2 files changed, 103 insertions, 7 deletions

diff --git a/internal/config/config.go b/internal/config/config.go
index 6f6b958..80777ff 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -45,6 +45,24 @@ func (m LocalModel) UseForElaborate() bool {
 	return *m.PreferForElaborate
 }
 
+// RunnersConfig controls which agent runners are registered. Each field is a
+// *bool so that nil (absent from TOML) means "enabled by default", while an
+// explicit false disables the runner without affecting others.
+//
+// The local runner also requires LocalModel.Endpoint to be set; setting
+// Local = true without an endpoint has no effect.
+type RunnersConfig struct {
+	Claude    *bool `toml:"claude"`
+	Gemini    *bool `toml:"gemini"`
+	Local     *bool `toml:"local"`
+	Container *bool `toml:"container"`
+}
+
+func (r RunnersConfig) ClaudeEnabled() bool    { return r.Claude == nil || *r.Claude }
+func (r RunnersConfig) GeminiEnabled() bool    { return r.Gemini == nil || *r.Gemini }
+func (r RunnersConfig) LocalEnabled() bool     { return r.Local == nil || *r.Local }
+func (r RunnersConfig) ContainerEnabled() bool { return r.Container == nil || *r.Container }
+
 type Config struct {
 	DataDir          string        `toml:"data_dir"`
 	DBPath           string        `toml:"-"`
@@ -69,20 +87,16 @@ type Config struct {
 	VAPIDEmail       string        `toml:"vapid_email"`
 	ClaudeConfigDir  string        `toml:"claude_config_dir"`
 	LocalModel       LocalModel    `toml:"local_model"`
+	Runners          RunnersConfig `toml:"runners"`
 	Budget           BudgetConfig  `toml:"budget"`
 	// ExternalBindAllowed must be explicitly true to bind a non-loopback address.
-	// Default external access should go through a reverse proxy (Tailscale /
-	// Cloudflare Access / Caddy); binding the server directly is a footgun.
 	ExternalBindAllowed bool `toml:"external_bind_allowed"`
 }
 
 // BudgetConfig configures rolling per-provider spend caps. With no providers
-// set, budget gating is disabled (nothing is blocked) — there is intentionally
-// no default cap; the user must opt in by configuring limits.
+// set, budget gating is disabled.
 type BudgetConfig struct {
-	// Window is the rolling lookback duration (e.g. "5h"); defaults to 5h.
-	Window string `toml:"window"`
-	// Provider5hUSD maps a provider (claude/gemini) to its USD cap within Window.
+	Window        string             `toml:"window"`
 	Provider5hUSD map[string]float64 `toml:"provider_5h_usd"`
 }
 
diff --git a/internal/config/config_test.go b/internal/config/config_test.go
index e4f1a5d..0d47ca0 100644
--- a/internal/config/config_test.go
+++ b/internal/config/config_test.go
@@ -54,6 +54,88 @@ func TestLoadFile_MissingFile_ReturnsError(t *testing.T) {
 	}
 }
 
+func TestRunnersConfig_DefaultsAllEnabled(t *testing.T) {
+	r := RunnersConfig{}
+	if !r.ClaudeEnabled() {
+		t.Error("claude should be enabled by default (nil)")
+	}
+	if !r.GeminiEnabled() {
+		t.Error("gemini should be enabled by default (nil)")
+	}
+	if !r.LocalEnabled() {
+		t.Error("local should be enabled by default (nil)")
+	}
+	if !r.ContainerEnabled() {
+		t.Error("container should be enabled by default (nil)")
+	}
+}
+
+func TestRunnersConfig_ExplicitFalseDisables(t *testing.T) {
+	f := false
+	r := RunnersConfig{Claude: &f, Gemini: &f, Local: &f, Container: &f}
+	if r.ClaudeEnabled() {
+		t.Error("explicit false should disable claude")
+	}
+	if r.GeminiEnabled() {
+		t.Error("explicit false should disable gemini")
+	}
+	if r.LocalEnabled() {
+		t.Error("explicit false should disable local")
+	}
+	if r.ContainerEnabled() {
+		t.Error("explicit false should disable container")
+	}
+}
+
+func TestRunnersConfig_ExplicitTrueEnables(t *testing.T) {
+	tr := true
+	r := RunnersConfig{Claude: &tr, Gemini: &tr, Local: &tr, Container: &tr}
+	if !r.ClaudeEnabled() || !r.GeminiEnabled() || !r.LocalEnabled() || !r.ContainerEnabled() {
+		t.Error("explicit true should keep all runners enabled")
+	}
+}
+
+func TestRunnersConfig_MixedToggles(t *testing.T) {
+	f, tr := false, true
+	r := RunnersConfig{Claude: &tr, Gemini: &f, Local: &tr}
+	if !r.ClaudeEnabled() {
+		t.Error("claude should be enabled")
+	}
+	if r.GeminiEnabled() {
+		t.Error("gemini should be disabled")
+	}
+	if !r.LocalEnabled() {
+		t.Error("local should be enabled")
+	}
+	if !r.ContainerEnabled() {
+		t.Error("container should be enabled (nil = default)")
+	}
+}
+
+func TestRunnersConfig_TOMLRoundTrip(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "config.toml")
+	toml := "[runners]\ngemini = false\n"
+	if err := os.WriteFile(path, []byte(toml), 0600); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("HOME", dir)
+
+	cfg, err := LoadFile(path)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if cfg.Runners.GeminiEnabled() {
+		t.Error("gemini should be disabled after TOML load")
+	}
+	if !cfg.Runners.ClaudeEnabled() {
+		t.Error("claude should remain enabled (not in TOML)")
+	}
+	if !cfg.Runners.LocalEnabled() {
+		t.Error("local should remain enabled (not in TOML)")
+	}
+}
+
 func TestLocalModel_UseForElaborate_EmptyEndpoint(t *testing.T) {
 	m := LocalModel{}
 	if m.UseForElaborate() {