Configuration

All configuration lives in .ovecc/config.toml in the analyzed repository. Every key is optional; ovecc init writes a fully commented template where the commented values are the defaults.

The template

# ovecc configuration - every key is optional; commented values are the defaults.
# Machine-readable reference: `ovecc capabilities`.

[output]
# text | json | ndjson | markdown (sarif / codeclimate via --format)
# default_format = "text"

[index]
# Extra paths to skip, on top of the built-ins (node_modules, target, dist, .venv, ...).
# exclude = ["vendored"]
# Flag manifest dependencies that no indexed file imports (off by default:
# config-only usages cause false positives).
# detect_unused_deps = true

# --- governance: declarative architecture rules, enforced at index time ---
# [[rules.boundaries]]
# name = "billing must not depend on user"
# source = "billing"
# target = "user"
# allowed = false
# severity = "high"

# [[rules.banned_imports]]
# name = "no-deprecated-lodash"
# pattern = "lodash"
# message = "use es-toolkit instead"
# severity = "medium"

# --- architecture diagnosis thresholds ---
# [diagnose]
# min_confidence = 0.5

[output]

Key	Default	Effect
default_format	"text"	Format used when --format isn't passed: text, json, ndjson, or markdown (sarif/codeclimate remain flag-only)

[index]

Key	Default	Effect
exclude	[]	Extra globs to skip, on top of the built-ins (node_modules, target, dist, .venv, …). The --exclude flag adds to this per run
detect_unused_deps	false	Report manifest dependencies no indexed file imports (unused-dependency, unused-dev-dependency, unused-optional-dependency). Off by default because config-only usages (tools loaded by name from a config file) cause false positives

[[rules.boundaries]]

Forbid (or document as allowed) a module-to-module dependency. Evaluated at index time; violations surface as CrossDomainDependency findings under your rule's name.

Key	Required	Meaning
name	yes	Human name — becomes the finding's rule label
source	yes	Module the dependency originates from
target	yes	Module being depended on
allowed	yes	false forbids the edge
severity	yes	low / medium / high / critical

Modules are inferred from directory structure — check yours with ovecc export graph or ovecc query "module <name>".

[[rules.banned_imports]]

Ban imports by specifier pattern.

Key	Required	Meaning
name	yes	Rule label (findings read banned-import/<name>)
pattern	yes	exact, prefix*, *suffix, or *infix* — matched against the import specifier, so lodash* catches lodash/groupBy too
message	no	Guidance shown with the finding
severity	yes	low / medium / high / critical

[diagnose]

Key	Default	Effect
min_confidence	0.5	Findings below this deterministic confidence are dropped from diagnose

Versioning the config

ovecc init git-ignores the whole .ovecc/ directory. To share rules with your team, switch the entry to ignore the directory's contents and re-include the config (Git cannot re-include files under a fully ignored directory):

# ovecc local state (database + parse cache)
.ovecc/*
!.ovecc/config.toml

Related

• Governance guide — boundaries, banned imports, suppressions, and the baseline ratchet in practice
• capabilities — the machine-readable version of everything configurable