Skip to content
Back to skills

072 Configuration Cdcb6f54

ASecurity

**Package:** `src/tunacode/configuration/`

  • 9 stars
  • 0 votes
  • 0 copies
  • 0 views
  • Added October 11, 2026
devopsnodegitapi

Works with

  • api

Security analysis

A100/100

Scanned October 11, 2026

npx -y skills add tools-only/X-Skills --skill 072-configuration_cdcb6f54 --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of 072 Configuration Cdcb6f54?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for 072 Configuration Cdcb6f54
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/tools-only-072-configuration-cdcb6f54/badge)](https://www.skillsdirectory.com/skills/tools-only-072-configuration-cdcb6f54)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

SKILL.md
---
title: Configuration Layer
summary: User settings, model registry, path resolution, pricing tables, and feature flags.
read_when: Adding a new user-facing setting, supporting a new provider, or changing default behavior.
depends_on: [types, infrastructure]
feeds_into: [core, tools, ui]
---

# Configuration Layer

**Package:** `src/tunacode/configuration/`

## What

Everything that can be configured by the user or the project. This layer reads `tunacode.json`, resolves paths, loads the bundled model registry, and exposes typed accessors for limits, pricing, and feature flags.

## Key Files

| File | Purpose |
|------|---------|
| `defaults.py` | `DEFAULT_USER_CONFIG` dict -- the fallback for every setting. |
| `user_config.py` | `load_config()` reads `tunacode.json` from `~/.config/`. `load_config_with_defaults()` deep-merges user overrides onto defaults. |
| `settings.py` | `ApplicationSettings` dataclass -- app name, version, paths, internal tool list. `PathConfig` resolves `~/.config/tunacode.json`. |
| `models.py` | `load_models_registry()` parses `models_registry.json` (bundled). `parse_model_string()` splits `"provider:model_id"`. Accessors: `get_providers()`, `get_models_for_provider()`, `get_provider_env_var()`, `get_provider_base_url()`, `get_model_context_window()`, `validate_provider_api_key()`. |
| `paths.py` | Session storage directory, project ID derivation, home-dir resolution. |
| `limits.py` | `get_max_tokens()` -- resolves the effective max output tokens from user config. |
| `pricing.py` | Per-model pricing tables used to compute `CostBreakdown`. |
| `feature_flags.py` | Boolean feature toggles (e.g., experimental features). |
| `ignore_patterns.py` | Default file patterns excluded from grep/glob (`.git`, `node_modules`, etc.). |

## How

At startup, `StateManager.__init__()` calls `load_config_with_defaults()` to build the merged user config. This config dict is stored on `SessionState.user_config` and read by every other layer.

Model resolution flow:
1. `parse_model_string("openrouter:openai/gpt-4.1")` returns `("openrouter", "openai/gpt-4.1")`.
2. `get_provider_env_var("openrouter")` returns `"OPENROUTER_API_KEY"`.
3. `get_provider_base_url("openrouter")` returns the API endpoint from the bundled registry.
4. `get_model_context_window("openrouter:openai/gpt-4.1")` returns the token limit.

## Why

Centralizing configuration avoids scattered `os.getenv()` calls. The bundled `models_registry.json` means users never need to know provider URLs or env-var names -- just pick a provider and model from the registry.

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…