{
  "_comment": [
    "Merge these keys into your ~/.cumulus/gateway.config.json — this file is a fragment, not a whole config.",
    "Then: sudo systemctl reload cumulus-gateway (SIGHUP; never restart, it kills in-flight turns).",
    "Replace sk-demoapp-REPLACE-ME with a long random string. It is the app's only credential.",
    "PORT: 8080 below is the DEFAULT for a fresh install, not a promise about your box.",
    "Read your own config's top-level \"port\" and use that in GATEWAY_ORIGIN — pointing the",
    "shim at whatever else happens to own 8080 fails in a confusing, non-obvious way."
  ],

  "_bridge": [
    "Top-level and GLOBAL — one setting for the whole gateway, not per-app. If it is",
    "already true (another app enabled it), leave it alone; adding a second app is a",
    "namespaces[] entry only. Setting it true again is harmless.",
    "",
    "There is one more optional key here: bridge.executorUrl (default",
    "http://127.0.0.1:8091). It is ALSO global — one URL for the whole gateway, so a",
    "second app cannot point it somewhere else. It is used for exactly one thing:",
    "hydrating a visitor's text selection into full records via POST <executorUrl>/execute",
    "before the turn runs. It soft-fails if unreachable, and it is UNRELATED to the",
    "per-namespace executorProxy below — enabling that does not require this. Omit it",
    "unless you have a headless executor serving /execute."
  ],
  "bridge": { "enabled": true },

  "namespaces": [
    {
      "name": "demoapp",
      "label": "Demo App",

      "_apiKeys": [
        "A key listed here is SCOPED: it can touch demoapp-* threads and nothing else,",
        "and it never sees the base 'demoapp' thread (that one belongs to you, for",
        "working on the app). It also lists NOTHING: /api/threads and /api/agents answer",
        "200 with an empty array even when the namespace is full — not 403. Reads outside",
        "the namespace are what 403. This is the key your serving layer hands to",
        "logged-in sessions."
      ],
      "apiKeys": ["sk-demoapp-REPLACE-ME"],

      "_extraMcpServers": [
        "Spawned per turn for demoapp-* threads only. {thread} is substituted with the",
        "calling thread's name, so one shim serves every visitor. Use an absolute path",
        "to the shim — the gateway spawns it with the thread's own cwd."
      ],
      "extraMcpServers": {
        "demoapp-tools": {
          "command": "node",
          "args": ["/absolute/path/to/examples/web-app-agent/agent/mcp-shim.js"],
          "env": {
            "GATEWAY_ORIGIN": "http://127.0.0.1:8080",
            "GATEWAY_API_KEY": "sk-demoapp-REPLACE-ME",
            "BRIDGE_THREAD": "{thread}",
            "MCP_SERVER_NAME": "demoapp-tools"
          }
        }
      },

      "_executorProxy": [
        "OPTIONAL. Only if your app has a backend the agent should reach directly.",
        "Lets the tab talk to a single origin (the gateway) instead of two.",
        "Delete this block if you don't need it — the demo does not."
      ],
      "executorProxy": {
        "origin": "http://127.0.0.1:8199",
        "pathPrefixes": ["/api/public"]
      }
    }
  ]
}