Every knob. What it actually does.

mode.*

Behavior axes

Each axis is independent — turning one off doesn't touch the others. Most default to on/advise; nothing here needs the network except routing_judge and catalog_check, both fail-open and bounded.

• mode.routingdefault: advise
  off · advise · enforce

  Set: deadeye config set mode.routing enforce

  Subagent model routing. Fits each subtask to the cheapest model tier that can still do it, based on cheap signals (prompt shape, file scope, git churn, test presence, task specificity) plus the AI routing judge on ambiguous cases. advise suggests the tier; enforce sets it on the Agent call.

• mode.effortdefault: advise
  off · advise

  Set: deadeye config set mode.effort advise

  Effort-level guidance (low/medium/high/xhigh) alongside the routing decision. Advisory only — the Agent tool has no effort parameter to enforce, so there's no enforce mode here.

• mode.preprocessdefault: on
  off · on

  Set: deadeye config set mode.preprocess off

  Context hygiene: Bash-output rewrite rules and unbounded-dump advisories (test/build/lint/install/log output, diffs, history, find/ tree/du/package-list caps), the duplicate-Read / large-Read / repeat-command / content-mode-Grep-without-head_limit advisories, repeat-WebFetch / oversized-MCP-response / flag-escalation-retry / large-paste / long-exploration-streak / compact-timing advisories, the subagent brevity note, and response-size observation logging. Individual rules can be turned off one at a time — see Preprocess rules below.

• mode.plan_gatedefault: soft
  off · soft · hard

  Set: deadeye config set mode.plan_gate hard

  Plan-first gate before multi-file edits. soft nudges; hard blocks an Edit/Write past the file-count trigger (plan_gate.min_files) until a plan exists.

• mode.workflow_hintdefault: on
  off · on

  Set: deadeye config set mode.workflow_hint off

  One-line workflow-authoring suggestion when a task shape looks like it would benefit from the Workflow tool.

• mode.codemapdefault: on
  off · on

  Set: deadeye config set mode.codemap off

  Cross-session codebase map: a directory/package skeleton rebuilt when the tracked-file list changes, plus accumulated touch-frequency and exploration notes, injected once per session. off disables both the SessionEnd writes and the injection.

• mode.update_checkdefault: on
  off · on

  Set: deadeye config set mode.update_check off

  Once-per-session background check for a newer deadeye release; when one is out, the agent asks (once per version) whether to update via /plugin update. Cached ~24h, never blocks the hook response.

• mode.routing_judgedefault: on
  off · on

  Set: deadeye config set mode.routing_judge off

  When the cheap signals can't confidently place a subtask (the majority of real routing decisions), classify its complexity with a real model call — shells to claude -p (sonnet), reusing your Claude login, no API key — instead of defaulting to the sonnet tier outright. Cached per task, fail-open on any error. A deliberate trade of the zero-network default for accuracy on genuinely ambiguous cases: this can block the routing decision for up to 30s on an unsure, uncached task. off restores pure heuristics with no network call.

• mode.catalog_checkdefault: on
  off · on

  Set: deadeye config set mode.catalog_check off

  Background refresh of the hosted model/pricing catalog (a static JSON file on this site), so a new model or price change reaches routing without a plugin release. Read-only GET, no request body. Cached ~24h, never blocks the hook response, and only takes effect if the fetched catalog is well-formed — a bad or unreachable fetch always falls back to the compiled-in table. A local ~/.deadeye/catalog.json override always wins over the hosted copy.

coder.*

The lean-coding persona

Injected into coding sessions and matching subagents. security and security_osv are independent of the persona level since 0.17.0 — turning the persona off no longer silences the security lens.

• coder.default_leveldefault: marksman
  off · spotter · marksman · sniper

  Set: deadeye config set coder.default_level sniper

  Coder-mode intensity new sessions start at. spotter flags the leaner alternative but builds what's asked; marksman enforces the lean-first ladder (default); sniper is maximum minimalism and challenges the requirement itself. Switch mid-session with /deadeye-coder <level> — that changes only the live session, not this default.

• coder.subagent_matcherdefault: "" (all)
  regex, free-form

  Set: deadeye config set coder.subagent_matcher '^review-.*'

  Optional regex on agent_type scoping which subagents receive the coder ruleset. Empty matches every subagent. A regex that fails to compile fails open (injects anyway).

• coder.injection_budget_tokensdefault: 2000
  integer ≥ 0

  Set: deadeye config set coder.injection_budget_tokens 3000

  Logged ceiling for the coder ruleset injection — separate from the top-level 400-token advisory budget, since the persona is an explicit opt-in and byte-stable per level.

• coder.securitydefault: advise
  off · advise · ask

  Set: deadeye config set coder.security ask

  Live security advisory on Edit/Write: SQL/shell/eval injection shapes, TLS-off, hardcoded secrets and provider tokens, weak crypto, and vulnerable/superseded dependencies in a manifest. ask additionally escalates a manifest edit that adds a dependency with a confirmed OSV advisory to a permission prompt (injection/secret/crypto findings stay advise). Also disabled by /deadeye-mute or the DEADEYE=off / DEADEYE_CODER=off env kill switches.

• coder.security_osvdefault: true
  true · false

  Set: deadeye config set coder.security_osv false

  Whether the dependency check may consult OSV.dev — package name and version only, never file paths or code — via a background cache refresh. false keeps the check fully offline; the bundled superseded-package table still works.

security.*

The exfiltration guard

Watches PreToolUse on Read and Bash for a credential file being read or shipped out — the classic first step of prompt-injection-driven secret egress. A top-level axis, independent of the coder persona: not disabled by DEADEYE_CODER=off, only by DEADEYE=off. A project's own .deadeye.json cannot weaken this axis — only ~/.deadeye/config.json can, so a hostile repo can't ship the guard's own off-switch alongside its prompt injection.

• security.exfildefault: ask
  off · advise · ask

  Set: deadeye config set security.exfil advise

  On a match: ask escalates to a permission prompt the model can't answer for itself (a prompt-injected instruction can't approve it); advise emits a one-line nudge; off disables the guard. Default ask — credential-file access is rare enough that interruptions should be too.

• security.sensitive_pathsdefault: []
  array of glob strings

  Not settable via deadeye config set — hand-edit the "security": {"sensitive_paths": [...]} array in ~/.deadeye/config.json directly.

  Extra glob patterns treated as sensitive credential paths, additive to the built-in table (~/.ssh private keys, ~/.aws/credentials, .env, ~/.claude/.credentials.json, ~/.netrc, ~/.kube/config, and more). Matched with filepath.Match against the full path and basename.

plan_gate.*

Multi-file gate trigger

• plan_gate.min_filesdefault: 2
  integer ≥ 1

  Set: deadeye config set plan_gate.min_files 3

  Working-tree modified/staged file count at which the gate's multi-file trigger fires — see mode.plan_gate for what happens once it does.

Top-level

Global tunables

• downshift_thresholddefault: 0.8
  number, 0–1

  Set: deadeye config set downshift_threshold 0.6

  Minimum kernel confidence required to lower model tier or effort. Upshifting (to a more capable tier) is always free and never gated by this.

• injection_budget_tokensdefault: 400
  integer ≥ 0

  Set: deadeye config set injection_budget_tokens 600

  Ceiling on the total SessionStart advisory injection — every mode advisory combined, not counting the separate coder-persona budget (coder.injection_budget_tokens).

preprocess.disabled_rules

Turn off individual rules

An array of rule/advisory names to disable one at a time, without turning off all of mode.preprocess. Default: empty (every rule active). Example: deadeye config set preprocess.disabled_rules test-filter,log-tail is not supported by the picker — hand-edit the array in ~/.deadeye/config.json instead, since a comma-split flag is more surprising than helpful for a list.