# OpenAI
OPENAI_API_KEY=your-openai-api-key-here
OPENAI_MODEL=gpt-4-turbo-preview
OPENAI_BASE_URL=https://api.openai.com/v1

# Anthropic
ANTHROPIC_API_KEY=your-anthropic-api-key-here
ANTHROPIC_MODEL=claude-3-5-sonnet-20241022

# LLM provider (openai | anthropic)
DEFAULT_LLM_PROVIDER=openai

# Puppeteer
PUPPETEER_HEADLESS=true
PUPPETEER_TIMEOUT=30000
# Optional: explicit browser executable (Chrome/Edge/Chromium)
# PUPPETEER_EXECUTABLE_PATH=C:\Program Files\Google\Chrome\Application\chrome.exe

# MCP server identity
MCP_SERVER_NAME=jshookmcp
MCP_SERVER_VERSION=0.1.0

# Tool registration mode
# - MCP_TOOL_PROFILE=search|minimal|workflow|full
# - MCP_TOOL_DOMAINS=browser,debugger,network,maintenance,core,hooks,process,streaming,encoding,graphql,workflow,platform,sourcemap,transform,wasm,antidebug
# If MCP_TOOL_DOMAINS is set, it overrides MCP_TOOL_PROFILE.
# MCP_TOOL_PROFILE=minimal

# search_tools ranking tuning
# Which tiers apply workflow-domain ranking multiplier (comma-separated)
# SEARCH_WORKFLOW_BOOST_TIERS=workflow,full
# Workflow-domain score multiplier in search_tools
# SEARCH_WORKFLOW_DOMAIN_BOOST_MULTIPLIER=1.5
# Optional JSON override for explicit intent -> tool boosts.
# If set and valid, it replaces built-in defaults.
# Example:
# SEARCH_INTENT_TOOL_BOOST_RULES_JSON=[{"pattern":"抓取接口|api\\s*capture\\s*session","flags":"i","boosts":[{"tool":"web_api_capture_session","bonus":26},{"tool":"api_probe_batch","bonus":18}]},{"pattern":"账号注册|注册验证","flags":"i","boosts":[{"tool":"register_account_flow","bonus":24},{"tool":"batch_register","bonus":18}]}]

# Logging
LOG_LEVEL=info

# Cache
ENABLE_CACHE=true
CACHE_DIR=.cache
CACHE_TTL=3600

# Performance
MAX_CONCURRENT_ANALYSIS=3
MAX_CODE_SIZE_MB=10

# CAPTCHA fallback screenshots
CAPTCHA_SCREENSHOT_DIR=./screenshots

# Screenshot output root (always constrained inside project root)
# MCP_SCREENSHOT_DIR=./screenshots/manual

# Plugin roots (comma-separated)
# MCP_PLUGIN_ROOTS=./plugins,./dist/plugins
# MCP_WORKFLOW_ROOTS=./workflows

# Plugin toggle overrides (core .env controls plugin enablement)
# Accepts: 1/0, true/false, yes/no, on/off
# PLUGIN_BURP_OFFICIAL_MCP_SSE_ENABLED=true
# PLUGIN_ZAP_REST_BRIDGE_ENABLED=true
# PLUGIN_PLATFORM_BRIDGE_ENABLED=true
# PLUGIN_NATIVE_BRIDGE_ENABLED=true

# Plugin boost tier: minimum tier at which plugin tools auto-register during boost.
# Values: search | minimal | workflow | full (default: full)
# MCP_DEFAULT_PLUGIN_BOOST_TIER=full
# PLUGIN_BURP_OFFICIAL_MCP_SSE_BOOST_DOMAIN=workflow
# PLUGIN_ZAP_REST_BRIDGE_BOOST_DOMAIN=workflow
# PLUGIN_PLATFORM_BRIDGE_BOOST_DOMAIN=full
# PLUGIN_NATIVE_BRIDGE_BOOST_DOMAIN=full

# Burp official MCP (SSE bridge)
# BURP_MCP_SSE_URL=http://127.0.0.1:9876/sse
# BURP_MCP_AUTH_TOKEN=

# OWASP ZAP REST bridge
# ZAP_API_URL=http://127.0.0.1:8080
# ZAP_API_KEY=

# Platform/native bridge endpoints
# GHIDRA_BRIDGE_URL=http://127.0.0.1:18080
# IDA_BRIDGE_URL=http://127.0.0.1:18081

# ── Runtime-tunable constants (see src/constants.ts for full list) ──

# CDP debug ports scanned (comma-separated)
# DEBUG_PORT_CANDIDATES=9222,9229,9333,2039
# DEFAULT_DEBUG_PORT=9222

# External tool runner
# EXTERNAL_TOOL_TIMEOUT_MS=30000
# EXTERNAL_TOOL_MAX_STDOUT_BYTES=10485760
# EXTERNAL_TOOL_MAX_STDERR_BYTES=1048576

# Sandbox execution
# SANDBOX_EXEC_TIMEOUT_MS=5000
# SANDBOX_MEMORY_LIMIT_MB=128

# Symbolic execution
# SYMBOLIC_EXEC_MAX_PATHS=100
# SYMBOLIC_EXEC_TIMEOUT_MS=30000

# Worker pool
# WORKER_POOL_MIN_WORKERS=2
# WORKER_POOL_MAX_WORKERS=4
# WORKER_POOL_IDLE_TIMEOUT_MS=30000
# WORKER_POOL_JOB_TIMEOUT_MS=15000

# Parallel execution
# PARALLEL_DEFAULT_CONCURRENCY=3
# PARALLEL_DEFAULT_TIMEOUT_MS=60000

# Cache
# CACHE_GLOBAL_MAX_SIZE_BYTES=524288000
# TOKEN_BUDGET_MAX_TOKENS=200000

# LLM token limits
# ADV_DEOBF_LLM_MAX_TOKENS=3000
# VM_DEOBF_LLM_MAX_TOKENS=4000
# DEOBF_LLM_MAX_TOKENS=2000
# CRYPTO_DETECT_LLM_MAX_TOKENS=2000

# CAPTCHA solver
# CAPTCHA_2CAPTCHA_BASE_URL=https://2captcha.com
# CAPTCHA_DEFAULT_TIMEOUT_MS=180000

# MCP HTTP transport
# MCP_HTTP_REQUEST_TIMEOUT_MS=30000
# MCP_HTTP_KEEPALIVE_TIMEOUT_MS=60000

# Extension registry
EXTENSION_REGISTRY_BASE_URL=https://raw.githubusercontent.com/vmoranv/jshookmcpextension/master/registry

# Workflow batch
# WORKFLOW_BATCH_MAX_RETRIES=3
# WORKFLOW_BATCH_MAX_TIMEOUT_MS=300000
# WORKFLOW_BUNDLE_CACHE_TTL_MS=300000
# WORKFLOW_BUNDLE_CACHE_MAX_BYTES=104857600

# Memory operations
# MEMORY_SCAN_TIMEOUT_MS=120000
# MEMORY_SCAN_MAX_RESULTS=10000