2c91a80f69
The onboarding scan started on its own, discarded what it found, claimed to read email and calendars, simulated progress for everyone who could not scan, and its project creation always failed (wrong Space fields and a space lookup by title across tenants). Discovery now asks first and creates nothing without a choice: - The scan step appears only for the deployment owner when ONBOARDING_SCAN_HOME is set; everyone else skips it. The simulated scan is gone. - It shows the folder and asks. Only directory listings are read: git projects up to four levels deep, their languages and a few tools (Docker, GitHub Actions, Terraform). Symlinks are never followed and each chosen folder is resolved again before use, so nothing outside the folder is reached. Results stay with the account that scanned. - Found projects are a checklist (none preselected); found languages and tools are facts (preselected). "Add" creates one project space per chosen project with createSpaceForMember and wireProjectWorkspace in the user's own organization, reusing the user's own space already linked to that folder, and saves the chosen facts as onboarding facts under the profile lock and fact limit. - When a connection becomes connected (direct connect, authorization round trip, or catalog reconciliation), "Uses <App>" is remembered as a tools fact from the connector. Revoking keeps it. The E2E harness now points ONBOARDING_SCAN_HOME at a fixture folder and starts without a deployment owner, so owner-only onboarding steps appear only in specs that take the seat through /__e2e/deployment-owner. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
239 lines
12 KiB
Plaintext
239 lines
12 KiB
Plaintext
NODE_ENV=development
|
|
# Compose Postgres role (source-checkout and images stacks). Generate with:
|
|
# openssl rand -hex 16
|
|
# Use a URI-safe value (hex from openssl is fine). Special characters such as
|
|
# @ : / ? # % break DATABASE_URL interpolation inside Compose.
|
|
# Put the same value in DATABASE_URL when using the optional host publish overlay.
|
|
# Existing pgdata volumes keep user/password/db from first init; keep those
|
|
# values in .env, or ALTER ROLE / rename in place. Recreate the volume only
|
|
# after a backup (or when disposable); down -v deletes all Postgres state.
|
|
POSTGRES_USER=rakazo
|
|
POSTGRES_PASSWORD=
|
|
POSTGRES_DB=rakazo
|
|
# Host-side clients only (pnpm db:migrate / pnpm dev). Requires the postgres-host
|
|
# overlay so 127.0.0.1:5433 is published. Inside Compose, api/worker ignore this
|
|
# and connect to the postgres service with POSTGRES_* above.
|
|
DATABASE_URL=postgres://rakazo:REPLACE_WITH_POSTGRES_PASSWORD@127.0.0.1:5433/rakazo
|
|
BETTER_AUTH_SECRET=replace-with-32-plus-character-secret
|
|
# Local loopback: localhost and 127.0.0.1 are interchangeable browser hosts.
|
|
BETTER_AUTH_URL=http://127.0.0.1:5173
|
|
API_URL=http://127.0.0.1:3100
|
|
# Listener address. Keep loopback unless a container or trusted reverse proxy must reach the API.
|
|
API_HOST=127.0.0.1
|
|
WEB_ORIGIN=http://127.0.0.1:5173
|
|
PUBLIC_POSTHOG_KEY=
|
|
PUBLIC_POSTHOG_HOST=https://us.i.posthog.com
|
|
SIGNUPS_ENABLED=true
|
|
SIGNUP_ALLOWLIST=
|
|
# First-run discovery. Leave unset and onboarding never looks at the host filesystem.
|
|
# Set a folder (for example a home folder) and the deployment owner's onboarding offers to list the
|
|
# git projects in it, reading file and folder names only. Other accounts never see the step.
|
|
# ONBOARDING_SCAN_HOME=
|
|
ENCRYPTION_KEY=replace-with-64-random-hex-characters
|
|
DATA_DIR=./data
|
|
SANDBOX_SUPERVISOR_URL=http://127.0.0.1:7091
|
|
# Dedicated credentials (distinct from BETTER_AUTH_SECRET). Required for Docker sandboxes /
|
|
# screen proxy outside local development.
|
|
SANDBOX_SUPERVISOR_TOKEN=replace-with-32-plus-character-supervisor-token
|
|
# Per-bot-computer ceilings. Defaults 2g / 2 CPUs / 2048 pids; "0", "none" or "unlimited" removes
|
|
# one. Memory also caps swap, and must be at least 6m (Docker's own minimum).
|
|
RAKAZO_COMPUTER_MEMORY=
|
|
RAKAZO_COMPUTER_CPUS=
|
|
RAKAZO_COMPUTER_PIDS_LIMIT=
|
|
SCREEN_PROXY_SECRET=replace-with-32-plus-character-screen-proxy-secret
|
|
SANDBOX_PROVIDER=docker
|
|
# none | emulator | cursor. Live agents require a key and an explicitly authorized Space.
|
|
CLOUD_AGENT_PROVIDER=none
|
|
CURSOR_API_KEY=
|
|
# Grant this Space access to the repositories connected to the Cursor credential.
|
|
CLOUD_AGENT_SPACE_ID=
|
|
# Optional Docker daemon socket. Defaults to /var/run/docker.sock (Unix) or
|
|
# //./pipe/docker_engine (Windows). Set for rootless Docker, Colima, or custom paths.
|
|
# DOCKER_HOST takes precedence over DOCKER_SOCKET when both are set.
|
|
# DOCKER_SOCKET=
|
|
# Enable for a host-run supervisor using a local Docker Desktop daemon: control
|
|
# uses a random token-guarded 127.0.0.1 port because container IPs are unreachable.
|
|
# Leave unset for Compose, remote Docker daemons, or native Linux Docker Engine.
|
|
# Changing this setting replaces incompatible computers on their next provision;
|
|
# their mounted homes are preserved.
|
|
# SANDBOX_CONTROL_VIA_LOOPBACK=true
|
|
DAYTONA_API_KEY=
|
|
DAYTONA_API_URL=
|
|
DAYTONA_TARGET=
|
|
BOX_API_KEY=
|
|
# Optional Box API base URL; defaults to https://ascii.dev/api/box/v1.
|
|
BOX_API_URL=
|
|
AGENT_RUNTIME=pi
|
|
# Opt-in Pi JSONL session recording under DATA_DIR/pi-sessions. Default off:
|
|
# transcripts are unencrypted on disk and unsuitable for multi-tenant hosted DATA_DIR.
|
|
# PI_SESSION_RECORDING=true
|
|
WAKEUP_DRIVER=graphile
|
|
# Keep app-owned PostgreSQL pools bounded. Leave DB_POOL_MAX unset so each
|
|
# process keeps its default (api 4, worker 8). A set value applies to both —
|
|
# size it for the worker (concurrency + LISTEN + leadership + Prisma headroom).
|
|
# DB_POOL_MAX=8
|
|
GRAPHILE_WORKER_CONCURRENCY=4
|
|
# Pause or stop computers after this many idle ms. Minimum 30000.
|
|
SANDBOX_IDLE_MS=600000
|
|
# Comma-separated model ids on centrally managed local / openai-compatible endpoints that accept images.
|
|
# User-connected OpenAI-compatible models use the per-connection Supports images setting instead.
|
|
# Declared ids get input ["text","image"] so screenshot computer tools stay available.
|
|
RAKAZO_LOCAL_VISION_MODELS=
|
|
RAKAZO_OPENAI_COMPATIBLE_VISION_MODELS=
|
|
SANDBOX_COMMAND_TIMEOUT_MS=300000
|
|
# Optional limit on active bot desktops per Docker Team Computer.
|
|
# 0 leaves capacity to the machine; desktops and Chrome start only when needed.
|
|
SANDBOX_TEAM_SCREEN_LIMIT=0
|
|
# Optional limit on total concurrent bot computer containers per space in Docker sandboxes.
|
|
# 0 (or unset) means unlimited. Set a positive integer to cap containers per space.
|
|
SANDBOX_MAX_COMPUTERS_PER_SPACE=0
|
|
# Optional per-turn tool-call fuse for the Pi agent runtime. Unset, empty, or 0
|
|
# means unlimited (default). Set a positive integer to soft-stop a turn that
|
|
# exceeds the budget and still emit a final assistant message.
|
|
MAX_TOOL_CALLS_PER_TURN=
|
|
# Deployment-wide fallback model. PI_DEFAULT_PROVIDER picks which key below is used.
|
|
OPENROUTER_API_KEY=
|
|
ANTHROPIC_API_KEY=
|
|
PI_DEFAULT_PROVIDER=openrouter
|
|
# Vision-capable default for chat and computer screenshots.
|
|
# Computer-use tests can override this with COMPUTER_E2E_MODEL.
|
|
PI_DEFAULT_MODEL=openai/gpt-5.6-luna
|
|
# Optional local OpenAI-compatible models. Leave blank to disable the provider.
|
|
RAKAZO_LOCAL_MODELS=
|
|
RAKAZO_LOCAL_MODELS_URL=http://127.0.0.1:11434/v1
|
|
RAKAZO_LOCAL_CONTEXT_WINDOW=32768
|
|
RAKAZO_LOCAL_MAX_TOKENS=4096
|
|
# Allow user-connected OpenAI-compatible endpoints on public hostnames (default: private/loopback only).
|
|
RAKAZO_OPENAI_COMPAT_ALLOW_PUBLIC=
|
|
E2B_API_KEY=
|
|
COMPOSIO_API_KEY=
|
|
# Optional integrations.sh-compatible catalog base URL (Rakazo appends api/search).
|
|
# Example: https://integrations.sh/ or a self-hosted mirror base, not the full search endpoint.
|
|
INTEGRATIONS_CATALOG_URL=
|
|
# Optional alternative managed connector provider.
|
|
PIPEDREAM_CLIENT_ID=
|
|
PIPEDREAM_CLIENT_SECRET=
|
|
PIPEDREAM_PROJECT_ID=
|
|
PIPEDREAM_ENVIRONMENT=development
|
|
# Optional messaging surface (Chat SDK). Each platform mounts when its full
|
|
# credential set is present; webhooks arrive at /api/v1/messaging/webhook/<provider>.
|
|
# Users link a chat app to their account from the web (Messaging settings).
|
|
# Set true to instead let unknown senders auto-provision their own chat-only
|
|
# accounts (their runs bill the deployment model key):
|
|
MESSAGING_OPEN_SIGNUP=false
|
|
# Sendblue (iMessage/SMS — all four required):
|
|
SENDBLUE_API_KEY_ID=
|
|
SENDBLUE_API_SECRET=
|
|
SENDBLUE_SIGNING_SECRET=
|
|
SENDBLUE_PHONE_NUMBER=
|
|
# Slack (both required). Channels and rooms use the shared messaging team-chat
|
|
# path when TEAM_CHAT_BOT_ID is set; Slack is one adapter, not a separate stack.
|
|
SLACK_BOT_TOKEN=
|
|
SLACK_SIGNING_SECRET=
|
|
# Gateway bot for provider-neutral team/external rooms (Slack, later Teams, etc.).
|
|
# Alias SLACK_RAKAZO_BOT_ID is accepted for older configs.
|
|
TEAM_CHAT_BOT_ID=
|
|
# Optional separate judge model for ambient room replies (both or neither):
|
|
TEAM_CHAT_JUDGE_PROVIDER=
|
|
TEAM_CHAT_JUDGE_MODEL=
|
|
# WhatsApp Business Cloud (all four required):
|
|
WHATSAPP_ACCESS_TOKEN=
|
|
WHATSAPP_PHONE_NUMBER_ID=
|
|
WHATSAPP_APP_SECRET=
|
|
WHATSAPP_VERIFY_TOKEN=
|
|
# Telegram (both required). Inbound is webhook-only at
|
|
# /api/v1/messaging/webhook/telegram with header X-Telegram-Bot-Api-Secret-Token;
|
|
# the worker must not long-poll getUpdates.
|
|
TELEGRAM_BOT_TOKEN=
|
|
TELEGRAM_WEBHOOK_SECRET_TOKEN=
|
|
# Feishu/Lark (app id, secret, and verification token required). Inbound is
|
|
# webhook-only at /api/v1/messaging/webhook/lark — do not enable long
|
|
# connection in the developer console or the HTTP webhook will miss events.
|
|
# Create a custom app with the Bot capability, subscribe to im.message.receive_v1,
|
|
# and set the event subscription URL to that path. LARK_DOMAIN=feishu uses
|
|
# open.feishu.cn (default); lark uses open.larksuite.com. Encrypt key is
|
|
# optional unless event encryption is enabled in the console.
|
|
LARK_APP_ID=
|
|
LARK_APP_SECRET=
|
|
LARK_VERIFICATION_TOKEN=
|
|
LARK_ENCRYPT_KEY=
|
|
LARK_DOMAIN=
|
|
SUPERMEMORY_API_KEY=
|
|
# Optional. Defaults to https://api.supermemory.ai. Self-hosted: http://localhost:6767
|
|
SUPERMEMORY_API_URL=
|
|
# Transactional account email. Works with Resend, Amazon SES, or any SMTP server.
|
|
SMTP_URL=
|
|
EMAIL_FROM=
|
|
# Local development only: capture password-reset email and print its link to the API console.
|
|
EMAIL_EMULATOR=
|
|
VAPID_PUBLIC_KEY=
|
|
VAPID_PRIVATE_KEY=
|
|
# Structured logs to stdout (json in production, pretty in development unless overridden).
|
|
LOG_LEVEL=info
|
|
LOG_FORMAT=
|
|
# Optional Axiom ingest. Needs both token and dataset. Failures never affect the product.
|
|
AXIOM_TOKEN=
|
|
AXIOM_DATASET=
|
|
# Optional region: AXIOM_EDGE is a hostname (eu-central-1.aws.edge.axiom.co).
|
|
# AXIOM_EDGE_URL is an https URL and wins when both are set.
|
|
AXIOM_EDGE=
|
|
AXIOM_EDGE_URL=
|
|
# Optional. GET /health returns this as `revision` so you can confirm the deployed commit.
|
|
GIT_SHA=
|
|
|
|
# --- Compose production deployments ---
|
|
# Absolute path of this checkout as the Docker *daemon* sees it. Production Compose defaults to
|
|
# /srv/rakazo on Linux; override it for any other host path so the updater bind mount resolves.
|
|
# Linux override: RAKAZO_DEPLOY_DIR=/opt/rakazo
|
|
# Docker Desktop on Windows (C:\Users\you\rakazo):
|
|
# RAKAZO_DEPLOY_DIR=/run/desktop/mnt/host/c/Users/you/rakazo
|
|
RAKAZO_DEPLOY_DIR=
|
|
# Compose files the updater reconciles, in overlay order, separated like Compose's own
|
|
# COMPOSE_FILE (":" unless COMPOSE_PATH_SEPARATOR says otherwise). Leave unset for the base stack.
|
|
# RAKAZO_COMPOSE_FILE=infra/compose/docker-compose.prod.yml:ops/compose/overlay.yml
|
|
RAKAZO_COMPOSE_FILE=
|
|
# Extra services an update pulls, recreates and rolls back, comma separated. Name any overlay
|
|
# service built from the application image, or it keeps running the previous code after an update.
|
|
# Appended to api, worker, web; the updater itself is refused.
|
|
# RAKAZO_UPDATE_SERVICES=supervisor
|
|
RAKAZO_UPDATE_SERVICES=
|
|
# Published images (defaults match this repository). Tag `local` is built from the checkout.
|
|
RAKAZO_IMAGE=ghcr.io/elie222/rakazo/app
|
|
RAKAZO_IMAGE_TAG=local
|
|
RAKAZO_IMAGE_TAG_PREVIOUS=
|
|
RAKAZO_UPDATER_IMAGE=ghcr.io/elie222/rakazo/updater
|
|
RAKAZO_UPDATER_IMAGE_TAG=local
|
|
# Required only when starting the opt-in `updater` Compose profile; the sidecar refuses to start
|
|
# without it. Use a dedicated random value, not BETTER_AUTH_SECRET,
|
|
# SANDBOX_SUPERVISOR_TOKEN, or SCREEN_PROXY_SECRET;
|
|
# ≥32 chars in production. Leave empty when the sidecar is disabled.
|
|
RAKAZO_UPDATER_URL=
|
|
RAKAZO_UPDATER_TOKEN=
|
|
|
|
# --- evOo Mission Control (Cockpit on port 3088) ---
|
|
PORT=3088
|
|
EVOO_COCKPIT_HOST=127.0.0.1
|
|
# Required when EVOO_COCKPIT_HOST binds beyond loopback (e.g. 0.0.0.0 for LAN/Tailscale).
|
|
# Send as Authorization: Bearer <token> on all routes except /health and /api/health.
|
|
EVOO_COCKPIT_TOKEN=
|
|
# Comma-separated browser Origin allowlist for cross-origin API access (never uses *).
|
|
# Loopback binds default to http://127.0.0.1:5173 and http://localhost:5173 when unset.
|
|
# Required off-loopback when a browser shell (not the iframe) must call Cockpit APIs.
|
|
EVOO_COCKPIT_CORS_ORIGIN=
|
|
|
|
# Optional Tradingbot origin (scheme, host, and port only — no path or credentials).
|
|
# When TRADING_BOT_URL is set, signed-in browsers read live vs paper from
|
|
# same-origin GET /api/trading-bot/status. Leave unset for SaaS; evOo runs without a bot.
|
|
# TRADING_BOT_URL=http://127.0.0.1:8000
|
|
# Optional build-time override. When set, the web app polls
|
|
# ${VITE_TRADING_BOT_URL}/bot/api/status directly. That call is cross-origin, so the
|
|
# bot must allow this web origin. Leave unset to use the API proxy above.
|
|
# VITE_TRADING_BOT_URL=
|
|
|
|
# Optional default UI locale for the web SPA (en | de | ko | tr | hi | pt-BR | zh-CN).
|
|
# Overridden by localStorage key rakazo.uiLocale when the user picks a language in Settings.
|
|
# VITE_DEFAULT_UI_LOCALE=en
|
|
# Expo: English or Simplified Chinese (en | zh-CN). Overridden by SecureStore key
|
|
# rakazo.uiLocale from Account → Language.
|
|
# EXPO_PUBLIC_DEFAULT_UI_LOCALE=en
|