.env.example

## Process
PORT=3583
RUN_MODE=combined
MAX_JSON_BODY_BYTES=1048576

## Worker
WORKER_CONCURRENCY=4
WORKER_POLL_INTERVAL_MS=1000
RUN_CANCELLATION_POLL_INTERVAL_MS=1000

## Persistence
# Use postgres for durable deployments; memory is useful for local UI experiments.
APP_DATA_STORE=postgres
DATABASE_URL=postgres://deputies:deputies@localhost:5432/deputies
TEST_DATABASE_URL=postgres://deputies:deputies@localhost:5432/deputies_test

# Runner runtime state is separate from product sessions/auth data.
RUNNER_STATE_STORE=postgres

# Deletes redundant agent_text_delta rows after their message has an agent_response_final.
# Keeps recent deltas for debugging/external consumers and keeps partial failed/cancelled output forever.
EVENT_DELTA_COMPACTION_ENABLED=true
EVENT_DELTA_COMPACTION_RETENTION_SECONDS=86400
EVENT_DELTA_COMPACTION_INTERVAL_SECONDS=60
EVENT_DELTA_COMPACTION_BATCH_SIZE=5000

## Product Auth
# Supported modes: none, bearer, session.
# Bearer auth is useful for scripts/internal API access, but service links opened in a
# browser require API_AUTH_MODE=none or session-cookie auth.
API_AUTH_MODE=bearer
API_BEARER_TOKEN=dev-secret

# Session auth provider. Use static for local/admin-only deployments, github for GitHub login.
AUTH_PROVIDER=static
AUTH_STATIC_USERNAME=dev
AUTH_STATIC_PASSWORD=dev-secret
AUTH_SESSION_SECRET=replace-with-random-secret
AUTH_COOKIE_SECURE=false
AUTH_COOKIE_SAME_SITE=lax
AUTH_COOKIE_DOMAIN=

# GitHub product login allowlists. Requires API_AUTH_MODE=session and AUTH_PROVIDER=github.
# Admin users are always restored to super admin on login and are the break-glass recovery path.
AUTH_GITHUB_ADMIN_USERS=
AUTH_GITHUB_ALLOWED_USERS=
AUTH_GITHUB_ALLOWED_ORGANIZATIONS=
AUTH_GITHUB_DEFAULT_GROUP_ROLE=member
# Grants public trial access to any GitHub account. Do not use for admin access.
UNSAFE_AUTH_GITHUB_ALLOW_ALL=false

## Public Web And Service URLs
# WEB_BASE_URL is the browser-facing app URL. Auth success/logout redirects use it.
WEB_BASE_URL=http://localhost:5173

# SERVICE_BASE_DOMAIN enables browser-openable sandbox service links such as
# https://s-3000-<session-id>.example.com. Leave empty to derive from request hosts.
SERVICE_BASE_DOMAIN=
SERVICE_TRUST_FORWARDED_HOSTS=false

# For local services with Portless TLS, use:
# AUTH_COOKIE_DOMAIN=.deputies.localhost
# AUTH_COOKIE_SECURE=true
# WEB_BASE_URL=https://deputies.localhost
# SERVICE_BASE_DOMAIN=deputies.localhost
# SERVICE_TRUST_FORWARDED_HOSTS=true

# For production HTTPS services, prefer a first-level wildcard such as *.example.com.
# Nested wildcards such as *.app.example.com may require provider-specific certificate upgrades.
# After changing AUTH_COOKIE_DOMAIN, users may need to log out/in so browsers replace old host-only cookies.
# AUTH_COOKIE_DOMAIN=.example.com
# AUTH_COOKIE_SECURE=true
# WEB_BASE_URL=https://app.example.com
# SERVICE_BASE_DOMAIN=example.com
# SERVICE_TRUST_FORWARDED_HOSTS=false

# Platform cookie names. Override for an instance running behind another Deputies
# sandbox service proxy so its auth cookies survive the outer proxy's cookie stripping.
# Sandbox providers inject the configured names into each sandbox bridge's strip
# list automatically (DEPUTIES_SANDBOX_SKIP_COOKIE_NAMES, settable directly on the
# bridge as a low-level override).
# SESSION_COOKIE_NAME=dev_deputies_session
# PREVIEW_COOKIE_NAME=deputies_preview

## Runner And Models
# Local defaults use fake execution. For real agent work, set RUNNER=flue and choose a real sandbox provider.
RUNNER=fake

# Required when RUNNER=flue or RUNNER=pi. Anthropic/OpenAI/OpenCode credentials are read by the model SDK.
# For Codex subscription auth, set RUNNER_MODEL_DEFAULT=openai-codex/<model> and run
# pnpm --dir apps/control-plane auth:login:openai-codex. Credentials default to ~/.pi/agent/auth.json.
# For Docker Compose, bind mount that file and set OPENAI_CODEX_AUTH_FILE.
# For Railway, prefer OPENAI_CODEX_AUTH_BASE64 with base64-encoded auth.json contents.
RUNNER_MODEL_DEFAULT=anthropic/claude-haiku-4-5

# Optional comma-separated picker choices. When empty, Deputies derives choices
# from configured provider auth (ANTHROPIC_API_KEY, OPENAI_API_KEY, OPENCODE_API_KEY, or Codex auth).
RUNNER_MODEL_CHOICES=
ANTHROPIC_API_KEY=
OPENAI_API_KEY=
OPENCODE_API_KEY=
OPENAI_CODEX_AUTH_FILE=
OPENAI_CODEX_AUTH_BASE64=

# Optional JSON artifact returned by the fake runner for demos/smoke tests.
FAKE_RUNNER_ARTIFACT_JSON=

## Web Search Tool
# Agent web_search runs in the control-plane worker, not inside the sandbox.
# WEB_SEARCH_PROVIDER=auto uses Brave Search when WEB_SEARCH_BRAVE_API_KEY is set, otherwise DuckDuckGo HTML search with no key.
# Supported providers: disabled, auto, brave, duckduckgo.
WEB_SEARCH_PROVIDER=auto
WEB_SEARCH_BRAVE_API_KEY=
WEB_SEARCH_MAX_RESULTS=10
WEB_SEARCH_CONTENT_MAX_CHARS=5000
WEB_SEARCH_TIMEOUT_MS=10000

## Sandbox Provider
# Supported providers: fake, unsafe-local, docker, daytona, tensorlake, k8s-agent-sandbox, ecs.
# ecs is reserved and not wired yet.
SANDBOX_PROVIDER=fake
SANDBOX_WORKSPACE_PATH=/workspace
SANDBOX_IDLE_TIMEOUT_SECONDS=900
SANDBOX_STOP_DELAY_SECONDS=60
SANDBOX_RETENTION_SECONDS=3600
SANDBOX_KEEPALIVE_MAX_EXTENSION_SECONDS=7200

# For real Flue without an external sandbox provider:
# RUNNER=flue
# WARNING: SANDBOX_PROVIDER=unsafe-local is not a security boundary. Agent commands run on
# the API/worker host runtime in a temporary workspace; use only for trusted local development.
# SANDBOX_PROVIDER=unsafe-local
# Optional comma-separated host commands exposed through PATH when SANDBOX_PROVIDER=unsafe-local.
# Empty uses the built-in development allowlist.
LOCAL_SANDBOX_ALLOWED_COMMANDS=

## Docker Sandbox Provider
# For real Flue + Docker, prefer the published GHCR image. Use a pinned tag or digest for deployments.
# Then set RUNNER=flue and SANDBOX_PROVIDER=docker.
DOCKER_SANDBOX_IMAGE=ghcr.io/sidpalas/deputies-docker-sandbox:latest
DOCKER_SANDBOX_BRIDGE_HOST=127.0.0.1
DOCKER_CLI_TIMEOUT_MS=30000

# Optional Docker runtime constraints/network. Leave empty for Docker defaults.
DOCKER_SANDBOX_NETWORK=
DOCKER_SANDBOX_MEMORY=
DOCKER_SANDBOX_CPUS=

# DOCKER_ORCHESTRATOR_MODE=in-process keeps Docker orchestration in the control-plane process.
# DOCKER_ORCHESTRATOR_MODE=http calls a separate orchestrator service started with:
# pnpm control-plane:docker-orchestrator:dev
DOCKER_ORCHESTRATOR_MODE=in-process
DOCKER_ORCHESTRATOR_URL=http://127.0.0.1:3585
DOCKER_ORCHESTRATOR_TOKEN=

# Standalone Docker orchestrator server bind address.
DOCKER_ORCHESTRATOR_HOST=0.0.0.0
DOCKER_ORCHESTRATOR_PORT=3585

# Required for Postgres-backed Docker sandboxes. Use a stable high-entropy value;
# changing it prevents decrypting existing sandbox provider secrets.
# Generate one with: openssl rand -base64 32
SANDBOX_SECRET_ENCRYPTION_KEY=replace-with-random-sandbox-secret

## Kubernetes Agent Sandbox Provider
# For real Flue + Kubernetes Agent Sandbox, set RUNNER=flue and SANDBOX_PROVIDER=k8s-agent-sandbox.
AGENT_SANDBOX_IMAGE=ghcr.io/sidpalas/deputies-docker-sandbox:sha-ac8a459
AGENT_SANDBOX_STORAGE_SIZE=1Gi
AGENT_SANDBOX_STORAGE_CLASS_NAME=
AGENT_SANDBOX_NAMESPACE=

# AGENT_SANDBOX_ORCHESTRATOR_MODE=in-process keeps orchestration in the control-plane process.
# AGENT_SANDBOX_ORCHESTRATOR_MODE=http calls a separate orchestrator service.
AGENT_SANDBOX_ORCHESTRATOR_MODE=in-process
AGENT_SANDBOX_ORCHESTRATOR_URL=http://127.0.0.1:3587
AGENT_SANDBOX_ORCHESTRATOR_TOKEN=

# Standalone Kubernetes Agent Sandbox orchestrator server bind address.
AGENT_SANDBOX_ORCHESTRATOR_HOST=0.0.0.0
AGENT_SANDBOX_ORCHESTRATOR_PORT=3587

## Daytona Sandbox Provider
# Required when SANDBOX_PROVIDER=daytona. Also set RUNNER=flue for real agent work.
DAYTONA_API_KEY=
DAYTONA_API_URL=
DAYTONA_TARGET=
# Prefer the published GHCR image. Use a pinned tag or digest for deployments.
DAYTONA_IMAGE=ghcr.io/sidpalas/deputies-daytona-sandbox:latest
DAYTONA_SNAPSHOT=

# Optional Daytona resource request. Values are Daytona SDK units: CPU/GPU counts,
# memory/disk in GiB. Leave empty for Daytona defaults.
DAYTONA_SANDBOX_CPU=
DAYTONA_SANDBOX_GPU=
DAYTONA_SANDBOX_MEMORY_GIB=
DAYTONA_SANDBOX_DISK_GIB=

# Required when SANDBOX_PROVIDER=tensorlake. Also set RUNNER=flue or RUNNER=pi for real agent work.
TENSORLAKE_API_KEY=
# Registered Tensorlake sandbox image name/id used by Sandbox.create. Create/update it with:
# mise run //deploy/sandboxes/tensorlake:image:create
TENSORLAKE_REGISTERED_IMAGE=deputies
TENSORLAKE_SANDBOX_CPU=
TENSORLAKE_SANDBOX_MEMORY_MB=
TENSORLAKE_SANDBOX_DISK_MB=
TENSORLAKE_ALLOW_INTERNET_ACCESS=true

## Artifact Storage
# Artifact blob storage. Metadata remains in Postgres.
# Supported providers: disabled, filesystem, s3.
# Local Docker Compose runs SeaweedFS S3 at http://localhost:8333.
ARTIFACT_STORAGE_PROVIDER=s3
ARTIFACT_STORAGE_FILESYSTEM_PATH=
ARTIFACT_STORAGE_S3_ENDPOINT=http://localhost:8333
ARTIFACT_STORAGE_S3_REGION=us-east-1
ARTIFACT_STORAGE_S3_BUCKET=deputies-artifacts
ARTIFACT_STORAGE_S3_ACCESS_KEY_ID=seaweed
ARTIFACT_STORAGE_S3_SECRET_ACCESS_KEY=seaweed
ARTIFACT_STORAGE_S3_FORCE_PATH_STYLE=true
ARTIFACT_STORAGE_S3_CREATE_BUCKET=true

# Max file size the artifact.create agent tool may publish from a sandbox.
ARTIFACT_CREATE_MAX_BYTES=26214400

## Slack Integration
# For local HTTPS emulation:
# pnpm control-plane:portless:start
# pnpm control-plane:emulate:slack
# For real Slack local testing, expose the web proxy with a public tunnel and set
# the Slack Events request URL to https://<public-tunnel>/webhooks/slack/events.
SLACK_API_BASE_URL=https://slack.emulate.localhost/api
SLACK_SIGNING_SECRET=dev-slack-signing-secret
SLACK_BOT_TOKEN=xoxb-dev-token

# Slack is fail-closed when SLACK_SIGNING_SECRET is set. Configure at least one
# allowlist, or explicitly set UNSAFE_SLACK_WEBHOOK_ALLOW_ALL_IDS=true for local tests.
UNSAFE_SLACK_WEBHOOK_ALLOW_ALL_IDS=false

# Optional comma-separated allowlists. Empty means unrestricted for that dimension,
# but at least one allowlist is required unless UNSAFE_SLACK_WEBHOOK_ALLOW_ALL_IDS=true.
# The dummy user ID keeps copied local config startable; replace it with a real
# Slack user/team/channel ID before using real Slack workspaces.
SLACK_ALLOWED_TEAM_IDS=
SLACK_ALLOWED_CHANNEL_IDS=
SLACK_ALLOWED_USER_IDS=U00000000

## GitHub Integration
GITHUB_API_BASE_URL=https://api.github.com
GITHUB_OAUTH_BASE_URL=https://github.com
# Separate clone/web base URL for GitHub Enterprise or git-server/emulator tests.
GITHUB_CLONE_BASE_URL=https://github.com

# GitHub App runtime access for private repo clone/push/PR operations.
GITHUB_APP_ID=
# Use a single-line key with \n escapes for env files, or provide real newlines in secrets managers.
GITHUB_APP_PRIVATE_KEY=

# GitHub product login OAuth. Required when API_AUTH_MODE=session and AUTH_PROVIDER=github.
GITHUB_OAUTH_CLIENT_ID=
GITHUB_OAUTH_CLIENT_SECRET=
GITHUB_OAUTH_CALLBACK_URL=http://localhost:5173/auth/oauth/github/callback

# Optional repository allowlist. Supports owner/repo and owner/* patterns.
GITHUB_ALLOWED_REPOSITORIES=

# GitHub webhook intake. Required to receive GitHub issue/PR/comment/review work.
GITHUB_WEBHOOK_SECRET=
# Optional comma-separated webhook allowlists. Empty means unrestricted for that dimension.
UNSAFE_GITHUB_WEBHOOK_ALLOW_ALL_USERS_AND_ORGS=false
GITHUB_WEBHOOK_ALLOWED_USERS=
GITHUB_WEBHOOK_ALLOWED_ORGANIZATIONS=
# Comma-separated trigger phrases required in issue/PR/comment/review text.
# Examples: /deputies, deputies:, @acme/deputies, deputies. Required when GITHUB_WEBHOOK_SECRET is set.
GITHUB_WEBHOOK_TRIGGER_PHRASES=

## Generic Callbacks
# Allows HTTP callbacks to local/private network hosts. Use only for trusted local testing.
UNSAFE_ALLOW_LOCAL_HTTP_CALLBACKS=false

## Web UI Development
# Leave empty to use same-origin proxying in Vite, Caddy, or Railway.
VITE_API_BASE_URL=
# Used by Vite dev server proxy only.
VITE_API_PROXY_TARGET=http://localhost:3583
VITE_PORTLESS_URL=https://deputies.localhost
# Optional comma-separated public tunnel hosts for Vite dev proxy requests.
# Defaults include common tunnel domains.
VITE_DEV_ALLOWED_HOSTS=

# Hide the setup checklist page in the web UI.
HIDE_SETUP_PAGE=false