{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "appearance": {
      "default": {
        "preview": {
          "autoOpen": true
        }
      },
      "type": "object",
      "properties": {
        "sidebar": {
          "type": "object",
          "properties": {
            "showHiddenFiles": {
              "default": false,
              "type": "boolean",
              "scope": "project-local",
              "agentSettable": false,
              "reload": "live",
              "defaultScope": "project-local",
              "description": "Show dot-prefixed entries (e.g. .ok/, .okignore) in the file tree. Per-machine (project-local) — not shared with collaborators."
            },
            "showOnlyMarkdownFiles": {
              "default": false,
              "type": "boolean",
              "scope": "project-local",
              "agentSettable": false,
              "reload": "live",
              "defaultScope": "project-local",
              "description": "Show only markdown documents (.md/.mdx) and folders in the file tree, hiding other file types from view. View-only: hidden files stay on disk and remain reachable via links and search. Per-machine (project-local) — not shared with collaborators."
            },
            "showSkillsSection": {
              "default": true,
              "type": "boolean",
              "scope": "project-local",
              "agentSettable": false,
              "reload": "live",
              "defaultScope": "project-local",
              "description": "Show the Skills section in the sidebar. Skill documents remain reachable via links and search while the section is hidden. Per-machine (project-local) — not shared with collaborators."
            },
            "showOkFolders": {
              "default": false,
              "type": "boolean",
              "scope": "project-local",
              "agentSettable": false,
              "reload": "live",
              "defaultScope": "project-local",
              "description": "Show .ok folders (skills, templates, and other OpenKnowledge-managed state) in the file tree as read-only entries. .ok/worktrees and .ok/local never appear. Per-machine (project-local) — not shared with collaborators."
            },
            "showSkillGroups": {
              "default": true,
              "type": "boolean",
              "scope": "project-local",
              "agentSettable": false,
              "reload": "live",
              "defaultScope": "project-local",
              "description": "Group skills in the sidebar by where they came from — the publisher they were imported from, or the plugin that ships them. Skills you authored stay ungrouped at the top of their scope. Per-machine (project-local) — not shared with collaborators."
            },
            "pinnedProjectSkills": {
              "default": [],
              "type": "array",
              "items": {
                "type": "string"
              },
              "scope": "project-local",
              "agentSettable": false,
              "reload": "live",
              "defaultScope": "project-local",
              "description": "Project-scope skills pinned to the top of the Skills sidebar, by name. A pinned skill also keeps its normal row, so a provenance group still lists everything from its source. Per-machine (project-local) — not shared with collaborators."
            }
          },
          "additionalProperties": {}
        }
      },
      "additionalProperties": {}
    },
    "autoSync": {
      "default": {
        "mode": null,
        "enabled": null,
        "default": null
      },
      "type": "object",
      "properties": {
        "mode": {
          "default": null,
          "anyOf": [
            {
              "type": "string",
              "enum": [
                "off",
                "follow",
                "full",
                "pull"
              ],
              "scope": "project-local",
              "agentSettable": false,
              "reload": "live",
              "defaultScope": "project-local",
              "description": "How this machine syncs this project with its git remote: 'off' (no sync), 'follow' (one-directional — pull remote changes, never push your own; 'pull' is accepted as a legacy alias), or 'full' (bidirectional pull and push). null = not chosen yet (onboarding asks). Per-machine (project-local) — not shared. Supersedes the legacy autoSync.enabled boolean."
            },
            {
              "type": "null"
            }
          ]
        },
        "enabled": {
          "default": null,
          "anyOf": [
            {
              "type": "boolean",
              "scope": "project-local",
              "agentSettable": false,
              "reload": "live",
              "defaultScope": "project-local",
              "description": "Legacy per-machine sync toggle, superseded by autoSync.mode. Read only when mode is absent (true = full, false = off). null = not chosen yet. Per-machine (project-local) — not shared."
            },
            {
              "type": "null"
            }
          ]
        },
        "resumeMode": {
          "type": "string",
          "enum": [
            "follow",
            "full",
            "pull"
          ],
          "scope": "project-local",
          "agentSettable": false,
          "reload": "live",
          "defaultScope": "project-local",
          "description": "When sync is paused (autoSync.mode 'off') after having been enabled, the active mode to resume into ('follow' | 'full'). Per-machine UI memory; ignored while a mode is active. Not shared."
        },
        "default": {
          "default": null,
          "anyOf": [
            {
              "anyOf": [
                {
                  "type": "boolean"
                },
                {
                  "type": "string",
                  "enum": [
                    "off",
                    "follow",
                    "full",
                    "pull"
                  ]
                }
              ],
              "scope": "project",
              "agentSettable": false,
              "reload": "live",
              "defaultScope": "project",
              "description": "Committed project default for a machine's sync mode on first open: 'off' | 'follow' | 'full', or the legacy boolean (true = full, false = off). null = ask (show the onboarding prompt). Shared via git. A per-machine autoSync.mode choice overrides it."
            },
            {
              "type": "null"
            }
          ]
        }
      },
      "additionalProperties": {}
    },
    "terminal": {
      "default": {
        "enabled": null
      },
      "type": "object",
      "properties": {
        "enabled": {
          "default": null,
          "anyOf": [
            {
              "type": "boolean",
              "scope": "project-local",
              "agentSettable": false,
              "reload": "live",
              "defaultScope": "project-local",
              "description": "Opt-out for the in-app terminal (a real OS shell at full user privilege). The terminal is on by default; set false to disable it for this project on this machine. Per-machine (project-local) — never shared via git, clone, or sync."
            },
            {
              "type": "null"
            }
          ]
        }
      },
      "additionalProperties": {}
    },
    "search": {
      "default": {
        "semantic": {
          "enabled": false,
          "baseUrl": "https://api.openai.com/v1",
          "model": "text-embedding-3-small"
        }
      },
      "type": "object",
      "properties": {
        "semantic": {
          "default": {
            "enabled": false,
            "baseUrl": "https://api.openai.com/v1",
            "model": "text-embedding-3-small"
          },
          "type": "object",
          "properties": {
            "enabled": {
              "default": false,
              "type": "boolean",
              "scope": "project-local",
              "agentSettable": false,
              "reload": "live",
              "defaultScope": "project-local",
              "description": "Add semantic (embeddings) ranking to the MCP search tool, fused with the lexical engine so conceptually-related pages surface even with no shared keywords. When ON and an API key is set (`ok embeddings set-key`), the search query and matching document content are sent to the configured embeddings provider — content egress. Default OFF. Per-machine (project-local) — not shared with collaborators."
            },
            "baseUrl": {
              "default": "https://api.openai.com/v1",
              "type": "string",
              "scope": "project-local",
              "agentSettable": false,
              "reload": "live",
              "defaultScope": "project-local",
              "description": "Base URL of the OpenAI-compatible embeddings API (default https://api.openai.com/v1). Override to point at a self-hosted server (Ollama / vLLM / LM Studio) or another provider. The API key is NOT stored here — set it with `ok embeddings set-key` (`~/.ok/secrets.yml`); it is sent to whichever endpoint this names."
            },
            "model": {
              "default": "text-embedding-3-small",
              "type": "string",
              "scope": "project-local",
              "agentSettable": false,
              "reload": "live",
              "defaultScope": "project-local",
              "description": "Embeddings model id (default text-embedding-3-small). Must be served by the provider at baseUrl. Changing it re-embeds the corpus (the cache is keyed by provider + model + dimensions)."
            },
            "dimensions": {
              "type": "integer",
              "exclusiveMinimum": 0,
              "maximum": 9007199254740991,
              "scope": "project-local",
              "agentSettable": false,
              "reload": "live",
              "defaultScope": "project-local",
              "description": "Optional output vector dimensions. Omit (recommended) to detect the model's native size from its first response — that is what lets a non-OpenAI model work without knowing its size up front. Set a smaller value (text-embedding-3 supports e.g. 512 / 1024) to shrink the on-disk cache, trading a little retrieval quality; a server that ignores the request param then fails loudly instead of silently. Changing it re-embeds the corpus."
            },
            "similarityFloor": {
              "type": "number",
              "minimum": 0,
              "maximum": 1,
              "scope": "project-local",
              "agentSettable": false,
              "reload": "live",
              "defaultScope": "project-local",
              "description": "Optional hard cutoff: drop any \"by meaning\" match whose cosine similarity is below this value. Off by default (0) because retrieval is rank-based (the closest pages are returned regardless of absolute score) and the right cutoff is model-specific. Set it only to suppress weak matches for a specific provider/model whose cosine scale you know. Most setups should leave it unset and rely on the result-count cap."
            }
          },
          "additionalProperties": {}
        }
      },
      "additionalProperties": {}
    },
    "linkPreviews": {
      "default": {
        "enabled": true
      },
      "type": "object",
      "properties": {
        "enabled": {
          "default": true,
          "type": "boolean",
          "scope": "project-local",
          "agentSettable": false,
          "reload": "live",
          "defaultScope": "project-local",
          "description": "Show a rich preview card (site name, page title, description, favicon) when you hover an external link in the editor. When ON, hovering an external link sends that link's URL to the destination site to fetch its preview metadata — outbound egress, one request per previewed link. Default ON; set to false to turn external previews off. Per-machine (project-local) — not shared with collaborators. Previews of links to other documents in this project are read from the local index with no network request and are always on."
        }
      },
      "additionalProperties": {}
    },
    "server": {
      "default": {
        "bind": [
          "127.0.0.1"
        ],
        "allowExternal": false
      },
      "type": "object",
      "properties": {
        "bind": {
          "default": [
            "127.0.0.1"
          ],
          "minItems": 1,
          "type": "array",
          "items": {
            "type": "string",
            "minLength": 1
          },
          "scope": "project-local",
          "agentSettable": false,
          "reload": "boot",
          "defaultScope": "project-local",
          "description": "Addresses the server binds, e.g. [127.0.0.1] or [0.0.0.0]. Default loopback-only ([127.0.0.1]): nothing off this machine can connect. A non-loopback bind additionally requires the server.allowExternal consent interlock. Per-machine (project-local): a value committed to .ok/config.yml is ignored, so one machine exposing the server can never break local clones for the rest of the team — the exposing host sets it via OK_BIND, --bind, or .ok/local/config.yml. Lists replace, never merge. Read at server start; changing it requires a restart."
        },
        "allowExternal": {
          "default": false,
          "type": "boolean",
          "scope": "project-local",
          "agentSettable": false,
          "reload": "boot",
          "defaultScope": "project-local",
          "description": "Exposure consent interlock. Once the unified server boot lands, a non-loopback server.bind or a server.externalUrl without allowExternal: true will be refused at boot with a one-line fix. Default off. Per-machine (project-local) — consent never travels via git, clone, or share; containers consent via the environment instead."
        },
        "openBrowser": {
          "type": "boolean",
          "scope": "project-local",
          "agentSettable": false,
          "reload": "boot",
          "defaultScope": "project-local",
          "description": "Open the UI in a browser when the server starts. Default derived: true when every bind address is loopback (a laptop start pops the UI), false otherwise (a container or exposed bind is headless and must never try). Acts once at start. Per-machine (project-local) — not shared."
        },
        "idleShutdown": {
          "anyOf": [
            {
              "type": "string",
              "const": "off"
            },
            {
              "type": "string",
              "pattern": "^[1-9]\\d*(s|m|h)$"
            }
          ],
          "scope": "project-local",
          "agentSettable": false,
          "reload": "live",
          "defaultScope": "project-local",
          "description": "Shut the server down after this long with no activity: a duration like '30m' (positive integer with unit s, m, or h), or 'off'. Default derived: '30m' when every bind address is loopback, 'off' otherwise (an exposed or containerized server stays up). Reloadable — a valid change applies without a restart. Per-machine (project-local) — not shared."
        }
      },
      "additionalProperties": {}
    }
  },
  "additionalProperties": {}
}