.env.example

# Azure DevOps Personal Access Token
AZURE_DEVOPS_PAT=your-pat-here

# Authentication for Claude Agent SDK: Use ONE of these methods
# Option 1 (recommended): Claude MAX subscription — run `claude setup-token` first
CLAUDE_CODE_OAUTH_TOKEN=your-oauth-token-here

# Option 2: Pay-per-token API key (takes precedence over OAuth if both set)
# ANTHROPIC_API_KEY=your-api-key-here

# Optional: Dedicated API key for PR review containers only.
# When set, PR review containers run with this key (and OAuth cleared) so the
# main pipeline keeps using the OAuth subscription. Pipeline containers are
# unaffected.
# PR_REVIEW_ANTHROPIC_API_KEY=your-api-key-here

# Optional: Discord webhook URL for infrastructure error notifications.
# Fires on container failures (rate limits, exit codes, validation errors)
# and spawn/setup failures (volume creation, missing image, docker socket).
# Leave unset to disable notifications. Created via Discord channel
# Settings → Integrations → Webhooks.
# DISCORD_WEBHOOK_URL=https://discord.com/api/webhooks/...

# PostgreSQL connection string (required)
DATABASE_URL=postgres://pipeline:pipeline@localhost:5432/pipeline

# Set to 1 to mark the dashboard's session cookie Secure (browsers only send it
# over HTTPS). docker-compose.yml sets this to 1 on the dashboard service
# unconditionally, because the `caddy` service in that file always terminates
# TLS in front of it — there is no supported way to run the compose dashboard
# without a TLS proxy in front of it. This only matters if you run the
# dashboard directly (bun run pipeline -- dashboard) outside compose, without
# Caddy: leave it unset there, or the cookie won't be sent at all over plain
# HTTP.
# DASHBOARD_SECURE_COOKIES=1

# Set to 1 to trust the X-Forwarded-For header on requests reaching the
# dashboard, for the login rate limiter's key and the auth_events.ip column
# (see resolveClientIp() in src/auth/http.ts). docker-compose.yml sets this to
# 1 unconditionally for the same reason as DASHBOARD_SECURE_COOKIES above:
# Caddy is the only thing that can reach the compose dashboard, and Caddy
# itself sets that header from the real connection rather than forwarding
# whatever a client already put in it, so trusting it there is safe. Leave
# this unset if you run the dashboard any other way (directly, or behind
# something that does NOT overwrite X-Forwarded-For) — with it unset, a
# forwarded header is ignored and the raw TCP peer address is used instead,
# which is the only safe default when you can't be sure of that guarantee.
# TRUST_PROXY_HEADERS=1

# Hostname Caddy terminates TLS for and clients use to reach the dashboard —
# see Caddyfile. Defaults to the placeholder "dashboard.localhost" if unset.
# Caddy mints its own certificate for this name via its internal CA (`tls
# internal`); it does not need to resolve publicly. Set this to whatever
# hostname your deployment actually uses (a LAN hostname, a local DNS entry,
# etc.) — never commit a real one to the public core's own files.
# DASHBOARD_HOSTNAME=dashboard.localhost

# Optional: Git identity inside pipeline containers (defaults shown).
# GIT_USER_EMAIL must be authorized in the AL Object ID Ninja backend app pool —
# the Coder agent reserves AL object IDs via the Ninja MCP, which authenticates
# with `git config user.email`. Unauthorized emails get 403 USER_NOT_AUTHORIZED.
# GIT_USER_NAME stays "DevOpsWorker" so AI commits are distinguishable from human ones.
# GIT_USER_NAME=DevOpsWorker
# GIT_USER_EMAIL=bot@example.com

# Optional: Default session path (used by `pipeline continue` if --session not specified)
# PIPELINE_SESSION=/path/to/session

# Optional: Path to docs-site repo for the docs-writer agent to survey (proprietary,
# machine-specific). Unset → docs-writer skips the "survey existing docs" step.
# DOCS_REPO_PATH=/path/to/docs-repo

# Private overlay (gitignored). ABSOLUTE host path to this repo's private/ dir.
# The watcher bind-mounts it into spawned pipeline/review containers so they load
# the same overlay (repo registry, env-provider, prompts). The compose daemons mount
# ./private directly; this var is only needed for the spawned sibling containers.
# Leave unset to run spawned containers generic (empty overlay).
# HOST_PRIVATE_DIR=/abs/path/to/repo/private

# Integration tests (optional — tests skip when missing)
# TEST_WORK_ITEM_ID=           # Azure DevOps work item ID for integration tests

# Optional: Azure DevOps configuration (override the active repo registration's defaults)
# AZURE_DEVOPS_ORG=your-ado-org
# AZURE_DEVOPS_ORG_URL=https://dev.azure.com/your-ado-org
# AZURE_DEVOPS_PROJECT=Your Project
# AZURE_DEVOPS_REPO_ID=00000000-0000-0000-0000-000000000000
# AZURE_DEVOPS_REPO_NAME=Your Repo
# AZURE_DEVOPS_CI_PIPELINE=0
# AZURE_DEVOPS_CD_PIPELINE=0
# AZURE_DEVOPS_AREA_PATH=Your Project\Your Area
# AZURE_DEVOPS_ITERATION=Your Project\Your Area