Skip to content

configuration.md

Latest commit

 

History

History
99 lines (69 loc) · 2.27 KB

configuration.md

File metadata and controls

99 lines (69 loc) · 2.27 KB

Configuration Guide

gloves supports bootstrap configuration through .gloves.toml.

Full schema: GLOVES_CONFIG_SPEC.md

Resolution Order

Config source precedence:

  1. --no-config (skip all config loading)
  2. --config <path>
  3. GLOVES_CONFIG
  4. parent-directory discovery of .gloves.toml
  5. built-in defaults

Minimal Example

version = 1

[paths]
root = ".openclaw/secrets"

[defaults]
agent_id = "default-agent"
secret_ttl_days = 30

[vault]
mode = "auto"

For a fresh OpenClaw setup, prefer generating this with:

gloves bootstrap --profile openclaw \
  --root .openclaw/secrets \
  --config .openclaw/.gloves.toml \
  --agents main,relationships,coder

The bootstrap command is intentionally thin. It writes the initial config and creation rules, creates agent identities, validates the result, and stops there.

Built-in default secret_ttl_days is 30. Override it when you need shorter or longer retention. For one-off secrets that should not expire, use gloves secrets set ... --ttl never. The create command prints the resolved expiry timestamp for expiring secrets and reports never expires otherwise.

Agent Path Visibility and Operations

[private_paths]
runtime_root = ".openclaw/secrets"
workspace_private = "./.private"

[agents.agent-main]
paths = ["runtime_root", "workspace_private"]
operations = ["read", "write", "list", "mount"]

Inspect one agent's view:

gloves access paths --agent agent-main --json

Secret ACL Policy

[secrets.acl.agent-main]
paths = ["shared/*", "svc/*"]
operations = ["read", "write", "list", "request", "status"]

[secrets.acl.human-ops]
paths = ["*"]
operations = ["read", "write", "list", "revoke", "request", "status", "approve", "deny"]

URL Policy for secrets get --pipe-to-args

[secrets.pipe.commands.curl]
require_url = true
url_prefixes = ["https://api.example.com/v1/"]

This restricts URL arguments to approved prefixes.

Validation

gloves config validate

Use this in CI and before deploy.

Related Docs