Configuration

The user-facing settings Leg reads, the seller settings for its checkout site, and the card-level options that configure one card instead of the whole install. For a developer who needs to change a default or point Leg at a non-default binary.

Environment variables use the LEG_ prefix with automatic fallback to legacy BATON_* variables if set.

.env

npm start and npm run dev run node --env-file-if-exists=.env bin/leg.mjs up: npm start and npm run dev automatically load a .env file in the repo root through that Node flag. Inherited shell values are still honored and take precedence. Copy .env.example to .env and edit it; .env is gitignored. Running node bin/leg.mjs directly does not automatically load .env; export the variables yourself in that case.

Interactive sessions

These apply to leg claude|codex|agy.

| LEG_PERSON | the board's owner | whose terminal this is when the board is shared (leg share); it is the name on the card and the one that decides who may control it | src/share.mjs whoami |

LEG_SESSION is not an input: Leg sets it in the agent's environment to the session id, so a hook or a script inside the session can find its own record under $LEG_HOME/sessions/.

CLAUDE_CONFIG_DIR and CODEX_HOME are set for the child when the session runs on a named account; see Accounts below.

Core

Optional syncs

Off unless explicitly enabled; a sync failure never blocks or fails a card (see concepts.md and the README's "Optional syncs" section).

Seller and checkout site

These are for the checkout/key-delivery site and its deployment helpers, not normal Leg CLI use.

Adapter binary overrides

Each points at a specific CLI binary (or, when it ends .mjs/.cjs/.js, a Node entry point run via node <entry>), instead of Leg's own resolution logic. See adapters.md for what each adapter resolves to by default.

Accounts

An extra login is a directory under $LEG_HOME, never a change to your real home. src/accounts.mjs LAYOUT is the whole definition.

~/.leg/
  accounts.json                     the named accounts per agent
  accounts/claude/<name>/
    hooks/ skills/ agents/ commands/ plugins/ rules/ scripts/
    output-styles/ tools/           junctions back to ~/.claude
    settings.json settings.local.json CLAUDE.md keybindings.json
    statusline.ps1 statusline-combined.ps1
                                    copies, refreshed before every launch
    .credentials.json               the login, written by claude itself
  accounts/codex/<name>/
    skills/ prompts/ rules/ plugins/ agents/ hooks/ memories/ superpowers/
    junctions back to ~/.codex
    config.toml AGENTS.md           copies, refreshed before every launch

Commands:

leg accounts ls                      logins and their 5h/7d usage
leg accounts add <claude|codex> <name>
leg accounts rm <claude|codex> <name>
leg accounts terms                   what both vendors' terms say

add creates the directory, junctions the shared directories in, copies the settings files, and prints one line to paste to log in. rm removes the junctions as links, never following them, then deletes the directory. Nothing under your real home is written at any point. Start a session on a named account with LEG_ACCOUNT=<name>, or let a limit hand off to it.

Test and development seams

Not meant for normal use; documented for completeness.

Network exposure

Leg binds 127.0.0.1 by default: no token is required, and only processes on the same machine can reach it. Setting LEG_BIND to any other address without also setting LEG_TOKEN makes the server refuse to start, exit code 3 (src/auth.mjs checkBind/BindRefused). With a token set, every /api/* request needs an Authorization: Bearer <token> header; the event stream (EventSource, which cannot set headers) accepts the same token as a ?token= query parameter instead. There is no TLS; keep LEG_BIND on loopback unless you are using leg share, which gives each human their own token (see Share).

Share (more than one human)

Off until leg share on writes $LEG_HOME/share.json. That file is the switch and the roster; the env variables below only tune the limits.

LEG_TOKEN is the single-token mode and is ignored while share is on.

Card-level options

These configure one card, not the whole install (set with card add flags or the New card form; see getting-started.md and board-guide.md):

• leases: path globs the card claims for scheduling (src/leases.mjs).
• land_mode: ff (fast-forward, the merge queue) or pr (stub; requires LEG_GH_BIN) (src/land.mjs).
• test_command: overrides the land/test stations' auto-detected command (src/mergequeue.mjs resolveTestCommand).
• trunk: the branch a card's worktree is based on and lands onto (default main).
• Per-adapter chain options: mode, max-turns, model, and approve (gate that leg behind a human Approve), set per adapter with --mode <adapter>=<mode>, --max-turns <adapter>=<n>, --model <adapter>=<name>, --approve <adapter,...> (src/pipeline.mjs normalizeChainEntry).

See also

• adapters.md: what each LEG_<ADAPTER>_BIN overrides, and each adapter's default resolution.
• concepts.md: leases, the scheduler, and the land station these variables tune.

Leg is commercial, source-available software by Wes Sander. The source you run ships in the npm package. Questions or a refund: legcli@practicalsystems.io.