feat(config): add TOML config file with layered loading (#9)

## Summary

Add file-based configuration via TOML, replacing the env-var-only setup
with layered loading. Each config source is a partial struct with
all-`Option` fields, merged field-by-field so higher-priority sources
override lower ones without requiring every source to specify every
value.

Precedence (highest wins): env vars > project `ox.toml` > user
`~/.config/ox/config.toml` > built-in defaults.

- Add `config/file.rs`: `FileConfig` struct with
`#[serde(deny_unknown_fields)]` for typo detection, partial merge via
`Option::or()`, user config path resolution (`$XDG_CONFIG_HOME` with
`~/.config` fallback), project config discovery (walk CWD upward for
nearest `ox.toml`).
- Update `Config::load()` to merge file config into the layering chain
for all fields (`api_key`, `model`, `base_url`, `max_tokens`,
`show_thinking`).
- Change `env_bool` from `bool` → `Option<bool>` so unset env vars fall
through to file config. Any non-empty value (even `"0"` or `"no"`) is
treated as an explicit override.
- Core logic extracted into parameter-accepting functions
(`resolve_user_config`, `find_project_config_from`) for testability
without `unsafe` env mutation (Rust 2024 edition).

## Changes

| File | Description |
| ---- | ----------- |
| `Cargo.toml` | Add `toml = "0.8"` to workspace dependencies |
| `crates/oxide-code/Cargo.toml` | Wire up `toml` |
| `crates/oxide-code/src/config/file.rs` | New module: `FileConfig`
(all-Option partial config with `deny_unknown_fields`), `merge`, `load`
(user + project), path discovery with 17 tests |
| `crates/oxide-code/src/config.rs` | Add `mod file`; update
`Config::load()` to integrate file config layer; change `env_bool` to
`Option<bool>` with documented semantics |
| `CLAUDE.md` | Add `file.rs` to crate structure diagram |
| `docs/roadmap.md` | Move shipped config items to "Working Today", keep
instruction directories as remaining work |
| `docs/guide/configuration.md` | Restructure to document layered
config: file locations, available keys, precedence, env var ↔ config key
mapping |

## Test plan

- [x] `cargo fmt --all --check` — clean
- [x] `cargo build` compiles cleanly
- [x] `cargo clippy --all-targets -- -D warnings` — zero warnings
- [x] `cargo test` — 223 tests pass (17 new)
- [x] `cargo llvm-cov --ignore-filename-regex 'main\.rs'` — 87% line
coverage (`config/file.rs` at 89%)

Author: hakula139

CLAUDE.md

@@ -27,8 +27,9 @@ ox     # Start an interactive session
 ├── client/
 │   ├── anthropic.rs            # Anthropic Messages API streaming client
 │   └── billing.rs              # Billing attribution header (fingerprint, cch attestation)
-├── config.rs                   # Configuration loading (env vars, model, base URL)
+├── config.rs                   # Configuration loading and layered merging
 ├── config/
+│   ├── file.rs                 # TOML config file discovery, parsing, and merge (user + project)
 │   └── oauth.rs                # Claude Code OAuth credentials (macOS Keychain + file), token refresh, file locking
 ├── main.rs                     # CLI entry point, agent loop, async REPL
 ├── message.rs                  # Conversation message types

Cargo.lock

@@ -35,6 +35,7 @@ serde_json = "1"
 sha2 = "0.10"
 tempfile = "3"
 time = { version = "0.3", features = ["local-offset"] }
+toml = "0.8"
 tokio = { version = "1", features = [
   "io-std",
   "io-util",

Cargo.toml

@@ -13,7 +13,15 @@ oxide-code is a Rust reimplementation of Claude Code — an interactive CLI agen
 
 ## Status
 
-Early development. See [`docs/roadmap.md`](docs/roadmap.md) for the current roadmap.
+Early development. What works today:
+
+- Agent loop with streaming and extended thinking
+- File and search tools (read, write, edit, glob, grep, bash)
+- System prompt with CLAUDE.md / AGENTS.md injection
+- Authentication (API key and Claude Code OAuth)
+- TOML config file with layered loading
+
+Next up: terminal UI. See [`docs/roadmap.md`](docs/roadmap.md) for details.
 
 ## Usage
 

README.md

@@ -26,6 +26,7 @@ serde_json.workspace = true
 sha2.workspace = true
 time.workspace = true
 tokio.workspace = true
+toml.workspace = true
 tracing.workspace = true
 tracing-subscriber.workspace = true
 xxhash-rust.workspace = true

crates/oxide-code/Cargo.toml

@@ -1,3 +1,4 @@
+mod file;
 mod oauth;
 
 use anyhow::{Context, Result};
@@ -33,12 +34,19 @@ pub struct Config {
 }
 
 impl Config {
-    /// Load configuration.
+    /// Load configuration from files and environment variables.
     ///
-    /// Auth priority: `ANTHROPIC_API_KEY` env var > Claude Code OAuth
-    /// credentials at `~/.claude/.credentials.json`.
+    /// Precedence (highest wins): env vars > project `ox.toml` > user
+    /// `~/.config/ox/config.toml` > built-in defaults.
+    ///
+    /// Auth priority: `ANTHROPIC_API_KEY` env var > `api_key` in config
+    /// file > Claude Code OAuth credentials.
     pub async fn load() -> Result<Self> {
-        let auth = if let Some(key) = non_empty_env("ANTHROPIC_API_KEY") {
+        let fc = file::load();
+        let client = fc.client.unwrap_or_default();
+        let tui = fc.tui.unwrap_or_default();
+
+        let auth = if let Some(key) = non_empty_env("ANTHROPIC_API_KEY").or(client.api_key) {
             Auth::ApiKey(key)
         } else {
             let token = oauth::load_token()
@@ -47,19 +55,25 @@ impl Config {
             Auth::OAuth(token)
         };
 
-        let model = non_empty_env("ANTHROPIC_MODEL").unwrap_or_else(|| DEFAULT_MODEL.to_owned());
+        let model = non_empty_env("ANTHROPIC_MODEL")
+            .or(client.model)
+            .unwrap_or_else(|| DEFAULT_MODEL.to_owned());
 
-        let base_url =
-            non_empty_env("ANTHROPIC_BASE_URL").unwrap_or_else(|| DEFAULT_BASE_URL.to_owned());
+        let base_url = non_empty_env("ANTHROPIC_BASE_URL")
+            .or(client.base_url)
+            .unwrap_or_else(|| DEFAULT_BASE_URL.to_owned());
 
         let max_tokens = non_empty_env("ANTHROPIC_MAX_TOKENS")
             .and_then(|v| v.parse().ok())
+            .or(client.max_tokens)
             .unwrap_or(DEFAULT_MAX_TOKENS);
 
         // Adaptive thinking is always enabled — the model decides the budget.
         let thinking = Some(ThinkingConfig::Adaptive);
 
-        let show_thinking = env_bool("OX_SHOW_THINKING");
+        let show_thinking = env_bool("OX_SHOW_THINKING")
+            .or(tui.show_thinking)
+            .unwrap_or(false);
 
         Ok(Self {
             auth,
@@ -76,8 +90,15 @@ fn non_empty_env(key: &str) -> Option<String> {
     std::env::var(key).ok().filter(|v| !v.is_empty())
 }
 
-fn env_bool(key: &str) -> bool {
-    non_empty_env(key).is_some_and(|v| v == "1" || v == "true")
+/// Parse a boolean environment variable.
+///
+/// Returns `Some(true)` for `"1"` or `"true"`, `Some(false)` for any other
+/// non-empty value, and `None` when unset or empty. The `Some(false)` case
+/// is intentional: setting the variable to any value (even `"0"` or `"no"`)
+/// is treated as an explicit override that prevents fallthrough to config
+/// file values.
+fn env_bool(key: &str) -> Option<bool> {
+    non_empty_env(key).map(|v| v == "1" || v == "true")
 }
 
 #[cfg(test)]