# VulnClaw container configuration.
# Copy to `.env` and fill in your LLM credentials:  cp .env.example .env

# ── LLM provider ──────────────────────────────────────────────────────
# IMPORTANT: when configuring via environment variables, set BASE_URL and
# MODEL explicitly to match the provider your API key belongs to. The
# PROVIDER value below is only a label here — unlike the interactive
# `vulnclaw config` command, it does NOT auto-fill base_url/model. If you
# set a non-OpenAI key but leave BASE_URL unset, requests go to OpenAI's
# endpoint and you'll get "invalid api key".

# Required: API key for your provider.
VULNCLAW_LLM_API_KEY=sk-your-key-here

# Provider label (openai, openrouter, anthropic, deepseek, zhipu, minimax, ...).
VULNCLAW_LLM_PROVIDER=openai

# API base URL — MUST match your key's provider. Examples:
#   OpenAI     https://api.openai.com/v1
#   OpenRouter https://openrouter.ai/api/v1
#   Anthropic  https://api.anthropic.com/v1
#   DeepSeek   https://api.deepseek.com
#   Zhipu      https://open.bigmodel.cn/api/paas/v4
#   Moonshot   https://api.moonshot.cn/v1
#   Qwen       https://dashscope.aliyuncs.com/compatible-mode/v1
VULNCLAW_LLM_BASE_URL=https://api.openai.com/v1

# Model name — MUST match the provider above (e.g. gpt-4o,
# claude-sonnet-5 for Anthropic, anthropic/claude-sonnet-5 for OpenRouter,
# deepseek-chat, glm-4.7, kimi-k2.6, qwen3-max).
VULNCLAW_LLM_MODEL=gpt-4o

# Optional: token / sampling tuning.
#VULNCLAW_LLM_MAX_TOKENS=4096
#VULNCLAW_LLM_MAX_CONTEXT_TOKENS=128000
#VULNCLAW_LLM_TEMPERATURE=0.2

# ── Local models via Ollama ─────────────────────────────────────────
# Ollama exposes an OpenAI-compatible API, so no API key is needed (any
# placeholder works). Use a TOOL-CAPABLE model — VulnClaw drives everything
# through function calls, so models without tool support will not work.
# From inside this container, reach Ollama on your host via
# host.docker.internal (NOT localhost — that is the container itself); this
# needs the extra_hosts mapping and a bigger num_ctx. See DOCKER.md.
#VULNCLAW_LLM_API_KEY=ollama
#VULNCLAW_LLM_PROVIDER=ollama
#VULNCLAW_LLM_BASE_URL=http://host.docker.internal:11434/v1
#VULNCLAW_LLM_MODEL=llama3.1

# ── Async collaborative sub-agents ──────────────────────────────────
# Main dispatches background Group Leaders; each Leader coordinates leaf waves.
#VULNCLAW_SUBAGENT_ENABLED=true
#VULNCLAW_SUBAGENT_MAX_BACKGROUND_GROUPS=3
#VULNCLAW_SUBAGENT_MAX_CONCURRENT_LEAF_TOTAL=4
#VULNCLAW_SUBAGENT_MAX_CONCURRENT_LEAF_PER_GROUP=3
#VULNCLAW_SUBAGENT_MAX_LEAF_PER_GROUP=6
#VULNCLAW_SUBAGENT_MAX_WAVES_PER_GROUP=3
#VULNCLAW_SUBAGENT_MAX_STEPS_PER_LEAF=12
#VULNCLAW_SUBAGENT_LEAF_MAX_TOOL_ROUNDS=4
#VULNCLAW_SUBAGENT_LEAF_TIMEOUT_SECONDS=900
#VULNCLAW_SUBAGENT_GROUP_TIMEOUT_SECONDS=1200
#VULNCLAW_SUBAGENT_FINALIZATION_TIMEOUT_SECONDS=120
#VULNCLAW_SUBAGENT_MAX_MODEL_TOKENS_PER_SOLVE=8000000
#VULNCLAW_SUBAGENT_MAX_MODEL_TOKENS_PER_GROUP=1000000
#VULNCLAW_SUBAGENT_MERGE_MAX_EVIDENCE_PER_GROUP=48
#VULNCLAW_SUBAGENT_RESULT_MAX_CHARS=16000

# ── Storage ───────────────────────────────────────────────────────────
# Where config, sessions, targets and reports live inside the container.
# Already defaulted to /data (the mounted volume) in the image; override
# only if you change the volume mount point.
#VULNCLAW_CONFIG_DIR=/data