version: 1
kind: unidesk-cli
output:
  maxStdoutBytes: 10240
  dumpDir: /tmp/unidesk-cli-output
  includePreview: false
  warning: "CLI stdout 超出 YAML 配置上限；默认不会创建临时 dump，请使用语义化窄查询。只有显式 --full/--raw 或 UNIDESK_TRAN_STREAM_DUMP=1 才允许为一次性完整披露创建受保护 dump；重复依赖 dump 仍属于 CLI 易用性缺陷。"
github:
  auth:
    tokenSource:
      enabled: true
      priority: before-env
      root: /root/.unidesk/.env
      sourceRef: gh_token.txt
      sourceKey: GH_TOKEN
      format: raw-token
    repositoryOverrides:
      - repository: pikainc/pikaoa
        priority: before-env
        root: /root/.unidesk/.env
        sourceRef: pikainc-selfmedia-gh-token.txt
        sourceKey: GH_TOKEN
        format: raw-token
        projectedEnv: UNIDESK_GH_TOKEN_PIKAINC_PIKAOA
      - repository: pikainc/selfmedia
        priority: before-env
        root: /root/.unidesk/.env
        sourceRef: pikainc-selfmedia-gh-token.txt
        sourceKey: GH_TOKEN
        format: raw-token
      - repository: pikainc/hwpod-home
        priority: before-env
        root: /root/.unidesk/.env
        sourceRef: pikainc-selfmedia-gh-token.txt
        sourceKey: GH_TOKEN
        format: raw-token
      - repository: pikainc/superapi
        priority: before-env
        root: /root/.unidesk/.env
        sourceRef: pikainc-selfmedia-gh-token.txt
        sourceKey: GH_TOKEN
        format: raw-token
  prMerge:
    unknownRetry:
      maxAttempts: 5
      initialDelayMs: 1000
      maxDelayMs: 16000
      factor: 2
trans:
  fileTransfer:
    concurrency: 8
    transportOpenRetries: 3
    transportRetryDelayMs: 1000
  windowsFs:
    rg:
      timeoutMs: 10000
      maxFiles: 5000
      maxMatches: 1000
      maxBytesPerFile: 1048576
gc:
  targetUsePercent: null
  fileLogs:
    enabled: true
    keepDays: 7
    maxBytes: 50MiB
    tailBytes: 20MiB
  dockerLogs:
    enabled: true
    maxBytes: 50MiB
  journal:
    enabled: true
    targetBytes: 512MiB
  buildCache:
    enabled: true
    until: 24h
    all: false
  tmp:
    enabled: true
    minAgeHours: 24
    includeStale: false
  browserCache:
    enabled: false
  toolCaches:
    enabled: false
  vscode:
    staleServers:
      enabled: false
      keepServers: 2
    staleExtensions:
      enabled: false
      keepVersions: 1
    cachedVsix:
      enabled: false
      keepDays: 7
  baiduStaging:
    enabled: false
    keepDays: 10
  stateArtifacts:
    enabled: false
    keepDays: 14
    fileRoots:
      e2e: /root/.unidesk/.state/e2e
      validation: /root/.unidesk/.state/validation
      jobs: /root/.unidesk/.state/jobs
      codex-queue-output-archive: /root/.unidesk/.state/codex-queue/output-archive
    dirRoots:
      deploy-exports: /root/.unidesk/.state/deploy/exports
      deploy-resolve: /root/.unidesk/.state/deploy/resolve
  stateStaleScratch:
    enabled: false
    keepHours: 24
    fileRoots:
      playwright-cli-screenshots: /root/.unidesk/.state/playwright-cli/screenshots
      playwright-cli-sessions: /root/.unidesk/.state/playwright-cli/sessions
      perf: /root/.unidesk/.state/perf
      tmp: /root/.unidesk/.state/tmp
      web-observe: /root/.unidesk/.state/web-observe
    dirRoots:
      hwlab-cd: /root/.unidesk/.state/hwlab-cd
      codex-queue-stats-verify: /root/.unidesk/.state/codex-queue-stats-verify
      codex-queue-perf: /root/.unidesk/.state/codex-queue-perf
      tmp: /root/.unidesk/.state/tmp
  legacyDockerImages:
    enabled: true
    minAgeHours: 12
    keepPerRepository: 2
    repositories:
      - 127.0.0.1:5000/hwlab/web-probe-sentinel-${nodeLower}
  legacyDockerRegistryVolumes:
    enabled: true
    requireK8sRegistryReady: true
  codexSessions:
    enabled: false
    keepHours: 72
    root: /root/.codex/sessions
  mergedWorktrees:
    enabled: false
    keepHours: 24
    mainRoot: /root/unidesk
    root: /root/unidesk/.worktree
    baseRef: origin/master
    scanBudgetMs: 20000
    cherryCheckTimeoutMs: 1000
    estimateSizeInPlan: false
  vpnDiagnosticLogs:
    enabled: false
    keepHours: 24
  databaseSummary:
    enabled: true
  output:
    limit: 50
    resultLimit: 50
    full: false
  remote:
    targets:
      NC01:
        mergedWorktrees:
          enabled: true
          mainRoot: /root/unidesk
          workspaceRoots:
            - /root/unidesk/.worktree
          baseRef: origin/master
          minAgeHours: 24
          scanBudgetMs: 20000
          cherryCheckTimeoutSeconds: 2
          manualMaxDeletePerRun: 20
          automatic:
            enabled: true
            maxDeletePerRun: 5
        registryRetention:
          enabled: true
          configRef: config/hwlab-node-control-plane.yaml#nodes.NC01.registry
          repositoryPrefixes:
            - hwlab/
            - agentrun/
            - pikaoa/
            - selfmedia/
            - unidesk/
          protectedRepositoryPrefixes:
            - hwlab/cache/
            - pikaoa/cache-
          protectedTags:
            - latest
            - 16-alpine
            - 20-bookworm-slim
            - node22-alpine-v1
            - node22-alpine-bun-v1
            - sidecar
          deletableTagPattern: ^[0-9a-f]{7,64}$
          keepPerRepo: 5
          minAgeHours: 24
          previewLimit: 20
          estimateBlobLimit: 5000
          automatic:
            enabled: false
            maxDeleteManifestsPerRun: 500
            writerGraceMinutes: 30
            requireIdleNamespaces:
              - devops-infra
              - agentrun-ci
              - hwlab-ci
              - pikaoa-ci
              - selfmedia-ci
        hostDockerGc:
          dockerJsonLogs:
            enabled: false
            reason: NC01 主机 Docker 承载主服务运行面，通用远端 GC 不得截断活跃服务日志。
          buildCachePrune:
            enabled: true
            until: 24h
            reason: 仅回收超过 YAML 年龄阈值且 Docker 判定可回收的 BuildKit cache；不清理 images、containers 或 volumes。
            automatic:
              enabled: true
              until: 168h
          imagePrune:
            enabled: true
            minAgeHours: 168
            maxDeletePerRun: 20
            previewLimit: 20
            reason: 仅删除超过 YAML 年龄阈值且未被任何运行、停止或 Created 容器引用的 host Docker image。
            automatic:
              enabled: true
              minAgeHours: 336
              maxDeletePerRun: 5
        memoryPressure:
          planPreviewLimit: 4
          processPatterns:
            - k3s-server
            - containerd
            - chrome
            - chromium
            - observer-runner
            - playwright
          observeStateRoots:
            - /root/hwlab-v03/.state/web-observe
            - /root/hwlab/.state/web-observe
          minimumReadableObserveRoots: 1
          observeRunDepth: 6
          observeScanLimit: 2000
          staleRunMaxAgeHours: 1
          processScanLimit: 32768
          attribution:
            cgroupRoot: /sys/fs/cgroup
            cgroupScanLimit: 32768
            topLevelLimit: 4
            systemServiceLimit: 4
            podLimit: 4
            processLimit: 4
            processPssLimit: 4
            processSwapLimit: 4
            commandTimeoutSeconds: 20
            kubeconfigPath: /etc/rancher/k3s/k3s.yaml
            targetMemAvailableBytes: 5368709120
            objectCountResources:
              - pods
              - pipelineruns.tekton.dev
              - taskruns.tekton.dev
              - events
              - secrets
              - persistentvolumeclaims
              - persistentvolumes
            namespaceCountNamespaces:
              - devops-infra
              - agentrun-ci
              - hwlab-ci
              - pikaoa-ci
              - selfmedia-ci
            namespaceCountConcurrency: 8
          processStaleMinAgeSeconds: 3600
          maxMemoryReclaimCandidates: 20
          terminationGraceSeconds: 5
          terminationPollMilliseconds: 200
          observerRootPatterns:
            - observer-runner.mjs
            - .state/web-observe/
          browserRootPatterns:
            - observer-runner.mjs
            - .state/web-observe/
            - playwright_chromiumdev_profile-
            - cliDaemon.mjs
            - .state/playwright
          browserProcessPatterns:
            - playwright_chromiumdev_profile-
            - /ms-playwright/
            - /usr/bin/chromium
            - /usr/bin/chromium-browser
            - /opt/google/chrome/
            - /headless_shell
          cgroupReclaim:
            enabled: true
            targetMemAvailableBytes: 5368709120
            minimumSwapFreeBytesAfterReclaim: 34359738368
            targets:
              - id: kafka-broker-inactive-anon
                workloadSelector:
                  namespace: platform-infra
                  matchLabels:
                    strimzi.io/name: platform-infra-kafka-kafka
                  maxMatchedPods: 1
                reclaimBytes: 268435456
                swappiness: 200
                minimumInactiveAnonBytes: 268435456
                priority: 10
              - id: kafka-entity-operator-inactive-anon
                workloadSelector:
                  namespace: platform-infra
                  matchLabels:
                    strimzi.io/name: platform-infra-kafka-entity-operator
                  maxMatchedPods: 1
                reclaimBytes: 134217728
                swappiness: 200
                minimumInactiveAnonBytes: 134217728
                priority: 20
              - id: argocd-controller-inactive-anon
                workloadSelector:
                  namespace: argocd
                  matchLabels:
                    app.kubernetes.io/name: argocd-application-controller
                  maxMatchedPods: 1
                reclaimBytes: 134217728
                swappiness: 200
                minimumInactiveAnonBytes: 134217728
                priority: 30
              - id: gitea-inactive-anon
                workloadSelector:
                  namespace: devops-infra
                  matchLabels:
                    app.kubernetes.io/name: gitea
                  maxMatchedPods: 1
                reclaimBytes: 134217728
                swappiness: 200
                minimumInactiveAnonBytes: 134217728
                priority: 40
              - id: hwlab-v03-hwpod-worker-inactive-anon
                workloadSelector:
                  namespace: hwlab-v03
                  matchLabels:
                    app.kubernetes.io/name: hwlab-hwpod-worker
                  maxMatchedPods: 2
                reclaimBytes: 134217728
                swappiness: 200
                minimumInactiveAnonBytes: 134217728
                priority: 50
              - id: sub2rank-development-worker-inactive-anon
                workloadSelector:
                  namespace: platform-infra-development
                  matchLabels:
                    app.kubernetes.io/name: sub2rank-worker
                  maxMatchedPods: 1
                reclaimBytes: 134217728
                swappiness: 200
                minimumInactiveAnonBytes: 134217728
                priority: 60
              - id: hwlab-v03-harnessrl-worker-inactive-anon
                workloadSelector:
                  namespace: hwlab-v03
                  matchLabels:
                    app.kubernetes.io/name: hwlab-harnessrl-worker
                  maxMatchedPods: 2
                reclaimBytes: 134217728
                swappiness: 200
                minimumInactiveAnonBytes: 134217728
                priority: 70
              - id: hwlab-v03-workbench-worker-inactive-anon
                workloadSelector:
                  namespace: hwlab-v03
                  matchLabels:
                    app.kubernetes.io/name: hwlab-workbench-worker
                  maxMatchedPods: 2
                reclaimBytes: 134217728
                swappiness: 200
                minimumInactiveAnonBytes: 134217728
                priority: 80
        kubernetesObjectRetention:
          enabled: true
          aggregatePreviewLimit: 1
          defaults:
            kubeconfigPath: /etc/rancher/k3s/k3s.yaml
            resource: pipelineruns.tekton.dev
            listMode: server-table
            countPath: /apis/tekton.dev/v1/namespaces/{namespace}/pipelineruns
            terminalConditionType: Succeeded
            terminalStatuses:
              - "True"
              - "False"
            manualMaxDeletePerRun: 500
            previewLimit: 5
            scanLimit: 5000
            requestTimeoutSeconds: 45
            deleteBatchSize: 50
            deleteTimeoutSeconds: 60
            postDeleteSettleSeconds: 5
            propagationPolicy: Background
          policies:
            - configId: devops-infra-tekton-history
              namespace: devops-infra
              minAgeHours: 1
              keepLatestPerGroup: 3
              automaticMaxDeletePerRun: 100
              groupSelectors:
                - id: outer-pac-event
                  groupByLabels:
                    - pipelinesascode.tekton.dev/repository
                    - pipelinesascode.tekton.dev/original-prname
                - id: inner-deterministic-publish
                  groupByLabels:
                    - unidesk.ai/node
                    - unidesk.ai/lane
                    - unidesk.ai/spec-ref
            - configId: agentrun-ci-tekton-history
              namespace: agentrun-ci
              minAgeHours: 12
              keepLatestPerGroup: 3
              automaticMaxDeletePerRun: 50
              groupSelectors:
                - id: agentrun-node-lane
                  groupByLabels:
                    - agentrun.pikastech.local/node
                    - agentrun.pikastech.local/lane
            - configId: hwlab-ci-tekton-history
              namespace: hwlab-ci
              minAgeHours: 1
              keepLatestPerGroup: 1
              automaticMaxDeletePerRun: 50
              groupSelectors:
                - id: hwlab-pac-lane
                  groupByLabels:
                    - pipelinesascode.tekton.dev/repository
                    - pipelinesascode.tekton.dev/original-prname
            - configId: pikaoa-ci-tekton-history
              namespace: pikaoa-ci
              minAgeHours: 12
              keepLatestPerGroup: 3
              automaticMaxDeletePerRun: 50
              groupSelectors:
                - id: pikaoa-pac-consumer
                  groupByLabels:
                    - pipelinesascode.tekton.dev/repository
            - configId: selfmedia-ci-tekton-history
              namespace: selfmedia-ci
              minAgeHours: 12
              keepLatestPerGroup: 3
              automaticMaxDeletePerRun: 50
              groupSelectors:
                - id: selfmedia-pac-consumer
                  groupByLabels:
                    - pipelinesascode.tekton.dev/repository
        policyTimer:
          enabled: true
          name: unidesk-devops-infra-retention
          onCalendar: "*:0/15"
          randomizedDelaySec: 2min
          stateDir: /var/lib/unidesk-gc
          configDir: /etc/unidesk-gc
          journalTargetBytes: 256MiB
          tmpMinAgeHours: 24
          includeJournal: false
          includeTmp: false
          includeAptCache: false
          includeToolCaches: false
          includeWebObserveArtifacts: false
          includeK3sImageCache: false
          includeHostContainerdCache: false
          includeLocalPathOrphans: false
          includeKubernetesObjectRetention: true
          includeMergedWorktrees: true
        pvcAttribution:
          namespaces:
            - agentrun-ci
            - agentrun-v02
            - devops-infra
            - hwlab-ci
            - pikaoa-ci
            - selfmedia-ci
          candidateNamespaces:
            - agentrun-ci
            - hwlab-ci
          hwlabNode: NC01
          hwlabLane: v03
          agentrunNode: NC01
          agentrunLane: nc01-v02
          limit: 80
      JD01:
        hostDockerGc:
          dockerJsonLogs:
            enabled: false
            reason: JD01 host Docker stores the provider-gateway/trans runtime; do not truncate provider container logs from generic remote GC.
          buildCachePrune:
            enabled: false
            reason: JD01 host Docker stores the provider-gateway/trans runtime; Docker builder prune previously preceded snapshot/lowerdir corruption.
        memoryPressure:
          planPreviewLimit: 6
          processPatterns:
            - chrome
            - chromium
            - web-probe observe
            - playwright
          observeStateRoots:
            - /root/workspace/hwlab-v03/.state/web-observe
            - /root/workspace/hwlab-v03/.state/playwright-cli
          staleRunMaxAgeHours: 6
        pvcAttribution:
          namespaces:
            - agentrun-ci
            - agentrun-v02
            - hwlab-ci
            - hwlab-dev
            - hwlab-prod
            - hwlab-v03
          candidateNamespaces:
            - agentrun-ci
            - hwlab-ci
          hwlabNode: JD01
          hwlabLane: v03
          agentrunNode: JD01
          agentrunLane: jd01-v02
          limit: 80
        containerdImageCache:
          enabled: true
          runtimeEndpoint: unix:///run/k3s/containerd/containerd.sock
          namespace: k8s.io
          ciNamespaces:
            - hwlab-ci
            - agentrun-ci
        hostContainerdCache:
          enabled: true
          root: /var/lib/containerd
          address: /run/containerd/containerd.sock
          namespaces:
            - default
          orphanCleanup:
            enabled: true
            overlaySnapshotsRoot: /var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots
            contentBlobRoot: /var/lib/containerd/io.containerd.content.v1.content/blobs/sha256
            maxDeletePerRun: 100
        localPathStorage:
          enabled: true
          root: /var/lib/rancher/k3s/storage
          orphanDirPrefixes:
            - pvc-
          orphanMinAgeMinutes: 0
          maxDeletePerRun: 100
        policyTimer:
          enabled: true
          name: unidesk-jd01-low-risk-gc
          onCalendar: daily
          randomizedDelaySec: 20min
          stateDir: /var/lib/unidesk-gc
          configDir: /etc/unidesk-gc
          journalTargetBytes: 256MiB
          tmpMinAgeHours: 24
          includeJournal: true
          includeTmp: true
          includeAptCache: true
          includeToolCaches: false
          includeWebObserveArtifacts: true
          includeK3sImageCache: true
          includeHostContainerdCache: true
          includeLocalPathOrphans: true
          includeKubernetesObjectRetention: false
          agentrunSessionPvcs:
            enabled: true
            namespace: agentrun-v02
            prefixes:
              - agentrun-v01-session-
              - agentrun-v02-session-
              - agentrun-jd01-v02-session-
            maxDeletePerRun: 100
  policyTimer:
    journald:
      systemMaxUse: 512MiB
      runtimeMaxUse: 128MiB
      maxRetentionSec: 7day
    daily:
      buildCacheUntil: 24h
      vpnDiagnosticLogs:
        enabled: true
        keepHours: 24
      stateArtifacts:
        enabled: true
        keepDays: 14
      vscodeCachedVsix:
        enabled: true
        keepDays: 7
      limit: 5000
      resultLimit: 25
