.env.example

# DEPLOYMENT_READINESS: local/pilot config template, not production readiness.
# Required values are marked REQUIRED. Optional values can stay empty for the
# deterministic local review path.

# App
APP_NAME=gdev-agent
APP_ENV=dev
LOG_LEVEL=INFO

# LLM
# REQUIRED for live LLM mode. Use LLM_MODE=demo for deterministic local review.
LLM_MODE=demo
ANTHROPIC_API_KEY=
ANTHROPIC_MODEL=claude-sonnet-4-6
# Knowledge base base URL for FAQ lookups (required — no default in production)
# Must also be added to URL_ALLOWLIST or FAQ links will be stripped by output guard
KB_BASE_URL=https://kb.yourdomain.com
LLM_INPUT_RATE_PER_1K=0.003
LLM_OUTPUT_RATE_PER_1K=0.015

# Agent behavior
MAX_INPUT_LENGTH=2000
AUTO_APPROVE_THRESHOLD=0.85
EXEMPLAR_GUARD_ENABLED=true
EXEMPLAR_GUARD_THRESHOLD=0.62
EXEMPLAR_GUARD_TOP_K=3
# Empty uses the committed synthetic examples in eval/exemplars/triage_v1.jsonl
EXEMPLAR_GUARD_EXAMPLES_PATH=
APPROVAL_CATEGORIES=billing,account_access
APPROVAL_TTL_SECONDS=3600

# Core infra
# REQUIRED outside Docker Compose.
DATABASE_URL=postgresql+asyncpg://gdev_app:gdev-app-pass@localhost:5432/gdev
REDIS_URL=redis://localhost:6379
# Local Compose-only database role passwords. Replace them in shared environments.
GDEV_OWNER_PASSWORD=gdev-owner-pass
GDEV_APP_PASSWORD=gdev-app-pass

# Output guard
OUTPUT_GUARD_ENABLED=true
URL_ALLOWLIST=kb.yourdomain.com
OUTPUT_URL_BEHAVIOR=strip

# Webhook security and rate limiting
# REQUIRED when using per-tenant encrypted webhook secrets.
WEBHOOK_SECRET_ENCRYPTION_KEY=
# Deprecated legacy single-tenant secret; leave empty for the current stack.
WEBHOOK_SECRET=
# REQUIRED outside local toy runs. Use a 32+ byte random value.
JWT_SECRET=
JWT_ALGORITHM=HS256
JWT_TOKEN_EXPIRY_HOURS=8
# Recommended for approval endpoint defense in depth.
APPROVE_SECRET=
RATE_LIMIT_RPM=10
RATE_LIMIT_BURST=3
AUTH_RATE_LIMIT_ATTEMPTS=5

# Integrations
LINEAR_API_KEY=
LINEAR_TEAM_ID=
TELEGRAM_BOT_TOKEN=
TELEGRAM_APPROVAL_CHAT_ID=
GOOGLE_SHEETS_CREDENTIALS_JSON=
GOOGLE_SHEETS_ID=

# Optional local SQLite event log path (empty disables SQLite logging)
SQLITE_LOG_PATH=

# Optional observability
OTLP_ENDPOINT=
OTEL_SERVICE_NAME=gdev-agent