Configuration

gori stores global preferences in settings.json and each project as its own SQLite database. See the Configuration guide for a walkthrough; this page is the key-by-key reference.

Storage Layout

Everything lives under GORI_HOME ($GORI_HOME if set and non-empty, otherwise ~/.gori):

settings.json

settings.json is JSON. Find or edit it with gori settings / gori settings --edit.

network

{
  "network": {
    "bind_host": "127.0.0.1",
    "bind_port": 8070,
    "upstream_proxy": ""
  }
}

CLI --listen / --port override these for the current process only (not written to disk). See Per-Project Overrides.

layout

Per-area TUI layout prefs (command palette → Settings: Layout). Omitted when both values are factory defaults.

{
  "layout": {
    "history_preview": false,
    "probe_preview": false,
    "issues_preview": false,
    "history_list_order": "newest",
    "sitemap_expand_depth": -1
  }
}

statusline

An opt-in extra row at the very bottom of the TUI (Preferences → General → Statusline). When enabled, gori runs a shell command on an interval and renders its stdout as that row. Think of it as a customizable status bar, inspired by Claude Code's status line. Disabled by default; the section is omitted from settings.json until you change it.

{
  "statusline": {
    "enabled": true,
    "command": "printf 'proj:%s flows:%s' \"$(jq -r .project)\" \"$(jq -r .flows)\"",
    "interval": 3
  }
}

The command's stdout is parsed for ANSI/SGR colour escapes (16-colour, 256-colour, and truecolor, plus bold/underline/etc.), so you can produce coloured segments. Only the first line is used; output is truncated to the terminal width. A run that exceeds interval seconds is terminated, and a failing command simply leaves the row blank. It never blocks the UI.

Each run receives a JSON context on stdin describing the live session, so scripts can display proxy state without querying gori:

{
  "version": 1,
  "project": "acme",
  "capturing": true,
  "flows": 1234,
  "proxy": { "host": "127.0.0.1", "port": 8070, "addr": "127.0.0.1:8070" },
  "upstream": ""
}

display

Message-body and chrome prefs (command palette → Settings: Display). Omitted when every value is a factory default.

{
  "display": {
    "detail_pane": "request",
    "history_time_format": "absolute",
    "show_gutter": true,
    "preview_body_kib": 64,
    "resource_meter": true,
    "terminal_title": "project"
  }
}

hostname_overrides

Global dial map (project-level overrides win on collision). Same idea as /etc/hosts:

{
  "hostname_overrides": [
    { "host": "api.prod.internal", "ip": "10.0.0.42" }
  ]
}

Edit from Preferences → Network & Tabs → Network → Hostname overrides, or the Project tab for per-project entries. See Proxy & History.

env

Tokens like $TOKEN expand at send time in Repeater, Fuzzer, Miner, Intercept, CLI, and MCP:

{
  "env": {
    "prefix": "$",
    "vars": [
      { "key": "TOKEN", "value": "eyJhbGciOi…" }
    ]
  }
}

See Environment Variables.

general

Preferences → General → General:

{
  "general": {
    "clipboard_osc52": true,
    "confirm_quit": false
  }
}

notifications

How background jobs (Miner, Fuzzer, Probe, Discover) announce their results. Preferences → General → Notifications:

{
  "notifications": {
    "bell": false,
    "toast": true,
    "retention": 100
  }
}

probe

{
  "probe": {
    "active_notify": "when-found"
  }
}

discover

Saved defaults for a Discover run. Written only once you save the discover options, so the section is absent until then:

{
  "discover": {
    "containment": "scope-aware",
    "max_depth": 4,
    "concurrency": 20,
    "spider": true,
    "bruteforce": true,
    "extensions": false
  }
}

mine

Saved Param Miner defaults, written only once you save the mine options:

scan_rules

Your own Probe match rules, global across every project. Project-scoped rules live in the project database instead. Edit them in Probe → Rules → CUSTOM:

{
  "scan_rules": [
    {
      "id": "a1b2c3d4",
      "title": "Internal hostname leak",
      "description": "Build-server hostname in a response body",
      "side": "response",
      "region": "body",
      "kind": "regex",
      "pattern": "build-\\d+\\.corp\\.internal",
      "severity": "medium",
      "enabled": true
    }
  ]
}

Parsing is tolerant. An entry missing id, title, or pattern is dropped, and an out-of-range side / region / kind / severity falls back to the safest value rather than failing the load.

Other sections

Per-Project Overrides

A project can pin its own network settings without editing the global file. These are stored in the project database (keys net.bind_host, net.bind_port, net.upstream_proxy) and edited from the Project tab's settings pane.

Effective bind / upstream for an open project:

Saving a Project-tab field that equals the current global value deletes that KV key, so the project keeps inheriting future global edits instead of freezing a duplicate.

Projects & Database

Each project is a SQLite database (via crystal-db / crystal-sqlite3) holding flows, WebSocket messages, scope rules, issues, match rules, HTTP/2 frames, repeater and fuzz sessions, host overrides, sitemap tags, miner sessions, and Probe issues, plus a full-text index over flow bodies. Stored request/response bodies are capped at 2 MiB; larger bodies are truncated in the database, but their true wire size is still recorded. Serve any project's database directly with --db PATH, or select a named project with --project NAME.