APP_ENV=local
LOG_LEVEL=INFO
SERVICE_NAME=assistant-api
# Host-only Docker Compose API port; container-internal API remains 8000.
ASSISTANT_API_HOST_PORT=18080
LOCAL_API_AUTH_REQUIRED=false
LOCAL_API_TOKEN=
CREDENTIAL_MASTER_KEY=
# One-time emergency administrator recovery. Generate a salted scrypt verifier;
# never store the answer itself. Disable again after a successful recovery.
ADMIN_RECOVERY_ENABLED=false
ADMIN_RECOVERY_QUESTION=
ADMIN_RECOVERY_ANSWER_VERIFIER=
ADMIN_RECOVERY_MAX_ATTEMPTS=5
ADMIN_RECOVERY_COOLDOWN_MINUTES=15

MANAGED_SKILLS_ROOT=var/skills
MANAGED_PROMPTS_ROOT=var/prompts
SKILL_PACKAGES_ROOT=var/skill-packages
ARTIFACTS_ROOT=var/artifacts
SESSION_WORKSPACE_ROOT=var/workspace/sessions
KNOWLEDGE_ROOT=var/knowledge

BROWSER_ENABLED=false
BROWSER_TIMEOUT_SECONDS=20
BROWSER_MAX_TEXT_CHARS=50000

SANDBOX_PROVIDER=none
SHELL_EXEC_ENABLED=false
SANDBOX_WORKSPACE_ROOT=var/sandbox
SANDBOX_DOCKER_IMAGE=
SANDBOX_DOCKER_ALLOWED_IMAGES=
SANDBOX_TIMEOUT_SECONDS=30

SUBAGENT_ENABLED=true
SUBAGENT_MAX_COUNT=3
SUBAGENT_CONCURRENCY=2
SUBAGENT_TIMEOUT_SECONDS=30

MEM0_CONFIG_PATH=
MEM0_SEARCH_LIMIT=5

QUALITY_JUDGE_SAMPLE_RATE=0
QUALITY_JUDGE_POLICY_VERSION=judge-v1
QUALITY_JUDGE_THRESHOLD=0.6

DATABASE_URL=postgresql+asyncpg://assistant:assistant@postgres:5432/assistant
REDIS_URL=redis://redis:6379/0
# Docker Compose bootstrap values; keep them consistent with DATABASE_URL.
POSTGRES_DB=assistant
POSTGRES_USER=assistant
POSTGRES_PASSWORD=assistant
SENTRY_DSN=

LANGFUSE_PUBLIC_KEY=
LANGFUSE_SECRET_KEY=
LANGFUSE_BASE_URL=
LANGFUSE_PROMPT_MANAGEMENT_ENABLED=false
LANGFUSE_PROMPT_LABEL=production
# Optional JSON map from local prompt module names to Langfuse prompt names. Keep empty until configured.
LANGFUSE_PROMPT_MODULE_MAP_JSON=

LANGBOT_WEBHOOK_SECRET=placeholder-langbot-webhook-secret
LANGBOT_API_BASE_URL=https://langbot.invalid
LANGBOT_API_KEY=placeholder-langbot-api-key
LANGBOT_SEND_TIMEOUT_SECONDS=10

DEEPSEEK_API_KEY=placeholder-deepseek-api-key
DEEPSEEK_BASE_URL=https://deepseek.invalid/v1
DEEPSEEK_LIGHT_MODEL=deepseek-light-placeholder
DEEPSEEK_STANDARD_MODEL=deepseek-standard-placeholder
# RAG/private model routes use Qwen through DashScope's OpenAI-compatible API.
QWEN_API_KEY=
QWEN_BASE_URL=https://dashscope.aliyuncs.com/compatible-mode/v1
QWEN_RAG_MODEL=qwen-plus
MODELS_TIMEOUT_SECONDS=30
MODELS_RETRY_ATTEMPTS=2
# Additional OpenAI-compatible GLM/enterprise/private nodes; keep [] until configured.
MODELS_NODES_JSON=[]

# Content governance is local by default and does not make network requests.
# Select guardrails_ai only after `cd backend && uv sync --extra content-governance`; the first
# adapter remains a local deterministic policy bridge and enables no remote validator.
CONTENT_GOVERNANCE_ENABLED=true
CONTENT_GOVERNANCE_PROVIDER=local

# Enterprise production gates remain disabled until reviewed Connector/MCP
# instances and governed credentials are configured in Web Admin.
PRODUCTION_PROVIDER_ENABLED=false
PRODUCTION_PROVIDER_TIMEOUT_SECONDS=20
SHARED_SEMANTIC_PROVIDER_ENABLED=false
# Set true in production after migration 202608100005 is applied and the
# application database role is not a PostgreSQL superuser or table owner.
POSTGRESQL_RLS_REQUIRED=false

TAVILY_API_KEY=placeholder-tavily-api-key
TAVILY_TIMEOUT_SECONDS=10
TAVILY_MAX_RESULTS=5
SEARCH_PROVIDER_ORDER=tavily,serper,exa
SERPER_API_KEY=
SERPER_BASE_URL=https://google.serper.dev/search
EXA_API_KEY=
EXA_BASE_URL=https://api.exa.ai/search
SEARCH_FALLBACK_ON_EMPTY=true
# Blank means reuse TAVILY_TIMEOUT_SECONDS for every provider.
SEARCH_PROVIDER_TIMEOUT_SECONDS=

RUNNING_TASK_TIMEOUT_SECONDS=300
PENDING_TASK_COMPENSATION_DELAY_SECONDS=120
SCHEDULER_MAINTENANCE_INTERVAL_SECONDS=300
# Keep one worker process for the 4 GB demonstration server; raise only after measuring memory use.
CELERY_WORKER_CONCURRENCY=1

# Workspace context tools read local project context through structured, bounded,
# readonly APIs. Keep deny globs conservative; do not include real secrets here.
WORKSPACE_CONTEXT_ROOT=.
WORKSPACE_CONTEXT_ENABLED=true
WORKSPACE_CONTEXT_DENY_GLOBS=.env,.env.*,**/.env,**/.env.*,.git/**,**/.git/**,node_modules/**,**/node_modules/**,__pycache__/**,**/__pycache__/**,*.pem,**/*.pem,*.key,**/*.key,*.p12,**/*.p12,*.sqlite,**/*.sqlite,*.db,**/*.db
WORKSPACE_CONTEXT_MAX_FILE_BYTES=200000
WORKSPACE_CONTEXT_MAX_RESULTS=50
READONLY_SHELL_ENABLED=false
READONLY_SHELL_TIMEOUT_SECONDS=10
READONLY_SHELL_MAX_OUTPUT_CHARS=50000

# V14 desktop screenshot capture for full Docker startup.
# Containers cannot read the host GUI directly, so Compose uses controller_http.
# Start a trusted host-side screenshot controller on this URL before using /screen.
DESKTOP_CAPTURE_ENABLED=true
DESKTOP_CAPTURE_MODE=controller_http
DESKTOP_CAPTURE_CONTROLLER_URL=http://host.docker.internal:8765/screenshot
DESKTOP_CAPTURE_DEFAULT_TARGET=frontend
DESKTOP_CAPTURE_REQUIRE_CONFIRMATION_FOR_DESKTOP=true
DESKTOP_CAPTURE_ARTIFACT_TTL_SECONDS=3600