ConfigLens BETA
v0.1.0-beta.3 / A public beta, built in the open

THE CONFIGURATION TRACE, EXPLAINED.

Know exactly
which config
wins.

You changed the setting. Nothing changed.
Trace the observed winner back to its source — and see what got overridden along the way.

Explore the trace View on GitHub

Local Rust CLI. Offline. Read-only configuration analysis.
For supported Claude Code and OpenCode settings.

Start with one command configlens explain /model --client claude --client-version 2.1.296
TRACE /modelCLAUDE CODE
↳

Project local replaces earlier file definitions.
Effective value withheld: coverage is partial.

Synthetic fixture NOT A LIVE SCAN
BOUNDED BY DESIGNClaude Code 2.1.296OpenCode 1.18.35Fixture-verified. Not runtime-conformant.

01 / FOLLOW THE VALUE

One setting. Competing layers.
Follow the evidence.

Change a value. Remove a definition.
Watch the observed result move through the trace.

BROWSER FIXTURE
/modelClaude Code 2.1.296 · user → project shared → project localLOW → HIGH PRECEDENCE

Select a source to inspect its definition.

OBSERVED WINNERlocal-model

Project local wins among included sources; 2 earlier definitions were replaced.

PARTIAL COVERAGE

Effective value withheld. Managed policy and server state are not observed here. This browser simulation covers only the fixture-verified /model scalar subset. It does not run the Rust CLI, inspect your machine, or establish upstream runtime conformance.

Different clients. Different rules. Claude environment variables are per-key pairs, not a universal precedence level. OpenCode uses an explicit project boundary in this example; its 2.x line is not supported.

02 / FROM FILE TO FINDING

A trace, not a hunch.

Four deliberate stages.
No client execution at any point.

Inventory known paths. No recursive crawl. Missing or unreadable layers remain visible.

Keep the file, line, and reason for each contribution — including the ones replaced.

Apply a supported, client-specific rule. Unknown semantics stay unknown.

Read the result alongside its evidence and coverage gaps. Partial is not effective.

Known paths → candidate sources

03 / LESS MYSTERY. MORE EVIDENCE.

Find the file.
Understand the result.

A focused diagnostic tool.
Not a configuration manager. Not a security certification.

01 /

Trace the losing values

The winning value is only half the story. Keep the definitions it replaced, with file and line provenance.

Inspect a contribution

project-model · $PROJECT/.claude/settings.json:2:12 · replaced_by_later_layer

02 /

Precedence, not folklore

Client-specific rules, not one universal merge. This demo focuses on the verified scalar /model subset.

Compare the file orders

Claude: user < shared < local. OpenCode: global < ancestor < nested (within the explicit project boundary).

03 /

Reports with receipts

Text for the terminal. Structured JSON for a report. Coverage gaps travel with the conclusion.

Inspect report fields

pointer: /model · status: partial · support: fixture_verified · effective_value: omitted

04 /

Redact by default

Protected values use a public projection. Unknown free text is not automatically safe to print.

See the privacy example

Only allowlisted values are reportable. Inspect the captured protected-value projection in the privacy section below.

05 /

Changes without guesswork

Compare compatible snapshots by value, provenance, and coverage. Two masks never prove equality.

Inspect a protected comparison

Protected values: comparison = unknown_redacted. Snapshots write only to explicitly requested output paths.

06 /

A small tool, not an agent

A local Rust CLI. No model calls, sockets, hooks, plugins, or client subprocesses at runtime.

See a first command

configlens explain /model --client claude --client-version 2.1.296

04 / THE ACTUAL CLI

Answers where
you work.

No account. No dashboard to maintain.
A report in the terminal you already have.

Read the getting-started guide

Captured from configlens 0.1.0-beta.3 against isolated synthetic files. No command on this page executes.

configlens / synthetic sandboxREAD ONLY PREVIEW
$ configlens explain /model --client claude --client-version 2.1.296 --cwd $SANDBOX/project --project-root $SANDBOX/project --input-context $SANDBOX/context.json --allow-read-root $SANDBOX --color never
/model = "local-model" (observed)
Observed winner: $PROJECT/.claude/settings.local.json:2:12  "local-model"  observed_winner
Losers:
  "user-model"  $HOME/.claude/settings.json:2:12  replaced_by_later_layer
  "project-model"  $PROJECT/.claude/settings.json:2:12  replaced_by_later_layer
Rule: claude.scalar.layer-override
Coverage: partial — cc.managed.hkcu — registry_not_read (expected_unobservable); cc.managed.mdm — platform_policy_store_not_read (expected_unobservable); cc.managed.server — remote_source_not_fetched (expected_unobservable); cc.managed.file — managed_file_absent_does_not_prove_policy_absent (managed_state_unknown)
Support: fixture_verified; confidence: evidence_class:fixture_verified
Conclusion: "local-model" wins among the observed applicable sources; effective value withheld.
Next inspection:
  - supply the managed settings file with --input-context to include it
  - remote/MDM layers are not observable here; re-run where the managed source is readable
EXIT 0 · FULL OUTPUT

Output is real; paths are normalized. $SANDBOX replaces only the throwaway directory prefix. Commands retain all capture arguments; set up the sandbox before using them. Reproduce the captures ↗

05 / LOCAL BY PRINCIPLE

Your configuration
is not our business.

ConfigLens analyses files on your machine. It does not send configuration anywhere, run a client, or execute the things it finds.

  • Configuration is read-only. Snapshot and explicit report outputs are intentional writes; diff reads the supplied reports.
  • Share mode reduces identifying details. Redaction is not a guarantee of anonymity — review before sharing.
  • Unix snapshots use owner-only permissions. Windows snapshots inherit the destination folder’s ACL; use a private directory.

Protection, made visible.

SYNTHETIC ONLY

Captured for /env/APP_TOKEN. The input below is a deliberately fake demonstration value.

{
  "kind": "string",
  "reason": "inventory_only",
  "redacted": true
}

Protected values compare as unknown_redacted, not “unchanged”.

Read the privacy boundaries ↗

06 / TAKE A CLOSER LOOK

Bring clarity
to your next config change.

PINNED PUBLIC BETA · v0.1.0-beta.3
A working prototype, not a stable release.

Download Linux archive Release notes ↗

Binaries are unsigned; the macOS archive is not notarized. Review the release and checksum before running anything.

Verify your download

Download SHA256SUMS into the same directory. Compare the matching archive’s hash; stop on any mismatch.

sha256sum configlens-v0.1.0-beta.3-x86_64-unknown-linux-gnu.tar.gz

Compare with the corresponding line in SHA256SUMS. A checksum checks integrity, not publisher identity.

OR BUILD FROM SOURCE · RUST 1.85+
cargo install --locked --git https://github.com/ob4cl/configlens configlens

Source install follows the repository default branch; it is not pinned to the beta archive.

YOUR FIRST TRACE
configlens explain /model --client claude --client-version 2.1.296

Use a supported client version claim. ConfigLens never runs a client binary to discover it.

All releases ↗ · Full installation guide ↗

Open source. Open about the limits.

Read the rules. Reproduce the fixtures. Help make the next explanation better.

Explore on GitHub