# dsh-lark-bot runtime configuration.
#
# This file is a template only. Never commit real credentials.
# At runtime the bot reads DSH_LARK_* variables and merges them with
# ~/.dsh-lark/config.json.

# Feishu / Lark application credentials. Prefer first-run QR binding; these
# variables are optional overrides for automated deployment.
# DSH_LARK_APP_ID=
# DSH_LARK_APP_SECRET=

# Feishu (default) or Lark international tenant.
DSH_LARK_TENANT=feishu

# Root directory for local state. Defaults to ~/.dsh-lark.
# DSH_LARK_HOME=

# Managed multi-bot services set these automatically. Do not reuse one bridge
# profile for two dsh processes.
# DSH_LARK_PROFILE=reviewer
# DSH_LARK_DSH_PROFILE=dsh-lark-reviewer

# Default working directory for new sessions.
# DSH_LARK_WORKSPACE=

# Optional DeepSeek Harness overrides. The CLI auto-discovers installed dsh
# installations such as ~/.dsh/profiles/node_modules/@deepseek-ai/dsh.
# Set these only when you need an explicit launcher or custom profile.
# DSH_LARK_DSH_COMMAND=
# DSH_LARK_DSH_ARGS=

# Agent backend mode: sdk (default, official client + per-action approval),
# acp (protocol-native approval via session/request_permission), headless (legacy fallback), or
# web (drive the local dsh web agent as the single writer of every session).
DSH_LARK_ADAPTER=sdk

# npm latest-version probes used by doctor, /version, /upgrade, and the
# best-effort reminder after every /new or /reset. Set 0 to disable all probes.
# DSH_LARK_UPGRADE_CHECK=1

# Bridge new-version check interval in ms (0 disables; default 6h).
# DSH_LARK_UPGRADE_CHECK_INTERVAL_MS=21600000

# Push a Feishu notification when a newer version is found (default: log-only).
# DSH_LARK_UPGRADE_NOTIFY=false
# DSH_LARK_UPGRADE_NOTIFY_CHAT=

# Provider/model route for the dsh agent.
# Optional when dsh agent-default-model already contains { provider, model }.
# SDK/ACP startup fails with an explicit bridge configuration error if neither
# source resolves a complete route. Managed restarts retain saved values that
# the current shell does not explicitly override.
# DSH_LARK_PROVIDER=provider-id
# DSH_LARK_MODEL=model-id

# Optional per-request output token cap for SDK-created agents.
# DSH_LARK_MAX_TOKENS=49152

# Long-edge bound (px) for inbound images before upload. Inbound screenshots
# whose longer side exceeds this are downscaled proportionally so they fit the
# upstream attachment-store admission limit (default 2000, matching
# dsh-attachment-local's maxImageDimension). Set 0 to disable scaling.
# DSH_LARK_IMAGE_MAX_DIMENSION=2000

# web adapter: base URL of the local dsh web agent. Session projection never
# follows the WebUI/TUI active session: users bind explicitly with /session.
# DSH_LARK_WEB_URL=http://127.0.0.1:3080
# Optional models.dev-compatible provider/model catalog mirror.
# DSH_LARK_MODEL_CATALOG_URL=https://models.dev/api.json
# DSH_LARK_SESSION_PROJECTION=1
# DSH_LARK_SESSION_BACKFILL_MESSAGES=20
# DSH_LARK_SESSION_BACKFILL_BYTES=65536
# DSH_LARK_SESSION_STREAM_UPDATE_MS=800

# Deprecated compatibility alias. It is read only when
# DSH_LARK_SESSION_PROJECTION is absent; it no longer enables auto-switching.
# DSH_LARK_WEB_PUSH=1

# Security: reject DM traffic when no allowlist is configured (1) or keep the
# onboarding-friendly open default (0).
DSH_LARK_ACCESS_DEFAULT_DENY=0

# Reject message events older than this window (ms). 0 disables the check.
DSH_LARK_EVENT_FRESHNESS_MS=600000

# Optional no-@ group delivery. When enabled, the bridge polls message history
# only for previously observed group/topic chats and only accepts explicitly
# allowlisted human senders. Requires Feishu scope im:message.group_msg.
DSH_LARK_GROUP_NO_AT=false
DSH_LARK_GROUP_POLL_MS=3000

# Maximum consecutive trusted bot-to-bot @ handoffs across the local fleet.
# Any fresh human message resets the shared counter.
DSH_LARK_BOT_HANDOFF_MAX=6

# Optional idle timeout for a single agent run, in milliseconds. A run is
# stopped only after it has been silent (no streaming events / tool activity)
# for this long; actively working runs are never cut short.
DSH_LARK_RUN_TIMEOUT_MS=300000

# Grace period allowed after SIGTERM before SIGKILL, in milliseconds.
DSH_LARK_STOP_GRACE_MS=5000

# Max agent runs allowed concurrently within one scope (chat/topic).
# Default 2 lets PM / dev / docs roles work in parallel; set 1 for strictly
# serial per-scope execution, or use /concurrency in chat to override.
DSH_LARK_SCOPE_CONCURRENCY=2
# Bootstrap fallback only: Plain Markdown cannot vary per viewer. Choose zh,
# en, or bilingual (default); `/language` persists the profile policy and is
# authoritative after startup. Card UI always remains per-viewer.
# DSH_LARK_REPLY_LANG=bilingual
# DSH_LARK_SECRET_URL is an internal localhost callback generated per boot;
# never configure it manually or expose it outside the host.
# strict (default) | off. `off` disables only the separate plan gate and is
# intended for trusted deployments; scope policy preflight and ordinary per-tool approval still apply.
# DSH_LARK_PLAN_GATE=strict
# off | completed (completed + failed) | all (completed + failed + approval)
DSH_LARK_NOTIFICATION_DEFAULT=off

# Outbound notification channels (issue #113): push-only forwarding of
# completed/failed/approval/urgent notifications to other IMs (Telegram,
# WeCom group robot, …). No environment variable is required — configure
# them in chat as an admin with `/channels`, and opt a scope in with
# `/notifications on … sinks=<id1,id2>`. Credentials are stored at mode 0600
# in <profile>/notification-channels.json and are never echoed.

# Installed as a dsh profile bundle: the plugin starts the bridge engine
# in-process when the profile boots. Set this to 1 to keep the engine stopped
# while the plugin stays loaded as a standard dsh plugin.
# DSH_LARK_DISABLED=0

# Session / task archival: live messages kept per scope + workspace before overflow is
# archived (0 keeps everything), max archives retained per scope + workspace, and the
# max age of an archive in days (0 disables pruning).
DSH_LARK_RETENTION_MSGS=40
DSH_LARK_ARCHIVE_MAX=50
DSH_LARK_ARCHIVE_MAX_AGE_DAYS=90

# Safety-net guardian (issue #6): a minimal process independent of dsh that
# keeps the Feishu rescue entrance alive after dsh goes down. Installed by
# default via `dsh-lark-bot setup` (or standalone `dsh-lark-bot guardian
# install`); skip it with `dsh-lark-bot setup --no-guardian`.

# Bridge engine heartbeat write interval (guardian liveness signal).
DSH_LARK_HEARTBEAT_MS=5000

# Set to 1 to keep the guardian process stopped (service stays installed).
# DSH_LARK_GUARDIAN_DISABLED=0

# dsh profile the guardian watches / relaunches. Persisted on install; the
# env value is used as the default when no state file exists yet.
# DSH_LARK_GUARDIAN_PROFILE=dsh-lark

# Bridge state profile that provides the Feishu credentials and allowlists.
# DSH_LARK_GUARDIAN_BRIDGE_PROFILE=default

# Guardian watchdog poll interval and heartbeat staleness threshold.
DSH_LARK_GUARDIAN_POLL_MS=2000
DSH_LARK_GUARDIAN_STALE_MS=15000

# If a dsh process survives but the bridge heartbeat stays stale for this
# long, the engine is treated as dead and the guardian takes over.
DSH_LARK_GUARDIAN_ENGINE_DEAD_MS=120000

# Safe-mode engine selection: `auto` tries the official SDK JSON-RPC runtime
# first (real-time thinking / tool calls / typewriter text on the card) and
# falls back to headless (final output only, but the card still shows live
# activity/elapsed time) when provisioning fails; `sdk` requires the SDK
# runtime; `headless` skips provisioning entirely.
# DSH_LARK_GUARDIAN_SAFE_ADAPTER=auto

# Safe-mode task idle timeout: the guardian stops the run and renders a
# timeout card only after the task has been silent for this long.
DSH_LARK_GUARDIAN_SAFE_TIMEOUT_MS=600000

# Card density for safe-mode run cards (compact | standard | detailed).
# `detailed` shows more safe tool-status records and token usage; raw payloads stay local.
DSH_LARK_GUARDIAN_CARD_DENSITY=detailed

# Feishu channel liveness watchdog (issue #108). The engine detects a half-open
# WebSocket (TCP still ESTABLISHED but Feishu not delivering) and force-reconnects
# it; when even a forced reconnect fails the engine exits so the managed service /
# guardian restarts it. The heartbeat also carries a channel-readiness snapshot so
# `service status` / `doctor` / `guardian status` distinguish "engine alive" from
# "channel ready".
DSH_LARK_CHANNEL_PING_TIMEOUT_SEC=30
# DSH_LARK_CHANNEL_KEEPALIVE=1
DSH_LARK_CHANNEL_KEEPALIVE_MS=15000
DSH_LARK_CHANNEL_HEALTH_POLL_MS=5000

# One-command upgrade (issue #10): npm registry used by `dsh-lark-bot upgrade`
# to discover the latest published version. Defaults to the official npm
# registry; set to a mirror when the default is unreachable from your network.
# DSH_LARK_UPGRADE_REGISTRY=https://registry.npmjs.org