Configuration

Four layers, each overriding the last key by key. Tables merge; arrays replace, so overriding one command leaves the patterns that read it alone.

built in                                 (compiled from default.toml)
$XDG_CONFIG_HOME/slop-review/config.toml yours
<repo>/.slop-review.toml                 the repository's, shared
<repo>/.slop-review.local.toml           yours, inside the repository

Either repo file may also be named without the leading dot. A command-line flag beats all four.

The ⚙ button in the window edits any of the three, one at a time. Each setting has a tick saying whether this file decides it — taking a key out is as much an edit as putting one in — and beside it, what the setting comes out as without this file and which layer said so. The control itself is always live: changing a value is the decision that this file should decide it, so it ticks the box on the way past. Ticking the box by hand starts the setting from the value already in force rather than resetting it. Under the controls is the file itself, so a VCS profile, which is argv and regular expressions and which a form would only make worse, stays text. Edits keep the comments and layout that were already there.

The commit message body has its own ink, because the weak grey it shared with the id and the author line under it is right for a label about the commit and wrong for the one piece of prose on the panel that is there to be read. message_color takes text, strong or weak — roles the appearance resolves, so they stay right on a light page and a dark one — or a #rrggbb, which is only ever right on the page you picked it against. The button beside the roles starts from whatever the setting currently comes out as.

A control applies itself: a quarter-second after you stop moving it the file is written and the stack is read back, so a zoom or a theme is judged by looking at the diff rather than by pressing Save and seeing. Writing is applying here — the window edits one file of several, and what a file means only comes out of reading the whole stack, so there is nothing honest to show in between. Save is still there for the text box below. Either way the file is validated first, and everything but the VCS commands takes effect at once; commands need a restart, because the readers were built when the backend opened.

Finding the repository needs a marker, which comes from a profile, so the stack is built in two passes: what ships plus your own file locates the root, and only then is anything inside it read. There is no third pass and no loop.

Trust

A configuration that says what to run is a program, and git clone should not be a way to run one. So a file inside a repository may set how a diff looks, what size the text is and which theme to use — all of that applies the moment you open it — but its VCS commands are ignored until you have said otherwise:

slop-review trust           # allow this repository's config to define commands
slop-review trust --revoke  # take it back

Trust is recorded against the file's contents, not its path. Keying the path is the mistake direnv made and then fixed: permission granted to ~/work/thing/.slop-review.toml would still stand after a fetch brought in a version of it that runs something else. Keyed by content, an edit ends the trust by itself.

Refusing outright would make an untrusted repository a broken one, so an untrusted file loses only its commands: the review opens with the ones you already had, and the reason is on stderr and in the debug view. Trust lives in the same SQLite file as the review state. Losing it fails closed, which is the safe direction.

.slop-review.local.toml is not special-cased. It is subject to the same check, and simply happens to get trusted once and stay that way until you edit it.

An edit made in the settings window keeps whatever trust the file already had — you are the person the trust is about — and the version it used to be stops being trusted in the same breath, so putting the old bytes back does not slip past on a stale key. The other direction never happens: a file that was not trusted does not become trusted by being saved, or opening someone else's configuration and nudging a slider would be all it took.