+    /// Override for the OAuth callback URL (e.g., a tunnel URL).
+    pub callback_url: Option<String>,
+    /// Override for the instance identifier.
+    pub instance_id: Option<String>,
+    /// HTTP request timeout in seconds (default: 30).
+    pub request_timeout_secs: u64,
+    /// SSE stream long-poll timeout in seconds (default: 86400 = 24 h).
+    pub stream_timeout_secs: u64,
+    /// Initial exponential backoff in milliseconds (default: 1000).
+    pub backoff_initial_ms: u64,
+    /// Maximum exponential backoff in milliseconds (default: 60000).
+    pub backoff_max_ms: u64,
+}
+
+impl std::fmt::Debug for RelayConfig {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("RelayConfig")
+            .field("url", &self.url)
+            .field("api_key", &"[REDACTED]")
+            .field("callback_url", &self.callback_url)
+            .field("instance_id", &self.instance_id)
+            .field("request_timeout_secs", &self.request_timeout_secs)
+            .field("stream_timeout_secs", &self.stream_timeout_secs)
+            .field("backoff_initial_ms", &self.backoff_initial_ms)
+            .field("backoff_max_ms", &self.backoff_max_ms)
+            .finish()
+    }
+}
+
+impl RelayConfig {
+    /// Load relay config from environment variables.
+    ///
+    /// Returns `None` if either `CHANNEL_RELAY_URL` or `CHANNEL_RELAY_API_KEY`
+    /// is not set, making the relay integration opt-in.
+    pub fn from_env() -> Option<Self> {
+        Self::from_env_reader(|key| std::env::var(key).ok())
+    }
+
+    /// Build a config for tests without touching the process environment.
+    pub fn from_values(url: impl Into<String>, api_key: impl Into<String>) -> Self {
+        Self {
+            url: url.into(),
+            api_key: SecretString::from(api_key.into()),
+            callback_url: None,
+            instance_id: None,
+            request_timeout_secs: 30,
+            stream_timeout_secs: 86400,
+            backoff_initial_ms: 1000,
+            backoff_max_ms: 60000,
+        }
+    }
+
+    /// Internal constructor that reads values through a closure, enabling safe testing.
+    fn from_env_reader(env: impl Fn(&str) -> Option<String>) -> Option<Self> {
+        let url = env("CHANNEL_RELAY_URL")?;
+        let api_key = SecretString::from(env("CHANNEL_RELAY_API_KEY")?);
+        Some(Self {
+            url,
+            api_key,
+            callback_url: env("IRONCLAW_OAUTH_CALLBACK_URL"),
+            instance_id: env("IRONCLAW_INSTANCE_ID"),
+            request_timeout_secs: env("RELAY_REQUEST_TIMEOUT_SECS")
+                .and_then(|v| v.parse().ok())
+                .unwrap_or(30),
+            stream_timeout_secs: env("RELAY_STREAM_TIMEOUT_SECS")
+                .and_then(|v| v.parse().ok())
+                .unwrap_or(86400),
+            backoff_initial_ms: env("RELAY_BACKOFF_INITIAL_MS")
+                .and_then(|v| v.parse().ok())
+                .unwrap_or(1000),
+            backoff_max_ms: env("RELAY_BACKOFF_MAX_MS")
+                .and_then(|v| v.parse().ok())
+                .unwrap_or(60000),
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn from_env_reader_returns_none_when_unset() {
+        let config = RelayConfig::from_env_reader(|_| None);
+        assert!(config.is_none());
+    }
+
+    #[test]
+    fn from_env_reader_loads_defaults() {
+        let config = RelayConfig::from_env_reader(|key| match key {
+            "CHANNEL_RELAY_URL" => Some("http://localhost:3001".into()),
+            "CHANNEL_RELAY_API_KEY" => Some("test-key".into()),
+            _ => None,
+        })
+        .expect("config should be Some");
+
+        assert_eq!(config.url, "http://localhost:3001");
+        assert_eq!(config.request_timeout_secs, 30);
+        assert_eq!(config.stream_timeout_secs, 86400);
+        assert_eq!(config.backoff_initial_ms, 1000);
+        assert_eq!(config.backoff_max_ms, 60000);
+        assert!(config.callback_url.is_none());
+        assert!(config.instance_id.is_none());
+    }
+
+    #[test]
+    fn from_env_reader_loads_overrides() {
+        let config = RelayConfig::from_env_reader(|key| match key {
+            "CHANNEL_RELAY_URL" => Some("http://relay:3001".into()),
+            "CHANNEL_RELAY_API_KEY" => Some("secret".into()),
+            "IRONCLAW_OAUTH_CALLBACK_URL" => Some("https://tunnel.example.com".into()),
+            "IRONCLAW_INSTANCE_ID" => Some("my-instance".into()),
+            "RELAY_REQUEST_TIMEOUT_SECS" => Some("60".into()),
+            "RELAY_STREAM_TIMEOUT_SECS" => Some("43200".into()),
+            "RELAY_BACKOFF_INITIAL_MS" => Some("2000".into()),
+            "RELAY_BACKOFF_MAX_MS" => Some("120000".into()),
+            _ => None,
+        })
+        .expect("config should be Some");
+
+        assert_eq!(
+            config.callback_url.as_deref(),
+            Some("https://tunnel.example.com")
+        );
+        assert_eq!(config.instance_id.as_deref(), Some("my-instance"));
+        assert_eq!(config.request_timeout_secs, 60);
+        assert_eq!(config.stream_timeout_secs, 43200);
+        assert_eq!(config.backoff_initial_ms, 2000);
+        assert_eq!(config.backoff_max_ms, 120000);
+    }
+
+    #[test]
+    fn from_values_builds_with_defaults() {
+        let config = RelayConfig::from_values("http://localhost:3001", "key");
+        assert_eq!(config.url, "http://localhost:3001");
+        assert_eq!(config.request_timeout_secs, 30);
+    }
+
+    #[test]
+    fn debug_redacts_api_key() {
+        let config = RelayConfig::from_values("http://localhost:3001", "super-secret");
+        let debug = format!("{:?}", config);
+        assert!(debug.contains("[REDACTED]"));
+        assert!(!debug.contains("super-secret"));
+    }
+}

src/config/routines.rs

@@ -14,6 +14,10 @@ pub struct RoutineConfig {
     pub default_cooldown_secs: u64,
     /// Max output tokens for lightweight routine LLM calls.
     pub max_lightweight_tokens: u32,
+    /// Enable tool execution in lightweight routines (default: true).
+    pub lightweight_tools_enabled: bool,
+    /// Max tool iterations for lightweight routines (default: 3, max: 5).
+    pub lightweight_max_iterations: u32,
 }
 
 impl Default for RoutineConfig {
@@ -24,18 +28,23 @@ impl Default for RoutineConfig {
             max_concurrent_routines: 10,
             default_cooldown_secs: 300,
             max_lightweight_tokens: 4096,
+            lightweight_tools_enabled: true,
+            lightweight_max_iterations: 3,
         }
     }
 }
 
 impl RoutineConfig {
     pub(crate) fn resolve() -> Result<Self, ConfigError> {
+        let max_iterations: u32 = parse_optional_env("ROUTINES_LIGHTWEIGHT_MAX_ITERATIONS", 3)?;
         Ok(Self {
             enabled: parse_bool_env("ROUTINES_ENABLED", true)?,
             cron_check_interval_secs: parse_optional_env("ROUTINES_CRON_INTERVAL", 15)?,
             max_concurrent_routines: parse_optional_env("ROUTINES_MAX_CONCURRENT", 10)?,
             default_cooldown_secs: parse_optional_env("ROUTINES_DEFAULT_COOLDOWN", 300)?,
             max_lightweight_tokens: parse_optional_env("ROUTINES_MAX_TOKENS", 4096)?,
+            lightweight_tools_enabled: parse_bool_env("ROUTINES_LIGHTWEIGHT_TOOLS", true)?,
+            lightweight_max_iterations: max_iterations.min(5), // cap at 5
         })
     }
 }

src/config/safety.rs

@@ -1,18 +1,50 @@
 use crate::config::helpers::{parse_bool_env, parse_optional_env};
 use crate::error::ConfigError;
 
-/// Safety configuration.
-#[derive(Debug, Clone)]
-pub struct SafetyConfig {
-    pub max_output_length: usize,
-    pub injection_check_enabled: bool,
+pub use ironclaw_safety::SafetyConfig;
+
+pub(crate) fn resolve_safety_config(
+    settings: &crate::settings::Settings,
+) -> Result<SafetyConfig, ConfigError> {
+    let ss = &settings.safety;
+    Ok(SafetyConfig {
+        max_output_length: parse_optional_env("SAFETY_MAX_OUTPUT_LENGTH", ss.max_output_length)?,
+        injection_check_enabled: parse_bool_env(
+            "SAFETY_INJECTION_CHECK_ENABLED",
+            ss.injection_check_enabled,
+        )?,
+    })
 }
 
-impl SafetyConfig {
-    pub(crate) fn resolve() -> Result<Self, ConfigError> {
-        Ok(Self {
-            max_output_length: parse_optional_env("SAFETY_MAX_OUTPUT_LENGTH", 100_000)?,
-            injection_check_enabled: parse_bool_env("SAFETY_INJECTION_CHECK_ENABLED", true)?,
-        })
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::config::helpers::ENV_MUTEX;
+    use crate::settings::Settings;
+
+    #[test]
+    fn resolve_falls_back_to_settings() {
+        let _guard = ENV_MUTEX.lock().expect("env mutex poisoned");
+        let mut settings = Settings::default();
+        settings.safety.max_output_length = 42;
+        settings.safety.injection_check_enabled = false;
+
+        let cfg = resolve_safety_config(&settings).expect("resolve");
+        assert_eq!(cfg.max_output_length, 42);
+        assert!(!cfg.injection_check_enabled);
+    }
+
+    #[test]
+    fn env_overrides_settings() {
+        let _guard = ENV_MUTEX.lock().expect("env mutex poisoned");
+        let mut settings = Settings::default();
+        settings.safety.max_output_length = 42;
+
+        // SAFETY: Under ENV_MUTEX, no concurrent env access.
+        unsafe { std::env::set_var("SAFETY_MAX_OUTPUT_LENGTH", "7") };
+        let cfg = resolve_safety_config(&settings).expect("resolve");
+        unsafe { std::env::remove_var("SAFETY_MAX_OUTPUT_LENGTH") };
+
+        assert_eq!(cfg.max_output_length, 7);
     }
 }

src/config/sandbox.rs

@@ -8,6 +8,13 @@ pub struct SandboxModeConfig {
     pub enabled: bool,
     /// Sandbox policy: "readonly", "workspace_write", or "full_access".
     pub policy: String,
+    /// Explicit opt-in for `FullAccess` policy.
+    ///
+    /// When `policy` is `full_access` but this is `false`, the policy is
+    /// downgraded to `workspace_write` with a loud error log. This prevents
+    /// accidental host-level command execution from a single misconfigured
+    /// env var.
+    pub allow_full_access: bool,
     /// Command timeout in seconds.
     pub timeout_secs: u64,
     /// Memory limit in megabytes.
@@ -20,6 +27,10 @@ pub struct SandboxModeConfig {
     pub auto_pull_image: bool,
     /// Additional domains to allow through the network proxy.
     pub extra_allowed_domains: Vec<String>,
+    /// How often the reaper scans for orphaned containers (seconds). Default: 300 (5 min).
+    pub reaper_interval_secs: u64,
+    /// Containers older than this with no active job are reaped (seconds). Default: 600 (10 min).
+    pub orphan_threshold_secs: u64,
 }
 
 impl Default for SandboxModeConfig {
@@ -27,40 +38,88 @@ impl Default for SandboxModeConfig {
         Self {
             enabled: true,
             policy: "readonly".to_string(),
+            allow_full_access: false,
             timeout_secs: 120,
             memory_limit_mb: 2048,
             cpu_shares: 1024,
             image: "ironclaw-worker:latest".to_string(),
             auto_pull_image: true,
             extra_allowed_domains: Vec::new(),
+            reaper_interval_secs: 300,
+            orphan_threshold_secs: 600,
         }
     }
 }
 
 impl SandboxModeConfig {
-    pub(crate) fn resolve() -> Result<Self, ConfigError> {
+    pub(crate) fn resolve(settings: &crate::settings::Settings) -> Result<Self, ConfigError> {
+        let ss = &settings.sandbox;
+
         let extra_domains = optional_env("SANDBOX_EXTRA_DOMAINS")?
             .map(|s| s.split(',').map(|d| d.trim().to_string()).collect())
-            .unwrap_or_default();
+            .unwrap_or_else(|| {
+                if ss.extra_allowed_domains.is_empty() {
+                    Vec::new()
+                } else {
+                    ss.extra_allowed_domains.clone()
+                }
+            });
+
+        // reaper/orphan fields have no Settings counterpart — env > default only.
+        let reaper_interval_secs: u64 = parse_optional_env("SANDBOX_REAPER_INTERVAL_SECS", 300)?;
+        let orphan_threshold_secs: u64 = parse_optional_env("SANDBOX_ORPHAN_THRESHOLD_SECS", 600)?;
+
+        // Validate that reaper timings are non-zero to prevent tokio::time::interval panics
+        if reaper_interval_secs == 0 {
+            return Err(ConfigError::InvalidValue {
+                key: "SANDBOX_REAPER_INTERVAL_SECS".to_string(),
+                message: "must be greater than 0".to_string(),
+            });
+        }
+
+        if orphan_threshold_secs == 0 {
+            return Err(ConfigError::InvalidValue {
+                key: "SANDBOX_ORPHAN_THRESHOLD_SECS".to_string(),
+                message: "must be greater than 0".to_string(),
+            });
+        }
 
         Ok(Self {
-            enabled: parse_bool_env("SANDBOX_ENABLED", true)?,
-            policy: parse_string_env("SANDBOX_POLICY", "readonly")?,
-            timeout_secs: parse_optional_env("SANDBOX_TIMEOUT_SECS", 120)?,
-            memory_limit_mb: parse_optional_env("SANDBOX_MEMORY_LIMIT_MB", 2048)?,
-            cpu_shares: parse_optional_env("SANDBOX_CPU_SHARES", 1024)?,
-            image: parse_string_env("SANDBOX_IMAGE", "ironclaw-worker:latest")?,
-            auto_pull_image: parse_bool_env("SANDBOX_AUTO_PULL", true)?,
+            enabled: parse_bool_env("SANDBOX_ENABLED", ss.enabled)?,
+            policy: parse_string_env("SANDBOX_POLICY", ss.policy.clone())?,
+            // allow_full_access has no Settings counterpart — env > default only.
+            allow_full_access: parse_bool_env("SANDBOX_ALLOW_FULL_ACCESS", false)?,
+            timeout_secs: parse_optional_env("SANDBOX_TIMEOUT_SECS", ss.timeout_secs)?,
+            memory_limit_mb: parse_optional_env("SANDBOX_MEMORY_LIMIT_MB", ss.memory_limit_mb)?,
+            cpu_shares: parse_optional_env("SANDBOX_CPU_SHARES", ss.cpu_shares)?,
+            image: parse_string_env("SANDBOX_IMAGE", ss.image.clone())?,
+            auto_pull_image: parse_bool_env("SANDBOX_AUTO_PULL", ss.auto_pull_image)?,
             extra_allowed_domains: extra_domains,
+            reaper_interval_secs,
+            orphan_threshold_secs,
         })
     }
 
     /// Convert to SandboxConfig for the sandbox module.
+    ///
+    /// If `policy` is `FullAccess` but `allow_full_access` is `false`,
+    /// the policy is downgraded to `WorkspaceWrite` and an error is logged.
     pub fn to_sandbox_config(&self) -> crate::sandbox::SandboxConfig {
         use crate::sandbox::SandboxPolicy;
         use std::time::Duration;
 
-        let policy = self.policy.parse().unwrap_or(SandboxPolicy::ReadOnly);
+        let mut policy = self.policy.parse().unwrap_or(SandboxPolicy::ReadOnly);
+
+        // Double opt-in guard: FullAccess requires SANDBOX_ALLOW_FULL_ACCESS=true
+        if policy == SandboxPolicy::FullAccess && !self.allow_full_access {
+            tracing::error!(
+                "SANDBOX_POLICY=full_access is set but SANDBOX_ALLOW_FULL_ACCESS is not \
+                 set to 'true'. FullAccess bypasses Docker and runs commands directly on \
+                 the host. Downgrading to WorkspaceWrite for safety. Set \
+                 SANDBOX_ALLOW_FULL_ACCESS=true to explicitly enable FullAccess."
+            );
+            policy = SandboxPolicy::WorkspaceWrite;
+        }
 
         let mut allowlist = crate::sandbox::default_allowlist();
         allowlist.extend(self.extra_allowed_domains.clone());
@@ -68,6 +127,7 @@ impl SandboxModeConfig {
         crate::sandbox::SandboxConfig {
             enabled: self.enabled,
             policy,
+            allow_full_access: self.allow_full_access,
             timeout: Duration::from_secs(self.timeout_secs),
             memory_limit_mb: self.memory_limit_mb,
             cpu_shares: self.cpu_shares,
@@ -150,7 +210,7 @@ impl ClaudeCodeConfig {
     /// Load from environment variables only (used inside containers where
     /// there is no database or full config).
     pub fn from_env() -> Self {
-        match Self::resolve() {
+        match Self::resolve_env_only() {
             Ok(c) => c,
             Err(e) => {
                 tracing::warn!("Failed to resolve ClaudeCodeConfig: {e}, using defaults");
@@ -203,7 +263,33 @@ impl ClaudeCodeConfig {
         None
     }
 
-    pub(crate) fn resolve() -> Result<Self, ConfigError> {
+    pub(crate) fn resolve(settings: &crate::settings::Settings) -> Result<Self, ConfigError> {
+        let defaults = Self::default();
+        Ok(Self {
+            // Use settings.sandbox.claude_code_enabled as fallback (written by setup wizard).
+            enabled: parse_bool_env("CLAUDE_CODE_ENABLED", settings.sandbox.claude_code_enabled)?,
+            config_dir: optional_env("CLAUDE_CONFIG_DIR")?
+                .map(std::path::PathBuf::from)
+                .unwrap_or(defaults.config_dir),
+            model: parse_string_env("CLAUDE_CODE_MODEL", defaults.model)?,
+            max_turns: parse_optional_env("CLAUDE_CODE_MAX_TURNS", defaults.max_turns)?,
+            memory_limit_mb: parse_optional_env(
+                "CLAUDE_CODE_MEMORY_LIMIT_MB",
+                defaults.memory_limit_mb,
+            )?,
+            allowed_tools: optional_env("CLAUDE_CODE_ALLOWED_TOOLS")?
+                .map(|s| {
+                    s.split(',')
+                        .map(|t| t.trim().to_string())
+                        .filter(|t| !t.is_empty())
+                        .collect()
+                })
+                .unwrap_or(defaults.allowed_tools),
+        })
+    }
+
+    /// Resolve from env vars only, no Settings. Used inside containers.
+    fn resolve_env_only() -> Result<Self, ConfigError> {
         let defaults = Self::default();
         Ok(Self {
             enabled: parse_bool_env("CLAUDE_CODE_ENABLED", defaults.enabled)?,
@@ -246,6 +332,7 @@ fn parse_oauth_access_token(json: &str) -> Option<String> {
 #[cfg(test)]
 mod tests {
     use crate::config::sandbox::*;
+    use crate::testing::credentials::*;
 
     // ── SandboxModeConfig defaults ──────────────────────────────────
 
@@ -273,6 +360,9 @@ mod tests {
             image: "custom-worker:v2".to_string(),
             auto_pull_image: false,
             extra_allowed_domains: vec!["example.com".to_string()],
+            reaper_interval_secs: 300,
+            orphan_threshold_secs: 600,
+            allow_full_access: false,
         };
         assert!(!cfg.enabled);
         assert_eq!(cfg.policy, "full_access");
@@ -295,6 +385,9 @@ mod tests {
             image: "test:latest".to_string(),
             auto_pull_image: false,
             extra_allowed_domains: vec!["custom.example.com".to_string()],
+            reaper_interval_secs: 300,
+            orphan_threshold_secs: 600,
+            allow_full_access: false,
         };
         let sc = mode.to_sandbox_config();
         assert!(sc.enabled);
@@ -375,9 +468,12 @@ mod tests {
 
     #[test]
     fn parse_oauth_token_valid() {
-        let json = r#"{"claudeAiOauth": {"accessToken": "sk-ant-oat01-fake"}}"#;
-        let token = parse_oauth_access_token(json);
-        assert_eq!(token, Some("sk-ant-oat01-fake".to_string()));
+        let json = format!(
+            r#"{{"claudeAiOauth": {{"accessToken": "{}"}}}}"#,
+            TEST_ANTHROPIC_OAUTH_BASIC
+        );
+        let token = parse_oauth_access_token(&json);
+        assert_eq!(token, Some(TEST_ANTHROPIC_OAUTH_BASIC.to_string()));
     }
 
     #[test]
@@ -404,16 +500,19 @@ mod tests {
 
     #[test]
     fn parse_oauth_token_nested_extra_fields() {
-        let json = r#"{
-            "claudeAiOauth": {
-                "accessToken": "sk-ant-oat01-real-token",
+        let json = format!(
+            r#"{{
+            "claudeAiOauth": {{
+                "accessToken": "{}",
                 "refreshToken": "rt-abc",
                 "expiresAt": 1700000000
-            }
-        }"#;
+            }}
+        }}"#,
+            TEST_ANTHROPIC_OAUTH_NESTED
+        );
         assert_eq!(
-            parse_oauth_access_token(json),
-            Some("sk-ant-oat01-real-token".to_string())
+            parse_oauth_access_token(&json),
+            Some(TEST_ANTHROPIC_OAUTH_NESTED.to_string())
         );
     }
 
@@ -448,4 +547,131 @@ mod tests {
             );
         }
     }
+
+    #[test]
+    fn test_full_access_downgraded_without_allow() {
+        let config = SandboxModeConfig {
+            policy: "full_access".to_string(),
+            allow_full_access: false,
+            ..Default::default()
+        };
+        let sandbox = config.to_sandbox_config();
+        // Should have been downgraded to WorkspaceWrite
+        assert_eq!(
+            sandbox.policy,
+            crate::sandbox::SandboxPolicy::WorkspaceWrite
+        );
+        assert!(!sandbox.allow_full_access);
+    }
+
+    #[test]
+    fn test_full_access_allowed_with_explicit_opt_in() {
+        let config = SandboxModeConfig {
+            policy: "full_access".to_string(),
+            allow_full_access: true,
+            ..Default::default()
+        };
+        let sandbox = config.to_sandbox_config();
+        assert_eq!(sandbox.policy, crate::sandbox::SandboxPolicy::FullAccess);
+        assert!(sandbox.allow_full_access);
+    }
+
+    #[test]
+    fn test_non_full_access_policy_unaffected() {
+        let config = SandboxModeConfig {
+            policy: "workspace_write".to_string(),
+            allow_full_access: false,
+            ..Default::default()
+        };
+        let sandbox = config.to_sandbox_config();
+        assert_eq!(
+            sandbox.policy,
+            crate::sandbox::SandboxPolicy::WorkspaceWrite
+        );
+    }
+
+    // ── Settings fallback tests ──────────────────────────────────────
+
+    #[test]
+    fn sandbox_resolve_falls_back_to_settings() {
+        let _guard = crate::config::helpers::ENV_MUTEX
+            .lock()
+            .expect("env mutex poisoned");
+        let mut settings = crate::settings::Settings::default();
+        settings.sandbox.cpu_shares = 99;
+        settings.sandbox.auto_pull_image = false;
+        settings.sandbox.enabled = false;
+
+        let cfg = SandboxModeConfig::resolve(&settings).expect("resolve");
+        assert!(!cfg.enabled);
+        assert_eq!(cfg.cpu_shares, 99);
+        assert!(!cfg.auto_pull_image);
+    }
+
+    #[test]
+    fn sandbox_env_overrides_settings() {
+        let _guard = crate::config::helpers::ENV_MUTEX
+            .lock()
+            .expect("env mutex poisoned");
+        let mut settings = crate::settings::Settings::default();
+        settings.sandbox.timeout_secs = 999;
+
+        // SAFETY: Under ENV_MUTEX, no concurrent env access.
+        unsafe { std::env::set_var("SANDBOX_TIMEOUT_SECS", "5") };
+        let cfg = SandboxModeConfig::resolve(&settings).expect("resolve");
+        unsafe { std::env::remove_var("SANDBOX_TIMEOUT_SECS") };
+
+        assert_eq!(cfg.timeout_secs, 5);
+    }
+
+    // ── ClaudeCodeConfig settings fallback tests ────────────────────
+
+    #[test]
+    fn claude_code_resolve_uses_settings_enabled() {
+        let _guard = crate::config::helpers::ENV_MUTEX
+            .lock()
+            .expect("env mutex poisoned");
+        let mut settings = crate::settings::Settings::default();
+        settings.sandbox.claude_code_enabled = true;
+
+        let cfg = ClaudeCodeConfig::resolve(&settings).expect("resolve");
+        assert!(cfg.enabled);
+    }
+
+    #[test]
+    fn claude_code_resolve_defaults_disabled() {
+        let _guard = crate::config::helpers::ENV_MUTEX
+            .lock()
+            .expect("env mutex poisoned");
+        let settings = crate::settings::Settings::default();
+        let cfg = ClaudeCodeConfig::resolve(&settings).expect("resolve");
+        assert!(!cfg.enabled);
+    }
+
+    #[test]
+    fn claude_code_env_overrides_settings() {
+        let _guard = crate::config::helpers::ENV_MUTEX
+            .lock()
+            .expect("env mutex poisoned");
+        let mut settings = crate::settings::Settings::default();
+        settings.sandbox.claude_code_enabled = true;
+
+        // SAFETY: Under ENV_MUTEX, no concurrent env access.
+        unsafe { std::env::set_var("CLAUDE_CODE_ENABLED", "false") };
+        let cfg = ClaudeCodeConfig::resolve(&settings).expect("resolve");
+        unsafe { std::env::remove_var("CLAUDE_CODE_ENABLED") };
+
+        assert!(!cfg.enabled);
+    }
+
+    #[test]
+    fn test_readonly_policy_unaffected() {
+        let config = SandboxModeConfig {
+            policy: "readonly".to_string(),
+            allow_full_access: false,
+            ..Default::default()
+        };
+        let sandbox = config.to_sandbox_config();
+        assert_eq!(sandbox.policy, crate::sandbox::SandboxPolicy::ReadOnly);
+    }
 }

src/config/search.rs

@@ -0,0 +1,211 @@
+use crate::config::helpers::{optional_env, parse_optional_env};
+use crate::error::ConfigError;
+use crate::workspace::FusionStrategy;
+
+/// Workspace search configuration resolved from environment variables.
+#[derive(Debug, Clone)]
+pub struct WorkspaceSearchConfig {
+    /// Fusion strategy: "rrf" or "weighted".
+    pub fusion_strategy: FusionStrategy,
+    /// RRF constant k (default 60).
+    pub rrf_k: u32,
+    /// FTS weight for fusion.
+    ///
+    /// [`Default`] uses 0.5. When the configuration is resolved, per-strategy
+    /// defaults are applied: 0.5 (RRF) or 0.3 (weighted).
+    pub fts_weight: f32,
+    /// Vector weight for fusion.
+    ///
+    /// [`Default`] uses 0.5. When the configuration is resolved, per-strategy
+    /// defaults are applied: 0.5 (RRF) or 0.7 (weighted).
+    pub vector_weight: f32,
+}
+
+impl Default for WorkspaceSearchConfig {
+    fn default() -> Self {
+        Self {
+            fusion_strategy: FusionStrategy::default(),
+            rrf_k: 60,
+            fts_weight: 0.5,
+            vector_weight: 0.5,
+        }
+    }
+}
+
+impl WorkspaceSearchConfig {
+    pub(crate) fn resolve() -> Result<Self, ConfigError> {
+        let fusion_strategy = match optional_env("SEARCH_FUSION_STRATEGY")? {
+            Some(s) => match s.to_lowercase().as_str() {
+                "rrf" => FusionStrategy::Rrf,
+                "weighted" => FusionStrategy::WeightedScore,
+                other => {
+                    return Err(ConfigError::InvalidValue {
+                        key: "SEARCH_FUSION_STRATEGY".to_string(),
+                        message: format!("must be 'rrf' or 'weighted', got '{other}'"),
+                    });
+                }
+            },
+            None => FusionStrategy::default(),
+        };
+
+        let rrf_k = parse_optional_env("SEARCH_RRF_K", 60u32)?;
+
+        // Per-strategy weight defaults: RRF uses 0.5/0.5, weighted uses 0.3/0.7 (vector-biased).
+        let (default_fts, default_vec) = match fusion_strategy {
+            FusionStrategy::Rrf => (0.5f32, 0.5f32),
+            FusionStrategy::WeightedScore => (0.3f32, 0.7f32),
+        };
+        let fts_weight = parse_optional_env("SEARCH_FTS_WEIGHT", default_fts)?;
+        let vector_weight = parse_optional_env("SEARCH_VECTOR_WEIGHT", default_vec)?;
+
+        if !fts_weight.is_finite() || fts_weight < 0.0 {
+            return Err(ConfigError::InvalidValue {
+                key: "SEARCH_FTS_WEIGHT".to_string(),
+                message: "must be a finite, non-negative float".to_string(),
+            });
+        }
+        if !vector_weight.is_finite() || vector_weight < 0.0 {
+            return Err(ConfigError::InvalidValue {
+                key: "SEARCH_VECTOR_WEIGHT".to_string(),
+                message: "must be a finite, non-negative float".to_string(),
+            });
+        }
+        if matches!(fusion_strategy, FusionStrategy::WeightedScore)
+            && fts_weight == 0.0
+            && vector_weight == 0.0
+        {
+            return Err(ConfigError::InvalidValue {
+                key: "SEARCH_FTS_WEIGHT/SEARCH_VECTOR_WEIGHT".to_string(),
+                message: "weighted fusion requires at least one non-zero weight".to_string(),
+            });
+        }
+
+        Ok(Self {
+            fusion_strategy,
+            rrf_k,
+            fts_weight,
+            vector_weight,
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::config::helpers::ENV_MUTEX;
+
+    fn clear_search_env() {
+        // SAFETY: Only called under ENV_MUTEX in tests.
+        unsafe {
+            std::env::remove_var("SEARCH_FUSION_STRATEGY");
+            std::env::remove_var("SEARCH_RRF_K");
+            std::env::remove_var("SEARCH_FTS_WEIGHT");
+            std::env::remove_var("SEARCH_VECTOR_WEIGHT");
+        }
+    }
+
+    #[test]
+    fn defaults_when_no_env() {
+        let _guard = ENV_MUTEX.lock().expect("env mutex poisoned");
+        clear_search_env();
+
+        let config = WorkspaceSearchConfig::resolve().expect("should resolve");
+        assert_eq!(config.fusion_strategy, FusionStrategy::Rrf);
+        assert_eq!(config.rrf_k, 60);
+        assert!((config.fts_weight - 0.5).abs() < 0.001);
+        assert!((config.vector_weight - 0.5).abs() < 0.001);
+    }
+
+    #[test]
+    fn env_overrides() {
+        let _guard = ENV_MUTEX.lock().expect("env mutex poisoned");
+        clear_search_env();
+
+        // SAFETY: Under ENV_MUTEX.
+        unsafe {
+            std::env::set_var("SEARCH_FUSION_STRATEGY", "weighted");
+            std::env::set_var("SEARCH_RRF_K", "30");
+            std::env::set_var("SEARCH_FTS_WEIGHT", "0.9");
+            std::env::set_var("SEARCH_VECTOR_WEIGHT", "0.1");
+        }
+
+        let config = WorkspaceSearchConfig::resolve().expect("should resolve");
+        assert_eq!(config.fusion_strategy, FusionStrategy::WeightedScore);
+        assert_eq!(config.rrf_k, 30);
+        assert!((config.fts_weight - 0.9).abs() < 0.001);
+        assert!((config.vector_weight - 0.1).abs() < 0.001);
+
+        clear_search_env();
+    }
+
+    #[test]
+    fn invalid_strategy_rejected() {
+        let _guard = ENV_MUTEX.lock().expect("env mutex poisoned");
+        clear_search_env();
+
+        // SAFETY: Under ENV_MUTEX.
+        unsafe {
+            std::env::set_var("SEARCH_FUSION_STRATEGY", "bm25");
+        }
+
+        let result = WorkspaceSearchConfig::resolve();
+        assert!(result.is_err());
+
+        clear_search_env();
+    }
+
+    #[test]
+    fn weighted_strategy_defaults() {
+        let _guard = ENV_MUTEX.lock().expect("env mutex poisoned");
+        clear_search_env();
+
+        // SAFETY: Under ENV_MUTEX.
+        unsafe {
+            std::env::set_var("SEARCH_FUSION_STRATEGY", "weighted");
+        }
+
+        let config = WorkspaceSearchConfig::resolve().expect("should resolve");
+        assert_eq!(config.fusion_strategy, FusionStrategy::WeightedScore);
+        // Weighted mode should default to 0.3 FTS / 0.7 vector
+        assert!((config.fts_weight - 0.3).abs() < 0.001);
+        assert!((config.vector_weight - 0.7).abs() < 0.001);
+
+        clear_search_env();
+    }
+
+    #[test]
+    fn weighted_both_zero_rejected() {
+        let _guard = ENV_MUTEX.lock().expect("env mutex poisoned");
+        clear_search_env();
+
+        // SAFETY: Under ENV_MUTEX.
+        unsafe {
+            std::env::set_var("SEARCH_FUSION_STRATEGY", "weighted");
+            std::env::set_var("SEARCH_FTS_WEIGHT", "0.0");
+            std::env::set_var("SEARCH_VECTOR_WEIGHT", "0.0");
+        }
+
+        let result = WorkspaceSearchConfig::resolve();
+        assert!(result.is_err());
+
+        clear_search_env();
+    }
+
+    #[test]
+    fn rrf_both_zero_allowed() {
+        let _guard = ENV_MUTEX.lock().expect("env mutex poisoned");
+        clear_search_env();
+
+        // SAFETY: Under ENV_MUTEX.
+        unsafe {
+            std::env::set_var("SEARCH_FTS_WEIGHT", "0.0");
+            std::env::set_var("SEARCH_VECTOR_WEIGHT", "0.0");
+        }
+
+        // RRF ignores weights, so both=0 is fine
+        let config = WorkspaceSearchConfig::resolve().expect("should resolve");
+        assert_eq!(config.fusion_strategy, FusionStrategy::Rrf);
+
+        clear_search_env();
+    }
+}

src/config/transcription.rs

@@ -9,11 +9,15 @@ use crate::settings::Settings;
 pub struct TranscriptionConfig {
     /// Whether audio transcription is enabled.
     pub enabled: bool,
-    /// Provider: "openai" (default).
+    /// Provider: "openai" (default) or "chat_completions".
     pub provider: String,
     /// OpenAI API key (reuses OPENAI_API_KEY).
     pub openai_api_key: Option<SecretString>,
-    /// Model to use (default: "whisper-1").
+    /// Explicit transcription API key (overrides provider-specific keys).
+    pub api_key: Option<SecretString>,
+    /// LLM API key (reuses LLM_API_KEY, used as fallback for chat_completions).
+    pub llm_api_key: Option<SecretString>,
+    /// Model to use (default depends on provider).
     pub model: String,
     /// Base URL override for the transcription API.
     pub base_url: Option<String>,
@@ -25,6 +29,8 @@ impl Default for TranscriptionConfig {
             enabled: false,
             provider: "openai".to_string(),
             openai_api_key: None,
+            api_key: None,
+            llm_api_key: None,
             model: "whisper-1".to_string(),
             base_url: None,
         }
@@ -42,8 +48,15 @@ impl TranscriptionConfig {
             optional_env("TRANSCRIPTION_PROVIDER")?.unwrap_or_else(|| "openai".to_string());
 
         let openai_api_key = optional_env("OPENAI_API_KEY")?.map(SecretString::from);
+        let api_key = optional_env("TRANSCRIPTION_API_KEY")?.map(SecretString::from);
+        let llm_api_key = optional_env("LLM_API_KEY")?.map(SecretString::from);
 
-        let model = optional_env("TRANSCRIPTION_MODEL")?.unwrap_or_else(|| "whisper-1".to_string());
+        let default_model = match provider.as_str() {
+            "chat_completions" => "google/gemini-2.0-flash-001",
+            _ => "whisper-1",
+        };
+        let model =
+            optional_env("TRANSCRIPTION_MODEL")?.unwrap_or_else(|| default_model.to_string());
 
         let base_url = optional_env("TRANSCRIPTION_BASE_URL")?;
 
@@ -51,29 +64,67 @@ impl TranscriptionConfig {
             enabled,
             provider,
             openai_api_key,
+            api_key,
+            llm_api_key,
             model,
             base_url,
         })
     }
 
+    /// Resolve the API key for the configured provider.
+    ///
+    /// Priority: `TRANSCRIPTION_API_KEY` > provider-specific key.
+    fn resolve_api_key(&self) -> Option<&SecretString> {
+        self.api_key
+            .as_ref()
+            .or_else(|| match self.provider.as_str() {
+                "chat_completions" => self.llm_api_key.as_ref().or(self.openai_api_key.as_ref()),
+                _ => self.openai_api_key.as_ref(),
+            })
+    }
+
     /// Create the transcription provider if enabled and configured.
     pub fn create_provider(&self) -> Option<Box<dyn crate::transcription::TranscriptionProvider>> {
         if !self.enabled {
             return None;
         }
 
-        // Currently only OpenAI Whisper is supported; more providers can be
-        // added here with a match on self.provider.
-        let api_key = self.openai_api_key.as_ref()?;
-        tracing::info!(model = %self.model, "Audio transcription enabled via OpenAI Whisper");
+        let api_key = self.resolve_api_key()?;
 
-        let mut provider = crate::transcription::OpenAiWhisperProvider::new(api_key.clone())
-            .with_model(&self.model);
+        match self.provider.as_str() {
+            "chat_completions" => {
+                tracing::info!(
+                    model = %self.model,
+                    "Audio transcription enabled via Chat Completions API"
+                );
 
-        if let Some(ref base_url) = self.base_url {
-            provider = provider.with_base_url(base_url);
+                let mut provider = crate::transcription::ChatCompletionsTranscriptionProvider::new(
+                    api_key.clone(),
+                )
+                .with_model(&self.model);
+
+                if let Some(ref base_url) = self.base_url {
+                    provider = provider.with_base_url(base_url);
+                }
+
+                Some(Box::new(provider))
+            }
+            _ => {
+                tracing::info!(
+                    model = %self.model,
+                    "Audio transcription enabled via OpenAI Whisper"
+                );
+
+                let mut provider =
+                    crate::transcription::OpenAiWhisperProvider::new(api_key.clone())
+                        .with_model(&self.model);
+
+                if let Some(ref base_url) = self.base_url {
+                    provider = provider.with_base_url(base_url);
+                }
+
+                Some(Box::new(provider))
+            }
         }
-
-        Some(Box::new(provider))
     }
 }

src/config/wasm.rs

@@ -44,20 +44,30 @@ fn default_tools_dir() -> PathBuf {
 }
 
 impl WasmConfig {
-    pub(crate) fn resolve() -> Result<Self, ConfigError> {
+    pub(crate) fn resolve(settings: &crate::settings::Settings) -> Result<Self, ConfigError> {
+        let ws = &settings.wasm;
         Ok(Self {
-            enabled: parse_bool_env("WASM_ENABLED", true)?,
+            enabled: parse_bool_env("WASM_ENABLED", ws.enabled)?,
             tools_dir: optional_env("WASM_TOOLS_DIR")?
                 .map(PathBuf::from)
+                .or_else(|| ws.tools_dir.clone())
                 .unwrap_or_else(default_tools_dir),
             default_memory_limit: parse_optional_env(
                 "WASM_DEFAULT_MEMORY_LIMIT",
-                10 * 1024 * 1024,
+                ws.default_memory_limit,
             )?,
-            default_timeout_secs: parse_optional_env("WASM_DEFAULT_TIMEOUT_SECS", 60)?,
-            default_fuel_limit: parse_optional_env("WASM_DEFAULT_FUEL_LIMIT", 10_000_000)?,
-            cache_compiled: parse_bool_env("WASM_CACHE_COMPILED", true)?,
-            cache_dir: optional_env("WASM_CACHE_DIR")?.map(PathBuf::from),
+            default_timeout_secs: parse_optional_env(
+                "WASM_DEFAULT_TIMEOUT_SECS",
+                ws.default_timeout_secs,
+            )?,
+            default_fuel_limit: parse_optional_env(
+                "WASM_DEFAULT_FUEL_LIMIT",
+                ws.default_fuel_limit,
+            )?,
+            cache_compiled: parse_bool_env("WASM_CACHE_COMPILED", ws.cache_compiled)?,
+            cache_dir: optional_env("WASM_CACHE_DIR")?
+                .map(PathBuf::from)
+                .or_else(|| ws.cache_dir.clone()),
         })
     }
 
@@ -81,3 +91,36 @@ impl WasmConfig {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::config::helpers::ENV_MUTEX;
+    use crate::settings::Settings;
+
+    #[test]
+    fn resolve_falls_back_to_settings() {
+        let _guard = ENV_MUTEX.lock().expect("env mutex poisoned");
+        let mut settings = Settings::default();
+        settings.wasm.default_memory_limit = 42;
+        settings.wasm.cache_compiled = false;
+
+        let cfg = WasmConfig::resolve(&settings).expect("resolve");
+        assert_eq!(cfg.default_memory_limit, 42);
+        assert!(!cfg.cache_compiled);
+    }
+
+    #[test]
+    fn env_overrides_settings() {
+        let _guard = ENV_MUTEX.lock().expect("env mutex poisoned");
+        let mut settings = Settings::default();
+        settings.wasm.default_fuel_limit = 42;
+
+        // SAFETY: Under ENV_MUTEX, no concurrent env access.
+        unsafe { std::env::set_var("WASM_DEFAULT_FUEL_LIMIT", "7") };
+        let cfg = WasmConfig::resolve(&settings).expect("resolve");
+        unsafe { std::env::remove_var("WASM_DEFAULT_FUEL_LIMIT") };
+
+        assert_eq!(cfg.default_fuel_limit, 7);
+    }
+}