.env.example

# Optional: Bearer token for callers. If unset, auto-generated and saved to
# ~/.grok-proxy/api_key (prefix sk-gp-...). Printed on startup for WorkBuddy etc.
# GROK_PROXY_API_KEY=change-me-to-a-long-random-secret

# State dir for auto key + client config files (default: ~/.grok-proxy)
# GROK_PROXY_HOME=~/.grok-proxy

# On start, upsert client model entries (merge only — never wipe other models).
# Or use: grok-proxy --install-workbuddy --install-opencode --install-pi-agent
# GROK_PROXY_INSTALL_WORKBUDDY=true
# GROK_PROXY_INSTALL_OPENCODE=true
# GROK_PROXY_INSTALL_PI_AGENT=true

# Listen (local single-user default)
GROK_PROXY_HOST=127.0.0.1
GROK_PROXY_PORT=8787

# Path to grok binary (default: search PATH)
# GROK_BIN=grok

# Default workspace when request omits cwd
# GROK_PROXY_DEFAULT_CWD=/path/to/default/project

# Optional path prefixes (comma or colon separated). Empty = allow any cwd.
# GROK_PROXY_CWD_ALLOWLIST=/Users/me/projects,/tmp/agent-work

GROK_PROXY_MAX_CONCURRENT=10
GROK_PROXY_DEFAULT_TIMEOUT_SEC=600
# Default "auto": resolved from `grok models` at startup. Do not set "grok-build"
# (invalid id; the bootstrap removes it from WorkBuddy configs).
# GROK_PROXY_DEFAULT_MODEL=auto
# DANGER: setting this to true lets the ACP backend run tools WITHOUT human
# approval. Keep false unless you fully trust every prompt reaching the proxy.
GROK_PROXY_ALWAYS_APPROVE=false
GROK_PROXY_STRICT_SESSION_CWD=true

# Grok CLI auth (if not already logged in via `grok login`)
# XAI_API_KEY=xai-...