# Preferences Module

Keybindings are also owned here. Cradle reads `preferences/keybindings.json` from its configured data directory; each rule contains `command`, `key`, and an optional boolean `when` expression. The API reports the file path and validation errors and never writes another tool's namespace.

提供 Server-owned 的 App、Chat、Codex、Desktop、Network 与 Jarvis 默认偏好读写接口。App preferences own Cradle application feature flags, including the CRA-026 multi-workspace POC gate, local auth for destructive actions, blocked Codex Goal continuation, the experimental Turn Checkpoint gate, the Codex CLI-compatible app-server identity mode, and the Cradle-owned Codex app-server log insert blocker workaround. `codexCliCompatibleIdentity` 使用 `codex-tui` client identity 与当前 Codex runtime 版本，并从 app-server 子进程环境移除 `CODEX_INTERNAL_ORIGINATOR_OVERRIDE`；session source 仍由 Codex app-server 自身决定。Chat preferences own default chat behavior, continuation behavior, and Codex session title-generation provider/model/thinking-effort preferences; provider targets are read only for title-generation execution. Codex preferences own Cradle-specific Codex app-server runtime behavior such as whether initialization advertises Cradle in the user agent and the Cradle-owned ChatGPT credential ref used as the default Codex account. Codex account routes own the Cradle UI/API entry point for Codex ChatGPT login; Cradle persists token material in the encrypted `secrets` namespace and injects it into Codex app-server with `chatgptAuthTokens` at runtime. Desktop preferences own Cradle Electron runtime behavior such as double Command+Q quit protection and the AppShot bare-modifier trigger selection. Network preferences own Cradle outbound proxy intent plus inbound listener intent for Electron-managed Cradle Server and built-in relayd access. Runtime outbound request execution is handled by the server-owned outbound network helper, which reads these preferences and resolves the current system proxy for new requests without requiring a server restart. Inbound listener changes are consumed on the next Cradle restart: Desktop reads `serverAccessMode` before forking the Server, and `local-relayd-supervisor` reads the managed relay access/public URL setting before starting relayd. Jarvis preferences store the selected runtime id, provider target, explicit model, and thinking level; runtime availability and provider compatibility remain owned by Chat Runtime's `/chat/runtimes` catalog.
多数路由 metadata 包含用于生成 CLI 命令的 `x-cradle-cli` 描述。Network proxy write routes intentionally skip CLI projection because proxy URLs may include credentials.

## Files

- **index.ts**: Elysia `/preferences` 路由，提供 App、Chat、Codex、Desktop、Network、Jarvis 与 keybindings preferences，以及 Network proxy status。
- **model.ts**: Preference request/response 的 TypeBox schema，包含 App-owned feature flags、Chat continuation behavior、Chat-owned session title-generation config、Codex app-server UA mode、Desktop quit behavior 和 AppShot trigger selection、Network outbound proxy mode/status、Network inbound access mode、Jarvis runtime 与显式模型选择。
- **service.ts**: Server-owned preferences 的持久化语义，并提供后端能力门控使用的 App feature flag 查询与断言 helper。
