skillscript-runtime 0.17.2 → 0.17.4

package/scaffold/.env.example

@@ -0,0 +1,89 @@
+# Skillscript runtime — example .env file.
+#
+# Copy this to `.env` in the same directory ($SKILLSCRIPT_HOME) and edit
+# the values you want set. The CLI auto-loads `.env` at startup and
+# populates `process.env` for any key not already set in the shell.
+#
+# Precedence (most-specific wins):
+#   1. CLI flag       (e.g. `--port 8080`)
+#   2. Shell env var  (e.g. `export SKILLSCRIPT_PORT=8080`)
+#   3. This `.env`    (the values you set below)
+#   4. `skillscript.config.json` field
+#   5. Built-in default
+#
+# Lines starting with `#` are comments. Blank lines are ignored.
+# Values can be quoted ("..." or '...') if they contain spaces.
+
+
+# ─── Posture / security switches ───────────────────────────────────────
+
+# Force every outside-MCP `skill_write` to land Draft regardless of what
+# the body declares. Closes the agent-self-approval path — adopters
+# wanting a human approval gate before any skill executes set this true.
+# Default false (preserves v0.9.1 self-approval-via-body-declaration).
+# SKILLSCRIPT_FORCE_ALWAYS_DRAFT=true
+
+# Permit `shell(unsafe=true)` ops (full bash interpretation: pipes, $VAR,
+# command substitution). Default false. Set true only after auditing
+# every unsafe-shell op in your skill corpus — lint tier-2 warning fires
+# on every appearance regardless.
+# SKILLSCRIPT_ENABLE_UNSAFE_SHELL=true
+
+
+# ─── Network / bind config ─────────────────────────────────────────────
+
+# Dashboard / serve HTTP bind address. Default 127.0.0.1 (localhost-only).
+# Container deployments set 0.0.0.0 so the host-side port-forward can
+# reach the listener.
+# SKILLSCRIPT_HOST=0.0.0.0
+
+# Dashboard / serve HTTP port. Default 7878.
+# SKILLSCRIPT_PORT=8080
+
+
+# ─── Identity propagation (multi-agent hosts only) ─────────────────────
+
+# Inbound HTTP header name carrying host-attested caller identity.
+# When set, `DashboardServer` reads this header on every /rpc request
+# and threads the value as `McpRequestCtx.callerIdentity`; the
+# `skill_write` handler captures it as `SkillMeta.author`. Multi-agent
+# MCP hosts (NanoClaw-style) configure this. Skip if single-user /
+# single-tenant — author is captured from the runtime's own writer
+# identity by default. See adopter playbook for the trust model.
+# SKILLSCRIPT_MCP_CALLER_IDENTITY_HEADER=X-Agent-Id
+
+
+# ─── LocalModel (Ollama) ───────────────────────────────────────────────
+
+# Override the Ollama endpoint. Default http://localhost:11434.
+# OLLAMA_BASE_URL=http://ollama.internal:11434
+
+
+# ─── Substrate-specific tokens / endpoints ─────────────────────────────
+#
+# Any variable set here is also reachable via `${VAR}` substitution in
+# `skillscript.config.json` and `connectors.json`. The canonical adopter
+# pattern: secrets + endpoints in `.env` (gitignored), declarative shape
+# in JSON configs (committed).
+#
+# Example wiring in connectors.json:
+#
+#   {
+#     "amp": {
+#       "class": "HttpMcpConnector",
+#       "config": {
+#         "endpoint": "${AMP_ENDPOINT}",
+#         "headers": { "Authorization": "Bearer ${AMP_TOKEN}" }
+#       }
+#     }
+#   }
+#
+# AMP_ENDPOINT=https://amp.internal/rpc
+# AMP_TOKEN=your-token-here
+
+
+# ─── NOT settable via .env (chicken-and-egg) ───────────────────────────
+#
+# SKILLSCRIPT_HOME — read BEFORE this .env loads (we need HOME_DIR to
+# find the .env). Set in your shell, Docker `-e`, or systemd Environment=
+# directive instead.