.env.example

# Environment for the `zero` CLI, run from the repository root.
#
# Copy to `.env`; the root `zero` script loads it with Node's own
# `--env-file-if-exists`, so a missing file is not an error and real environment
# variables always win over the file in CI and production.
#
# Each process in this repository reads exactly one env file, kept next to the
# process that reads it. Nothing here is shared implicitly: a file is loaded
# only by the process it sits next to.
#
#   .env                     this file — the `zero` CLI: model providers,
#                            subscription transports, GITHUB_TOKEN
#   apps/dashboard/.env      the dashboard process, loaded by Nuxt itself:
#                            control plane (AGENT_ZERO_CONTROL_PLANE_*),
#                            webhook ingress, DATABASE_URL, authentication,
#                            mail, NUXT_PUBLIC_SITE_URL
#   apps/marketing/.env      the marketing site, loaded by Nuxt itself:
#                            MARKETING_SITE_URL, MARKETING_DASHBOARD_URL
#   packages/database/.env   drizzle-kit migrations, loaded from its own
#                            directory: DATABASE_URL
#
# A variable two processes both read (DATABASE_URL, and the model-provider keys
# when the dashboard's control plane executes runs) is written in both files on
# purpose: no process silently inherits configuration meant for another one.
# See docs: apps/docs/guide/environment-variables.md.

OPENAI_API_KEY=
AGENT_ZERO_MODEL=gpt-5
GITHUB_TOKEN=

# Subscription model transports (model.provider: claude-code / codex-cli). These take no API key:
# they drive the vendor CLI already logged in on this host, so they are single-tenant and bound to
# this machine. Each stays off unless its flag is exactly "true", so a CI runner without the CLI
# installed never spawns a subprocess.
AGENT_ZERO_ENABLE_CLAUDE_CODE_PROVIDER=false
AGENT_ZERO_ENABLE_CODEX_CLI_PROVIDER=false
# Absolute path to the executable when it is not on PATH.
AGENT_ZERO_CLAUDE_CODE_PATH=
AGENT_ZERO_CODEX_PATH=
# Required when runner.isolation is "container" in .agent-zero.yml. Without it, claude-code is
# refused rather than spawned unisolated on the control-plane host: this image must have the
# `claude` CLI installed, and only claude-code is affected (codex-cli's vendor SDK has no spawn
# hook to route through a container either way; see README "Known limits"). The container gets no
# repository checkout and unrestricted network — both deliberately different from runner.image and
# permissions.network, which govern an untrusted checkout's own commands, not this process.
AGENT_ZERO_CLAUDE_CODE_CONTAINER_IMAGE=
# Executable name/path to run inside that container. Defaults to "claude"; only needs setting if
# the image installs it somewhere not on PATH. The vendor SDK's own resolved path (its bundled
# native binary, or AGENT_ZERO_CLAUDE_CODE_PATH) is a host path and never used inside the container.
AGENT_ZERO_CLAUDE_CODE_CONTAINER_EXECUTABLE=
# Host directory holding the CLI's own `claude login` session, mounted read-only into that
# container along with its sibling ~/.claude.json. Defaults to ~/.claude; only needs setting if the
# CLI was configured with a custom CLAUDE_CONFIG_DIR on this host.
CLAUDE_CONFIG_DIR=
# Longest a run may block in total waiting for a spent subscription window to reopen, before
# resuming the interrupted CLI session. Default 3600000 (one hour); 0 disables waiting so a run
# fails straight onto the fallback below. A reset further out than this is never waited on.
AGENT_ZERO_SUBSCRIPTION_LIMIT_WAIT_MS=3600000
# Optional API-key transport a subscription run degrades to when the CLI is missing, its session
# expired, or its usage window is spent and too far from reopening to wait out. Both must be set
# together, and the provider must not itself be subscription-based.
AGENT_ZERO_MODEL_FALLBACK_PROVIDER=
AGENT_ZERO_MODEL_FALLBACK_MODEL=