.env.example

# === E2E Browser Test Configuration ===

# 飞书测试群 URL（bot 所在的话题群）
FEISHU_TEST_GROUP_URL=https://xxx.feishu.cn/next/messenger/...

# Midscene AI 模型配置
MIDSCENE_MODEL_NAME=your-model-name
MIDSCENE_MODEL_API_KEY=your-api-key
MIDSCENE_MODEL_BASE_URL=https://your-endpoint
MIDSCENE_MODEL_FAMILY=your-model-family

# （可选）普通群聊名称（多机器人），用于群聊 @mention 路由和话题回复测试
# FEISHU_TEST_GROUP_CHAT_NAME=普通群聊

# （可选）话题群聊名称，用于话题群的话题回复测试
# FEISHU_TEST_TOPIC_GROUP_NAME=话题群聊

# （可选）已有浏览器的 CDP 地址，用于从已登录的浏览器提取登录态
# 不设置时，setup 脚本会自动检测 Agent Browser，或启动新浏览器
# BROWSER_CDP_URL=http://127.0.0.1:9222

# === Dashboard Feishu H5 passwordless authentication (optional, fail-closed) ===

# NOTE on how the Dashboard reads this file: it loads an ALLOWLIST of keys only
# (the BOTMUX_DASHBOARD_FEISHU_H5_* family plus the dashboard/daemon settings it
# consumes — see src/utils/dashboard-env.ts). Any other value here, including
# credentials for unrelated tooling, is NOT loaded into the dashboard process,
# and therefore cannot be inherited by the children it forks (debug terminals,
# start/stop-bot, global package updates, plugin installs). Bot daemons keep
# reading the file in full via their own entry point.

# Disabled by default. When enabled, open the configured entry path from the
# Feishu/Lark H5 application. The page uses requestAccess/requestAuthCode and
# exchanges the one-time code server-side; no Dashboard token is put in the URL.
# BOTMUX_DASHBOARD_FEISHU_H5_ENABLED=true
# BOTMUX_DASHBOARD_FEISHU_H5_BRAND=feishu
# BOTMUX_DASHBOARD_FEISHU_H5_APP_ID=cli_xxx
# BOTMUX_DASHBOARD_FEISHU_H5_APP_SECRET=replace-me
# BOTMUX_DASHBOARD_FEISHU_H5_ALLOWED_OPEN_IDS=ou_owner_a,ou_owner_b
# BOTMUX_DASHBOARD_FEISHU_H5_ENTRY_PATH=/auth/feishu

# Fixed Dashboard session lifetime. Default 30 minutes; accepted range 1 minute
# to 24 hours. The cookie is opaque, HttpOnly, SameSite=Lax, and never persisted
# by Botmux. Set Secure explicitly when TLS terminates upstream but
# BOTMUX_PUBLIC_URL is not configured as https://.
# BOTMUX_DASHBOARD_FEISHU_H5_SESSION_TTL_MS=1800000
# BOTMUX_DASHBOARD_FEISHU_H5_SECURE_COOKIE=true

# How many reverse-proxy hops sit in front of the Dashboard. Default 0: the
# login endpoint's rate limiter buckets by the socket peer address and IGNORES
# x-forwarded-for, because anyone can send that header and a trusted one would
# hand an attacker unlimited distinct bucket keys. Set it to the number of
# proxies you actually run (1 for a single nginx/ALB) and only the hop THAT
# proxy wrote is used as the client address; anything the client prepended is
# ignored. Accepted range 0-8.
# BOTMUX_DASHBOARD_FEISHU_H5_TRUSTED_PROXY_HOPS=1

# Explicit terminal takeover lease. Default 5 minutes, hard-capped at 15
# minutes. Release, expiry, or controlling-WebSocket disconnect returns the
# terminal to read-only. The signed write grant stays on the loopback proxy hop.
# BOTMUX_DASHBOARD_TERMINAL_CONTROL_TTL_MS=300000

# 0600 append-only audit. Records timestamp/user/session/action and optional
# input byte count only; terminal input content, URLs, cookies, codes and tokens
# are never recorded. Default: ~/.botmux/audit/dashboard-control.ndjson
# BOTMUX_DASHBOARD_CONTROL_AUDIT_PATH=/var/lib/botmux/audit/dashboard-control.ndjson