<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<!--
  Gnista: a template configuration profile for team plans (gnista.sh/teams/mdm).

  How to use it:
  1. Keep the keys you need under "Forced" and delete the rest. Every key is optional; Gnista ignores keys it
     doesn't know.
  2. Give each PayloadUUID a fresh UUID (run `uuidgen` in Terminal), and set PayloadOrganization.
  3. Upload it to your MDM (Jamf Pro, Kandji, Microsoft Intune, Mosyle, ...) and scope it to your Macs, or for a first
     try double-click it and install it in System Settings > General > Device Management.

  Settings other than LicenceKey apply only with a team plan's key (active, or ended). With a personal licence Gnista
  ignores them and says "Central configuration requires a team plan" in Settings > About > Licence.
  Enforced settings show as "Managed by your organisation" in Gnista's Settings and can't be changed there.

  Every key except LicenceKey and DisplayMode counts only under Forced.

  Agent names, for EnabledAgents and ApprovalAgents: claude, cowork, codex, gemini, copilot (CLI and VS Code),
  opencode, devin, qwen, qwenwork, qoder, qoder-cn, qoderwork, droid, cursor, antigravity, vibe, codebuddy,
  workbuddy, kimi, kilo, mimocode, zcode, amp, auggie, goose, pi, omp, openhands, codewhale, dsh, grok, trae, trae-cn, and custom
  agents by their file's name. Answering prompts in Gnista works for claude, codex, devin, opencode, qwen, qoder,
  qoder-cn, codebuddy, workbuddy, droid, kilo, mimocode and zcode.
-->
<plist version="1.0">
<dict>
	<key>PayloadDisplayName</key>
	<string>Gnista</string>
	<key>PayloadDescription</key>
	<string>Gnista's licence key and settings for your team.</string>
	<key>PayloadIdentifier</key>
	<string>sh.gnista.Gnista.profile</string>
	<key>PayloadOrganization</key>
	<string>Your organisation</string>
	<key>PayloadScope</key>
	<string>System</string>
	<key>PayloadType</key>
	<string>Configuration</string>
	<!-- Replace with a fresh UUID (uuidgen). -->
	<key>PayloadUUID</key>
	<string>00000000-0000-4000-8000-000000000001</string>
	<key>PayloadVersion</key>
	<integer>1</integer>
	<key>PayloadContent</key>
	<array>
		<dict>
			<key>PayloadDisplayName</key>
			<string>Gnista settings</string>
			<key>PayloadIdentifier</key>
			<string>sh.gnista.Gnista.profile.preferences</string>
			<key>PayloadType</key>
			<string>com.apple.ManagedClient.preferences</string>
			<!-- Replace with a fresh UUID (uuidgen). -->
			<key>PayloadUUID</key>
			<string>00000000-0000-4000-8000-000000000002</string>
			<key>PayloadVersion</key>
			<integer>1</integer>
			<key>PayloadContent</key>
			<dict>
				<!-- Gnista's preferences domain. -->
				<key>sh.gnista.Gnista</key>
				<dict>
					<!-- Enforced: the user can't change these. -->
					<key>Forced</key>
					<array>
						<dict>
							<key>mcx_preference_settings</key>
							<dict>
								<!-- Your team plan's key, from Creem's email. Gnista activates it by itself on
								     each Mac without a licence, at launch, which takes one of the plan's places
								     (Team 10: 10 Macs). -->
								<key>LicenceKey</key>
								<string>GNISTA-XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX</string>

								<!-- Only these agents can be connected, and only their sessions show. -->
								<key>EnabledAgents</key>
								<array>
									<string>claude</string>
									<string>codex</string>
								</array>

								<!-- false: nobody answers prompts in Gnista; agents always ask in their own
								     prompt. -->
								<key>ApprovalsAllowed</key>
								<true/>

								<!-- Agents whose prompts may be answered in Gnista. Others ask in their own
								     prompt. -->
								<key>ApprovalAgents</key>
								<array>
									<string>claude</string>
								</array>

								<!-- ask (default), always or never. ask: after a crash, Gnista asks whether to
								     send the report. always: it sends it without asking. never: it doesn't
								     send or ask. -->
								<key>CrashReportsMode</key>
								<string>never</string>

								<!-- true: automatic updates on, and locked. false: Gnista doesn't check for
								     updates by itself, for IT to roll them out. Leave it out to let people
								     choose. -->
								<key>AutomaticUpdates</key>
								<false/>

								<!-- false: no remote machines over SSH. Gnista closes its tunnels and Settings
								     can't add one. -->
								<key>RemoteMachinesAllowed</key>
								<true/>

								<!-- How remote machines connect: automatic (Gnista's own ssh, forwarding),
								     relay (Gnista's own ssh, never forwarding: an ordinary command) or manual
								     (no ssh of Gnista's own: the user's sessions forward, by a line in their
								     ssh config). -->
								<key>RemoteConnection</key>
								<string>relay</string>
							</dict>
						</dict>
					</array>
					<!-- Set once: a starting point the user can change in Settings. To enforce it instead, move
					     DisplayMode into Forced above. -->
					<key>Set-Once</key>
					<array>
						<dict>
							<key>mcx_data_timestamp</key>
							<date>2026-10-15T00:00:00Z</date>
							<key>mcx_preference_settings</key>
							<dict>
								<!-- notch, menuBar or both. -->
								<key>DisplayMode</key>
								<string>notch</string>
							</dict>
						</dict>
					</array>
				</dict>
			</dict>
		</dict>
	</array>
</dict>
</plist>
