Workspace settings

/sparkyard settings shows; /sparkyard settings KEY VALUE changes (admin only, per workspace — there are no deployment-wide defaults for anything a workspace can choose).

Key	Values	Meaning
workbench	on / off	Allow /sparkyard ide, shell and db — access to the machine rather than a page. Off until you accept what that means.
canvas	auto / on / off	Thread archive canvases.
idle-days	number	Days before idle threads are reaped.
vm-idle-minutes	number	Quiet minutes before your VMs suspend. Tightens the operator’s value; the minimum wins.
agent	claude / chatgpt / gemini / copilot	Which agent answers when nothing else has chosen one. A thread, a person and a desk each beat it.
guardrails	names, or none	Rules a turn cannot talk its way out of — currently protected-branches. Claude only; see below.
protected-branches	names	Branches the rule above defends. Unset means master and main.
no-tools	tool names	Tools a turn may never use. Claude only; see below.
max-turns	number	A hard stop on agentic turns within one message. Claude only; see below.
vm-abandon-days	number	Days before an abandoned VM is destroyed (the volume survives). Also min-wins.
link-auth	claim / oidc / both	How somebody proves a locked link was meant for them. claim needs no setup and works on any chat platform — it is what you get having chosen nothing. oidc makes a link inherit your own sign-in, MFA and conditional access included. both offers the two doors.
link-ceiling	public / workspace / people / owner	The most open any link here may be. A ceiling, not a default: set it to workspace and a link that would have been public is created clamped to this instead. For an org with customer code in its repositories.

Rules and which agents can run

guardrails, no-tools, protected-branches and max-turns are enforced by the Claude agent itself. Codex, Gemini and Copilot are separate programs that accept none of them.

So setting one of these is a choice between the rule and the other three agents, and Sparkyard makes that choice visible instead of dropping the rule quietly:

• Switching a thread to an agent that cannot enforce your rule is refused, and the message names the rule. Use //agent claude, or clear the setting.
• Setting a rule tells you which agents it excludes. Threads already running on one of them carry on, and the rule does not apply to them.
• max-turns is the exception. It caps cost rather than access, so you get a warning and the switch goes ahead.