Configuration
Both config files refuse unknown keys. A typo stops the program from starting rather than being silently ignored, because a daemon that starts and reports nothing looks identical to a machine with nothing running.
Client: config.toml
~/.config/sealmesh/config.toml, or under $XDG_CONFIG_HOME. Any command takes --config PATH to read another file. The daemon reads it once at startup, so restart it after editing. sealmesh doctor parses it without connecting to anything.
integration_branch = "dev" # "3 ahead" is measured against this branch
ticket_prefixes = ["ENG"] # tracker prefixes parsed from branch names
[server]
url = "https://router.example.com" # https, or http only for loopback
[allow] # both required, both default-deny
repos = ["example-org/example-repo"]
paths = ["~/Development"] # resolved through symlinks before matching
[claude]
extra_roots = [] # more Claude Code config dirs to read
[events]
enabled = true
interval_secs = 120 # 10..=3600
[declared]
ttl_secs = 900 # how long a declared record is believed; 60..=86400
[chat]
enabled = false # room chat is opt-in
project_rooms = false # also name the project-wide room
hook_drain = false # let the Claude Code hook mention new room messages
There's no host key, deliberately: the name you appear under comes from your GitHub login. A config that sets one is refused.
The off switch is a file, not a key: ~/.config/sealmesh/off. While it exists the daemon stays connected, answers not sharing, collects nothing, and refuses all room chat.
[[provider]] blocks, for reading other tools' files, are described on Agents & providers.
Router: sealmesh-server.toml
Passed with --config, or named by SEALMESH_CONFIG.
github_org = "example-org" # whose active members may connect; no default
listen = "0.0.0.0:8787"
tls_terminated_by = "caddy" # required to listen in plaintext on non-loopback
projects = [
{ id = "example", repos = ["example-org/example-repo", "example-org/other-repo"] },
]
[history]
backend = "sqlite" # or "dynamodb" in a --features dynamodb build
path = "/var/lib/sealmesh/history.sqlite" # no default
The org and the history path have no defaults on purpose: a guessed org would authorize the wrong people, and a guessed path would write coordination history somewhere nobody is looking.
Environment variables
Router
Environment variables win over the file.
| Variable | Meaning |
|---|---|
SEALMESH_CONFIG | Path to sealmesh-server.toml |
SEALMESH_GITHUB_ORG | The organization whose members may connect |
SEALMESH_LISTEN | Listen address, default 0.0.0.0:8787 |
SEALMESH_TLS_TERMINATED_BY | What terminates TLS in front of the router |
SEALMESH_PROJECTS | Projects, as JSON |
SEALMESH_HISTORY_BACKEND | sqlite or dynamodb |
SEALMESH_HISTORY_PATH | SQLite file for room history |
DYNAMODB_ROOM_HISTORY | DynamoDB table name |
SEALMESH_ROOM_TOKENS_PER_HOUR | Per-host, per-room token budget (default 20,000, max 200,000) |
SEALMESH_ROOM_TURN_CAP | Turns two hosts may trade alone in a room (default 20, 4–100) |
SEALMESH_READER_CHECKS_PER_HOUR | Uncached access checks per reader (default 1,000) |
SEALMESH_ACCESS_CACHE_TTL_SECS | Access cache lifetime (default 30, max 300) |
Client
| Variable | Meaning |
|---|---|
GH_TOKEN, GITHUB_TOKEN | Used before falling back to gh auth token |
SEALMESH_CLAUDE_CONFIG_DIR | An explicit Claude Code config directory |
XDG_CONFIG_HOME, XDG_CACHE_HOME, XDG_STATE_HOME | Honored only when absolute; otherwise ~/.config, ~/.cache, ~/.local/state |
NO_COLOR | Plain output |
Files on your machine
| Path | What it holds |
|---|---|
~/.config/sealmesh/config.toml | Your config |
~/.config/sealmesh/off | The off switch, when present |
~/.local/state/sealmesh/audit.jsonl | Who asked this machine, and when |
~/.local/state/sealmesh/agents/ | Records written by sealmesh declare and the hook |
~/.local/state/sealmesh/local/daemon.sock | The local room-chat socket, when chat is on |
~/.cache/sealmesh/ | Pull request and CI status cache |