# ── LLM: Ollama (primary) ────────────────────────────────────────────────────
OLLAMA_HOST=http://localhost:11434
OLLAMA_API_KEY=
OLLAMA_DEFAULT_MODEL=gemma4:31b-cloud
OLLAMA_NUM_CTX=65536
OLLAMA_THINK=true
OLLAMA_REQUEST_TIMEOUT=30

# Multi-server fallback: path to JSON file [{host, api_key?}, ...]
# When set, overrides OLLAMA_HOST / OLLAMA_API_KEY.
# OLLAMA_BACKENDS_FILE=ollama_backends.json

# ── LLM: OpenAI (optional) ───────────────────────────────────────────────────
OPENAI_API_KEY=
# OPENAI_MODEL=gpt-4
# OPENAI_BASE_URL=https://api.openai.com/v1

ANTHROPIC_API_KEY=

# ── Database (PostgreSQL 15+ with pgvector) ──────────────────────────────────
DATABASE_URL=postgresql://user:pass@localhost:5432/navidb

# ── Embedding (Ollama) ─────────────────────────────────────────────────────────
# When empty, falls back to OLLAMA_HOST.
EMBEDDING_OLLAMA_HOST=
EMBEDDING_OLLAMA_API_KEY=
EMBEDDING_MODEL=nomic-embed-text:latest

# ── Filesystem / Terminal / SSH ──────────────────────────────────────────────
FS_ALLOWED_PATHS=*
TERMINAL_ALLOWED_COMMANDS=*
SSH_HOSTS_FILE=ssh_hosts.json

# ── Session files ──────────────────────────────────────────────────────────────
SESSION_FILES_DIR=session_files
SESSION_FILES_MAX_SIZE_MB=200

# ── Context compression ────────────────────────────────────────────────────────
CONTEXT_COMPRESSION_ENABLED=true
CONTEXT_COMPRESSION_THRESHOLD=0.70
CONTEXT_KEEP_RECENT=8
CONTEXT_SUMMARY_TEMPERATURE=0.3
CONTEXT_SUMMARY_MAX_TOKENS=3000

# ── Logging ────────────────────────────────────────────────────────────────────
LOG_LEVEL=INFO

# ── Public URL (used by share_file for download links) ───────────────────────
PUBLIC_URL=http://localhost:8000

# ── Persona ─────────────────────────────────────────────────────────────────────
# Preferred: put persona in persona.txt and set NAVI_PERSONA_FILE.
NAVI_PERSONA_FILE=persona.txt
# NAVI_PERSONA="You are Navi, a loyal assistant..."

# ── User tools ─────────────────────────────────────────────────────────────────
TOOLS_DIR=tools

# ── Eval system (optional) ─────────────────────────────────────────────────────
# EVAL_DATA_DIR=debug/eval

# ── Auth switch ──────────────────────────────────────────────────────────────────
# Set to false to disable OAuth/API-token auth entirely. Every request is then
# treated as the anonymous admin user. Use only for trusted local deployments.
NAVI_AUTH_ENABLED=true

# ── Web UI / server shape ────────────────────────────────────────────────────────
# NAVI_WEBCLIENT_ENABLED=false removes all web-facing routes (index, static
# mounts, /admin panel, /debug*) and skips the navi_ui MCP server — a pure
# API/WS server for terminal clients. Needs a restart to take effect.
NAVI_WEBCLIENT_ENABLED=true
# Bind address/port for the `navi-server` launcher (and systemd unit).
NAVI_HOST=127.0.0.1
NAVI_PORT=8000

# ── Internal navi_ui MCP server ─────────────────────────────────────────────────
# Lets the agent push structured UI components (card_grid, form) to the webclient
# via the render_component tool. Started automatically in the app lifespan
# (only when the web UI is enabled).
NAVI_UI_MCP_ENABLED=true
NAVI_UI_MCP_HOST=127.0.0.1
NAVI_UI_MCP_PORT=8001

# ── gnexus-auth OAuth ────────────────────────────────────────────────────────────
GNAUTH_BASE_URL=https://auth.your-domain.com
GNAUTH_CLIENT_ID=
GNAUTH_CLIENT_SECRET=
GNAUTH_REDIRECT_URI=https://navi.your-domain.com/auth/callback
# GNAUTH_PROFILE_PATH=/account/profile  # path appended to base URL for profile links

# ── Auth encryption ──────────────────────────────────────────────────────────────
# Fernet key for encrypting tokens in DB. Generate once with:
#   python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
# Must stay constant — changing it invalidates all stored sessions.
NAVI_AUTH_ENCRYPTION_KEY=

# ── CORS ────────────────────────────────────────────────────────────────────────
# REQUIRED when NAVI_AUTH_ENABLED=true (server refuses to start without it).
# Comma-separated list of origins allowed to call the API with credentials.
# Ignored when NAVI_AUTH_ENABLED=false (then any origin is allowed, no credentials).
NAVI_ALLOWED_ORIGINS=https://navi.your-domain.com

# ── Webhooks (gnexus-auth logout) ─────────────────────────────────────────────────
# HMAC-SHA256 secret shared with gnexus-auth. Copy from its admin panel.
# Empty + NAVI_AUTH_ENABLED=true → webhook endpoint answers 503.
# Empty + NAVI_AUTH_ENABLED=false → accepted unsigned, with a warning in the log.
GNAUTH_WEBHOOK_SECRET=

# ── Cookie security ───────────────────────────────────────────────────────────────
# The session cookie Secure flag is set automatically when GNAUTH_BASE_URL is
# https://. Set this to force it on for an https navi deploy behind an http
# auth server (leave empty otherwise).
# NAVI_AUTH_COOKIE_SECURE=true