.env.example

# Project Muteki (無敵) — environment variables.
#
# Copy to `.env` (git-ignored) and fill in. The eval scripts and the web server
# auto-load `.env` from the repo root for local convenience. A variable already
# exported in your shell ALWAYS wins over this file (override=False), so
# `MUTEKI_DEEPSEEK_API_KEY=... uv run ...` keeps working unchanged.
#
# SECURITY: never commit a real `.env`. `.gitignore` blocks `.env` / `.env.*`.
# This `.env.example` carries placeholders only — no real secrets.

# ── Required to run a real eval (the swarm uses live models) ──────────────────
# DeepSeek API key. Without it, eval scripts abort and live tests skip.
MUTEKI_DEEPSEEK_API_KEY=sk-your-deepseek-key-here

# ── Strongly recommended: web command deck auth ──────────────────────────────
# Set this to require a login password for the web command deck. When set, the
# whole /api surface (runs, credential accounts, HITL, SSE/WS) is gated: open
# http://localhost:3001, enter the password once, and the browser keeps a signed
# session token. Leave UNSET only for a loopback-only single-operator setup.
#
# REQUIRED when the backend binds to anything non-loopback (for example
# `./run.sh web --host 0.0.0.0` or docker compose). The backend refuses to start
# otherwise so credential-account APIs are never exposed unauthenticated.
# MUTEKI_WEB_PASSWORD=choose-a-strong-password
# MUTEKI_WEB_TOKEN_TTL=43200       # session-token lifetime in seconds (default 12h)
# MUTEKI_WEB_AUTH_SECRET=          # optional explicit HMAC signing key

# ── Optional: model endpoint / HTTP transport ────────────────────────────────
# Defaults to https://api.deepseek.com/v1 if unset.
# MUTEKI_DEEPSEEK_BASE_URL=https://api.deepseek.com/v1
# httpx proxy envs (HTTP_PROXY / HTTPS_PROXY / NO_PROXY) are ignored by default
# for reproducibility. Set only if your deployment needs process-level proxies.
# MUTEKI_LLM_TRUST_ENV=0

# ── Optional: paths (sensible defaults exist) ────────────────────────────────
# NYU CTF Bench clone. Defaults to ~/Desktop/nyu_ctf_bench.
# MUTEKI_NYU_CTF_DIR=/Users/you/Desktop/nyu_ctf_bench
# Distilled knowledge/templates dir. Defaults to ./knowledge.
# MUTEKI_KNOWLEDGE_DIR=knowledge
# Durable web run/event/account store. Defaults to ./sessions.
# MUTEKI_SESSIONS_ROOT=sessions
# Sandbox artifact store. Defaults to ./artifacts.
# MUTEKI_ARTIFACTS_DIR=artifacts

# ── Optional: local web runner / Next UI ─────────────────────────────────────
# `./run.sh web` starts the backend on :8000 and the production Next UI on :3001.
# Use these only when ports or proxy targets differ from defaults.
# MUTEKI_UI_PORT=3001             # same as ./run.sh web --ui-port
# MUTEKI_UI_REBUILD=auto          # auto | 1/true/always | 0/false/never
# MUTEKI_BACKEND=http://127.0.0.1:8000
#
# For `npm run dev` experiments that bypass the same-origin Next rewrite proxy.
# Normal `./run.sh web` and docker compose do NOT need this.
# NEXT_PUBLIC_MUTEKI_API=http://127.0.0.1:8000

# ── Optional: web upload limits (raise for big handouts: disk images, pcaps) ──
# Per-file size cap in MB (default 25) and max files per upload (default 20).
# MUTEKI_MAX_UPLOAD_MB=25
# MUTEKI_MAX_UPLOAD_FILES=20

# ── Optional: run retention policy ───────────────────────────────────────────
# The web backend auto-archives idle unpinned runs, then deletes old archived
# runs. Disable only if you want to keep every local run forever.
# MUTEKI_RETENTION_ENABLED=1
# MUTEKI_RETENTION_INTERVAL=3600  # sweep interval, seconds
# MUTEKI_ARCHIVE_DAYS=3
# MUTEKI_DELETE_DAYS=7

# ── Optional: containerized worker image ─────────────────────────────────────
# The single generic worker image used in CONTAINER mode (one image for all
# engines; real credentials are injected at runtime, never baked in). Defaults
# to the moving :latest tag below. Override to point at your own registry/repo,
# or pin a version tag for reproducibility. This is also the name shown on the
# settings page (运行环境 → Worker 镜像). Local mode does NOT use this image.
# MUTEKI_WORKER_IMAGE=ghcr.io/fishcodetech/muteki-worker:latest
# MUTEKI_WORKER_IMAGE=ghcr.io/fishcodetech/muteki-worker-slim:latest
# Optional expected version label — when set, the settings page flags a mismatch
# if the pulled image's OCI version label differs. Unset → version check is
# informational only (reports what's pulled, never flags a mismatch).
# MUTEKI_WORKER_IMAGE_VERSION=
#
# Worker execution backend. Usually controlled from Worker Settings; env is an
# operator override for scripts/debugging. Values: container | local.
# MUTEKI_WORKER_BACKEND=container
# Cache expensive engine auth probes for this many seconds (default 120).
# MUTEKI_HEALTH_PROBE_TTL=120
# `/btw` side-query worker timeout in seconds (default 240).
# MUTEKI_BTW_WORKER_TIMEOUT=240
#
# Advanced: worker container user ownership. By default Muteki reads the kali
# UID/GID from the selected worker image; set these only to override a custom image.
# MUTEKI_WORKER_UID=1000
# MUTEKI_WORKER_GID=1000

# ── Optional: docker-compose deployment (the unified control plane) ──────────
# Only for `docker compose up` (web + workers both containerized). For a plain
# local run these are irrelevant. See docker-compose.yml for the full picture.
# Absolute HOST path bind-mounted at the SAME path into the web container so the
# web process can hand workers paths the host daemon resolves. REQUIRED by compose.
# MUTEKI_HOST_DATA_ROOT=/opt/muteki/data
# Compose network workers join so the control host (web-api) resolves by alias.
# Defaults to "muteki_net" in compose; only change if you rename the network.
# MUTEKI_WORKER_NETWORK=muteki_net
# Compose also consumes MUTEKI_UI_PORT, MUTEKI_DEEPSEEK_API_KEY,
# MUTEKI_DEEPSEEK_BASE_URL, MUTEKI_LLM_TRUST_ENV, and MUTEKI_WEB_PASSWORD from
# this file / shell. The remaining compose vars are set by docker-compose.yml:
# MUTEKI_IN_CONTAINER, MUTEKI_CONTROL_BIND, MUTEKI_CONTROL_HOST,
# MUTEKI_CONTAINER_DATA_ROOT, MUTEKI_SESSIONS_ROOT, MUTEKI_WEB_BIND.
# Do NOT set those by hand unless you are building a custom deployment topology.

# ── Optional: reverse-connect control plane (advanced) ───────────────────────
# Worker containers dial back to the backend receiver. Defaults work for local
# Docker Desktop; compose sets the right values automatically.
# MUTEKI_CONTROL_PORT=9100
# MUTEKI_CONTROL_BIND=127.0.0.1
# MUTEKI_CONTROL_HOST=host.docker.internal
# MUTEKI_CONTAINER_DEBUG=0

# ── Optional: knowledge-base MCP (off by default) ────────────────────────────
# An optional knowledge-base MCP you can point at your OWN service (e.g. a
# security-intel / CVE / writeup index). There is no bundled KB; this is OFF
# unless you opt in. Set MUTEKI_KB_MCP_NAME to the server key from your own
# .mcp.json to enable it; leave it empty (the default) for no KB. Workers then
# get the configured KB server's tools (mcp__<your-kb-name>__*).
# MUTEKI_KB_MCP_NAME=
#
# Any bearer token for YOUR KB server is supplied via whatever env var your
# .mcp.json interpolates — it is read by the MCP CLIENT, not by Python code, so
# load_env() does not feed it to the client; export it in the same shell that
# launches your MCP-enabled client. Such a token is a SECRET.

# ── Optional: CLI worker binary/model overrides ──────────────────────────────
# Muteki auto-discovers official claude/codex/cursor-agent binaries and skips
# known-bad repackages. Pin paths here only when auto-discovery picks the wrong
# binary on your host.
# MUTEKI_CLAUDE_BIN=/absolute/path/to/claude
# MUTEKI_CODEX_BIN=/absolute/path/to/codex
# MUTEKI_CURSOR_BIN=/absolute/path/to/cursor-agent
# Cursor only: pin a specific headless model; unset means Cursor's default.
# MUTEKI_CURSOR_MODEL=

# ── Optional: credential fallback envs ───────────────────────────────────────
# Prefer the Worker Settings -> Accounts UI for durable credentials. These envs
# are fallback / automation inputs for local scripts, health checks, and account
# detection. Never commit real values.
#
# Default account-id selection when a worker profile does not bind an account.
# MUTEKI_DEFAULT_ACCOUNT_ID=
# MUTEKI_CLAUDE_ACCOUNT_ID=claude-main
# MUTEKI_CODEX_ACCOUNT_ID=codex-main
# MUTEKI_CURSOR_ACCOUNT_ID=cursor-main
#
# Claude fallback auth:
# CLAUDE_CODE_OAUTH_TOKEN=
# ANTHROPIC_AUTH_TOKEN=
# ANTHROPIC_API_KEY=
# ANTHROPIC_BASE_URL=
#
# Codex/OpenAI fallback auth:
# OPENAI_API_KEY=
# OPENAI_BASE_URL=
# CODEX_HOME=/Users/you/.codex
#
# Cursor fallback auth:
# CURSOR_API_KEY=
# CURSOR_ENDPOINT=

# ── Optional: developer/test toggles ─────────────────────────────────────────
# Run optional pwntools-backed pwn tests in ./init.sh.
# MUTEKI_RUN_PWN_TESTS=0
# Public release sync target for maintainers only (publish.sh).
# MUTEKI_PUBLIC_DIR=/Users/you/Desktop/muteki-public

# ── Internal runtime env (documented so you do NOT set them manually) ─────────
# The coordinator injects these per worker/turn. They are not operator config:
# MUTEKI_BLACKBOARD_DB, MUTEKI_BLACKBOARD_SCRIPT, MUTEKI_WORKER_ID,
# MUTEKI_INTENT_ID, MUTEKI_WORKER_PROFILE_ID, MUTEKI_CREDENTIAL_ACCOUNT_ID,
# MUTEKI_WORKER_MODEL, MUTEKI_BTW_WORKER, MUTEKI_WTAG.
# Credential projection may also inject file-backed secret envs:
# CLAUDE_CODE_OAUTH_TOKEN_FILE, CURSOR_API_KEY_FILE, ANTHROPIC_API_KEY_FILE,
# OPENAI_API_KEY_FILE, MUTEKI_CODEX_HOME_SEED.
# Worker images set CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC internally.