# =============================================================================
# ZhikunCode — Environment Configuration
# Copy this to .env and fill in your values: cp .env.example .env
# =============================================================================

# ===== Multi-Provider Configuration (Recommended) =====
# Support multiple LLM providers simultaneously, switch freely in frontend.
# Fill in API keys for the providers you want to use.

# DashScope (Alibaba Cloud - Qwen series)
LLM_PROVIDER_DASHSCOPE_API_KEY=your-dashscope-api-key-here
# LLM_PROVIDER_DASHSCOPE_MODELS=qwen3.8-max-0902,qwen3.7-plus

# DashScope Token Plan (阿里云百炼 Token Plan 专属, sk-sp- 开头)
# 与 LLM_PROVIDER_DASHSCOPE_API_KEY（按量计费）相互独立、不可混用
LLM_PROVIDER_DASHSCOPE_TOKEN_PLAN_API_KEY=your-token-plan-api-key-here
# LLM_PROVIDER_DASHSCOPE_TOKEN_PLAN_MODELS=qwen3.8-max,qwen3.8-flash,deepseek-v4-pro-0813,deepseek-v4-flash-0731

# DeepSeek
LLM_PROVIDER_DEEPSEEK_API_KEY=your-deepseek-api-key-here
# LLM_PROVIDER_DEEPSEEK_MODELS=deepseek-v4-pro,deepseek-v4-flash,deepseek-v4-flash-vision-exp

# Moonshot (Kimi)
LLM_PROVIDER_MOONSHOT_API_KEY=your-moonshot-api-key-here
# LLM_PROVIDER_MOONSHOT_MODELS=kimi-k3,moonshot-v1-128k

# Zhipu (智谱 GLM)
LLM_PROVIDER_ZHIPU_API_KEY=your-zhipu-api-key-here
# LLM_PROVIDER_ZHIPU_MODELS=glm-5.3,glm-5.3-flash

# MiniMax
LLM_PROVIDER_MINIMAX_API_KEY=your-minimax-api-key-here
# LLM_PROVIDER_MINIMAX_MODELS=MiniMax-M3

# ZenMux (Anthropic Claude series: claude-opus-4.8 / claude-fable-5.1, 1M context)
LLM_PROVIDER_ZENMUX_API_KEY=your-zenmux-api-key-here
# LLM_PROVIDER_ZENMUX_MODELS=anthropic/claude-opus-4.8,anthropic/claude-fable-5.1

# [Optional] Default model (used when no model is explicitly selected)
# LLM_DEFAULT_MODEL=qwen3.8-max-0902

# ===== Legacy Single-Provider (Backward Compatible) =====
# If llm.providers.* is empty, falls back to this config.
# LLM_API_KEY=your-api-key-here
# LLM_BASE_URL=https://dashscope.aliyuncs.com/compatible-mode/v1
# LLM_DEFAULT_MODEL=qwen3.8-max-0902
# LLM_MODELS=qwen3.8-max-0902,qwen3.6-plus

# [Optional] Host port mapping (default: 8080)
# ZHIKUN_PORT=8080

# [Optional] Spring profile (default: production)
# SPRING_PROFILES_ACTIVE=production

# [Optional] JVM options
# JAVA_OPTS=-Xms256m -Xmx1024m --enable-preview

# [Optional] Workspace path to mount into container
# WORKSPACE_PATH=./workspace

# Direct (non-Docker) server workspace policy. Docker Compose sets these to
# /app/workspace automatically. Separate multiple allowed roots with commas.
# ZHIKUN_DEFAULT_WORKSPACE=/absolute/path/to/default-workspace
# ZHIKUN_WORKSPACE_ALLOWED_ROOTS=/absolute/path/to/allowed-root
# Direct local desktop only; never enable behind a reverse proxy.
# ZHIKUN_LOCAL_PICKER_ENABLED=false
# ZHIKUN_GLOBAL_DB_PATH=/absolute/path/to/global.db

# ===== OSS publication + clipboard screenshot paste (optional, disabled by default) =====
# auto: prefer local ALIBABA_CLOUD_* credentials; otherwise use the named ECS RAM role when present.
ZHIKUN_OSS_ENABLED=false
ZHIKUN_OSS_ENDPOINT=
ZHIKUN_OSS_REGION=
ZHIKUN_OSS_BUCKET=
ZHIKUN_OSS_PREFIX=zhikuncode-artifacts
ZHIKUN_OSS_ECS_ROLE_NAME=
ZHIKUN_OSS_CREDENTIAL_MODE=auto
ZHIKUN_OSS_MAX_FILE_BYTES=104857600
ZHIKUN_OSS_CONNECT_TIMEOUT_MS=10000
ZHIKUN_OSS_REQUEST_TIMEOUT_MS=120000
# Local one-click startup options (never commit real values):
# 1) Configure the Alibaba Cloud CLI default profile; or
# 2) Use a restricted RAM user / temporary STS credentials below.
# ALIBABA_CLOUD_ACCESS_KEY_ID=
# ALIBABA_CLOUD_ACCESS_KEY_SECRET=
# ALIBABA_CLOUD_SECURITY_TOKEN=

# Feature flags
ZHIKUN_COORDINATOR_MODE=0

# [Optional] Bash tool timeout configuration (milliseconds)
# BASH_DEFAULT_TIMEOUT_MS=120000
# BASH_MAX_TIMEOUT_MS=600000

# =============================================================================
# Docker Advanced Configuration (usually no change needed)
# =============================================================================

# [Optional] Allow private network access without auth token (Docker default: true)
# When running in Docker, requests from Docker bridge network bypass authentication.
# Set to 'false' to require auth token for all non-localhost requests.
# ALLOW_PRIVATE_NETWORK=true

# [Optional] Container log directory (Docker default: /app/log)
# LOG_DIR=/app/log

# [Optional] MCP capability registry file path
# MCP_REGISTRY_PATH=/app/configuration/mcp/mcp_capability_registry.json
# [Optional] User-controlled MCP state (low-frequency or high-risk services default off)
# MCP_SERVICE_STATE_PATH=/absolute/path/to/mcp-service-states.json

# ===== External MCP servers (optional) =====
# Keep credentials only in .env. ZHIKUN_MCP_SERVERS may reference them with ${NAME};
# local startup resolves them in ZhikunCode and Compose interpolates them for Docker.
# CONTEXT7_API_KEY=
# ALIBABA_CLOUD_ACCESS_KEY_ID=
# ALIBABA_CLOUD_ACCESS_KEY_SECRET=
# ALIBABA_CLOUD_SECURITY_TOKEN=
# ALIBABA_CLOUD_OPS_VISIBLE_TOOLS=ECS_DescribeInstances,ECS_DescribeRegions,ECS_DescribeSecurityGroups,OSS_ListBuckets,OSS_ListObjects
# GITHUB_TOOLS=get_me,get_file_contents,search_code,list_branches,list_commits,list_pull_requests,pull_request_read
# GITHUB_READ_ONLY=1
# GITHUB_LOCKDOWN_MODE=1
# ZHIKUN_MCP_SERVERS='{"github":{"command":"zhikun-github-mcp","env":{"GITHUB_TOOLS":"${GITHUB_TOOLS}","GITHUB_READ_ONLY":"${GITHUB_READ_ONLY}","GITHUB_LOCKDOWN_MODE":"${GITHUB_LOCKDOWN_MODE}"}},"context7":{"type":"HTTP","url":"https://mcp.context7.com/mcp","headers":{"Authorization":"Bearer ${CONTEXT7_API_KEY}"}},"alibaba-cloud-ops":{"command":"zhikun-alibaba-cloud-ops-mcp","args":["--visible-tools","${ALIBABA_CLOUD_OPS_VISIBLE_TOOLS}"],"env":{"ALIBABA_CLOUD_ACCESS_KEY_ID":"${ALIBABA_CLOUD_ACCESS_KEY_ID}","ALIBABA_CLOUD_ACCESS_KEY_SECRET":"${ALIBABA_CLOUD_ACCESS_KEY_SECRET}"}}}'