config.json, models, context, providers

Global settings live in ~/.dgc/config.json; per-project overrides live in a project's .dgc/. Most settings have a slash command, so you rarely edit the file by hand.

Useful keys:

• base_url, model — the endpoint and model (/connect, /model). Credentials live in owner-only ~/.dgc/secrets.json, VS Code SecretStorage, or DGC_API_KEY / the other DGC_*_API_KEY environment references; they are not written into normal config.
• mode, thinking — permission mode and reasoning effort. Thinking is off by default; accepts off · low · medium · high · xhigh. DGC maps levels to provider controls: reasoning-only models may use minimum effort for off, unsupported endpoints may ignore it, and Qwen3-family llama.cpp/unsloth templates receive chat_template_kwargs. Reasoning models (o-series, DeepSeek-R1, qwen-thinking) may benefit from /think high on hard tasks. See Thinking & reasoning.
• show_reasoning, preserve_thinking — show_reasoning (/thoughts show|hide) shows the model's thinking, muted, in the transcript. preserve_thinking (/preserve-thinking on|off, default off) re-embeds the prior turn's reasoning in the context sent back so a compatible/local model keeps its own thinking across turns (costs tokens; only the OpenAI-compatible/chat_completions path — Anthropic and Ollama already round-trip their reasoning natively).
• thinking_inline, thinking_inline_max_chars — show a short provider summary of the model's thinking inline instead of folded (default on, /thoughts inline|collapsed), up to thinking_inline_max_chars characters (default 280, 0-1000). See Thinking & reasoning.
• think_budget_tokens, max_tokens — safety backstops: a reasoning phase that runs away with no output is aborted + retried with less reasoning (think_budget_tokens, default auto: 8,000 tokens at Off/Low, 16,000 at Medium, 32,000 at High, 64,000 at Extra high/Ultra; a number applies to every level, 0=off); output is capped at max_tokens plus the level's reasoning allowance when reasoning is on, within the model's output limit and half the context window (length-truncation auto-continues, 0=don't send).
• api_mode, provider_state, prompt_cache — transport and continuity. auto selects native Ollama chat for detected Ollama endpoints, Anthropic Messages for Anthropic, OpenAI Responses for OpenAI, and Chat Completions for compatible servers. Use api_mode: ollama or api_mode: anthropic only when a proxy hides its provider identity. Anthropic Messages preserves signed thinking and grouped tool-result continuation blocks locally; it never sends the key as Bearer authentication. Responses defaults to stateless (store: false) with local encrypted-reasoning replay and a hashed cache-routing key when DGC derives the key. An explicit prompt_cache_key of up to 64 characters is sent verbatim. Choose provider_state: server only when provider-side response storage is acceptable.
• provider_capabilities, capability_cache_ttl_s — explicit feature overrides and the bounded interval before DGC retries a capability that an endpoint/model rejected.
• context_size — requested operating window. Known models receive memory-conscious defaults; provider metadata clamps impossible values without silently expanding local Ollama allocations. Sessions compact at compact_threshold of the effective window. Changes apply to the next request, even during a turn. Editor settings saves wait only when changing an execution route: provider, model, sandbox, or delegation engine.
• search_timeout — bounded 1–60 second lifetime for internal grep/glob discovery. DGC uses ripgrep without a shell when available and a link-safe bounded fallback otherwise.
• session_redaction — on by default. Adds credential redaction to saved transcripts, checkpoint conversations, goals, titles, and plans. Live native-provider/tool and editor/headless/ACP masking is always enforced. TUI and one-shot subscription streams retain vendor output after terminal-control cleanup; treat it as sensitive. File rewind snapshots stay byte-for-byte intact in the owner-private session, preserving exact /rewind restoration.
• tool_profile — standard (default) offers every product tool on every request and lets the model decide (about 3,300 tokens of tool schema, cached by the provider between turns). adaptive offers core coding tools always and adds web, artifact, skill-install, memory, delegation and background-monitor tools only when the request's wording asks for them — about 1,500 tokens of schema for a small local context window, at the cost of a differently worded ask being refused. full also drops the state-based filters and offers every tool on every model request. Releases through 0.41.7 wrote their adaptive default into every config, so the first load after upgrading reads a stored adaptive as standard, once. Choosing adaptive yourself afterwards — /set tool_profile adaptive in the terminal, or the editor's settings — is kept.
• code_action — off by default. Opt in to the python tool: arbitrary code in a persistent per-session interpreter, retaining variables/imports across calls. Approval follows bash (asked in default/acceptEdits, denied in plan). It has no /sandbox, checkpoints, or mutation tracking for verifier reuse. See Python code-action.
• theme, background — appearance. background defaults to inherit, keeping your terminal's own canvas. /bg light (also /bg white) sets a white canvas with dark text; /bg dark sets a dark canvas with light text. Both apply immediately in the TUI and classic CLI, and restore the terminal's defaults on exit. /bg inherit restores the host colors immediately. /bg auto takes effect on the next launch and darkens a light terminal. The same choices are in Settings → Display → Background. /theme auto|dark|light chooses the text palette; when a background is forced, it follows that choice to stay readable.
• suggest — ghost-text next-prompt suggestions (Tab/→ to accept). Auxiliary title/suggestion requests wait for fleet-wide idle time and are canceled before foreground work; aux_idle_delay_ms controls the grace period.
• mcp_servers, hooks, fallback_model, subagent_model — extend the agent. When a fallback or sub-agent uses another endpoint, its transport is inferred independently instead of inheriting a forced main-provider mode; set fallback_api_mode or subagent_api_mode only to override that. Lifecycle-hook batches are capped at 32 entries and one 20-second deadline, drain only a bounded redacted head/tail, own a process group and checkout mutation lease, and honor /sandbox.
• subagent_context_size — each sub-agent's context window in tokens, as context_size is the main model's (0, the default, uses the main window). A named agent's own context_size: frontmatter wins. /subagent context 64k sets it; so does Settings → Agents in the editor. The sub-agent route (subagent_model, host, transport, key, window) may change mid-turn: it applies from the next sub-agent, as a new main model applies from the next request.
• subagent_worktree_root — optional private storage for automatic delegated checkouts; empty uses ~/.dgc/worktrees. It must be outside the source repository.
• subagent_link_paths — empty by default, and normally left that way. A delegated checkout holds tracked files only, so the project's ignored dependency and build directories are not in it; the sub-agent is told which ones are missing and installs what it needs into its own checkout, where the work is thrown away with the checkout. Listing a path here shares the project's real directory with every sub-agent instead, so an install runs once — and so a sub-agent's writes land in your own copy immediately, outside /rewind and outside the delta /tasks apply reviews. Only Git-ignored paths can be shared; anything else is refused, because a shared path must never reach the integrated result.
• fleet_worktree_root — optional private storage for automatically isolated TUI agents; empty uses ~/.dgc/fleet-worktrees. Conversation resume state remains scoped to the source project, and changed managed checkouts are retained rather than force-removed.
• max_parallel_tasks — bounded task fan-out (default 4, maximum 8; set 1 to disable). In a Git-backed full-auto turn, two or more independent task calls emitted together are snapshotted from one parent baseline, run concurrently, and integrated in call order. Hooks, interactive permission modes and non-Git projects keep the normal serial path. A batch may mix tools: the task calls fan out when they are the LAST calls in the response, so a todo, an edit or a bash command beside them runs first, in order, and nothing is reordered past a running child. A task call that is not part of that trailing run keeps the whole batch serial.
• max_subagent_depth — how deep task may nest (default 1, maximum 8). 1 keeps the tree flat: the agent you are talking to delegates, and its children do their work themselves. Raise it to 2 when a lead should be able to delegate research that itself fans out; 0 turns delegation off entirely. Depth is counted from the real parent chain, so a sub-agent cannot talk its way past it: past the limit task is not offered, and a call to it is refused naming the depth it is at. Under DGC Ultra this is what keeps an aggressive lead from fanning out recursively.
• language_servers, code_intel_timeout, code_intel_lsp_idle_s — optional stdio LSP commands for definitions, references, symbols, and diagnostics. Key by language (python) or extension (.py): {"language_servers":{"python":{"command":"pyright-langserver","args":["--stdio"]}}}. The bounded dependency-free static analyzer works without LSP. Servers use a minimal environment, no shell, and serialized requests per project/server spec. At most four sessions stay warm (default 120 seconds); idle and failed sessions retire. Approved external-file queries always run one-shot. Set code_intel_lsp_idle_s to 0 for one-shot isolation everywhere.

The api_key, search_api_key, subagent_api_key, and fallback_api_key values never live in config.json; they are written to ~/.dgc/secrets.json with owner-only permissions, and each can be supplied by environment variable instead (DGC_API_KEY, DGC_SEARCH_API_KEY, …). On the command line, --api-key-env NAME reads a key from the environment without persisting it at all. fallback_base_url and subagent_base_url point the fallback and sub-agent at their own endpoints.

Sampling keys are empty by default, which means use the endpoint's own defaults — set one only when you want to override it.

• temperature, top_p, top_k, min_p — sampling parameters, passed through when set.
• max_turns (default 0) — optional emergency tool-iteration backstop. 0 lets a progressing turn continue until it completes, is cancelled, or reaches an explicitly configured time budget; repeated-call and no-progress guards remain active independently.
• turn_budget_s (default 0, meaning no limit) — wall-clock budget for a turn. The agent reserves the tail of this budget to converge and persist rather than being cut off mid-edit.
• turn_token_budget (default 0, meaning no limit) — token budget for a turn, counting every sub-agent the turn started, however deep and whether or not it is still running in the background. A detached sub-agent is charged to the turn that asked for it, not to whichever turn is running when it finally reports. At 70% and 85% the model is told to converge; past 100% a new task is refused and the turn stops requesting model output. Nothing is rolled back: unlike the wall-clock limit, which restores the last test-passing state because a kill is coming, the tokens already spent bought the edits on disk and discarding them would pay for nothing. Use this, not turn_budget_s, to cap what a turn COSTS; turn_budget_s bounds a turn that HANGS.
• request_timeout (default 1800) — hard ceiling on socket silence, including the wait for response headers; an active response can take longer overall. The stall watcher below normally acts first.
• model_first_token_timeout_s (default auto) — how long a request may produce nothing (no headers, a silent stream, or keep-alives with no tokens) before it counts as stalled. auto is 900 for a local endpoint (loopback, private or Tailscale addresses, *.local, or an Ollama/llama.cpp/LM Studio/vLLM server: room for a model load and a large prefill) and 300 for a remote one — including an Ollama cloud model (…:cloud, …-cloud) reached through a local Ollama, which is remote work. Streamed reasoning counts as progress. 0 turns it off.
• model_idle_timeout_s (default 300) — how long a stream may go silent after it started. A stall after partial output continues from what already streamed. 0 turns it off.
• model_stall_notice_s (default 45) — when to say "No response from the model" (with the model and host) in the status line and the editor. 0 never shows it.
• model_stall_retries (default 2) — how many times a stalled request is re-issued. After that DGC switches to fallback_model when one is set, or fails the turn with a message naming the model and endpoint. Esc / Stop works in every phase, including before any response headers.
• model_load_timeout_s (default 900, self-hosted Ollama only) — while /api/ps shows the model still loading, the first-token clock is paused ("Loading the model") for up to this long. Ollama cloud models never load locally and are never probed.
• bash_timeout (default 120) — per-command shell timeout.
• approval_timeout_s (default 300) — how long a permission prompt waits before giving up.
• ollama_keep_alive (default 30m) — how long Ollama keeps the model resident between turns.
• prompt_cache_key — an explicit cache key for providers that support prompt caching.

• search_provider (default duckduckgo) — which backend answers the agent's web searches. DuckDuckGo needs no key: it uses the bundled ddgs client, falling back to DGC's own HTML and lite parsing.
• search_url — a custom endpoint for a self-hosted search backend; empty uses the provider's own.
• search_api_key lives in secrets.json (above). Web providers use bounded transport timeouts.

• sandbox (default false) — run shell commands inside the sandbox.
• sandbox_network (default false) — allow network access from sandboxed commands.
• sandbox_env_allow (default []) — environment variable names to pass through to sandboxed commands. Other non-baseline host variables are withheld; DGC still supplies a small safe baseline plus sandbox-specific home, temporary, and runtime paths.

• artifact_autostart (default true) — serve artifacts automatically as they are produced.
• artifact_port (default 45000) — the shared port for project artifacts. Plan previews use a separate transient loopback server and port.
• artifact_bind (default localhost) — the bind mode. Set it to lan to preview from another device on your own network.
• artifact_hostname — the hostname used when building the printed URL, if it differs from the bind address. The server also accepts requests addressed to this name (a reverse proxy, a Codespaces or other forwarded URL, or a Tailscale MagicDNS name); requests for any other unknown host are refused. A running server picks up a changed value the next time an artifact is served, the bind mode is switched, or dgc starts.
• plan_artifact (default true) — render proposed plans as an artifact page.
• artifact_in_plan (default false) — also serve artifacts while in plan mode.

• autonomous_gate — a check command that must exit 0 before a native local/API agent may stop a turn.
• autonomous_max_turns (default 30) — bound on failed gate retries.
• verify_before_done (default false) and verify_command — run a command and feed a failure back before allowing a native local/API turn to end. Passing a check normally returns its result to the model so it can finish other requested work and selected skill steps.
• finish_on_verified (default false) — opt in only when the configured verifier defines the entire task. In timed native auto runs with verify_before_done and verify_command, a green check can end the turn without another model request. Active goals, explicit skills and unfinished todos always retain normal completion. Leave this off for ordinary multi-step work.

Subscription turns are delegated to the selected vendor CLI and bypass these two native-loop gates.

The autonomous-gate pair has command-line equivalents; see Command line. The verifier pair is configured in config.json.

• subscription_engine — which vendor CLI drives the turn.
• subscription_model, subscription_effort — model and effort passed through to that CLI.

• eta (default true) — show the calibrated "~2–4 min left" range while a turn runs.
• notify (default off) — on pings after every turn over 20 seconds; /notify arms a single one.

• mouse (default capture) — capture lets the wheel scroll DGC and rows respond to clicks; off leaves the mouse to your terminal so drag-select works. /select toggles it for one session; /mouse on|off changes this setting.
• recall_max_bytes (default 524288) — how much earlier conversation /recall keeps per session after compaction, oldest turns dropped first.
• trash_mode (default dgc) — where /files sends deleted entries: dgc keeps them in ~/.dgc/trash for 30 days (undo with u), os uses the system trash (freedesktop layout on Linux, ~/.Trash on macOS; other platforms fall back to dgc).

• logo_animation (default true) — the animated mark on the welcome screen. Turn it off for a static logo.