.env.example

# ============================================================
# ServerFS MCP
# ============================================================

# Docker image for the serverfs-mcp service (published to GHCR).
#
# Production: pin an exact published release so deploys are reproducible and rollback
# is a one-line change. Current published stable release (v0.23.0):
#   SERVERFS_IMAGE=ghcr.io/ntlx/serverfs_mcp:0.23.0
# Track development builds from main:
#   SERVERFS_IMAGE=ghcr.io/ntlx/serverfs_mcp:edge
# Building from source? Leave this as-is and run `docker compose build`.
SERVERFS_IMAGE=ghcr.io/ntlx/serverfs_mcp:latest

# Log level for the ServerFS MCP container (DEBUG / INFO / WARNING / ERROR)
SERVERFS_LOG_LEVEL=INFO

# Streamable HTTP listener and transport-security policy.
# The defaults preserve the existing Docker-internal OpenAI Tunnel path.
# Generic remote MCP publication should normally keep the container private,
# publish it on loopback through compose.http.yml, terminate HTTPS/authentication
# at an operator-managed reverse proxy/gateway, and explicitly add that proxy's
# preserved Host value to SERVERFS_HTTP_ALLOWED_HOSTS.
SERVERFS_HTTP_HOST=0.0.0.0
SERVERFS_HTTP_PORT=8000
SERVERFS_HTTP_PATH=/mcp
# Empty auto-derives the Docker-internal authority serverfs-mcp:<HTTP_PORT>.
# Set an explicit comma-separated allowlist for any additional reverse-proxy
# or private-network Host values used by generic MCP clients.
SERVERFS_HTTP_ALLOWED_HOSTS=
# Empty means every non-empty Origin header is rejected. Add exact HTTP(S)
# origins only when a browser-based MCP host genuinely needs one.
SERVERFS_HTTP_ALLOWED_ORIGINS=

# Generic HTTP publication override (compose.http.yml). Keep loopback unless
# you deliberately bind a trusted private interface such as Tailscale/LAN.
SERVERFS_HTTP_PUBLISH_HOST=127.0.0.1
SERVERFS_HTTP_PUBLISH_PORT=8000

# Optional static API Key authentication for remote Streamable HTTP (v0.17+).
# Leave empty to disable. When configured, clients should preferably send:
#   Authorization: Bearer <key>
# A DingTalk-style one-line URL `/mcp?key=<key>` is also supported for
# compatibility/convenience, but URL credentials may be captured by reverse
# proxy or infrastructure logs. Public endpoints still require HTTPS.
# Static API Key authentication and SERVERFS_OAUTH_ENABLED=true are mutually
# exclusive; ServerFS fails closed at startup if both are configured.
SERVERFS_HTTP_API_KEY=

# ============================================================
# Optional Linux Cloudflare Tunnel ingress (planned v0.24.0)
# ============================================================
# Use compose.yml + compose.cloudflare.yml to attach cloudflared to ServerFS
# through its private Docker network without publishing an HTTP host port.
# Create a remotely managed tunnel; route its public hostname to
# http://serverfs-mcp:8000 (adjust when SERVERFS_HTTP_PORT changes).
# The original token file MUST be outside the checkout and every workdir,
# mode 0600 and owned/readable by CLOUDFLARED_UID (default 10001).
# For rootless operator-owned credentials, use your own `id -u` / `id -g`
# values here; this does NOT change SERVERFS_UID / SERVERFS_GID.
CLOUDFLARED_UID=10001
CLOUDFLARED_GID=10001
# Keep the token itself out of .env, argv, Compose logs, and Git.
# Set the next value to the absolute external file path before rendering.
# Recommended tested image tag (Linux amd64 tested; amd64/arm64 manifest checked).
# Example only: operators may choose a newer version; no digest pin enforced.
CLOUDFLARED_IMAGE=cloudflare/cloudflared:2026.10.7
# CLOUDFLARE_TUNNEL_TOKEN_FILE=/home/operator/.config/serverfs/cloudflare-tunnel-token

# ============================================================
# Optional OAuth 2.1 for remote Streamable HTTP (v0.16+)
# ============================================================
#
# OAuth is disabled by default. When false, ServerFS preserves the v0.15
# behavior and none of the settings below are required.
SERVERFS_OAUTH_ENABLED=false

# Resource Server identity. Required only when OAuth is enabled.
# Use the externally meaningful public HTTPS MCP URL and serverfs-auth issuer.
# HTTP is accepted only for explicit localhost/loopback test fixtures.
SERVERFS_OAUTH_RESOURCE_URL=
SERVERFS_OAUTH_ISSUER_URL=
SERVERFS_OAUTH_REQUIRED_SCOPES=serverfs:access
# Private serverfs-mcp -> serverfs-auth introspection path.
SERVERFS_OAUTH_INTROSPECTION_URL=http://serverfs-auth:8082/internal/introspect
# Shared only between serverfs-mcp and serverfs-auth. Use a long random secret.
SERVERFS_OAUTH_INTROSPECTION_SECRET=
SERVERFS_OAUTH_INTROSPECTION_TIMEOUT_SECONDS=2

# serverfs-auth runtime. compose.oauth.yml owns this service; historical base
# deployments do not start it merely because the repository was upgraded.
SERVERFS_AUTH_HOST=0.0.0.0
SERVERFS_AUTH_PORT=8082
SERVERFS_AUTH_PUBLIC_URL=
# OpenAI Secure MCP Tunnel trusts the configured MCP origin by default. If
# serverfs-auth is published on a different origin, list that exact public
# origin here (newline-separated when multiple origins are required). Leave
# blank when not using Tunnel OAuth or when the auth server shares the MCP origin.
MCP_OAUTH_TRUSTED_ORIGINS=
# compose.oauth.yml publishes serverfs-auth on loopback by default; place a
# public HTTPS reverse proxy in front rather than binding this directly to LAN.
SERVERFS_AUTH_PUBLISH_HOST=127.0.0.1
SERVERFS_AUTH_PUBLISH_PORT=8082
# Host directory must exist before `up` and be writable by SERVERFS_UID/GID.
# It is the only writable persistent mount in the serverfs-auth container.
SERVERFS_AUTH_STATE_HOST_DIR=./.serverfs-auth-state
SERVERFS_AUTH_STATE_DIR=/var/lib/serverfs-auth
# Optional read-only JSON array of public pre-registered OAuth clients.
# Use an absolute path inside serverfs-auth; compose.oauth.yml may mount it read-only.
SERVERFS_AUTH_CLIENTS_FILE=
# Default deny. Exact comma-separated provider:stable-subject entries only;
# wildcards are intentionally unsupported.
SERVERFS_AUTH_ALLOWED_PRINCIPALS=
SERVERFS_AUTH_ACCESS_TOKEN_TTL_SECONDS=3600
SERVERFS_AUTH_REFRESH_TOKEN_TTL_SECONDS=2592000
# DCR is compatibility-only; modern client registration should prefer CIMD or
# explicit pre-registration when supported.
SERVERFS_AUTH_DCR_ENABLED=false
# Reuse SERVERFS_PROXY_* below when provider traffic requires an HTTP proxy.
SERVERFS_AUTH_USE_PROXY=false

# Upstream identity providers are independently opt-in. Provider credentials
# are passed only to serverfs-auth, never to serverfs-mcp.
SERVERFS_OAUTH_GITHUB_ENABLED=false
SERVERFS_OAUTH_GITHUB_CLIENT_ID=
SERVERFS_OAUTH_GITHUB_CLIENT_SECRET=

SERVERFS_OAUTH_DINGTALK_ENABLED=false
SERVERFS_OAUTH_DINGTALK_CLIENT_ID=
SERVERFS_OAUTH_DINGTALK_CLIENT_SECRET=

SERVERFS_OAUTH_FEISHU_ENABLED=false
SERVERFS_OAUTH_FEISHU_CLIENT_ID=
SERVERFS_OAUTH_FEISHU_CLIENT_SECRET=

# WeChat here means WeChat Open Platform Website Application login, not WeCom
# and not Official Account webpage authorization.
SERVERFS_OAUTH_WECHAT_ENABLED=false
SERVERFS_OAUTH_WECHAT_CLIENT_ID=
SERVERFS_OAUTH_WECHAT_CLIENT_SECRET=

# Linux UID/GID the serverfs-mcp container runs as.
# The host directories you expose must be readable by this UID/GID.
# Docker's read-only bind mount does NOT bypass Linux file permissions.
# For the optional Phase E Agent Bridge deployment, set these to the current
# normal login user's `id -u` / `id -g` so the container requests the same
# identity as the host-side Bridge.
SERVERFS_UID=10001
SERVERFS_GID=10001

# ============================================================
# Optional Phase E Agent Bridge deployment
# ============================================================
#
# `.env` is the single deployment configuration source. The base compose.yml
# ignores these Agent-specific values; they become active only when the explicit
# compose.agent.yml overlay is used.
#
# Keep false for the default v0.2-compatible 11-tool deployment. Change to true
# only after SO_PEERCRED has been measured and the selected workdir/provider
# settings have been reviewed; then install and validate the host-side Bridge.
#
# SERVERFS_AGENT_MODE / SERVERFS_AGENT_RUNTIMES are the global Agent policy
# defaults inherited by workdirs whose WORKDIR_XX overrides are empty. They
# do NOT replace SERVERFS_AGENT_BRIDGE_ENABLED: the Bridge switch is still the
# infrastructure master gate.
SERVERFS_AGENT_BRIDGE_ENABLED=false
# MCP container -> Bridge RPC timeout. This does not limit Agent task lifetime.
SERVERFS_AGENT_BRIDGE_TIMEOUT_SECONDS=30
# Agent lifecycle bounds enforced by the host Bridge.
SERVERFS_AGENT_TASK_TIMEOUT_SECONDS=7200
SERVERFS_AGENT_INTERACTION_TIMEOUT_SECONDS=1800
SERVERFS_AGENT_MAX_ACTIVE_TASKS=4
SERVERFS_AGENT_TASK_RETENTION_HOURS=168
# Final responses at or below this UTF-8 byte threshold stay inline; larger responses up to
# the fixed 8 MiB result ceiling are spooled. Production default remains 256 KiB.
SERVERFS_AGENT_RESULT_SPOOL_THRESHOLD_BYTES=262144
# v0.12 Linux Agent egress switch. Reuses SERVERFS_PROXY_* below. Agent proxying requires
# a credentialless endpoint; use an operator-managed local broker for authenticated upstreams.
SERVERFS_AGENT_USE_PROXY=false
# Optional operator-defined ACP launch profiles; JSON array, no secrets. Each allowlisted
# acp-<id> runtime must have a profile and use workspace-write. Example:
# [{"id":"opencode","command":"/absolute/path/to/opencode","args":["acp"]}]
SERVERFS_ACP_PROFILES_JSON=
SERVERFS_AGENT_MODE=disabled
SERVERFS_AGENT_RUNTIMES=

# Fill PEER_UID/GID only from deployment/agent-bridge/measure_peercred.py output.
# Never infer them from id -u/id -g. The measured values must equal the current
# login user for the default user-scoped Phase E deployment; otherwise fail closed.
SERVERFS_AGENT_PEER_UID=
SERVERFS_AGENT_PEER_GID=

# User-owned host runtime/state paths. Use absolute paths for the actual login user.
# Example: /home/me/.local/share/serverfs-agent-bridge/runtime/socket
SERVERFS_AGENT_BRIDGE_HOST_SOCKET_DIR=
SERVERFS_AGENT_LOCK_HOST_DIR=
SERVERFS_AGENT_BRIDGE_STATE_DIR=

# Provider executables are host-side only and must be absolute when enabled by a
# workdir Agent policy. Provider secrets/shell-only variables normally do NOT belong
# here; keep those in ~/.config/serverfs-agent-bridge/provider.env (mode 0600).
# Opt-in exception: SERVERFS_JEV_API_KEY is the master gate for the experimental
# advisory Jev features (Preflight, Runtime Router, Approval Advisor). Leave it empty
# to disable all Jev functionality.
SERVERFS_CODEX_BIN=
SERVERFS_CODEX_HOME=~/.codex
SERVERFS_CODEX_AUTOSTART=false
SERVERFS_CODEX_REQUEST_TIMEOUT_SECONDS=10
SERVERFS_CLAUDE_BIN=
SERVERFS_CLAUDE_PROBE_TIMEOUT_SECONDS=5
SERVERFS_QODER_BIN=
SERVERFS_QODER_PROBE_TIMEOUT_SECONDS=5
SERVERFS_JEV_API_KEY=
# v0.12 Jev-only egress switch. The explicit Jev HTTP client reuses SERVERFS_PROXY_* without
# setting process-wide proxy environment variables inherited by Agent provider children.
SERVERFS_JEV_USE_PROXY=false

# read_text_file limits
SERVERFS_MAX_READ_BYTES=524288
SERVERFS_MAX_READ_LINES=500

# list_directory limits
SERVERFS_DEFAULT_LIST_LIMIT=100
SERVERFS_MAX_LIST_ENTRIES=500

# search limits (find_files / search_text)
SERVERFS_DEFAULT_SEARCH_RESULTS=50
SERVERFS_MAX_SEARCH_RESULTS=100

# find_files traversal cap (filesystem entries per call)
SERVERFS_MAX_WALK_ENTRIES=200000

# search_text: ripgrep wall-clock timeout and per-file size ceiling
SERVERFS_SEARCH_TIMEOUT_SECONDS=15
SERVERFS_SEARCH_MAX_FILE_BYTES=52428800

# Allow hidden (dot-prefixed) paths to be listed/read/searched.
# Credential-like files (.env, *.key, id_rsa, .ssh/**, ...) stay denied
# regardless of this setting (defense in depth).
SERVERFS_ALLOW_HIDDEN=false

# Extra deny globs: comma-separated filename patterns appended to the
# credential deny rules, applied on every channel (list/find/search/read/stat).
# Semantics: a plain glob (e.g. "*.sqlite") matches file/directory names;
# "dirname/**" (e.g. "internal/**") matches everything inside that directory.
# These rules always apply — including when SERVERFS_DISABLE_DEFAULT_DENY=true.
SERVERFS_EXTRA_DENY_GLOBS=

# Disable the built-in credential deny rules (.env, *.pem, *.key, id_rsa,
# .ssh/**, ...). Default false. WARNING: setting this to true lets the AI
# agent read credential material inside your workdirs — if you use it,
# define compensating rules via SERVERFS_EXTRA_DENY_GLOBS.
SERVERFS_DISABLE_DEFAULT_DENY=false

# Mutation limits (only apply to workdirs configured READ_ONLY=false).
# Max bytes for create_text_file content, an edited source file and an edit
# result; also caps the total size of all old_text+new_text in one call.
SERVERFS_MAX_WRITE_BYTES=1048576

# Max edits accepted in one edit_text_file call.
SERVERFS_MAX_EDITS_PER_CALL=50

# Binary transfer is opt-in. When disabled for every workdir, the binary
# upload/download tools are not registered at all. The whole-file transfer
# ceiling applies before/while decoding uploads, while reading downloads, and
# to file-parameter ingress fetches when that sidecar is enabled.
SERVERFS_BINARY_TRANSFER_ENABLED=false
SERVERFS_MAX_BINARY_TRANSFER_BYTES=8388608

# Optional ChatGPT/OpenAI file-parameter ingress. This does NOT give the
# serverfs-mcp container Internet access: it talks only to the isolated
# serverfs-file-ingress sidecar over an internal Docker network.
# Start the sidecar explicitly with the `file-ingress` Compose profile.
SERVERFS_FILE_INGRESS_ENABLED=false
SERVERFS_FILE_INGRESS_TIMEOUT_SECONDS=30

# Sidecar-only policy. ALLOWED_HOSTS is an exact comma-separated hostname
# allowlist: generic wildcards are never accepted. Real ChatGPT probes show that
# OpenAI fileParams can use region-varying Azure Blob storage accounts; opt in to
# only that measured account-name family with the separate boolean below.
SERVERFS_FILE_INGRESS_ALLOWED_HOSTS=
SERVERFS_FILE_INGRESS_ALLOW_OPENAI_BLOB_HOSTS=false
SERVERFS_FILE_INGRESS_FETCH_TIMEOUT_SECONDS=30
SERVERFS_FILE_INGRESS_MAX_REDIRECTS=3


# ============================================================
# Workdirs (16 slots)
# ============================================================
#
# Each slot has identity/mount fields plus optional policy overrides.
# Empty policy overrides inherit the matching SERVERFS_* global default.
# Scalar workdir overrides win over global defaults. EXTRA_DENY_GLOBS is the
# deliberate exception: global + workdir deny globs are UNIONED, so a workdir
# can tighten but cannot remove the global deny floor.
#
# Identity/mount:
#   ALIAS, PATH, DESCRIPTION, READ_ONLY
# Read policy overrides:
#   ALLOW_HIDDEN, DISABLE_DEFAULT_DENY, EXTRA_DENY_GLOBS
#   MAX_READ_BYTES, MAX_READ_LINES, MAX_WRITE_BYTES
# Binary policy overrides:
#   BINARY_TRANSFER_ENABLED, MAX_BINARY_TRANSFER_BYTES
# Repo Ops policy overrides (v0.23 Linux development):
#   REPO_OPS_ENABLED, REPO_ACTIONS_JSON
# Agent policy overrides:
#   AGENT_MODE, AGENT_RUNTIMES
#
# The authenticated host Bridge transport requires the optional compose.agent.yml overlay and
# SERVERFS_AGENT_BRIDGE_ENABLED=true. Repo Ops and Agent delegation are then authorized
# independently per workdir. Every enabled Agent runtime, including ACP profiles, requires
# effective AGENT_MODE=workspace-write and READ_ONLY=false.
#
# Rules:
#   - alias: letter first, then letters/digits/_/-, max 32 chars
#   - alias must be unique across slots
#   - leave ALIAS and PATH empty to disable a slot
#   - host path must already exist (it is never auto-created)
#   - READ_ONLY accepts true/false (also 1/0, yes/no, on/off), but write it
#     as true or false: Docker Compose itself rejects 1 and 0 for the
#     matching bind-mount flag. An unknown value stops the container at
#     startup instead of guessing.
#   - READ_ONLY controls BOTH the ServerFS authorization and the Docker
#     bind mount, from this one variable. A read-write workdir needs the
#     ServerFS UID/GID to have write permission on the host directory.
#   - empty workdir policy fields inherit their SERVERFS_* global defaults;
#     explicit true/false or numeric overrides take precedence for that slot.
#   - REPO_OPS_ENABLED/REPO_ACTIONS_JSON and AGENT_MODE/AGENT_RUNTIMES remain inert unless
#     compose.agent.yml is used with SERVERFS_AGENT_BRIDGE_ENABLED=true.
#   - Every enabled Agent runtime, including ACP profiles, requires effective
#     AGENT_MODE=workspace-write and READ_ONLY=false.
#   - BINARY_TRANSFER_ENABLED does not make a read-only workdir writable:
#     downloads may be allowed, but uploads still require READ_ONLY=false.
#   - REPO_OPS_ENABLED is an independent, opt-in deterministic repository capability.
#     It requires SERVERFS_AGENT_BRIDGE_ENABLED=true only for the authenticated host IPC;
#     Repo Ops never starts an Agent runtime. REPO_ACTIONS_JSON maps caller-visible action
#     names to operator-fixed argv/mutates/argument/integrity policies; do not put secrets in it.
#     Built-in release actions use kind=release_tag or publish_npm, argument=release_tag,
#     mutates=true, repository=<owner/repo>, and no argv. Pin package.json and
#     .github/workflows/publish.yml at minimum. See the Repo Ops guide for review/usage.
#     Any configured named action requires READ_ONLY=false and always takes the exclusive
#     writer lease, even when mutates=false, so integrity verification cannot race another
#     ServerFS/Agent writer. mutates is descriptive/audit metadata, not a sandbox boundary.
#
# Upgrading from v0.1: this variable did not exist, so every existing
# workdir stays read-only until you explicitly set it to false.

WORKDIR_01_ALIAS=projects
WORKDIR_01_PATH=/srv/projects
WORKDIR_01_DESCRIPTION="项目代码、部署配置和技术文档"
WORKDIR_01_READ_ONLY=true
WORKDIR_01_ALLOW_HIDDEN=
WORKDIR_01_DISABLE_DEFAULT_DENY=
WORKDIR_01_EXTRA_DENY_GLOBS=
WORKDIR_01_MAX_READ_BYTES=
WORKDIR_01_MAX_READ_LINES=
WORKDIR_01_MAX_WRITE_BYTES=
WORKDIR_01_BINARY_TRANSFER_ENABLED=
WORKDIR_01_MAX_BINARY_TRANSFER_BYTES=
WORKDIR_01_REPO_OPS_ENABLED=
WORKDIR_01_REPO_ACTIONS_JSON=
WORKDIR_01_AGENT_MODE=
WORKDIR_01_AGENT_RUNTIMES=

WORKDIR_02_ALIAS=
WORKDIR_02_PATH=
WORKDIR_02_DESCRIPTION=
WORKDIR_02_READ_ONLY=true
WORKDIR_02_ALLOW_HIDDEN=
WORKDIR_02_DISABLE_DEFAULT_DENY=
WORKDIR_02_EXTRA_DENY_GLOBS=
WORKDIR_02_MAX_READ_BYTES=
WORKDIR_02_MAX_READ_LINES=
WORKDIR_02_MAX_WRITE_BYTES=
WORKDIR_02_BINARY_TRANSFER_ENABLED=
WORKDIR_02_MAX_BINARY_TRANSFER_BYTES=
WORKDIR_02_REPO_OPS_ENABLED=
WORKDIR_02_REPO_ACTIONS_JSON=
WORKDIR_02_AGENT_MODE=
WORKDIR_02_AGENT_RUNTIMES=

WORKDIR_03_ALIAS=
WORKDIR_03_PATH=
WORKDIR_03_DESCRIPTION=
WORKDIR_03_READ_ONLY=true
WORKDIR_03_ALLOW_HIDDEN=
WORKDIR_03_DISABLE_DEFAULT_DENY=
WORKDIR_03_EXTRA_DENY_GLOBS=
WORKDIR_03_MAX_READ_BYTES=
WORKDIR_03_MAX_READ_LINES=
WORKDIR_03_MAX_WRITE_BYTES=
WORKDIR_03_BINARY_TRANSFER_ENABLED=
WORKDIR_03_MAX_BINARY_TRANSFER_BYTES=
WORKDIR_03_REPO_OPS_ENABLED=
WORKDIR_03_REPO_ACTIONS_JSON=
WORKDIR_03_AGENT_MODE=
WORKDIR_03_AGENT_RUNTIMES=

WORKDIR_04_ALIAS=
WORKDIR_04_PATH=
WORKDIR_04_DESCRIPTION=
WORKDIR_04_READ_ONLY=true
WORKDIR_04_ALLOW_HIDDEN=
WORKDIR_04_DISABLE_DEFAULT_DENY=
WORKDIR_04_EXTRA_DENY_GLOBS=
WORKDIR_04_MAX_READ_BYTES=
WORKDIR_04_MAX_READ_LINES=
WORKDIR_04_MAX_WRITE_BYTES=
WORKDIR_04_BINARY_TRANSFER_ENABLED=
WORKDIR_04_MAX_BINARY_TRANSFER_BYTES=
WORKDIR_04_REPO_OPS_ENABLED=
WORKDIR_04_REPO_ACTIONS_JSON=
WORKDIR_04_AGENT_MODE=
WORKDIR_04_AGENT_RUNTIMES=

WORKDIR_05_ALIAS=
WORKDIR_05_PATH=
WORKDIR_05_DESCRIPTION=
WORKDIR_05_READ_ONLY=true
WORKDIR_05_ALLOW_HIDDEN=
WORKDIR_05_DISABLE_DEFAULT_DENY=
WORKDIR_05_EXTRA_DENY_GLOBS=
WORKDIR_05_MAX_READ_BYTES=
WORKDIR_05_MAX_READ_LINES=
WORKDIR_05_MAX_WRITE_BYTES=
WORKDIR_05_BINARY_TRANSFER_ENABLED=
WORKDIR_05_MAX_BINARY_TRANSFER_BYTES=
WORKDIR_05_REPO_OPS_ENABLED=
WORKDIR_05_REPO_ACTIONS_JSON=
WORKDIR_05_AGENT_MODE=
WORKDIR_05_AGENT_RUNTIMES=

WORKDIR_06_ALIAS=
WORKDIR_06_PATH=
WORKDIR_06_DESCRIPTION=
WORKDIR_06_READ_ONLY=true
WORKDIR_06_ALLOW_HIDDEN=
WORKDIR_06_DISABLE_DEFAULT_DENY=
WORKDIR_06_EXTRA_DENY_GLOBS=
WORKDIR_06_MAX_READ_BYTES=
WORKDIR_06_MAX_READ_LINES=
WORKDIR_06_MAX_WRITE_BYTES=
WORKDIR_06_BINARY_TRANSFER_ENABLED=
WORKDIR_06_MAX_BINARY_TRANSFER_BYTES=
WORKDIR_06_REPO_OPS_ENABLED=
WORKDIR_06_REPO_ACTIONS_JSON=
WORKDIR_06_AGENT_MODE=
WORKDIR_06_AGENT_RUNTIMES=

WORKDIR_07_ALIAS=
WORKDIR_07_PATH=
WORKDIR_07_DESCRIPTION=
WORKDIR_07_READ_ONLY=true
WORKDIR_07_ALLOW_HIDDEN=
WORKDIR_07_DISABLE_DEFAULT_DENY=
WORKDIR_07_EXTRA_DENY_GLOBS=
WORKDIR_07_MAX_READ_BYTES=
WORKDIR_07_MAX_READ_LINES=
WORKDIR_07_MAX_WRITE_BYTES=
WORKDIR_07_BINARY_TRANSFER_ENABLED=
WORKDIR_07_MAX_BINARY_TRANSFER_BYTES=
WORKDIR_07_REPO_OPS_ENABLED=
WORKDIR_07_REPO_ACTIONS_JSON=
WORKDIR_07_AGENT_MODE=
WORKDIR_07_AGENT_RUNTIMES=

WORKDIR_08_ALIAS=
WORKDIR_08_PATH=
WORKDIR_08_DESCRIPTION=
WORKDIR_08_READ_ONLY=true
WORKDIR_08_ALLOW_HIDDEN=
WORKDIR_08_DISABLE_DEFAULT_DENY=
WORKDIR_08_EXTRA_DENY_GLOBS=
WORKDIR_08_MAX_READ_BYTES=
WORKDIR_08_MAX_READ_LINES=
WORKDIR_08_MAX_WRITE_BYTES=
WORKDIR_08_BINARY_TRANSFER_ENABLED=
WORKDIR_08_MAX_BINARY_TRANSFER_BYTES=
WORKDIR_08_REPO_OPS_ENABLED=
WORKDIR_08_REPO_ACTIONS_JSON=
WORKDIR_08_AGENT_MODE=
WORKDIR_08_AGENT_RUNTIMES=

WORKDIR_09_ALIAS=
WORKDIR_09_PATH=
WORKDIR_09_DESCRIPTION=
WORKDIR_09_READ_ONLY=true
WORKDIR_09_ALLOW_HIDDEN=
WORKDIR_09_DISABLE_DEFAULT_DENY=
WORKDIR_09_EXTRA_DENY_GLOBS=
WORKDIR_09_MAX_READ_BYTES=
WORKDIR_09_MAX_READ_LINES=
WORKDIR_09_MAX_WRITE_BYTES=
WORKDIR_09_BINARY_TRANSFER_ENABLED=
WORKDIR_09_MAX_BINARY_TRANSFER_BYTES=
WORKDIR_09_REPO_OPS_ENABLED=
WORKDIR_09_REPO_ACTIONS_JSON=
WORKDIR_09_AGENT_MODE=
WORKDIR_09_AGENT_RUNTIMES=

WORKDIR_10_ALIAS=
WORKDIR_10_PATH=
WORKDIR_10_DESCRIPTION=
WORKDIR_10_READ_ONLY=true
WORKDIR_10_ALLOW_HIDDEN=
WORKDIR_10_DISABLE_DEFAULT_DENY=
WORKDIR_10_EXTRA_DENY_GLOBS=
WORKDIR_10_MAX_READ_BYTES=
WORKDIR_10_MAX_READ_LINES=
WORKDIR_10_MAX_WRITE_BYTES=
WORKDIR_10_BINARY_TRANSFER_ENABLED=
WORKDIR_10_MAX_BINARY_TRANSFER_BYTES=
WORKDIR_10_REPO_OPS_ENABLED=
WORKDIR_10_REPO_ACTIONS_JSON=
WORKDIR_10_AGENT_MODE=
WORKDIR_10_AGENT_RUNTIMES=

WORKDIR_11_ALIAS=
WORKDIR_11_PATH=
WORKDIR_11_DESCRIPTION=
WORKDIR_11_READ_ONLY=true
WORKDIR_11_ALLOW_HIDDEN=
WORKDIR_11_DISABLE_DEFAULT_DENY=
WORKDIR_11_EXTRA_DENY_GLOBS=
WORKDIR_11_MAX_READ_BYTES=
WORKDIR_11_MAX_READ_LINES=
WORKDIR_11_MAX_WRITE_BYTES=
WORKDIR_11_BINARY_TRANSFER_ENABLED=
WORKDIR_11_MAX_BINARY_TRANSFER_BYTES=
WORKDIR_11_REPO_OPS_ENABLED=
WORKDIR_11_REPO_ACTIONS_JSON=
WORKDIR_11_AGENT_MODE=
WORKDIR_11_AGENT_RUNTIMES=

WORKDIR_12_ALIAS=
WORKDIR_12_PATH=
WORKDIR_12_DESCRIPTION=
WORKDIR_12_READ_ONLY=true
WORKDIR_12_ALLOW_HIDDEN=
WORKDIR_12_DISABLE_DEFAULT_DENY=
WORKDIR_12_EXTRA_DENY_GLOBS=
WORKDIR_12_MAX_READ_BYTES=
WORKDIR_12_MAX_READ_LINES=
WORKDIR_12_MAX_WRITE_BYTES=
WORKDIR_12_BINARY_TRANSFER_ENABLED=
WORKDIR_12_MAX_BINARY_TRANSFER_BYTES=
WORKDIR_12_REPO_OPS_ENABLED=
WORKDIR_12_REPO_ACTIONS_JSON=
WORKDIR_12_AGENT_MODE=
WORKDIR_12_AGENT_RUNTIMES=

WORKDIR_13_ALIAS=
WORKDIR_13_PATH=
WORKDIR_13_DESCRIPTION=
WORKDIR_13_READ_ONLY=true
WORKDIR_13_ALLOW_HIDDEN=
WORKDIR_13_DISABLE_DEFAULT_DENY=
WORKDIR_13_EXTRA_DENY_GLOBS=
WORKDIR_13_MAX_READ_BYTES=
WORKDIR_13_MAX_READ_LINES=
WORKDIR_13_MAX_WRITE_BYTES=
WORKDIR_13_BINARY_TRANSFER_ENABLED=
WORKDIR_13_MAX_BINARY_TRANSFER_BYTES=
WORKDIR_13_REPO_OPS_ENABLED=
WORKDIR_13_REPO_ACTIONS_JSON=
WORKDIR_13_AGENT_MODE=
WORKDIR_13_AGENT_RUNTIMES=

WORKDIR_14_ALIAS=
WORKDIR_14_PATH=
WORKDIR_14_DESCRIPTION=
WORKDIR_14_READ_ONLY=true
WORKDIR_14_ALLOW_HIDDEN=
WORKDIR_14_DISABLE_DEFAULT_DENY=
WORKDIR_14_EXTRA_DENY_GLOBS=
WORKDIR_14_MAX_READ_BYTES=
WORKDIR_14_MAX_READ_LINES=
WORKDIR_14_MAX_WRITE_BYTES=
WORKDIR_14_BINARY_TRANSFER_ENABLED=
WORKDIR_14_MAX_BINARY_TRANSFER_BYTES=
WORKDIR_14_REPO_OPS_ENABLED=
WORKDIR_14_REPO_ACTIONS_JSON=
WORKDIR_14_AGENT_MODE=
WORKDIR_14_AGENT_RUNTIMES=

WORKDIR_15_ALIAS=
WORKDIR_15_PATH=
WORKDIR_15_DESCRIPTION=
WORKDIR_15_READ_ONLY=true
WORKDIR_15_ALLOW_HIDDEN=
WORKDIR_15_DISABLE_DEFAULT_DENY=
WORKDIR_15_EXTRA_DENY_GLOBS=
WORKDIR_15_MAX_READ_BYTES=
WORKDIR_15_MAX_READ_LINES=
WORKDIR_15_MAX_WRITE_BYTES=
WORKDIR_15_BINARY_TRANSFER_ENABLED=
WORKDIR_15_MAX_BINARY_TRANSFER_BYTES=
WORKDIR_15_REPO_OPS_ENABLED=
WORKDIR_15_REPO_ACTIONS_JSON=
WORKDIR_15_AGENT_MODE=
WORKDIR_15_AGENT_RUNTIMES=

WORKDIR_16_ALIAS=
WORKDIR_16_PATH=
WORKDIR_16_DESCRIPTION=
WORKDIR_16_READ_ONLY=true
WORKDIR_16_ALLOW_HIDDEN=
WORKDIR_16_DISABLE_DEFAULT_DENY=
WORKDIR_16_EXTRA_DENY_GLOBS=
WORKDIR_16_MAX_READ_BYTES=
WORKDIR_16_MAX_READ_LINES=
WORKDIR_16_MAX_WRITE_BYTES=
WORKDIR_16_BINARY_TRANSFER_ENABLED=
WORKDIR_16_MAX_BINARY_TRANSFER_BYTES=
WORKDIR_16_REPO_OPS_ENABLED=
WORKDIR_16_REPO_ACTIONS_JSON=
WORKDIR_16_AGENT_MODE=
WORKDIR_16_AGENT_RUNTIMES=


# ============================================================
# OpenAI Secure MCP Tunnel
# ============================================================

# Official OpenAI tunnel-client image. v0.0.17 is the ServerFS-tested default,
# not a compatibility lock; operators may select another explicit release.
OPENAI_TUNNEL_IMAGE=ghcr.io/openai/tunnel-client:v0.0.17

# Create the tunnel in the OpenAI dashboard first, then paste:
CONTROL_PLANE_BASE_URL=https://api.openai.com

# v0.12 shared HTTP proxy contract. Tunnel, Agent runtimes and Jev each have an
# independent *_USE_PROXY switch but reuse these same four endpoint fields.
# HOST requires PORT. USERNAME enables proxy authentication; PASSWORD may be empty.
# Agent runtimes intentionally require a credentialless proxy; use a local broker
# when the upstream requires authentication.
SERVERFS_OPENAI_TUNNEL_USE_PROXY=false
SERVERFS_PROXY_HOST=
SERVERFS_PROXY_PORT=
SERVERFS_PROXY_USERNAME=
SERVERFS_PROXY_PASSWORD=

CONTROL_PLANE_TUNNEL_ID=
CONTROL_PLANE_API_KEY=

# How long the tunnel client waits for the MCP server to accept connections
MCP_STARTUP_WAIT_TIMEOUT=60s

# Tunnel client logging / ops endpoints (not published to the host)
TUNNEL_LOG_LEVEL=info
TUNNEL_LOG_FORMAT=json

HEALTH_LISTEN_ADDR=:8080


# ============================================================
# Runtime
# ============================================================

TZ=Asia/Shanghai