Configuration overview

Write config with grith init or grith config set. Hand-writing a short config file has a failure mode that stops the CLI dead - see the sparse-file trap below.

grith config prints the effective configuration, every key, after all layers are applied.

$ grith config
2026-08-24T17:05:10.719720Z  INFO grith: grith starting version="0.3.1"
[general]
log_level = "info"
audit_dir = "~/.local/share/grith/audit"
plan_tier = "community"
update_check = true
audit_sync = true
profile_update_check = true
onboarded = false
exec_notice_seen = false

Layers

Five layers, applied in order. Later wins.

--log-level is applied after all five and is the only CLI flag that behaves as a config layer. --config and --project are inputs to the layering, not values in it.

The sparse-file trap

Every layer is deserialised into the config struct and then deep-merged, so a file that omits a key still contributes that key's Rust default - which is not always the value default.toml ships. A two-line overlay is enough to break the CLI:

$ cat config.toml
[general]
log_level = "debug"

$ grith --config config.toml config
Error: configuration invalid:
supervisor.default_profile must be set in TOML or via GRITH_SUPERVISOR_PROFILE

default.toml sets default_profile = "generic"; the struct default is the empty string, which validation rejects. Five keys differ this way, and all five shift the moment any user, project or --config file exists:

Both safe routes write a complete file. grith init writes the whole of default.toml, comments intact, to ~/.config/grith/config.toml - unconditionally, with no backup and no merge. grith config set loads the effective config, changes one key and writes it all back; comments are lost. If you do hand-write a file, keep supervisor.default_profile in it and check the result with grith config.

What grith config set accepts

A fixed whitelist of keys, not arbitrary dotted paths:

$ grith config set supervisor.trust.restrict_to_workspace true
2026-08-24T17:05:10.733695Z  INFO grith: grith starting version="0.3.1"
Error: configuration error: unknown config key: supervisor.trust.restrict_to_workspace

The grith config reference lists the keys worth knowing about. Everything else - all of [supervisor.coverage], [supervisor.trust], [audit], [reputation], [proxy.filters.*], [server.tls] - is edited in the file. There is no grith config reload, get, list, edit or validate; set is the only subcommand.

When a change takes effect

Config is read at process start, so a change reaches a running daemon on restart:

$ grith daemon stop && grith daemon start

The dashboard writes two proxy thresholds and auto_open_dashboard through PUT /api/config. That updates the file; it does not mutate the live proxy, and its own response says the thresholds apply after a restart. Filter toggles saved from the dashboard persist to the file but do not change which filters the daemon registers.

Validation aborts the command rather than degrading quietly - a threshold pair the wrong way round, a log level outside trace|debug|info|warn|error, a provider outside ollama|openai|anthropic|openrouter, server.port = 0, or a blank default_profile:

$ grith --config bad.toml config
Error: configuration invalid:
proxy.auto_allow_threshold (9) must be less than auto_deny_threshold (8)

Where to go next

• [supervisor] - syscall coverage, workspace trust, DNS
• [proxy] - thresholds and filter switches
• [audit] - what is recorded and for how long
• Filter config files - the data files filters load
• Environment variables