Complete settings reference

Files and loading order

Global user configuration: ~/.lurus/settings.json. Project configuration: <cwd>/.lurus/settings.json. Do not rely on an additional settings.local.json layer. Use JSON without comments. Preserve existing values when editing; do not blindly overwrite an existing file with examples.

The CLI first loads defaults, then global files and project files. LURUS_API_URL and LURUS_MODEL can override the corresponding file values. Executable settings and permissions become active only after the required consent.

Not simply “project wins”. Ordinary global values are shallowly applied. Project UX fields can override directly, denies accumulate, execution/grants/utility models require consent. Same-name MCP objects replace each other entirely. No general deep merge or live reload guarantee. /config shows cached configuration, has no set, get or reset, and does not generally reload edits. Start a new CLI session after manual edits.

The tables describe effective defaults, not just schema metadata. G = global; P direct = project without override consent; P consent = after deliberate consent; P ignored = not applied by the normal project loader. Model support and explicit CLI overrides also apply.

Minimal project settings

.lurus/settings.json:

{
  "displayCost": true,
  "permissions": {
    "allow": [],
    "deny": [],
    "allowedCommands": ["git status"],
    "deniedCommands": ["git push"],
    "bashAutoApprove": false
  }
}

Cost display applies directly. Grants require consent; allowedCommands is exact Bash text, not a universal Exec grant. git push adds a deny. After restarting, expect configuration visibility and reviewed consent offers, not blanket permission for Git.

Global counterpart ~/.lurus/settings.json:

{
  "disableDangerousTrust": true,
  "indexing": false,
  "permissions": {
    "allow": [],
    "deny": [],
    "allowedCommands": ["git status"],
    "deniedCommands": ["git push"],
    "bashAutoApprove": false
  }
}

disableDangerousTrust and indexing belong globally here. The same fields are ignored by the normal project loader and do not provide persistent project protection.

Every configuration field

For optional model fields, use an actual selection from /model.

Output truncation and index restart

Without truncateToolOutput, character limits depend on the tool: 40,000 for file reads, shell output and web content; 25,000 for text and semantic search; 10,000 for file and directory lists; 80,000 for subagent responses; and 8,000 for other output. Ordinary tool output is also dynamically limited to between 5,000 and 80,000 characters. Subagent responses and plan documents are exempt from that reduction.

/indexing on|off writes a project file and sets a trusted runtime override, but the normal loader does not apply that project value after restarting. That project write alone is not a dependable persistent opt-out. For persistent opt-out use global indexing:false and check the account setting. /indexing clear|delete removes the index, not the setting.

Permission subfields

allowedCommands:["git"] does not permit arbitrary Git commands. git status --short is not git status. Script/CWD/secret/dangerous/capability checks remain; see permissions.

Do not rely on a universal default for bashAutoApprove. Its active effect depends on loaded rules and consent.

Important: A project value of false is not a persistent veto against an approved global value of true. For protection, explicitly set bashAutoApprove to false globally and review or revoke existing grants.

MCP subfields

All fields live under mcpServers.<name>; see the full MCP workflow:

A project server replaces a same-name global object entirely. Rejecting the project source does not guarantee starting a global fallback server.

Hook subfields

hooks|globalHooks|projectHooks.<Event>: Definition[]; definitions have optional matcher:string and hooks:Action[]:

• Command action: type:"command", command:string, optional timeout:number ms.
• HTTP action: type:"http", url:string, optional method:"POST"|"PUT"|"PATCH", headers:Record<string,string>, timeout:number.
• The timeout defaults to 30,000 ms and the HTTP method to POST. A separate hooks.json contains the event map directly.

Hooks covers complete examples, supported events, blocked headers, matchers and failure behavior.

Advanced project scenarios

.lurus/settings.json for existing reviewed npm scripts:

{
  "autoLint": true,
  "autoTest": "npm run test:unit",
  "displayCost": true
}

After project consent, verification uses the existing lint and test:unit scripts. Review the npm lifecycle, working directory and script contents; changes can require new approval. Do not create wrapper scripts to bypass a denied operation.

For modelAliases, obtain the public selection from /model first. Use {"my-review":"<selected-public-model>"} and replace the placeholder before use. Project aliases require consent and merge by name with global aliases. The project model value itself is not applied.

Managed values and legacy fields

Manage skill activation with /skills activate|deactivate and agent approval with /agents trust|untrust, rather than editing stored management data manually. Bundled skills are active by default.

• Select interaction mode through a CLI flag or /mode, not by manually setting mode in the file.
• permissionMode is a process option, not a supported settings key.
• disableBypassPermissions is an older global alias for disableDangerousTrust; use the latter in new configurations.
• costWarningThreshold is ignored; use costLimit.
• lurus.config.json, .lurusrc, allowedPaths, blockedPaths, requireConfirmation, beforeWrite and afterCommit are not current CLI settings.

Schema and public environment

The local settings schema does not fully describe all supported options and defaults. Do not rely solely on its validation or assume a public $schema URL exists. Use the field types and scopes documented here.

Troubleshooting and automation cover safe usage.