# CommandMate Environment Configuration
# Copy this file to .env and fill in your values

# ===================================
# Server Configuration
# ===================================

# Managed repository directory: the scope CommandMate is allowed to manage.
# - Repositories must be located under this directory to be registered from the UI
# - Cloned repositories are saved under this directory
# This directory is a container of repositories; it is not scanned for
# repositories itself, so nothing is discovered just by setting it. Register
# repositories from the UI, or list them explicitly in WORKTREE_REPOS below.
CM_ROOT_DIR=/path/to/your/repos

# Extra directories the folder picker may browse and register from (optional,
# comma-separated). CM_ROOT_DIR is always allowed, so leave this unset unless
# repositories live outside it. Directory names under these paths become readable
# to authenticated clients (file names are never returned), so keep the set
# narrow. The clone destination stays CM_ROOT_DIR regardless.
# CM_BROWSE_ROOTS=/path/to/work,/opt/src

# Repositories to load on startup (optional, comma-separated).
# Each entry must be a git repository itself, not a directory containing them.
# Repositories registered from the UI or added by cloning do not need to be
# listed here; they are remembered automatically.
# WORKTREE_REPOS=/path/to/your/repos/repo-a,/path/to/your/repos/repo-b

# Server port (default: 3000)
CM_PORT=3000

# Bind address
# - 127.0.0.1: Localhost only (development)
# - 0.0.0.0: All interfaces (production, reverse proxy auth recommended)
CM_BIND=127.0.0.1

# ===================================
# Security / Authentication (Issue #331)
# ===================================

# Token authentication is enabled via CLI: commandmate start --auth
# The following variables are set automatically and should NOT be manually edited:
# CM_AUTH_TOKEN_HASH=<sha256-hash>  # Set automatically by --auth
# CM_AUTH_EXPIRE=24h                 # Token expiration (default: 24h, max: 30d)

# When CM_BIND=0.0.0.0, use a reverse proxy (e.g., Nginx) with authentication,
# or enable token auth with: commandmate start --auth
# See: docs/security-guide.md

# ===================================
# HTTPS / TLS (Issue #331)
# ===================================

# Enable HTTPS with TLS certificates:
#   commandmate start --auth --cert ./localhost.pem --key ./localhost-key.pem
#
# Quick setup with mkcert:
#   brew install mkcert && mkcert -install && mkcert localhost
#
# CM_HTTPS_CERT=./localhost.pem
# CM_HTTPS_KEY=./localhost-key.pem

# ===================================
# Database
# ===================================

# SQLite database file path
#
# Resolution order (first match wins). CM_DB_PATH is read from the process
# environment, so exporting it as an environment variable and setting it in this
# file are equivalent:
#   1. CM_DB_PATH (or the legacy MCBD_DB_PATH alias)
#   2. DATABASE_PATH (deprecated, warns)
#   3. Install-type default: global -> ~/.commandmate/data/cm.db, local -> <cwd>/data/cm.db
#
# Allowed locations (SEC-001):
#   - Global install: the path must be inside your home directory
#   - Local install: the path must be outside /etc /usr /bin /sbin /var /tmp /dev /sys /proc
# A CM_DB_PATH outside those bounds is rejected at startup with an error; it is
# never silently replaced by the default, which would point the server at a
# different database than the one you asked for.
#
# Note: Usually you don't need to set this manually. commandmate init will set the appropriate absolute path.
# CM_DB_PATH=~/.commandmate/data/cm.db

# Legacy: DATABASE_PATH is deprecated and will be removed in v2.0.0
# Use CM_DB_PATH instead
# DATABASE_PATH=./data/db.sqlite

# ===================================
# Claude CLI Configuration
# ===================================

# Claude CLI executable path (optional)
# If set, CommandMate will use this path instead of searching via 'which claude'.
# The path must be absolute and point to an executable file.
# Security: Only alphanumeric characters, forward slashes, dots, underscores, and hyphens are allowed.
# Example: CLAUDE_PATH=/opt/homebrew/bin/claude
# CLAUDE_PATH=

# ===================================
# Web Push / Phone Notifications (Issues #1125, #2123, #2124)
# ===================================

# CommandMate can push a notification to your phone when an agent needs you.
# It sends nothing until this key pair exists, and it says so at startup and in
# `commandmate status` when it is missing.
#
# Generate the pair with:
#   commandmate init          # writes all three variables below into .env
#
# Full setup (HTTPS requirement, iOS "Add to Home Screen", how to verify):
#   docs/user-guide/webapp-guide.md
#
# CM_VAPID_PRIVATE_KEY is a SECRET. Never commit it and never share it; .env is
# git-ignored, a copy of it is not. Replacing the pair silently orphans every
# device that has already subscribed, so keep the one `init` generated.
# CM_VAPID_PUBLIC_KEY=<base64url, 65 bytes>
# CM_VAPID_PRIVATE_KEY=<base64url, 32 bytes>

# The VAPID `sub` claim: who to contact about pushes from this server.
# RFC 8292 allows a "mailto:" address or an "https://" URL, and **Apple (APNs)
# validates it** — a host that cannot resolve (localhost, a bare hostname, a
# reserved TLD like .local) is answered with 403 and iPhone/iPad receive nothing
# while Android keeps working, because FCM does not check it.
# Default when unset: https://github.com/Kewton/CommandMate
# CM_VAPID_SUBJECT=https://github.com/Kewton/CommandMate

# ===================================
# Logging
# ===================================

# Log level: debug | info | warn | error
# Default: info (matches what `commandmate init` generates)
# Set to debug when you need verbose logs for troubleshooting
CM_LOG_LEVEL=info

# Log output format: json | text
# json: Structured logs (production, log analysis tools)
# text: Human-readable format (development)
CM_LOG_FORMAT=text

# ===================================
# Legacy Environment Variables (Deprecated)
# The following MCBD_* variables are deprecated and will be removed in a future version.
# Use CM_* variables instead. Fallback is supported for backwards compatibility.
# ===================================
# MCBD_ROOT_DIR=/path/to/your/worktrees
# MCBD_PORT=3000
# MCBD_BIND=127.0.0.1
# MCBD_LOG_LEVEL=debug
# MCBD_LOG_FORMAT=text