config.toml is desired state. The daemon active generation advances only when ConfigApplyService can apply the desired change to runtime truth.
| Lifecycle | Runtime effect |
|---|
live | Applies in place and advances the active config generation. |
live-add | Adds a new runtime entry in place and advances the active generation. |
live-remove-if-unused | Removes a runtime entry only when it has no active users. |
session-rebind | Applies to new sessions while existing sessions keep their bound values. |
restart-required | Writes desired state and records a blocked apply until the daemon restarts. |
| Key path pattern | Lifecycle | Diff class | Next action when not immediately active |
|---|
attention.* | live | live | none |
automation.* | restart-required | restart-required | restart-daemon |
daemon.memory_report_interval | restart-required | restart-required | restart-daemon |
daemon.reload_timeouts.bridges | live | live | none |
daemon.reload_timeouts.mcp | live | live | none |
daemon.reload_timeouts.providers | live | live | none |
daemon.socket | restart-required | restart-required | restart-daemon |
daemon.subprocess_health_escalation_threshold | restart-required | restart-required | restart-daemon |
defaults.* | restart-required | restart-required | restart-daemon |
extensions.* | restart-required | restart-required | restart-daemon |
extensions.trust.allow_unverified | live | live | none |
gateway.* | live | live | none |
gateway.private_port | restart-required | restart-required | restart-daemon |
gateway.public_port | restart-required | restart-required | restart-daemon |
goals.* | restart-required | restart-required | restart-daemon |
hooks.* | restart-required | restart-required | restart-daemon |
http.* | restart-required | restart-required | restart-daemon |
limits.* | restart-required | restart-required | restart-daemon |
log.* | restart-required | restart-required | restart-daemon |
loops.* | restart-required | restart-required | restart-daemon |
marketplace.catalog.* | live | live | none |
mcp-servers.* | restart-required | restart-required | restart-daemon |
mcp.oauth.* | restart-required | restart-required | restart-daemon |
memory.* | restart-required | restart-required | restart-daemon |
network.* | restart-required | restart-required | restart-daemon |
network.enabled | live | live | none |
observability.* | restart-required | restart-required | restart-daemon |
permissions.* | restart-required | restart-required | restart-daemon |
providers.* | restart-required | restart-required | restart-daemon |
providers.*.models | live | live | none |
providers.*.models.* | live | live | none |
redact.* | restart-required | restart-required | restart-daemon |
roles | live | live | none |
roles.* | live | live | none |
sandboxes.* | session-rebind | session-rebind | new-session |
session.* | restart-required | restart-required | restart-daemon |
shell.*.* | live | live | none |
skills.* | restart-required | restart-required | restart-daemon |
skills.disabled_skills | live | live | none |
task.* | restart-required | restart-required | restart-daemon |
task.orchestration.profile.default_worktree_mode | live | live | none |
tools.artifacts.* | restart-required | restart-required | restart-daemon |
tools.clarify.* | restart-required | restart-required | restart-daemon |
window_manager.* | live | live | none |
window_manager.closed_entry_limit | live | live | none |
window_manager.nav_stack_limit | live | live | none |
worktrees.* | live | live | none |
| Key | Default | Validation |
|---|
daemon.reload_timeouts.providers | 5s | At least 1s and at most 60s. |
daemon.reload_timeouts.mcp | 10s | At least 1s and at most 60s. |
daemon.reload_timeouts.bridges | 30s | At least 1s and at most 300s. |