# =============================================================================
# ZhikunCode — Environment Configuration
# Copy this to .env and fill in your values: cp .env.example .env
# =============================================================================

# ===== Multi-Provider Configuration (Recommended) =====
# Support multiple LLM providers simultaneously, switch freely in frontend.
# Fill in API keys for the providers you want to use.

# DashScope (Alibaba Cloud - Qwen series)
LLM_PROVIDER_DASHSCOPE_API_KEY=your-dashscope-api-key-here
# LLM_PROVIDER_DASHSCOPE_MODELS=qwen3.8-max-0902

# DashScope Token Plan (阿里云百炼 Token Plan 专属, sk-sp- 开头)
# 与 LLM_PROVIDER_DASHSCOPE_API_KEY（按量计费）相互独立、不可混用
LLM_PROVIDER_DASHSCOPE_TOKEN_PLAN_API_KEY=your-token-plan-api-key-here
# LLM_PROVIDER_DASHSCOPE_TOKEN_PLAN_MODELS=qwen3.8-max,qwen3.8-flash,deepseek-v4-pro-0813,deepseek-v4-flash-0731,deepseek-v4.1-flash,bailian/glm-5.3
# 百炼 GLM 使用 bailian/glm-5.3，与智谱直连 glm-5.3 分开；请求上游时自动映射回 glm-5.3。

# ASR 语音识别热词纠正规则，格式：标准写法:变体1,变体2;多条分号分隔（qwen3-asr-flash 词表偏置 +
# 误识别变体确定性纠正双层机制：标准写法注入 system 实体词表，变体在识别结果中替换回标准写法）
# ASR_CORRECTIONS=zhikuncode:zhi kun code,zkun code,智坤code,志鲲Code,智kuncode,zhi坤code

# DeepSeek
LLM_PROVIDER_DEEPSEEK_API_KEY=your-deepseek-api-key-here
# LLM_PROVIDER_DEEPSEEK_MODELS=deepseek-flash

# Moonshot (Kimi)
LLM_PROVIDER_MOONSHOT_API_KEY=your-moonshot-api-key-here
# LLM_PROVIDER_MOONSHOT_MODELS=kimi-k3

# Kimi Code 订阅（独立于 Moonshot 按量 Key）：K3 + K2.8 Preview，max 推理 / 1M 上下文
# K3 的 1M 上下文需要 Pro / Allegretto 及以上套餐；K2.8 Preview 取决于有效 coding 权益。
LLM_PROVIDER_KIMI_CODE_API_KEY=
# LLM_PROVIDER_KIMI_CODE_MODELS=k3,kimi-for-coding

# Zhipu (智谱 GLM)
LLM_PROVIDER_ZHIPU_API_KEY=your-zhipu-api-key-here
# LLM_PROVIDER_ZHIPU_MODELS=glm-5.3,glm-5.3-flash

# MiniMax
LLM_PROVIDER_MINIMAX_API_KEY=your-minimax-api-key-here
# LLM_PROVIDER_MINIMAX_MODELS=MiniMax-M3

# ZenMux (models below form a complete override when LLM_PROVIDER_ZENMUX_MODELS is set)
# api-key supports comma-separated multi-key: subscription key (sk-ss-v1- prefix) first
# with pay-as-you-go key (sk-ai-v1- prefix) as fallback; automatic key switch on
# 402 quote_exceeded (subscription quota exhausted) / 404 model_not_available.
LLM_PROVIDER_ZENMUX_API_KEY=your-zenmux-api-key-here
# LLM_PROVIDER_ZENMUX_MODELS=anthropic/claude-fable-5.1,openai/gpt-5.6-sol,openai/gpt-6-astra,google/gemini-3.8-flash,x-ai/grok-4.6

# OpenRouter (Union Alpha; leave empty to disable)
LLM_PROVIDER_OPENROUTER_API_KEY=
# LLM_PROVIDER_OPENROUTER_MODELS=stealth/union-alpha,openrouter/openai/gpt-6-astra,openrouter/anthropic/claude-fable-5.1
# To use Union Alpha as the default: LLM_DEFAULT_MODEL=stealth/union-alpha

# [Optional] Model defaults below require the Bailian Token Plan provider,
# except compact summary defaults which require the DeepSeek provider
# (LLM_PROVIDER_DEEPSEEK_API_KEY; otherwise summaries fall back to local selection).
# LLM_DEFAULT_MODEL=deepseek-v4.1-flash
# LLM_FAST_MODEL=deepseek-v4.1-flash
# LLM_COMPACT_MODEL=deepseek-flash
# Summary-only settings; disabled/unavailable uses validated local selection.
# LLM_COMPACT_LLM_ENABLED=true
# LLM_COMPACT_PROVIDER=deepseek
# LLM_COMPACT_THINKING_MODE=max
# LLM_COMPACT_MAX_COMPLETION_TOKENS=8192
# LLM_COMPACT_MAX_SUMMARY_TOKENS=4096
# LLM_COMPACT_TIMEOUT_MS=90000
# LLM_VISION_FALLBACK_MODEL=deepseek-v4.1-flash

# ===== Legacy Single-Provider (Backward Compatible) =====
# If llm.providers.* is empty, falls back to this config.
# LLM_API_KEY=your-api-key-here
# LLM_BASE_URL=https://dashscope.aliyuncs.com/compatible-mode/v1
# LLM_DEFAULT_MODEL=qwen3.8-max-0902
# LLM_MODELS=qwen3.8-max-0902,qwen3.6-plus

# [Optional] Host port mapping (default: 8080)
# ZHIKUN_PORT=8080

# [Optional] Spring profile (default: production)
# SPRING_PROFILES_ACTIVE=production

# [Optional] JVM options
# JAVA_OPTS=-Xms256m -Xmx1024m --enable-preview

# [Optional] Workspace path to mount into container
# WORKSPACE_PATH=./workspace

# Direct (non-Docker) server workspace policy. Docker Compose sets these to
# /app/workspace automatically. Separate multiple allowed roots with commas.
# ZHIKUN_DEFAULT_WORKSPACE=/absolute/path/to/default-workspace
# ZHIKUN_WORKSPACE_ALLOWED_ROOTS=/absolute/path/to/allowed-root
# Direct local desktop only; never enable behind a reverse proxy.
# ZHIKUN_LOCAL_PICKER_ENABLED=false
# ZHIKUN_GLOBAL_DB_PATH=/absolute/path/to/global.db

# ===== OSS publication + clipboard screenshot paste + remote file references =====
# Remote/ECS file references are uploaded immediately as permanent public-read objects.
# A reverse proxy in front of ECS must allow request bodies up to ZHIKUN_OSS_MAX_FILE_BYTES.
# Valid file limit range: 1-104857600 bytes (100 MiB hard maximum).
# auto: prefer local ALIBABA_CLOUD_* credentials; otherwise use the named ECS RAM role when present.
ZHIKUN_OSS_ENABLED=false
ZHIKUN_OSS_ENDPOINT=
ZHIKUN_OSS_REGION=
ZHIKUN_OSS_BUCKET=
ZHIKUN_OSS_PREFIX=zhikuncode-artifacts
ZHIKUN_OSS_ECS_ROLE_NAME=
ZHIKUN_OSS_CREDENTIAL_MODE=auto
ZHIKUN_OSS_MAX_FILE_BYTES=104857600
ZHIKUN_OSS_CONNECT_TIMEOUT_MS=10000
ZHIKUN_OSS_REQUEST_TIMEOUT_MS=120000
# Local one-click startup options (never commit real values):
# 1) Configure the Alibaba Cloud CLI default profile; or
# 2) Use a restricted RAM user / temporary STS credentials below.
# ALIBABA_CLOUD_ACCESS_KEY_ID=
# ALIBABA_CLOUD_ACCESS_KEY_SECRET=
# ALIBABA_CLOUD_SECURITY_TOKEN=

# Feature flags
ZHIKUN_COORDINATOR_MODE=0

# 删除会话二次确认验证码：配置后删除会话需输入该验证码；不配置则无需输入
# ZHIKUN_DELETE_CONFIRM_CODE=

# [Optional] Bash tool timeout configuration (milliseconds)
# BASH_DEFAULT_TIMEOUT_MS=120000
# BASH_MAX_TIMEOUT_MS=600000

# =============================================================================
# Docker Advanced Configuration (usually no change needed)
# =============================================================================

# [Optional] Allow private network access without auth token (Docker default: true)
# When running in Docker, requests from Docker bridge network bypass authentication.
# Set to 'false' to require auth token for all non-localhost requests.
# ALLOW_PRIVATE_NETWORK=true

# [Optional] Container log directory (Docker default: /app/log)
# LOG_DIR=/app/log

# [Optional] MCP capability registry file path
# MCP_REGISTRY_PATH=/app/configuration/mcp/mcp_capability_registry.json
# [Optional] User-controlled MCP state (low-frequency or high-risk services default off)
# MCP_SERVICE_STATE_PATH=/absolute/path/to/mcp-service-states.json

# Skill 开关默认全部开启；选择保存在后端，所有设备和会话共享。
# 默认路径 ~/.zhikun/skill-states.json；Docker 使用 /app/data/skill-states.json。
# SKILL_STATE_PATH=/absolute/path/to/skill-states.json

# ===== External MCP servers (optional) =====
# Keep credentials only in .env. ZHIKUN_MCP_SERVERS may reference them with ${NAME};
# local startup resolves them in ZhikunCode and Compose interpolates them for Docker.
# CONTEXT7_API_KEY=
# ALIBABA_CLOUD_ACCESS_KEY_ID=
# ALIBABA_CLOUD_ACCESS_KEY_SECRET=
# ALIBABA_CLOUD_SECURITY_TOKEN=
# ALIBABA_CLOUD_OPS_VISIBLE_TOOLS=ECS_DescribeInstances,ECS_DescribeRegions,ECS_DescribeSecurityGroups,OSS_ListBuckets,OSS_ListObjects
# GITHUB_TOOLS=get_me,get_file_contents,search_code,list_branches,list_commits,list_pull_requests,pull_request_read
# GITHUB_READ_ONLY=1
# GITHUB_LOCKDOWN_MODE=1
# ZHIKUN_MCP_SERVERS='{"github":{"command":"zhikun-github-mcp","env":{"GITHUB_TOOLS":"${GITHUB_TOOLS}","GITHUB_READ_ONLY":"${GITHUB_READ_ONLY}","GITHUB_LOCKDOWN_MODE":"${GITHUB_LOCKDOWN_MODE}"}},"context7":{"type":"HTTP","url":"https://mcp.context7.com/mcp","headers":{"Authorization":"Bearer ${CONTEXT7_API_KEY}"}},"alibaba-cloud-ops":{"command":"zhikun-alibaba-cloud-ops-mcp","args":["--visible-tools","${ALIBABA_CLOUD_OPS_VISIBLE_TOOLS}"],"env":{"ALIBABA_CLOUD_ACCESS_KEY_ID":"${ALIBABA_CLOUD_ACCESS_KEY_ID}","ALIBABA_CLOUD_ACCESS_KEY_SECRET":"${ALIBABA_CLOUD_ACCESS_KEY_SECRET}"}}}'

# Optional Meoo publishing (disabled by default). Never put the API key here.
ZHIKUN_MEOO_ENABLED=false
# Local: absolute path to ~/.meoo/credentials.json; Docker: read-only mounted secret.
# ZHIKUN_MEOO_CREDENTIALS_FILE=/run/secrets/meoo-credentials.json
ZHIKUN_MEOO_TIMEOUT_SECONDS=1200