Configuration

Global defaults live in config.json under the platform config directory. co-maintainer set writes that file. init / sync also record per-repo choices there (not API tokens). Generated guides sit under repos/ in the same tree. Full paths: Caching.

serve reads the same config.json for the GitHub App, webhook URL, dashboard auth defaults, and CLI remote-review targets.

Precedence

For CLI commands (probe, init, sync, review):

API tokens are never stored per repo. They come from --token=, env, or set --token=... only.

co-maintainer set

Persists global settings so later commands can skip flags and prompts.

co-maintainer set --auth=gh --ai=openrouter --token=YOUR_KEY \
  --low-model=openai/gpt-oss-120b --high-model=openai/gpt-5.6-luna

co-maintainer set --github-app-id=... --github-app-private-key-file=./app.pem
co-maintainer set --github-app-id=... --github-app-private-key-path=./app.pem
co-maintainer set --remote-host=https://your-server --remote-token=cmr_...

--ai also takes openai and anthropic. There is no default model for any provider, so both models are saved the first time. See AI providers.

set flags

App private key: inline, file contents, or path

Three flags set the GitHub App private key, and they differ in what lands in config.json:

• --github-app-private-key=PEM writes the key itself.
• --github-app-private-key-file=path reads the file and writes its contents. If the file later moves or is deleted, the App keeps working.
• --github-app-private-key-path=path writes only the path. The key stays on disk and is read at startup, so the secret never enters config.json. If the file is missing or unreadable, serve warns at startup that the App will not work.

An inline key wins if both an inline key and a path are ever present. set clears the other form when you pass one, so the choice is unambiguous.

Verification before saving

Whatever the provider is, set asks it whether the key works and, if a model is given, whether the provider has that model. OpenRouter is checked against its key and model endpoints, OpenAI and Anthropic against their model list, and OpenCode against its public model list, which checks the model but not the key. A bad key or unknown model is refused with exit code 2 and nothing is written. A network failure only warns (saved anyway), because that is not a typo. Pass --no-verify to skip the check, for example in CI with an offline key. The checks are listed on AI providers.

OAuth setup steps: serve: Sign in.

co-maintainer config

Reads and edits the same config.json without opening the file. set is the short form of config set, and its output and flags are unchanged.

co-maintainer config list                  # key, value, and source per row
co-maintainer config get high-model        # one raw value, no label
co-maintainer config set remote-host https://review.example.com
co-maintainer config set --remote-token=cmr_...
co-maintainer config unset remote-token
co-maintainer config path                  # the config file
co-maintainer config path --all            # config, repos, and cache directories

list prints where each value came from: env (an environment variable overrides the file at run time), file, or nothing for an unset key. Secrets are masked: twelve characters or more keep their last four, shorter ones show only ••••, and the dashboard password reports set or not set rather than its hash. get prints the real value, so treat its output as a secret.

Keys are the UserConfig field names in kebab-case (high-model, remote-host, review-blocking), and camelCase is accepted too. A name that is not a config key is refused with exit code 2.

Config keys

Every key config.json can hold. The mask column says whether config list hides the value.

config get prints the real value even for a masked key, so treat its output as a secret.

CM_CODEGRAPH_VERSION overrides codegraph-version at run time, ahead of the file. See Codegraph.

Unset

co-maintainer set --unset=token
co-maintainer set --unset=github-webhook-secret
co-maintainer set --unset=disable-auth

--unset=disable-auth clears passwordAuthDisabled so the dashboard password is allowed again. Match --unset= to the field name or the flag name (see co-maintainer set --help).

Per-repo memory

After each successful init or sync, config.json gains repos["owner/repo"] with:

A plain co-maintainer sync owner/repo reuses those values. Pass new flags on sync or run init again to change includes, limits, or pull request filters permanently. --only-request-changed-pr stays on once saved. To collect every pull request state again, pass --pr-state=open,closed,merged. clear owner/repo deletes this entry, so the repository goes back to "never inited" and the next build is an init.

review-system-prompt and its cap are the exception: init and sync never write them. Set them with co-maintainer set --repo=owner/repo or the repository Settings page.

Guide files (SKILL.md, CODEBASE.md, review guides) live under <config>/co-maintainer/repos/<owner>/<repo>/, not in your git clone. See Caching. co-maintainer view prints them locally, and view --remote prints the copies a configured review server holds (see Remote review).

Secrets on disk

config.json may contain tokens, PATs, App private keys, and webhook/OAuth secrets in plain text. The file is chmod 0600 where supported (not on Windows).

Dashboard Settings can also save credentials after validating them with GitHub.

Path overrides

More cache and database paths: Caching.

Remote review variables

These let a job with no config file, such as CI, reach a review server. A flag wins over the environment, and the environment wins over config.json. An empty value counts as not set.

config list shows env as the source of remote-host and remote-token when their variable is set.