brawny 0.1.13__py3-none-any.whl → 0.1.22__py3-none-any.whl

brawny/config/__init__.py

@@ -8,10 +8,11 @@ from __future__ import annotations
 
 import os
 
-from brawny.config.models import AdvancedConfig, Config, RPCGroupConfig
+from brawny.config.models import AdvancedConfig, Config, IntentCooldownConfig, RPCGroupConfig
 from brawny.config.validation import (
     InvalidEndpointError,
     canonicalize_endpoint,
+    canonicalize_endpoints,
     dedupe_preserve_order,
     validate_config,
 )
@@ -21,10 +22,12 @@ __all__ = [
     # Models
     "Config",
     "AdvancedConfig",
+    "IntentCooldownConfig",
     "RPCGroupConfig",
     # Validation
     "InvalidEndpointError",
     "canonicalize_endpoint",
+    "canonicalize_endpoints",
     "dedupe_preserve_order",
     "validate_config",
     # Errors

brawny/config/models.py

@@ -7,6 +7,7 @@ from __future__ import annotations
 
 from dataclasses import asdict, dataclass, field
 from brawny.model.enums import KeystoreType
+from brawny.http import HttpConfig
 
 DEFAULT_BLOCK_HASH_HISTORY_SIZE = 256
 DEFAULT_JOB_ERROR_BACKOFF_BLOCKS = 1
@@ -15,17 +16,15 @@ DEFAULT_NONCE_RECONCILE_INTERVAL_SECONDS = 300
 DEFAULT_STUCK_TX_BLOCKS = 50
 DEFAULT_SHUTDOWN_TIMEOUT_SECONDS = 30
 DEFAULT_RPC_RETRY_BACKOFF_BASE = 1.0
-DEFAULT_RPC_CIRCUIT_BREAKER_SECONDS = 300
 DEFAULT_DB_CIRCUIT_BREAKER_FAILURES = 5
 DEFAULT_DB_CIRCUIT_BREAKER_SECONDS = 30
 DEFAULT_GAS_REFRESH_SECONDS = 15
 DEFAULT_FALLBACK_GAS_LIMIT = 500_000
-DEFAULT_TELEGRAM_RATE_LIMIT_PER_MINUTE = 20
 DEFAULT_ABI_CACHE_TTL_SECONDS = 86400 * 7
-DEFAULT_DATABASE_POOL_TIMEOUT_SECONDS = 30.0
 DEFAULT_NONCE_GAP_ALERT_SECONDS = 300
 DEFAULT_MAX_EXECUTOR_RETRIES = 5
 DEFAULT_FINALITY_CONFIRMATIONS = 12
+DEFAULT_ALERTS_HEALTH_MAX_OLDEST_AGE_SECONDS = 120
 
 
 @dataclass
@@ -36,7 +35,7 @@ class TelegramConfig:
         bot_token: Bot token for API calls (None = disabled)
         chats: Named chat targets (e.g., {"ops": "-100...", "dev": "-100..."})
         default: Default targets when job.alert_to not specified
-        parse_mode: Default parse mode for telegram messages (None = plain text)
+        parse_mode: Default parse mode for telegram messages (None = disable formatting)
         health_chat: Chat name for daemon health alerts (None = logged only)
         health_cooldown_seconds: Deduplication window for health alerts
     """
@@ -49,6 +48,31 @@ class TelegramConfig:
     health_cooldown_seconds: int = 1800  # 30 minutes between identical alerts
 
 
+@dataclass
+class GuardrailsConfig:
+    """Guardrail configuration for linting and runtime enforcement."""
+
+    lint_paths: list[str] = field(default_factory=list)
+
+
+@dataclass
+class DebugConfig:
+    """Debug-only settings (opt-in)."""
+
+    allow_console: bool = False
+    enable_null_lease_reclaim: bool = False
+
+
+@dataclass
+class IntentCooldownConfig:
+    """Global intent cooldown configuration."""
+
+    enabled: bool = True
+    default_seconds: int = 300
+    max_seconds: int = 3600
+    prune_older_than_days: int = 30
+
+
 @dataclass
 class RPCGroupConfig:
     """A named collection of RPC endpoints."""
@@ -88,13 +112,12 @@ class AdvancedConfig:
     rpc_timeout_seconds: float = 30.0
     rpc_max_retries: int = 3
 
-    # Database pool (Postgres only)
-    database_pool_size: int = 5
-    database_pool_max_overflow: int = 10
-
     # Job logs
     log_retention_days: int = 7
 
+    # Alerts
+    alerts_health_max_oldest_age_seconds: int = DEFAULT_ALERTS_HEALTH_MAX_OLDEST_AGE_SECONDS
+
 
 @dataclass
 class Config:
@@ -126,6 +149,18 @@ class Config:
     # Telegram (canonical form - parsed from telegram: or legacy fields)
     telegram: TelegramConfig = field(default_factory=TelegramConfig)
 
+    # Guardrails (lint hints for job code)
+    guardrails: GuardrailsConfig = field(default_factory=GuardrailsConfig)
+
+    # Debug-only flags (disabled by default)
+    debug: DebugConfig = field(default_factory=DebugConfig)
+
+    # Intent cooldown (global defaults)
+    intent_cooldown: IntentCooldownConfig = field(default_factory=IntentCooldownConfig)
+
+    # HTTP (approved client for job code)
+    http: HttpConfig = field(default_factory=HttpConfig)
+
     # Metrics
     metrics_port: int = 9091
 
@@ -145,15 +180,6 @@ class Config:
         validate_advanced_config(self._advanced_or_default())
 
     @property
-    def is_sqlite(self) -> bool:
-        """Check if using SQLite database."""
-        return self.database_url.startswith("sqlite:///")
-
-    @property
-    def is_postgres(self) -> bool:
-        """Check if using PostgreSQL database."""
-        return self.database_url.startswith(("postgresql://", "postgres://"))
-
     @classmethod
     def from_env(cls) -> "Config":
         """Load configuration from environment variables."""
@@ -209,10 +235,6 @@ class Config:
                             }
                     redacted_groups[group_name] = group_value
                 redacted[key] = redacted_groups
-            elif key == "rpc_rate_limits" and isinstance(value, dict):
-                redacted[key] = {
-                    _redact_url(str(endpoint)): limiter for endpoint, limiter in value.items()
-                }
             elif key == "telegram" and isinstance(value, dict):
                 # Redact bot_token within telegram config
                 redacted[key] = {
@@ -280,14 +302,6 @@ class Config:
     def rpc_max_retries(self) -> int:
         return self._advanced_or_default().rpc_max_retries
 
-    @property
-    def database_pool_size(self) -> int:
-        return self._advanced_or_default().database_pool_size
-
-    @property
-    def database_pool_max_overflow(self) -> int:
-        return self._advanced_or_default().database_pool_max_overflow
-
     @property
     def priority_fee(self) -> int:
         return int(self.default_priority_fee_gwei * 1_000_000_000)
@@ -343,10 +357,6 @@ class Config:
     def rpc_retry_backoff_base(self) -> float:
         return DEFAULT_RPC_RETRY_BACKOFF_BASE
 
-    @property
-    def rpc_circuit_breaker_seconds(self) -> int:
-        return DEFAULT_RPC_CIRCUIT_BREAKER_SECONDS
-
     @property
     def db_circuit_breaker_failures(self) -> int:
         return DEFAULT_DB_CIRCUIT_BREAKER_FAILURES
@@ -355,18 +365,6 @@ class Config:
     def db_circuit_breaker_seconds(self) -> int:
         return DEFAULT_DB_CIRCUIT_BREAKER_SECONDS
 
-    @property
-    def rpc_rate_limit_per_second(self) -> float | None:
-        return None
-
-    @property
-    def rpc_rate_limit_burst(self) -> int | None:
-        return None
-
-    @property
-    def rpc_rate_limits(self) -> dict[str, dict[str, float | int]]:
-        return {}
-
     @property
     def gas_refresh_seconds(self) -> int:
         return DEFAULT_GAS_REFRESH_SECONDS
@@ -375,18 +373,10 @@ class Config:
     def fallback_gas_limit(self) -> int:
         return DEFAULT_FALLBACK_GAS_LIMIT
 
-    @property
-    def telegram_rate_limit_per_minute(self) -> int:
-        return DEFAULT_TELEGRAM_RATE_LIMIT_PER_MINUTE
-
     @property
     def abi_cache_ttl_seconds(self) -> int:
         return DEFAULT_ABI_CACHE_TTL_SECONDS
 
-    @property
-    def database_pool_timeout_seconds(self) -> float:
-        return DEFAULT_DATABASE_POOL_TIMEOUT_SECONDS
-
     @property
     def allow_unsafe_nonce_reset(self) -> bool:
         return False
@@ -395,10 +385,6 @@ class Config:
     def nonce_gap_alert_seconds(self) -> int:
         return DEFAULT_NONCE_GAP_ALERT_SECONDS
 
-    @property
-    def brownie_password_fallback(self) -> bool:
-        return False
-
     @property
     def log_retention_days(self) -> int:
         return self._advanced_or_default().log_retention_days

brawny/config/parser.py

@@ -7,6 +7,7 @@ from __future__ import annotations
 
 import os
 import re
+from typing import Callable
 from dataclasses import replace
 
 from brawny.model.enums import KeystoreType
@@ -33,8 +34,6 @@ _ADVANCED_FIELDS = {
     "fee_bump_percent",
     "rpc_timeout_seconds",
     "rpc_max_retries",
-    "database_pool_size",
-    "database_pool_max_overflow",
 }
 
 _REMOVED_ENV_KEYS = {
@@ -104,6 +103,7 @@ def _parse_telegram(raw: dict) -> "TelegramConfig":
             default = [default]
         default = [d.strip() for d in default if d and str(d).strip()]
 
+        parse_mode_provided = "parse_mode" in tg
         parse_mode = tg.get("parse_mode")
         if isinstance(parse_mode, str):
             parse_mode = parse_mode.strip() or None
@@ -111,6 +111,8 @@ def _parse_telegram(raw: dict) -> "TelegramConfig":
             raise ConfigError(
                 "telegram.parse_mode must be one of: Markdown, MarkdownV2, HTML, or null"
             )
+        if not parse_mode_provided and parse_mode is None:
+            parse_mode = TelegramConfig().parse_mode
 
         health_chat = tg.get("health_chat")
         if isinstance(health_chat, str):
@@ -160,6 +162,115 @@ def _parse_telegram(raw: dict) -> "TelegramConfig":
     return TelegramConfig()
 
 
+def _parse_guardrails(raw: dict) -> "GuardrailsConfig":
+    from brawny.config.models import GuardrailsConfig
+
+    if "guardrails" in raw and isinstance(raw["guardrails"], dict):
+        guardrails = raw["guardrails"]
+        lint_paths = guardrails.get("lint_paths", [])
+        if lint_paths is None:
+            lint_paths = []
+        if isinstance(lint_paths, str):
+            lint_paths = [lint_paths]
+        lint_paths = [str(path).strip() for path in lint_paths if str(path).strip()]
+        return GuardrailsConfig(lint_paths=lint_paths)
+    return GuardrailsConfig()
+
+
+def _parse_debug(raw: dict) -> "DebugConfig":
+    from brawny.config.models import DebugConfig
+
+    if "debug" in raw and isinstance(raw["debug"], dict):
+        debug = raw["debug"]
+        allow_console = debug.get("allow_console", False)
+        if not isinstance(allow_console, bool):
+            raise ConfigError("debug.allow_console must be a boolean")
+        enable_null_lease_reclaim = debug.get("enable_null_lease_reclaim", False)
+        if not isinstance(enable_null_lease_reclaim, bool):
+            raise ConfigError("debug.enable_null_lease_reclaim must be a boolean")
+        return DebugConfig(
+            allow_console=allow_console,
+            enable_null_lease_reclaim=enable_null_lease_reclaim,
+        )
+    return DebugConfig()
+
+
+def _parse_intent_cooldown(raw: dict) -> "IntentCooldownConfig":
+    from brawny.config.models import IntentCooldownConfig
+
+    if "intent_cooldown" in raw and isinstance(raw["intent_cooldown"], dict):
+        cfg = raw["intent_cooldown"]
+        enabled = cfg.get("enabled", True)
+        default_seconds = cfg.get("default_seconds", IntentCooldownConfig().default_seconds)
+        max_seconds = cfg.get("max_seconds", IntentCooldownConfig().max_seconds)
+        prune_older_than_days = cfg.get(
+            "prune_older_than_days", IntentCooldownConfig().prune_older_than_days
+        )
+        if not isinstance(enabled, bool):
+            raise ConfigError("intent_cooldown.enabled must be a boolean")
+        return IntentCooldownConfig(
+            enabled=enabled,
+            default_seconds=int(default_seconds),
+            max_seconds=int(max_seconds),
+            prune_older_than_days=int(prune_older_than_days),
+        )
+    return IntentCooldownConfig()
+
+
+def _parse_http(raw: dict) -> "HttpConfig":
+    """Parse HTTP config, handling canonical http: block."""
+    from brawny.http import HttpConfig
+
+    if "http" in raw and isinstance(raw["http"], dict):
+        cfg = raw["http"]
+        allowed_domains = cfg.get("allowed_domains", [])
+        if isinstance(allowed_domains, str):
+            allowed_domains = [allowed_domains]
+        if not isinstance(allowed_domains, list):
+            raise ConfigError("http.allowed_domains must be a list of domains")
+        allowed_domains = [str(d).strip() for d in allowed_domains if str(d).strip()]
+
+        connect_timeout_seconds = cfg.get("connect_timeout_seconds")
+        read_timeout_seconds = cfg.get("read_timeout_seconds")
+        max_retries = cfg.get("max_retries")
+        backoff_base_seconds = cfg.get("backoff_base_seconds")
+
+        if connect_timeout_seconds is None:
+            connect_timeout_seconds = HttpConfig().connect_timeout_seconds
+        if read_timeout_seconds is None:
+            read_timeout_seconds = HttpConfig().read_timeout_seconds
+        if max_retries is None:
+            max_retries = HttpConfig().max_retries
+        if backoff_base_seconds is None:
+            backoff_base_seconds = HttpConfig().backoff_base_seconds
+        try:
+            connect_timeout_seconds = float(connect_timeout_seconds)
+        except (TypeError, ValueError) as exc:
+            raise ConfigError("http.connect_timeout_seconds must be a number") from exc
+        try:
+            read_timeout_seconds = float(read_timeout_seconds)
+        except (TypeError, ValueError) as exc:
+            raise ConfigError("http.read_timeout_seconds must be a number") from exc
+        try:
+            max_retries = int(max_retries)
+        except (TypeError, ValueError) as exc:
+            raise ConfigError("http.max_retries must be an integer") from exc
+        try:
+            backoff_base_seconds = float(backoff_base_seconds)
+        except (TypeError, ValueError) as exc:
+            raise ConfigError("http.backoff_base_seconds must be a number") from exc
+
+        return HttpConfig(
+            allowed_domains=allowed_domains,
+            connect_timeout_seconds=connect_timeout_seconds,
+            read_timeout_seconds=read_timeout_seconds,
+            max_retries=max_retries,
+            backoff_base_seconds=backoff_base_seconds,
+        )
+
+    return HttpConfig()
+
+
 
 
 def _interpolate_env_vars(
@@ -290,9 +401,43 @@ def _parse_env_float(key: str) -> float:
         raise ConfigError(f"BRAWNY_{key} must be a number, got: {value}")
 
 
+_ADVANCED_ENV_MAPPING: dict[str, tuple[str, Callable[[str], object]]] = {
+    "POLL_INTERVAL_SECONDS": ("poll_interval_seconds", _parse_env_float),
+    "REORG_DEPTH": ("reorg_depth", _parse_env_int),
+    "FINALITY_CONFIRMATIONS": ("finality_confirmations", _parse_env_int),
+    "DEFAULT_DEADLINE_SECONDS": ("default_deadline_seconds", _parse_env_int),
+    "STUCK_TX_SECONDS": ("stuck_tx_seconds", _parse_env_int),
+    "MAX_REPLACEMENT_ATTEMPTS": ("max_replacement_attempts", _parse_env_int),
+    "GAS_LIMIT_MULTIPLIER": ("gas_limit_multiplier", _parse_env_float),
+    "DEFAULT_PRIORITY_FEE_GWEI": ("default_priority_fee_gwei", _parse_env_float),
+    "MAX_FEE_CAP_GWEI": ("max_fee_cap_gwei", _parse_env_float),
+    "FEE_BUMP_PERCENT": ("fee_bump_percent", _parse_env_int),
+    "RPC_TIMEOUT_SECONDS": ("rpc_timeout_seconds", _parse_env_float),
+    "RPC_MAX_RETRIES": ("rpc_max_retries", _parse_env_int),
+}
+
+
+def _get_advanced_env_overrides() -> dict[str, object]:
+    overrides: dict[str, object] = {}
+    for env_key, (field_name, parser) in _ADVANCED_ENV_MAPPING.items():
+        if _env_is_set(env_key):
+            overrides[field_name] = parser(env_key)
+    return overrides
+
+
+def _get_advanced_env_overrides_with_keys() -> tuple[dict[str, object], list[str]]:
+    overrides: dict[str, object] = {}
+    overridden: list[str] = []
+    for env_key, (field_name, parser) in _ADVANCED_ENV_MAPPING.items():
+        if _env_is_set(env_key):
+            overrides[field_name] = parser(env_key)
+            overridden.append(f"advanced.{field_name}")
+    return overrides, overridden
+
+
 def from_env() -> "Config":
     """Load configuration from environment variables."""
-    from brawny.config.models import AdvancedConfig, Config, RPCGroupConfig
+    from brawny.config.models import AdvancedConfig, Config, GuardrailsConfig, RPCGroupConfig
     from brawny.config.validation import canonicalize_endpoint, dedupe_preserve_order, InvalidEndpointError
 
     _fail_removed_env_vars()
@@ -328,35 +473,7 @@ def from_env() -> "Config":
             f"Must be one of: {', '.join(kt.value for kt in KeystoreType)}"
         )
 
-    advanced_kwargs: dict[str, object] = {}
-    if _env_is_set("POLL_INTERVAL_SECONDS"):
-        advanced_kwargs["poll_interval_seconds"] = _parse_env_float("POLL_INTERVAL_SECONDS")
-    if _env_is_set("REORG_DEPTH"):
-        advanced_kwargs["reorg_depth"] = _parse_env_int("REORG_DEPTH")
-    if _env_is_set("FINALITY_CONFIRMATIONS"):
-        advanced_kwargs["finality_confirmations"] = _parse_env_int("FINALITY_CONFIRMATIONS")
-    if _env_is_set("DEFAULT_DEADLINE_SECONDS"):
-        advanced_kwargs["default_deadline_seconds"] = _parse_env_int("DEFAULT_DEADLINE_SECONDS")
-    if _env_is_set("STUCK_TX_SECONDS"):
-        advanced_kwargs["stuck_tx_seconds"] = _parse_env_int("STUCK_TX_SECONDS")
-    if _env_is_set("MAX_REPLACEMENT_ATTEMPTS"):
-        advanced_kwargs["max_replacement_attempts"] = _parse_env_int("MAX_REPLACEMENT_ATTEMPTS")
-    if _env_is_set("GAS_LIMIT_MULTIPLIER"):
-        advanced_kwargs["gas_limit_multiplier"] = _parse_env_float("GAS_LIMIT_MULTIPLIER")
-    if _env_is_set("DEFAULT_PRIORITY_FEE_GWEI"):
-        advanced_kwargs["default_priority_fee_gwei"] = _parse_env_float("DEFAULT_PRIORITY_FEE_GWEI")
-    if _env_is_set("MAX_FEE_CAP_GWEI"):
-        advanced_kwargs["max_fee_cap_gwei"] = _parse_env_float("MAX_FEE_CAP_GWEI")
-    if _env_is_set("FEE_BUMP_PERCENT"):
-        advanced_kwargs["fee_bump_percent"] = _parse_env_int("FEE_BUMP_PERCENT")
-    if _env_is_set("RPC_TIMEOUT_SECONDS"):
-        advanced_kwargs["rpc_timeout_seconds"] = _parse_env_float("RPC_TIMEOUT_SECONDS")
-    if _env_is_set("RPC_MAX_RETRIES"):
-        advanced_kwargs["rpc_max_retries"] = _parse_env_int("RPC_MAX_RETRIES")
-    if _env_is_set("DATABASE_POOL_SIZE"):
-        advanced_kwargs["database_pool_size"] = _parse_env_int("DATABASE_POOL_SIZE")
-    if _env_is_set("DATABASE_POOL_MAX_OVERFLOW"):
-        advanced_kwargs["database_pool_max_overflow"] = _parse_env_int("DATABASE_POOL_MAX_OVERFLOW")
+    advanced_kwargs = _get_advanced_env_overrides()
 
 
     # Parse telegram config from env (legacy format)
@@ -364,6 +481,20 @@ def from_env() -> "Config":
         "telegram_bot_token": _get_env("TELEGRAM_BOT_TOKEN"),
         "telegram_chat_id": _get_env("TELEGRAM_CHAT_ID"),
     })
+    guardrails_config = _parse_guardrails({
+        "guardrails": {
+            "lint_paths": _get_env_list("GUARDRAILS_LINT_PATHS"),
+        }
+    })
+    http_allowed = _get_env("HTTP_ALLOWED_DOMAINS")
+    http_config = _parse_http({
+        "http": {
+            "allowed_domains": [d.strip() for d in http_allowed.split(",")] if http_allowed else [],
+            "connect_timeout_seconds": _get_env("HTTP_CONNECT_TIMEOUT_SECONDS"),
+            "read_timeout_seconds": _get_env("HTTP_READ_TIMEOUT_SECONDS"),
+            "max_retries": _get_env("HTTP_MAX_RETRIES"),
+        }
+    })
 
     config = Config(
         database_url=database_url,
@@ -374,6 +505,9 @@ def from_env() -> "Config":
         worker_count=_get_env_int("WORKER_COUNT", 1),
         advanced=AdvancedConfig(**advanced_kwargs) if advanced_kwargs else None,
         telegram=telegram_config,
+        guardrails=guardrails_config,
+        http=http_config,
+        intent_cooldown=IntentCooldownConfig(),
         keystore_type=keystore_type,
         keystore_path=_get_env("KEYSTORE_PATH", "~/.brawny/keys") or "~/.brawny/keys",
     )
@@ -397,7 +531,7 @@ def from_yaml(path: str) -> "Config":
 
     Empty/unset variables in lists are automatically filtered out.
     """
-    from brawny.config.models import AdvancedConfig, Config, RPCGroupConfig
+    from brawny.config.models import AdvancedConfig, Config, IntentCooldownConfig, RPCGroupConfig
     from brawny.config.validation import (
         canonicalize_endpoint,
         dedupe_preserve_order,
@@ -431,6 +565,24 @@ def from_yaml(path: str) -> "Config":
 
     validate_no_removed_fields(data)
 
+    guardrails_data: dict[str, object] = {}
+    if "guardrails" in data:
+        guardrails_value = data.pop("guardrails")
+        if guardrails_value is None:
+            guardrails_value = {}
+        if not isinstance(guardrails_value, dict):
+            raise ConfigError("guardrails must be a mapping")
+        guardrails_data = dict(guardrails_value)
+
+    debug_data: dict[str, object] = {}
+    if "debug" in data:
+        debug_value = data.pop("debug")
+        if debug_value is None:
+            debug_value = {}
+        if not isinstance(debug_value, dict):
+            raise ConfigError("debug must be a mapping")
+        debug_data = dict(debug_value)
+
     advanced_data: dict[str, object] = {}
     if "advanced" in data:
         advanced_value = data.pop("advanced")
@@ -499,14 +651,28 @@ def from_yaml(path: str) -> "Config":
         if unknown:
             raise ConfigError(f"Unknown advanced config fields: {sorted(unknown)}")
         data["advanced"] = AdvancedConfig(**advanced_data)
+    if guardrails_data:
+        data["guardrails"] = guardrails_data
 
     # Parse telegram config (handles both new and legacy formats)
     telegram_config = _parse_telegram(data)
+    http_config = _parse_http(data)
+    guardrails_config = _parse_guardrails(data)
+    debug_config = _parse_debug(data)
+    intent_cooldown_config = _parse_intent_cooldown(data)
     # Remove raw telegram fields - they've been canonicalized
     data.pop("telegram", None)
     data.pop("telegram_bot_token", None)
     data.pop("telegram_chat_id", None)
     data["telegram"] = telegram_config
+    data.pop("http", None)
+    data["http"] = http_config
+    data.pop("guardrails", None)
+    data["guardrails"] = guardrails_config
+    data.pop("debug", None)
+    data["debug"] = debug_config
+    data.pop("intent_cooldown", None)
+    data["intent_cooldown"] = intent_cooldown_config
 
     config = Config(**data)
     config.validate()
@@ -515,13 +681,21 @@ def from_yaml(path: str) -> "Config":
 
 def apply_env_overrides(config: "Config") -> tuple["Config", list[str]]:
     """Apply environment overrides to the current config."""
-    from brawny.config.models import AdvancedConfig, Config, RPCGroupConfig, TelegramConfig
+    from brawny.config.models import (
+        AdvancedConfig,
+        Config,
+        GuardrailsConfig,
+        RPCGroupConfig,
+        TelegramConfig,
+    )
+    from brawny.http import HttpConfig
     from brawny.config.validation import canonicalize_endpoint, dedupe_preserve_order, InvalidEndpointError
 
     _fail_removed_env_vars()
 
     overrides: dict[str, object] = {}
     advanced_overrides: dict[str, object] = {}
+    guardrails_overrides: dict[str, object] = {}
     overridden: list[str] = []
 
     mapping = {
@@ -573,29 +747,63 @@ def apply_env_overrides(config: "Config") -> tuple["Config", list[str]]:
         if telegram_chat_override is not None:
             overridden.append("telegram.chat_id")
 
-    advanced_mapping = {
-        "POLL_INTERVAL_SECONDS": ("poll_interval_seconds", _parse_env_float),
-        "REORG_DEPTH": ("reorg_depth", _parse_env_int),
-        "FINALITY_CONFIRMATIONS": ("finality_confirmations", _parse_env_int),
-        "DEFAULT_DEADLINE_SECONDS": ("default_deadline_seconds", _parse_env_int),
-        "STUCK_TX_SECONDS": ("stuck_tx_seconds", _parse_env_int),
-        "MAX_REPLACEMENT_ATTEMPTS": ("max_replacement_attempts", _parse_env_int),
-        "GAS_LIMIT_MULTIPLIER": ("gas_limit_multiplier", _parse_env_float),
-        "DEFAULT_PRIORITY_FEE_GWEI": ("default_priority_fee_gwei", _parse_env_float),
-        "MAX_FEE_CAP_GWEI": ("max_fee_cap_gwei", _parse_env_float),
-        "FEE_BUMP_PERCENT": ("fee_bump_percent", _parse_env_int),
-        "RPC_TIMEOUT_SECONDS": ("rpc_timeout_seconds", _parse_env_float),
-        "RPC_MAX_RETRIES": ("rpc_max_retries", _parse_env_int),
-        "DATABASE_POOL_SIZE": ("database_pool_size", _parse_env_int),
-        "DATABASE_POOL_MAX_OVERFLOW": ("database_pool_max_overflow", _parse_env_int),
-    }
-
-    for env_key, (field_name, parser) in advanced_mapping.items():
-        if not _env_is_set(env_key):
-            continue
-        value = parser(env_key)
-        advanced_overrides[field_name] = value
-        overridden.append(f"advanced.{field_name}")
+    # Handle http env overrides
+    if (
+        _env_is_set("HTTP_ALLOWED_DOMAINS")
+        or _env_is_set("HTTP_CONNECT_TIMEOUT_SECONDS")
+        or _env_is_set("HTTP_READ_TIMEOUT_SECONDS")
+        or _env_is_set("HTTP_MAX_RETRIES")
+        or _env_is_set("HTTP_BACKOFF_BASE_SECONDS")
+    ):
+        base_http = config.http
+        allowed_raw = _get_env("HTTP_ALLOWED_DOMAINS")
+        allowed_domains = (
+            [d.strip() for d in allowed_raw.split(",") if d.strip()] if allowed_raw is not None else base_http.allowed_domains
+        )
+        connect_timeout_seconds = (
+            _parse_env_float("HTTP_CONNECT_TIMEOUT_SECONDS")
+            if _env_is_set("HTTP_CONNECT_TIMEOUT_SECONDS")
+            else base_http.connect_timeout_seconds
+        )
+        read_timeout_seconds = (
+            _parse_env_float("HTTP_READ_TIMEOUT_SECONDS")
+            if _env_is_set("HTTP_READ_TIMEOUT_SECONDS")
+            else base_http.read_timeout_seconds
+        )
+        max_retries = (
+            _parse_env_int("HTTP_MAX_RETRIES")
+            if _env_is_set("HTTP_MAX_RETRIES")
+            else base_http.max_retries
+        )
+        backoff_base_seconds = (
+            _parse_env_float("HTTP_BACKOFF_BASE_SECONDS")
+            if _env_is_set("HTTP_BACKOFF_BASE_SECONDS")
+            else base_http.backoff_base_seconds
+        )
+        overrides["http"] = HttpConfig(
+            allowed_domains=allowed_domains,
+            connect_timeout_seconds=connect_timeout_seconds,
+            read_timeout_seconds=read_timeout_seconds,
+            max_retries=max_retries,
+            backoff_base_seconds=backoff_base_seconds,
+        )
+        if _env_is_set("HTTP_ALLOWED_DOMAINS"):
+            overridden.append("http.allowed_domains")
+        if _env_is_set("HTTP_CONNECT_TIMEOUT_SECONDS"):
+            overridden.append("http.connect_timeout_seconds")
+        if _env_is_set("HTTP_READ_TIMEOUT_SECONDS"):
+            overridden.append("http.read_timeout_seconds")
+    if _env_is_set("HTTP_MAX_RETRIES"):
+        overridden.append("http.max_retries")
+    if _env_is_set("HTTP_BACKOFF_BASE_SECONDS"):
+        overridden.append("http.backoff_base_seconds")
+
+    if _env_is_set("GUARDRAILS_LINT_PATHS"):
+        guardrails_overrides["lint_paths"] = _get_env_list("GUARDRAILS_LINT_PATHS")
+        overridden.append("guardrails.lint_paths")
+
+    advanced_overrides, advanced_overridden = _get_advanced_env_overrides_with_keys()
+    overridden.extend(advanced_overridden)
 
     rpc_endpoints_override: list[str] | None = None
     if _env_is_set("RPC_ENDPOINTS"):
@@ -617,6 +825,9 @@ def apply_env_overrides(config: "Config") -> tuple["Config", list[str]]:
     if advanced_overrides:
         base_advanced = config.advanced or AdvancedConfig()
         overrides["advanced"] = replace(base_advanced, **advanced_overrides)
+    if guardrails_overrides:
+        base_guardrails = config.guardrails or GuardrailsConfig()
+        overrides["guardrails"] = replace(base_guardrails, **guardrails_overrides)
 
     if rpc_endpoints_override is not None:
         default_group = overrides.get("rpc_default_group") or config.rpc_default_group or "primary"