.env.example

# ============================================================
# Hivemind — Environment Configuration
# ============================================================
# Copy this file to .env and fill in the values.
#   cp .env.example .env
#
# WARNING: Never commit the .env file to version control!
# ============================================================

# ── Core ────────────────────────────────────────────────────
# No API key needed — we call the Claude CLI directly.
# Run `claude login` once to authenticate via OAuth.

# Path to Claude CLI binary (default: auto-detected from $PATH)
# Set explicitly if installed to a non-standard location.
CLAUDE_CLI_PATH=claude

# Default directory for new project workspaces.
# This is just a default — you can create projects in any directory.
CLAUDE_PROJECTS_DIR=~/hivemind-projects

# Dashboard listen port (default: 8080)
DASHBOARD_PORT=8080

# Dashboard bind address (default: 127.0.0.1 = localhost only)
# Set to 0.0.0.0 to allow LAN/remote access
DASHBOARD_HOST=127.0.0.1

# Path to cloudflared binary for remote tunnel (optional, auto-detected)
# CLOUDFLARED_PATH=/usr/local/bin/cloudflared

# ── Agent Limits ─────────────────────────────────────────────

# Max orchestrator turns per session (default: 25)
MAX_TURNS_PER_CYCLE=25

# Max orchestrator delegation loops before forced stop (default: 20)
MAX_ORCHESTRATOR_LOOPS=20

# Total session budget in USD (default: 50)
MAX_BUDGET_USD=50

# Warn when budget usage exceeds this fraction (default: 0.8 = 80%)
BUDGET_WARNING_THRESHOLD=0.8

# ── SDK Settings ─────────────────────────────────────────────

# Max agentic turns per single sub-agent call (default: 25)
SDK_MAX_TURNS_PER_QUERY=25

# Max budget per single sub-agent call in USD (default: 2.0)
SDK_MAX_BUDGET_PER_QUERY=2.0

# ── Timeouts ─────────────────────────────────────────────────

# Per-agent wall-clock timeout in seconds (default: 300 = 5 min)
AGENT_TIMEOUT_SECONDS=300

# Total session wall-clock timeout in seconds (default: 28800 = 8h)
SESSION_TIMEOUT_SECONDS=28800

# Seconds of inactivity before stall alert (default: 60)
STALL_ALERT_SECONDS=60

# Minimum seconds between agent calls — rate limiting (default: 3.0)
RATE_LIMIT_SECONDS=3.0

# ── Storage ──────────────────────────────────────────────────

# Directory for SQLite database and conversation data (default: ./data)
CONVERSATION_STORE_DIR=./data

# Session expiry in hours for cleanup (default: 24)
SESSION_EXPIRY_HOURS=24

# ── Pipeline ─────────────────────────────────────────────────

# Max steps in a pipeline execution (default: 10)
PIPELINE_MAX_STEPS=10

# Scheduler polling interval in seconds (default: 30)
SCHEDULER_CHECK_INTERVAL=30

# Scheduler timezone (default: Asia/Jerusalem)
# SCHEDULER_TIMEZONE=UTC

# ── Concurrency ──────────────────────────────────────────────

# Max parallel tasks per DAG execution (default: 4)
# Note: also configurable via DAG_MAX_CONCURRENT_NODES
DAG_MAX_CONCURRENT_NODES=4

# ── Logging ──────────────────────────────────────────────────

# Log level: DEBUG, INFO, WARNING, ERROR, CRITICAL (default: INFO)
LOG_LEVEL=INFO

# Log format: "text" for human-readable, "json" for structured (default: text)
# Use "json" in production/Docker for log aggregation.
LOG_FORMAT=text

# ── Input Validation ─────────────────────────────────────────

# Max user message length in characters (default: 200000)
MAX_USER_MESSAGE_LENGTH=200000

# ── Security ──────────────────────────────────────────────────

# API key for dashboard authentication (REQUIRED when binding to non-localhost).
# Generate one with: python -c "import secrets; print(secrets.token_urlsafe(32))"
# DASHBOARD_API_KEY=

# Optional password for remote access (two-factor: access code + password).
# When set, users must enter BOTH the rotating access code AND this password.
# Strongly recommended when using Cloudflare Tunnel for remote access.
# HIVEMIND_PASSWORD=your-secret-password

# Enable device-based authentication (default: true)
# DEVICE_AUTH_ENABLED=true

# Enable sandbox mode for agent execution (default: true)
# SANDBOX_ENABLED=true

# Project file isolation mode: "strict" or "relaxed" (default from config)
# ISOLATION_MODE=strict

# ── Rate Limiting ────────────────────────────────────────────

# Max API requests per rate-limit window (default: 300)
# RATE_LIMIT_MAX_REQUESTS=300

# Burst allowance above the per-window limit (default: 100)
# RATE_LIMIT_BURST=100

# ── CORS ─────────────────────────────────────────────────────

# Comma-separated list of allowed CORS origins.
# Default: http://localhost:5173,http://localhost:8080 (Vite dev + dashboard).
# WARNING: Do NOT use '*' — it is incompatible with credentials and is insecure.
CORS_ORIGINS=http://localhost:5173,http://localhost:8080

# ── Agent Runtimes (Advanced) ────────────────────────────────

# Default agent runtime: claude_code, openclaw, http, bash (default: claude_code)
# AGENT_RUNTIME_DEFAULT=claude_code

# JSON map of role → runtime override (default: {})
# Example: {"researcher": "openclaw", "qa": "bash"}
# AGENT_RUNTIME_MAP={}

# OpenClaw path and model (when using openclaw runtime)
# OPENCLAW_PATH=openclaw
# OPENCLAW_MODEL=claude-sonnet-4-20250514

# HTTP runtime endpoint and auth token (when using http runtime)
# HTTP_RUNTIME_URL=
# HTTP_RUNTIME_TOKEN=
# HTTP_RUNTIME_TIMEOUT=300

# ── Debate Engine (Experimental) ─────────────────────────────

# Enable adversarial debate for critical decisions (default: false)
# HIVEMIND_DEBATE_ENABLED=true

# ── Predefined Projects (optional JSON) ─────────────────────

# JSON map of project-name → directory path
# PREDEFINED_PROJECTS={"my-app": "~/projects/my-app"}

# ============================================================
# MCP (Model Context Protocol) API Keys — Optional
# Fill in the keys below to enable each MCP server.
# Free tier available for all of these.
# ============================================================

# Brave Search — free 2,000 queries/month
# Get key: https://brave.com/search/api/
BRAVE_API_KEY=

# Exa — semantic web search for AI agents
# Get key: https://exa.ai  (free tier: 1,000 searches/month)
EXA_API_KEY=

# Firecrawl — scrape any URL to clean Markdown
# Get key: https://firecrawl.dev  (free tier: 500 pages/month)
FIRECRAWL_API_KEY=

# GitHub — full repo/PR/issues access
# Get token: https://github.com/settings/tokens (scope: repo, read:org)
GITHUB_PERSONAL_ACCESS_TOKEN=

# Sentry — pull production errors & fix them automatically
# Get token: https://sentry.io/settings/account/api/auth-tokens/
SENTRY_AUTH_TOKEN=

# PostgreSQL — direct DB access for agents (optional)
# Format: postgresql://user:password@host:5432/dbname
DATABASE_URL=