.env.example

# Env vars are read with MEMBERRY_* as the canonical name; the legacy AMP_*
# names still work for one deprecation cycle (a one-time warning is logged when
# only the AMP_* name is set). Prefer MEMBERRY_* in new configs.
#
# ─── Neo4j ────────────────────────────────────────────────────────────────────
# Managed by docker-compose.yml (memberry-neo4j container).
# Used by: packages/mcp/src/bootstrap.ts, packages/core/src/cli.ts, all tests.
NEO4J_URI=bolt://localhost:7687
NEO4J_USER=neo4j
# Connection password used by the MCP server / CLI / tests, AND the password
# docker-compose provisions Neo4j with (NEO4J_AUTH). Defaults to
# "memberry-local-dev" if unset in compose. Keep both sides in sync.
NEO4J_PASSWORD=memberry-local-dev

# ─── Redis ────────────────────────────────────────────────────────────────────
# Provisioned by docker-compose.yml (memberry-redis container).
# REDIS_URL must embed the same password as REDIS_PASSWORD below.
REDIS_URL=redis://:memberry-local-dev@localhost:6379
# Password docker-compose starts Redis with (--requirepass). Defaults to
# "memberry-local-dev" if unset. Must match the password inside REDIS_URL.
REDIS_PASSWORD=memberry-local-dev

# ─── OpenAI ───────────────────────────────────────────────────────────────────
# Used for embeddings (text-embedding-3-small) and GPT-4o-mini entity extraction.
OPENAI_API_KEY=

# ─── Per-task model selection (optional) ──────────────────────────────────────
# Override the chat-completion model per task (see packages/core/src/llm.ts).
# Unset keys fall back to DEFAULT_MODELS: extraction=gpt-4o-mini, synthesis=gpt-4o,
# dream=gpt-4o. Extraction stays cheap; berry_ask synthesis and the dream pass use
# the synthesis/dream tiers.
MEMBERRY_MODEL_EXTRACTION=
MEMBERRY_MODEL_SYNTHESIS=
MEMBERRY_MODEL_DREAM=

# ─── MCP Server ───────────────────────────────────────────────────────────────
# PORT is checked first, then MCP_PORT, then default 3101.
# In production the systemd unit sets MCP_PORT=3101; PORT is for PaaS compat.
PORT=
MCP_PORT=3101

# ─── Access mode: local vs LAN/server ─────────────────────────────────────────
# The MCP container always binds 0.0.0.0 (MEMBERRY_BIND_HOST → MEMBERRY_HOST) so
# it's reachable through Docker's port proxy. The HOST PUBLISH ADDRESS is what
# actually restricts who can reach it:
#   local  → MEMBERRY_PUBLISH_HOST=127.0.0.1, MEMBERRY_PUBLIC_HOST=localhost
#            (server reachable only from this machine)
#   server → MEMBERRY_PUBLISH_HOST=0.0.0.0,   MEMBERRY_PUBLIC_HOST=<LAN IP>
#            (server reachable from the LAN — the bearer token is the ONLY gate)
# Neo4j + Redis always stay bound to 127.0.0.1 and are never exposed on the LAN.
#
# Container bind host (advanced — rarely changed; keep 0.0.0.0 so the publish
# layer below is the single access gate).
MEMBERRY_BIND_HOST=0.0.0.0
# Host publish address: 127.0.0.1 = local-only, 0.0.0.0 = LAN/server.
MEMBERRY_PUBLISH_HOST=127.0.0.1
# Host shown in printed client URLs. Leave as localhost for local mode; set to
# the machine's LAN IP in server mode so the printed URL is reachable.
MEMBERRY_PUBLIC_HOST=localhost

# Optional public-URL label shown by the wiki viewer (the "wiki" compose profile,
# enabled via setup.sh --with-wiki). Purely cosmetic — e.g. "192.168.0.25:3200".
# Empty by default; the wiki still serves on port 3200 regardless of this value.
MEMBERRY_WIKI_PUBLIC_LABEL=

# gap-15: OPT-IN auto-refresh of the served wiki (the "wiki" compose profile,
# port 3200) after the MCP graph changes. Default (empty/false) = OFF — behavior
# is unchanged: MCP never recompiles the wiki. When set truthy
# (1/true/yes/on), the MCP server recompiles the WHOLE wiki (all projects) into
# the shared wiki_output volume after every berry_store (debounced ~3s) and
# immediately after berry_bootstrap / berry_ingest_codebase. The wiki viewer's
# fs.watch on the shared dir then picks up the regenerated markdown. Requires the
# wiki_output volume to be mounted in BOTH the mcp and wiki services (it is, in
# docker-compose.yml) so MCP's writes reach the viewer.
MEMBERRY_WIKI_AUTOREFRESH=

# Directory the MCP server compiles the wiki into for autorefresh (above). Must
# match the directory the wiki viewer serves/watches. Default /app/wiki — the
# mount point of the shared wiki_output volume inside the container. Rarely
# changed; only relevant when MEMBERRY_WIKI_AUTOREFRESH is on.
MEMBERRY_WIKI_OUTPUT_DIR=/app/wiki

# Single shared API token for authenticated MCP access.
# If unset and MEMBERRY_ALLOW_UNAUTHENTICATED is not "true", the server generates
# a random session token printed to stderr on startup.
MEMBERRY_API_TOKEN=

# Per-actor named tokens: comma-separated "name:token" pairs. Each token maps to
# an actor identity so a leaked token can be revoked individually instead of
# rotating one shared secret. Combined with MEMBERRY_API_TOKEN if both are set.
# CONSTRAINT: a name or token may NOT contain ',' or ':' (the delimiters are not
# escapable) and a token must be 4..4096 chars; malformed/out-of-range entries
# are SKIPPED WITH A WARNING on stderr (they do not silently disable auth).
# Example: MEMBERRY_API_TOKENS=alice:tok_alice_xxx,ci:tok_ci_yyy
MEMBERRY_API_TOKENS=

# Set to "true" to skip Bearer-token auth entirely (development only).
MEMBERRY_ALLOW_UNAUTHENTICATED=

# Multi-tenant mode (opt-in): comma-separated "tenant:token" pairs. Setting this
# turns on enforced tenant isolation — each token binds its session to a tenant,
# every memory read/write is filtered by tenant_id, and tenant sessions are served
# only the tenant-safe tool set. Leave empty for single-tenant (the default).
# Same parsing constraint as MEMBERRY_API_TOKENS: tenant/token may not contain
# ',' or ':' and the token must be 4..4096 chars; bad entries are skipped+warned.
# Example: MEMBERRY_TENANT_TOKENS=acme:tok_acme_xxx,globex:tok_globex_yyy
MEMBERRY_TENANT_TOKENS=

# When multi-tenant mode is on, a token that authenticates but is NOT a tenant
# token (a global MEMBERRY_API_TOKEN or a per-actor MEMBERRY_API_TOKENS entry)
# is REJECTED — otherwise it would silently operate on the DEFAULT tenant.
# Set to "true" ONLY to restore that legacy default-tenant fallback. Has no
# effect in single-tenant mode. Default (empty/false) = fail-closed.
MEMBERRY_ALLOW_DEFAULT_TENANT=

# Graduation seam (optional): route specific tenants to their OWN Neo4j/Redis
# (physical isolation) instead of the shared instance. JSON map of
# tenant -> { neo4jUri, neo4jUser, neo4jPassword, redisUrl, openaiKey? }.
# Tenants not listed here use the shared instance with tenant_id filtering.
# Shape-validated at startup: neo4jUri/neo4jPassword/redisUrl are REQUIRED and a
# malformed value FAILS startup (rather than silently colocating the tenant on
# the shared localhost store). Unknown keys are rejected.
# Example: MEMBERRY_TENANT_DATASTORES={"acme":{"neo4jUri":"bolt://acme-neo4j:7687","neo4jPassword":"...","redisUrl":"redis://acme-redis:6379"}}
MEMBERRY_TENANT_DATASTORES=

# ─── Safety / tenancy ─────────────────────────────────────────────────────────
# Set to "true" to run as a strict read-only deployment: berry_store and all
# memory-block writes are rejected (reads/retrieval still work).
MEMBERRY_READONLY=

# Set to "true" to redact common secret shapes (API keys, tokens, connection-
# string passwords, PEM keys) from episode content/task BEFORE persistence.
MEMBERRY_REDACT_ON_INGEST=

# Confidence at/above which an existing fact is "established" and is NOT auto-
# invalidated during consolidation by a LOWER-confidence, extraction-derived
# contradiction (the contender is held `tentative` until corroborated). Guards
# against untrusted content silently overwriting authoritative facts. Range
# [0,1]; default 0.75.
MEMBERRY_FACT_PROTECT_CONFIDENCE=

# Per-item char cap on each evidence chunk fed to berry_ask synthesis, so one
# oversized memory can't dominate (or crowd out) the rest of the prompt.
# Positive integer; default 4000. Over-cap items are truncated with a marker.
MEMBERRY_ASK_MAX_EVIDENCE_ITEM_CHARS=

# Override the embedding dimension for all vector indexes (default 1536 =
# text-embedding-3-small). Changing this requires recreating the vector indexes;
# startup logs a warning if an existing index's dimension no longer matches.
MEMBERRY_EMBEDDING_DIM=

# ─── Paths ────────────────────────────────────────────────────────────────────
# Export directory for berry_compile and berry_ingest cold storage.
MEMBERRY_EXPORT_PATH=./.memberry

# Restrict berry_ingest source_path, berry_compile output_dir, and code indexing
# (berry_code_index / berry_code_ast_grep / berry_code_watch / berry_ingest_codebase)
# to this prefix (default: cwd). Wired into docker-compose.yml (mcp service), where
# it defaults to /workspace — a path INSIDE the container, backed by the host
# directory mounted read-only at /workspace (see MEMBERRY_WORKSPACE_HOST_PATH).
MEMBERRY_INGEST_ALLOW_DIR=

# Host directory mounted read-only at /workspace in the mcp container for code
# indexing / ingest / compile. The container confines access to /workspace via
# MEMBERRY_INGEST_ALLOW_DIR above. Point this at the repo/codebase you want the
# MCP server to be able to read. Default: ./ (the compose project directory).
MEMBERRY_WORKSPACE_HOST_PATH=./

# Max bytes the code indexer (parseFile) will read+AST-parse; larger files are
# skipped (no symbols indexed) so a giant generated/minified/binary file can't
# blow up parse time/memory. Positive integer; default 2097152 (2 MiB).
MEMBERRY_MAX_PARSE_FILE_BYTES=

# Default server-side transaction timeout (ms) for raw Cypher (berry_query and
# any rawCypher caller) so a catastrophic `=~`/runaway query self-aborts instead
# of pinning the shared Neo4j. Positive integer; default 15000 (15s). The grep
# path uses a tighter internal bound.
MEMBERRY_RAW_CYPHER_TIMEOUT_MS=

# ─── Testing ──────────────────────────────────────────────────────────────────
# Set to 1 to run live OpenAI embedding tests (costs API credits).
# When unset, embedding tests are skipped.
RUN_LIVE_TESTS=