From 6d6f671c72628ba359fba5b1e93ec6fb04633d91 Mon Sep 17 00:00:00 2001
From: ayobamiseun <adegokeayobamiseun@gmail.com>
Date: Sun, 26 Jul 2026 15:04:54 +0100
Subject: [PATCH] docs: document web_search_provider and cloud_* keys in config
 example
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

config.example.toml covered 7 of the 13 supported keys; a user reading it
could not discover how to switch web-search providers or point a dev/BYO
deployment at its own cloud instance. Adds web_search_provider (with the
three supported backends) and the cloud_* family (commented out — the
defaults are the production values, and an empty cloud_relay_ws_url
meaningfully disables the relay). Also notes the Windows global config
location and that allowed_commands/auto_allow are global-only until
workspace trust.

Verified: the example parses with tomllib and every key (including the
commented cloud_* names) matches coworker.config._FIELDS.
---
 docs/config.example.toml | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/docs/config.example.toml b/docs/config.example.toml
index 9638ad23..53940f67 100644
--- a/docs/config.example.toml
+++ b/docs/config.example.toml
@@ -1,13 +1,20 @@
 # coworker config — copy to one of:
-#   ~/.config/coworker/config.toml          (global)
+#   ~/.config/coworker/config.toml          (global; Windows: %APPDATA%\coworker\config.toml)
 #   <your-project>/.coworker/config.toml    (per-workspace, overrides global)
 #
 # All keys are optional; unset keys fall back to built-in defaults.
+# Security-sensitive keys (allowed_commands, auto_allow) are honored from the
+# global file only; a workspace file's allowed_commands apply only after you
+# trust that workspace.
 
 model = "gpt-5.5"            # default model id (override per session in the UI/CLI)
 mode = "interactive"         # plan | interactive | auto | custom
 max_iterations = 12          # max model<->tool iterations per turn before stopping
 
+# Web search backend: "duckduckgo" (keyless, default) | "tavily" | "brave"
+# (the latter two need an API key, set in the app's Settings or secret store).
+web_search_provider = "duckduckgo"
+
 # Commands auto-allowed without an approval prompt (prefix match).
 allowed_commands = [
   "ls", "cat", "pwd", "grep", "find",
@@ -22,3 +29,14 @@ auto_allow = ["write_file", "replace_in_file", "apply_patch", "apply_unified_dif
 # Server (openworker-server) bind address.
 host = "127.0.0.1"
 port = 8765
+
+# OpenWorker Cloud (sign-in + managed connectors + Slack/GitHub relay).
+# Defaults point at production so a fresh install works out of the box; only
+# dev/staging/BYO-VPC deployments need to change these.
+#cloud_base_url = "https://api.openworker.com"
+#cloud_auth_domain = "opencoworker.us.auth0.com"
+#cloud_client_id = "g1l4Q1lhYWmyS03qPSf4KEJGrgq02Qam"
+#cloud_audience = "https://api.opencoworker.app"
+# Managed relay WebSocket endpoint (Slack/GitHub inbound). Set to "" to disable
+# the relay entirely (manual Socket Mode still works).
+#cloud_relay_ws_url = "wss://l4z1paxb83.execute-api.us-east-1.amazonaws.com/ocw-connect"