.env.example

# Discord application (https://discord.com/developers/applications)
DISCORD_TOKEN=
DISCORD_CLIENT_ID=

# GitHub App (https://github.com/settings/apps/new) — see README for permissions
GITHUB_APP_ID=
GITHUB_APP_SLUG=anywarecode
# PEM contents; literal \n is fine
GITHUB_APP_PRIVATE_KEY=

# BYO-LLM only: there is no platform key. Every server connects its own AI
# credential via /connect llm (Anthropic key, Claude Pro/Max token, or any
# Anthropic-compatible endpoint). We never supply or bill for AI.

# AES-256-GCM encryption key for stored guild LLM credentials.
# Generate: openssl rand -base64 48
CREDENTIAL_SECRET=

# Comma-separated hostnames allowed for custom LLM provider base URLs.
# Empty = allow any host (fine for dev; set explicitly in prod).
# CUSTOM_PROVIDER_ALLOWLIST=api.openai.com,api.deepseek.com

# --- Database (Supabase) ---
# Project Settings → Database → Connection string → Session pooler URI
DATABASE_URL=postgresql://postgres.<ref>:<password>@aws-0-<region>.pooler.supabase.com:5432/postgres
DATABASE_SSL=true

# Public base URL GitHub redirects to after app install (dev: cloudflared tunnel)
PUBLIC_URL=https://example.com
# Random >=16 chars; signs the install state linking guild <-> installation
# Generate: openssl rand -base64 24
STATE_SECRET=
# Minutes an install link stays valid (single-use either way)
INSTALL_STATE_TTL_MINUTES=10

HTTP_PORT=3000
RUNNER_IMAGE=anywarecode-runner
# RUNNER_NETWORK and RUNNER_HTTPS_PROXY must be set TOGETHER or both left empty.
# Dev: both empty = runner on the default bridge with direct egress.
# Prod: RUNNER_NETWORK=anywarecode-egress + RUNNER_HTTPS_PROXY=http://egress-proxy:8888
#       (a proxy without the matching network = unresolvable host, every clone fails).
RUNNER_NETWORK=
RUNNER_HTTPS_PROXY=

TASK_TIMEOUT_MINUTES=30
# Max task/question prompt length (guards token/cap abuse)
MAX_PROMPT_CHARS=8000

# --- Agent engine ---
# Which engine the runner spawns: "claude" (Claude Agent SDK, default) or "claw".
RUNNER_ENGINE=claude
# Model used when a task doesn't request one (BYO providers use their own).
DEFAULT_MODEL=claude-sonnet-4-6
# Default model for the openai provider when a guild hasn't picked one (BYO key).
OPENAI_DEFAULT_MODEL=gpt-4o-mini
# Default model for the openrouter provider when a guild hasn't picked one (BYO key).
OPENROUTER_DEFAULT_MODEL=openrouter/auto
# Default model for /code when no model is picked (deeper work → Opus). /ask and
# chat keep DEFAULT_MODEL. Ignored for custom providers.
CODE_MODEL=claude-opus-4-8
# Selectable models for /code (csv); empty = no picker, DEFAULT_MODEL only.
MODEL_ALLOWLIST=claude-opus-4-8,claude-sonnet-4-6,claude-haiku-4-5
# Hard cap on agent turns per task (runaway guard).
MAX_AGENT_TURNS=60

# --- Verification + self-repair loop ---
# Master switch. After the agent finishes, the runner runs detected
# typecheck/test/lint and feeds failures back as repair turns (all plans).
VERIFY_ENABLED=true
# Repair attempts after a failed check (0 disables repair).
VERIFY_MAX_REPAIR_ATTEMPTS=2
# Share of remaining wall-clock reserved for verify+repair (0..0.9).
VERIFY_RESERVE_FRACTION=0.30
# Escalate to the stronger repair model after this many failed repairs.
# 0 = use VERIFY_REPAIR_MODEL on the very first repair turn (recommended).
VERIFY_ESCALATE_AFTER=0
# Per-user cooldown between task-launching commands, in seconds (0 = off).
COMMAND_COOLDOWN_SECONDS=5

# --- Billing / plans ---
# Monthly /code cap on the Free plan (the BYO-LLM default tier). Every plan
# ships every feature; plans differ only by this cap. /ask is always unlimited.
FREE_TASK_CAP=15
# Public web base URL — the Razorpay pay-redirects (/pay/...) the bot links to
# from /billing, and the company admin panel. Required for in-Discord billing.
WEB_URL=
# Shared secret bridging bot<->web for billing: signs the Job-Pack attribution
# token and authenticates the bot's cancel call. Set the SAME value in the web
# app's env. >=16 chars. Unset = pack buttons unattributed + cancel button hidden.
# Generate: openssl rand -base64 24
BILLING_BRIDGE_SECRET=

# --- GitHub webhooks (Issue feed, auto-review, ship log, previews) ---
# Secret configured on the GitHub App's webhook (>=16 chars); unset = webhook
# route disabled. Webhook URL: <PUBLIC_URL>/github/webhook
# GITHUB_WEBHOOK_SECRET=

# --- GitHub user identity (/link github, provenance receipts) ---
# GitHub App OAuth client id + a generated client secret. Set the App's
# "Callback URL" to <PUBLIC_URL>/github/user-callback. Unset = linking off.
# GITHUB_CLIENT_ID=
# GITHUB_CLIENT_SECRET=

# --- Discord Premium Apps (optional second billing rail) ---
# SKU ids from the dev portal (guild subscription SKUs for pro/studio, a
# consumable SKU for task packs). Unset = rail inert; Stripe still works.
# Payouts require a US/UK/EU developer entity.
# DISCORD_SKU_PRO=
# DISCORD_SKU_STUDIO=
# DISCORD_SKU_PACK=

# --- MCP extensions ---
# Comma-separated hostnames /connect mcp may target. Empty = any host (dev
# only); in prod mirror this in infra/egress-proxy/filter and rebuild it.
# MCP_HOST_ALLOWLIST=mcp.sentry.dev

# --- Squad Mode ---
SQUAD_MAX=3
SQUAD_VOTE_TTL_HOURS=24

# --- Feature knobs ---
# Hours/minutes the Run button on generated proposal cards stays valid.
ISSUE_PROPOSAL_TTL_HOURS=72
SCHEDULE_PROPOSAL_TTL_HOURS=24
PLAN_VOTE_TTL_MINUTES=120
# Max /schedule entries per guild (tiers with the scheduled_tasks feature).
SCHEDULE_MAX_PER_GUILD=5
# Server Memory size cap (Discord modal max is 4000).
MEMORY_MAX_CHARS=4000

# --- Voice / Standup Mode (Studio tier) ---
# Whisper transcription key; unset = /standup disabled.
# OPENAI_API_KEY=
STANDUP_MAX_MINUTES=30
STANDUP_MAX_UTTERANCE_SECONDS=60

# --- Web (apps/web; marketing + company admin panel; shares DATABASE_URL above) ---
# Supabase Auth powers the company admin sign-in (email/password only). From the
# Supabase project: Settings → API. Enable Email provider and DISABLE sign-ups in
# Authentication → Providers (admins are created by an operator in the dashboard).
NEXT_PUBLIC_SUPABASE_URL=
NEXT_PUBLIC_SUPABASE_ANON_KEY=
NEXT_PUBLIC_APP_URL=http://localhost:3001
NEXT_PUBLIC_DISCORD_INSTALL_URL=
# --- Razorpay (sole payment processor; INR + USD) ---
# Dashboard → Settings → API Keys. International payments must be ENABLED on the
# account for USD to work (operator prerequisite; INR works without it).
RAZORPAY_KEY_ID=
RAZORPAY_KEY_SECRET=
# Webhook secret (Dashboard → Webhooks). URL: <web-url>/api/razorpay/webhook
# Subscribe to: subscription.activated/charged/updated/pending/halted/paused/
# cancelled/completed, payment_link.paid, order.paid.
RAZORPAY_WEBHOOK_SECRET=
# Two plan ids per tier (one per currency). Create monthly plans in the
# dashboard at Pro $19/₹1600 and Studio $49/₹4100, then seed:
# pnpm --filter @anywarecode/db db:seed
RAZORPAY_PLAN_PRO_INR=
RAZORPAY_PLAN_PRO_USD=
RAZORPAY_PLAN_STUDIO_INR=
RAZORPAY_PLAN_STUDIO_USD=
# One-time job-pack amounts in the smallest unit (paise / cents): ₹700 / $8.
RAZORPAY_PACK_AMOUNT_INR=70000
RAZORPAY_PACK_AMOUNT_USD=800

# --- Admin panel ---
# Bearer token for /api/admin/* (CLI/programmatic). openssl rand -base64 24
ADMIN_API_SECRET=
# CSV of email addresses allowed into the admin UI. Must match a Supabase user.
# Fail-closed: empty = nobody can sign in.
ADMIN_EMAILS=

# --- Observability ---
# Sentry error tracking; leave empty to disable.
# SENTRY_DSN=
NODE_ENV=development
# LOG_LEVEL=info

# --- @mention chat ---
# Model for bot-side mention classification/replies (custom providers use their own model)
CHAT_MODEL=claude-haiku-4-5
# Per-guild mention classifications per minute
CHAT_RATE_PER_MINUTE=8
# Minutes a proposed task's Run button stays valid
CHAT_PROPOSAL_TTL_MINUTES=60
# Fall back to a cheaper model when the primary chat model is rate-limited.
CHAT_FALLBACK_ENABLED=false
# Cheaper/faster model used when CHAT_FALLBACK_ENABLED and the primary is throttled.
CHAT_FALLBACK_MODEL=claude-haiku-4-5
# Upper bound (seconds) on a single retry backoff delay for LLM calls (0..30).
RETRY_MAX_DELAY_SECONDS=5
# Wall-clock timeout (seconds) for a mention-classifier LLM call (min 1).
CLASSIFIER_TIMEOUT_SECONDS=60