codey/config.example.toml at main · gitgost-anonymous/codey · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
# Codey Configuration Example
# Copy this file to: ~/.config/codey/config.toml

[general]
# Default model to use
model = "claude-sonnet-4-20250514"

# Working directory (default: current directory)
# working_dir = "/path/to/project"

# Maximum tokens for responses
max_tokens = 8192

[auth]
# Authentication method: "oauth" or "api_key"
method = "oauth"

# API key (only if method = "api_key")
# api_key = "sk-ant-..."
#
# Or set the ANTHROPIC_API_KEY environment variable

[ui]
# Syntax highlighting theme
# Available: base16-ocean.dark, base16-ocean.light, InspiredGitHub, Solarized (dark), Solarized (light)
theme = "base16-ocean.dark"

# Enable auto-scroll when new content arrives
auto_scroll = true

# Show token usage in status bar
show_tokens = true

[tools]
# Tools to enable (leave empty for all)
enabled = ["read_file", "write_file", "edit_file", "shell", "fetch_url"]

# Tool parameter filters for auto-approve/auto-deny
# Evaluation order:
#   1. If any deny pattern matches → auto-deny (blocked)
#   2. If any allow pattern matches → auto-approve (no prompt)
#   3. Otherwise → prompt user for approval

# Shell command filters (matches against 'command' parameter)
[tools.shell]
allow = [
    "^ls\\b",           # ls commands
    "^find\\b",         # find commands
    "^cat\\b",          # cat commands
    "^head\\b",         # head commands
    "^tail\\b",         # tail commands
    "^grep\\b",         # grep commands
    "^rg\\b",           # ripgrep commands
    "^wc\\b",           # wc commands
    "^pwd$",            # pwd command
    "^echo\\b",         # echo commands
]
deny = [
    "rm\\s+-rf\\s+/",   # dangerous rm
    "sudo\\s+rm",       # sudo rm
    ":(){ :|:& };:",    # fork bomb
    "\\|\\s*sh\\b",     # piping to shell
    "\\|\\s*bash\\b",   # piping to bash
    "curl.*\\|",        # curl piped to anything
    "wget.*\\|",        # wget piped to anything
]

# Read file filters (matches against 'path' parameter)
[tools.read_file]
allow = [
    "\\.(rs|toml|md|txt|json|yaml|yml|ts|js|py|go|c|h|cpp|hpp)$",  # Common code files
]
deny = [
    "\\.env$",          # Environment files
    "secrets?",         # Secret files
    "\\.pem$",          # Private keys
    "\\.key$",          # Key files
]

# Write file filters (matches against 'path' parameter)
[tools.write_file]
allow = []
deny = [
    "\\.env$",          # Environment files
    "\\.pem$",          # Private keys
    "\\.key$",          # Key files
]

# Edit file filters (matches against 'path' parameter)
[tools.edit_file]
allow = []
deny = [
    "\\.env$",          # Environment files
    "\\.pem$",          # Private keys
]

# URL fetch filters (matches against 'url' parameter)
[tools.fetch_url]
allow = [
    "^https://",        # Only HTTPS
]
deny = [
    "localhost",        # No local requests
    "127\\.0\\.0\\.1",  # No loopback
    "192\\.168\\.",     # No private networks
    "10\\.",            # No private networks
    "172\\.(1[6-9]|2[0-9]|3[01])\\.",  # No private networks
]

# =============================================================================
# Neovim Integration
# =============================================================================
# Codey connects to Neovim via RPC socket for diff previews, buffer management,
# and navigation. Start nvim with: nvim --listen /tmp/nvim-$(tmux display -p '#S').sock

[ide.nvim]
# Enable neovim integration
enabled = true

# Explicit socket path (optional - auto-discovers from tmux or $NVIM_LISTEN_ADDRESS)
# socket = "/tmp/nvim.sock"

# Show diff/file previews in nvim before approving changes
show_diffs = true

# Automatically reload buffers after file modifications
auto_reload = true