# Canonical copyable configuration example. Docker Compose reads `.env` automatically,
# and non-Compose runtimes can use the same variables from their environment.
# Optional YAML configuration is documented separately for advanced deployments.

# Public HTTPS origin used by ChatGPT for OAuth discovery and callbacks.
# Example: https://local-shell-mcp.example.com
LOCAL_SHELL_MCP_PUBLIC_BASE_URL=https://your-public-host.example.com

# ChatGPT custom connectors should use OAuth mode. Do not expose this service publicly with auth_mode=none.
LOCAL_SHELL_MCP_AUTH_MODE=oauth

# Stateful MCP sessions are released after three minutes without any HTTP activity.
# The higher cap accommodates clients that frequently establish fresh sessions.
LOCAL_SHELL_MCP_MCP_SESSION_IDLE_TIMEOUT_S=180
LOCAL_SHELL_MCP_MCP_MAX_SESSIONS=1024

# Required for approving the OAuth authorization page. Choose a strong random value.
LOCAL_SHELL_MCP_OAUTH_ADMIN_PIN=change-me-long-random-pin

# Required for stable bearer tokens across restarts. Generate with: openssl rand -hex 32
LOCAL_SHELL_MCP_OAUTH_JWT_SECRET=change-me-64-hex-random-secret

# Keep false unless the container is disposable and intentionally fully controlled by ChatGPT.
LOCAL_SHELL_MCP_ALLOW_FULL_CONTAINER=false

# Remote-only controller mode. Stateless mode implies disable_local and avoids
# controller-local persistent state; use Redis when state must survive cold starts.
LOCAL_SHELL_MCP_DISABLE_LOCAL=false
LOCAL_SHELL_MCP_STATELESS_CONTROLLER=false
LOCAL_SHELL_MCP_STATE_BACKEND=file
LOCAL_SHELL_MCP_STATE_BACKEND_URL=
LOCAL_SHELL_MCP_STATE_BACKEND_PREFIX=local-shell-mcp

# Persist GitHub CLI, Git HTTPS credentials, GitCode credentials, SSH keys, .netrc, and GPG state across container rebuilds.
# The Docker Compose example stores them in the local-shell-mcp-credentials volume.
LOCAL_SHELL_MCP_PERSISTENT_CREDENTIALS=true

# Optional for the cloudflared tunnel sidecar profile. This uses Cloudflare Tunnel only, not Cloudflare Access.
CLOUDFLARE_TUNNEL_TOKEN=

# Remote worker mode: enabled by default. Set false to disable /join, /remote/*,
# and the remote_* MCP tools.
LOCAL_SHELL_MCP_REMOTE_ENABLED=true
LOCAL_SHELL_MCP_REMOTE_INVITE_TTL_S=600
LOCAL_SHELL_MCP_REMOTE_POLL_TIMEOUT_S=25
LOCAL_SHELL_MCP_REMOTE_JOB_TIMEOUT_S=3600

# Optional MCP runtime features. Disable Logical Sessions for a smaller v3-style
# tool surface, or disable only the MCP App Live Workspace while keeping Native WebUI.
LOCAL_SHELL_MCP_LOGICAL_SESSIONS_ENABLED=true
LOCAL_SHELL_MCP_LIVE_WORKSPACE_ENABLED=true

# Shared native OpenTUI and browser terminal interface.
LOCAL_SHELL_MCP_UI_ENABLED=true
LOCAL_SHELL_MCP_UI_PATH=/ui
LOCAL_SHELL_MCP_UI_WALLPAPER=bing
LOCAL_SHELL_MCP_UI_TERMINAL_IDLE_TIMEOUT_S=3600
LOCAL_SHELL_MCP_UI_TERMINAL_MAX_SESSIONS=8

# Environment exposed to user shell commands. Values are comma-separated.
# Block server/tunnel configuration from leaking into subprocesses by default.
LOCAL_SHELL_MCP_SHELL_ENV_BLOCKLIST=CLOUDFLARE_TUNNEL_TOKEN
LOCAL_SHELL_MCP_SHELL_ENV_BLOCKED_PREFIXES=LOCAL_SHELL_MCP_,DOCKER_