marvisx-cli 0.1.0__py3-none-any.whl

core/api/config.py

@@ -0,0 +1,533 @@
+# v1.18.0 - 2026-05-16 - KG PR-Impact PRE phase: function cap + branch stale + replay buffer + pr_impact_enabled
+from __future__ import annotations
+
+import os
+from pathlib import Path
+from typing import Literal
+
+from pydantic import AliasChoices, Field, SecretStr
+from pydantic_settings import BaseSettings, SettingsConfigDict
+
+
+class Settings(BaseSettings):
+    model_config = SettingsConfigDict(
+        env_file=".env",
+        env_file_encoding="utf-8",
+        extra="ignore",  # ignora env vars non dichiarate
+        populate_by_name=True,
+    )
+
+    pir_env: str = "development"
+    # Free-form tenant identifier. Default "core" (OSS). Deploy bundles set
+    # DEPLOY_MODE to their own tenant slug via .env; no tenant names are
+    # hard-coded in core.
+    deploy_mode: str = Field(default="core", alias="DEPLOY_MODE")
+    pir_instance: str = Field(default="prod", alias="PIR_INSTANCE")
+    marvisx_phase: Literal["A", "B", "C", "D"] = Field(
+        default="A", alias="MARVISX_PHASE"
+    )
+    pir_canary_banner: bool = Field(default=False, alias="PIR_CANARY_BANNER")
+    pir_voyage_disabled: bool = Field(default=False, alias="PIR_VOYAGE_DISABLED")
+    pir_jwt_secret: str = "dev-secret-change-in-production"
+    pir_admin_password_hash: str = ""
+    db_path: str = Field(
+        default="console.db",
+        validation_alias=AliasChoices("PIR_DB_PATH", "DB_PATH"),
+    )
+    cookie_domain: str | None = Field(default=None, alias="COOKIE_DOMAIN")
+    cors_origins_prod: list[str] = Field(
+        default_factory=list,
+        alias="CORS_ORIGINS_PROD",
+    )
+    cors_origins_dev: list[str] = ["http://localhost:3000", "http://localhost:3001"]
+    console_base_url: str | None = Field(default=None, alias="CONSOLE_BASE_URL")
+    jwt_expiry_hours: int = 24
+    ws_ticket_ttl_seconds: int = 30
+    tasks_api_token: str = ""
+    sqlite_busy_timeout_ms: int = 30000  # 30s — backfill/reindex can hold lock >15s
+    db_pool_size: int = 8  # bounded connection pool size
+    auto_hibernate_enabled: bool = True
+    tasks_rate_limit_per_min: int = 60
+    kg_deep_rate_limit_per_min: int = (
+        30  # max deep KG bundle requests per user per minute
+    )
+    inbox_sources_json: str = "{}"
+    inbox_max_title_chars: int = 500
+    inbox_max_content_chars: int = 20000
+    inbox_max_metadata_bytes: int = 20000
+    inbox_digest_scheduler_interval_seconds: int = 3600
+    brain_scheduler_interval_seconds: int = 3600
+    brain_run_off_peak_only: bool = Field(
+        default=False, alias="BRAIN_RUN_OFF_PEAK_ONLY"
+    )
+
+    # GitHub Webhook
+    github_webhook_secret: str = ""
+
+    # KG PR-Impact View (planned 2026-05-16, sub-01/02/03 sequential implementation)
+    # Source-of-truth single owner per setting: vedi docs/plans/2026-05-16-feat-kg-pr-impact-view-plan.md §9.10
+    # Magic numbers cross-sub extracted per Emilio decision (D-MAGIC-NUMBERS-SETTINGS)
+    pr_impact_enabled: Literal["off", "shadow", "on"] = Field(
+        default="shadow", alias="PR_IMPACT_ENABLED"
+    )
+    function_cap_default: int = Field(
+        default=800, alias="FUNCTION_CAP_DEFAULT"
+    )  # PR-impact response: top-N functions per priority ranking (sub-02 §2.1)
+    function_cap_max_deep_link: int = Field(
+        default=50, alias="FUNCTION_CAP_MAX_DEEP_LINK"
+    )  # sub-04 deep-link ?op= max highlighted nodes
+    kg_branch_stale_days: int = Field(
+        default=30, alias="KG_BRANCH_STALE_DAYS"
+    )  # branch is_stale threshold (sub-02 §2.2)
+    pr_events_replay_maxlen: int = Field(
+        default=20, alias="PR_EVENTS_REPLAY_MAXLEN"
+    )  # in-memory WS ring buffer per project_slug (sub-02 §3.2)
+    telegram_bot_token: str | None = Field(default=None, alias="TELEGRAM_BOT_TOKEN")
+    telegram_owner_chat_id: str | None = Field(
+        default=None, alias="TELEGRAM_OWNER_CHAT_ID"
+    )
+
+    # Plan 3 tenant scaffolding. Defaults stay off for marvis-personal/core.
+    multi_tenant_enabled: bool = Field(default=False, alias="MULTI_TENANT_ENABLED")
+    per_user_api_key_enabled: bool = Field(
+        default=False, alias="PER_USER_API_KEY_ENABLED"
+    )
+    byok_fernet_secret: str | None = Field(
+        default=None, alias="BYOK_FERNET_SECRET"
+    )
+    fernet_salt_version: str = Field(default="v1", alias="FERNET_SALT_VERSION")
+    uid_isolation_enabled: bool = Field(default=False, alias="UID_ISOLATION_ENABLED")
+    uid_pool_size: int = Field(default=0, alias="UID_POOL_SIZE")
+    uid_pool_prefix: str = Field(default="tenant", alias="UID_POOL_PREFIX")
+    uid_pool_base: int = Field(default=10100, alias="UID_POOL_BASE")
+    # Git run-as user for deployments where the API service account differs from
+    # the user that owns the git repositories. When set and != the current
+    # process user, git runs via `sudo -u <user>` and chown targets `<user>:<user>`.
+    # Empty default (single-user / self-hosted): git runs directly and chown is
+    # skipped — the API process already owns the repos. See services/runas.py.
+    git_runas_user: str = Field(default="", alias="GIT_RUNAS_USER")
+    force_password_change_on_first_login: bool = Field(
+        default=False, alias="FORCE_PASSWORD_CHANGE_ON_FIRST_LOGIN"
+    )
+    # Extra env-var names a tenant exposes into its user tmux panes, on top of
+    # the generic core defaults. JSON array form, e.g.
+    #   TENANT_ENV_WHITELIST=["DATABASE_URL","DEPLOY_MODE","TENANT_SLUG"]
+    # The tenant overlay (deploy/<tenant>/, tenants/<tenant>/config.env) ships
+    # this. No tenant-specific whitelist is hardcoded in core.
+    tenant_env_whitelist: list[str] = Field(
+        default_factory=list, alias="TENANT_ENV_WHITELIST"
+    )
+
+    # Agents whose `hybrid` self-improvement proposals always require human
+    # review (auto-approval veto). JSON array form, e.g.
+    #   SELF_IMPROVEMENT_AGENTS=["agent-a","agent-b"]
+    # Default empty: OSS core ships no internal agent names hardcoded. The deploy
+    # bundle (.env) sets the names so the safety veto stays armed on our prod /
+    # tenant installs. Empty list = no veto (auto-approval proceeds per the other
+    # rules), which is safe for a fresh OSS install that has no self-improvement
+    # agent. See services/auto_approval.py::ApprovalPolicy.evaluate.
+    self_improvement_agents: list[str] = Field(
+        default_factory=list, alias="SELF_IMPROVEMENT_AGENTS"
+    )
+
+    # Static agent identities accepted for X-Agent-Name attribution on top of the
+    # DB `users` table (the authoritative source via get_valid_agent_names) and
+    # the generic system identities. JSON array form, e.g.
+    #   STATIC_AGENT_IDENTITIES=["agent-a","agent-b"]
+    # Default empty: OSS core hardcodes no tenant agent names. Agents still
+    # authenticate via their DB row; this list only covers the legacy shared
+    # TASKS_API_TOKEN attribution path + the scope-enforcement gate in rbac.py,
+    # which do not query the DB. The deploy bundle (.env) sets the names.
+    # See security.py::_VALID_AGENT_NAMES and rbac.py::require_scope.
+    static_agent_identities: list[str] = Field(
+        default_factory=list, alias="STATIC_AGENT_IDENTITIES"
+    )
+
+    # Monitoring
+    monitoring_metrics_interval: int = (
+        60  # was 10 — caused DB lock every ~30min via metrics_collector.save_to_db
+    )
+    monitoring_docker_interval: int = (
+        60  # Docker stats interval (separate from system metrics)
+    )
+    monitoring_security_interval: int = 60
+    monitoring_retention_raw_hours: int = 24
+    monitoring_retention_candles_days: int = 30
+    monitoring_retention_events_days: int = 30
+    monitoring_rate_limit_per_min: int = 30
+
+    # Finder
+    finder_root: str = "/data"
+    workspace_root: str | None = Field(
+        default=None, alias="WORKSPACE_ROOT"
+    )
+    repo_share_root: str | None = Field(
+        default=None, alias="REPO_SHARE_ROOT"
+    )
+    runtime_home: str | None = Field(default=None, alias="RUNTIME_HOME")
+    agents_base: str | None = Field(
+        default=None, alias="AGENTS_BASE"
+    )
+    constitution_path: str | None = Field(
+        default=None,
+        alias="CONSTITUTION_PATH",
+    )
+    finder_max_upload_bytes: int = 50_000_000  # 50MB
+    finder_max_edit_bytes: int = 1_000_000  # 1MB
+    finder_max_view_bytes: int = 10_000_000  # 10MB
+    finder_hidden_patterns: list[str] = [
+        ".ssh",
+        ".gnupg",
+        ".env",
+        "*.key",
+        "*.pem",
+        "node_modules",
+        ".npm",
+        "__pycache__",
+        ".cache",
+        "proc",
+        "sys",
+        "dev",
+        "run",
+    ]
+    finder_symlink_whitelist: list[str] = Field(
+        default_factory=list,
+        alias="FINDER_SYMLINK_WHITELIST",
+    )
+
+    # n8n Integration
+    n8n_webhook_url: str = ""
+    n8n_api_url: str = ""
+    n8n_api_key: str = ""
+    n8n_webhook_secret: str = ""
+    n8n_dispatch_interval: int = 30
+    n8n_max_retry_count: int = 5
+
+    # Web Push (VAPID)
+    vapid_private_key: str = ""
+    vapid_public_key: str = ""
+
+    # SSO / WorkOS AuthKit
+    workos_api_key: str = ""
+    workos_client_id: str = ""
+    workos_cookie_password: str = ""  # 32+ chars for state cookie encryption
+    sso_enabled: bool = False  # feature flag for gradual rollout
+    expose_openapi: bool = (
+        True  # expose /docs and /openapi.json (auth-protected in prod)
+    )
+    openai_api_key: str = ""
+    anthropic_api_key: str = ""  # used by inbox_tldr and other Anthropic SDK callers
+
+    # MAC-Phase 0.5: LiteLLM gateway endpoint. Example forms:
+    #   http://<tailnet-host>:4000/v1
+    #   https://llm.<your-domain>/v1
+    # The deploy bundle (e.g. deploy/marvis-personal/.env) provides the actual value.
+    llm_gateway_base_url: str = Field(default="", alias="LLM_GATEWAY_BASE_URL")
+    llm_gateway_enforce_public_base_url: bool = Field(
+        default=False, alias="LLM_GATEWAY_ENFORCE_PUBLIC_BASE_URL"
+    )
+    llm_gateway_api_key: SecretStr | None = Field(
+        default=None, alias="LLM_GATEWAY_API_KEY"
+    )
+    ingest_llm_gateway_api_key: SecretStr | None = Field(
+        default=None, alias="INGEST_LLM_GATEWAY_API_KEY"
+    )
+    ingest_llm_gateway_agent_name: str = Field(
+        default="marvisx-ingester", alias="INGEST_LLM_GATEWAY_AGENT_NAME"
+    )
+    newsletter_llm_gateway_api_key: SecretStr | None = Field(
+        default=None, alias="NEWSLETTER_LLM_GATEWAY_API_KEY"
+    )
+    newsletter_llm_gateway_agent_name: str = Field(
+        default="newsletter-digest", alias="NEWSLETTER_LLM_GATEWAY_AGENT_NAME"
+    )
+    # Inbox TLDR migration flags. Both default false → behaviour unchanged
+    # (Sonnet only). Setting shadow_mode=true logs cloud + local in parallel
+    # without affecting the user response. Setting use_local=true serves the
+    # local response and falls back to cloud only on gateway failure.
+    inbox_tldr_use_local: bool = Field(default=False, alias="INBOX_TLDR_USE_LOCAL")
+    inbox_tldr_shadow_mode: bool = Field(default=False, alias="INBOX_TLDR_SHADOW_MODE")
+    inbox_tldr_local_model: Literal["tier-think", "tier-fast"] = Field(
+        default="tier-think", alias="INBOX_TLDR_LOCAL_MODEL"
+    )
+    inbox_deep_research_local_model: Literal[
+        "tier-think", "tier-fast", "tier-write"
+    ] = Field(
+        default="tier-fast", alias="INBOX_DEEP_RESEARCH_LOCAL_MODEL"
+    )
+    inbox_deep_research_llm_gateway_api_key: SecretStr | None = Field(
+        default=None, alias="INBOX_DEEP_RESEARCH_LLM_GATEWAY_API_KEY"
+    )
+    inbox_deep_research_repair_model: Literal[
+        "tier-think", "tier-fast", "tier-write"
+    ] = Field(
+        default="tier-fast", alias="INBOX_DEEP_RESEARCH_REPAIR_MODEL"
+    )
+    inbox_deep_research_local_max_tokens: int = Field(
+        default=2000, alias="INBOX_DEEP_RESEARCH_LOCAL_MAX_TOKENS"
+    )
+    inbox_deep_research_local_timeout_seconds: float = Field(
+        default=300.0, alias="INBOX_DEEP_RESEARCH_LOCAL_TIMEOUT_SECONDS"
+    )
+    ingest_parser_max_concurrency: int = Field(
+        default=1, alias="INGEST_PARSER_MAX_CONCURRENCY"
+    )
+    ingest_local_parser_max_concurrency: int = Field(
+        default=1, alias="INGEST_LOCAL_PARSER_MAX_CONCURRENCY"
+    )
+    ingest_ocr_max_concurrency: int = Field(
+        default=3, alias="INGEST_OCR_MAX_CONCURRENCY"
+    )
+    ingest_docparse_max_concurrency: int = Field(
+        default=1, alias="INGEST_DOCPARSE_MAX_CONCURRENCY"
+    )
+    ingest_transcribe_max_concurrency: int = Field(
+        default=1, alias="INGEST_TRANSCRIBE_MAX_CONCURRENCY"
+    )
+    ingest_vision_max_concurrency: int = Field(
+        default=1, alias="INGEST_VISION_MAX_CONCURRENCY"
+    )
+    # Optional AUX proxy URL for non-chat gateway endpoints (/v1/ocr,
+    # /v1/audio/transcriptions). If unset, consumers derive it from
+    # LLM_GATEWAY_BASE_URL when the private Mac tailnet URL uses :4000.
+    llm_gateway_aux_base_url: str = Field(default="", alias="LLM_GATEWAY_AUX_BASE_URL")
+    ingest_transcribe_timeout_seconds: float = Field(
+        default=900.0, alias="INGEST_TRANSCRIBE_TIMEOUT_SECONDS"
+    )
+    ingest_transcribe_ffmpeg_timeout_seconds: float = Field(
+        default=900.0, alias="INGEST_TRANSCRIBE_FFMPEG_TIMEOUT_SECONDS"
+    )
+    ingest_transcribe_max_bytes: int = Field(
+        default=500 * 1024 * 1024, alias="INGEST_TRANSCRIBE_MAX_BYTES"
+    )
+    ingest_transcribe_language: str = Field(
+        default="", alias="INGEST_TRANSCRIBE_LANGUAGE"
+    )
+    ingest_ocr_timeout_seconds: float = Field(
+        default=300.0, alias="INGEST_OCR_TIMEOUT_SECONDS"
+    )
+    ingest_ocr_max_bytes: int = Field(
+        default=500 * 1024 * 1024, alias="INGEST_OCR_MAX_BYTES"
+    )
+    ingest_docparse_enabled: bool = Field(
+        default=False, alias="INGEST_DOCPARSE_ENABLED"
+    )
+    ingest_docparse_pdfs_enabled: bool = Field(
+        default=True, alias="INGEST_DOCPARSE_PDFS_ENABLED"
+    )
+    ingest_docparse_images_enabled: bool = Field(
+        default=True, alias="INGEST_DOCPARSE_IMAGES_ENABLED"
+    )
+    ingest_docparse_mode: Literal["fast", "standard", "precise"] = Field(
+        default="standard", alias="INGEST_DOCPARSE_MODE"
+    )
+    ingest_docparse_mode_override: Literal["", "fast", "standard", "precise"] = Field(
+        default="", alias="INGEST_DOCPARSE_MODE_OVERRIDE"
+    )
+    ingest_docparse_timeout_seconds: float = Field(
+        default=900.0, alias="INGEST_DOCPARSE_TIMEOUT_SECONDS"
+    )
+    ingest_docparse_max_bytes: int = Field(
+        default=500 * 1024 * 1024, alias="INGEST_DOCPARSE_MAX_BYTES"
+    )
+    ingest_vision_images_enabled: bool = Field(
+        default=False, alias="INGEST_VISION_IMAGES_ENABLED"
+    )
+    ingest_vision_timeout_seconds: float = Field(
+        default=120.0, alias="INGEST_VISION_TIMEOUT_SECONDS"
+    )
+    ingest_vision_max_bytes: int = Field(
+        default=20 * 1024 * 1024, alias="INGEST_VISION_MAX_BYTES"
+    )
+    ingest_vision_max_tokens: int = Field(
+        default=900, alias="INGEST_VISION_MAX_TOKENS"
+    )
+    ingest_docx_max_bytes: int = Field(
+        default=25 * 1024 * 1024, alias="INGEST_DOCX_MAX_BYTES"
+    )
+    ingest_llm_classifier_model: Literal["tier-fast"] = Field(
+        default="tier-fast", alias="INGEST_LLM_CLASSIFIER_MODEL"
+    )
+    ingest_llm_provider: Literal["local", "gateway", "mac", "tier-fast"] = Field(
+        default="local", alias="INGEST_LLM_PROVIDER"
+    )
+    ingest_llm_classifier_timeout_seconds: float = Field(
+        default=30.0, alias="INGEST_LLM_CLASSIFIER_TIMEOUT_SECONDS"
+    )
+    ingest_llm_classifier_max_concurrency: int = Field(
+        default=4, alias="INGEST_LLM_CLASSIFIER_MAX_CONCURRENCY"
+    )
+    ingest_llm_classifier_max_attempts: int = Field(
+        default=3, alias="INGEST_LLM_CLASSIFIER_MAX_ATTEMPTS"
+    )
+    ingest_llm_classifier_retry_after_cap_seconds: float = Field(
+        default=30.0, alias="INGEST_LLM_CLASSIFIER_RETRY_AFTER_CAP_SECONDS"
+    )
+    ingest_llm_gateway_priority: Literal[
+        "interactive", "batch", "background"
+    ] = Field(default="batch", alias="INGEST_LLM_GATEWAY_PRIORITY")
+    ingest_llm_gateway_initial_poll_delay_seconds: int = Field(
+        default=1, alias="INGEST_LLM_GATEWAY_INITIAL_POLL_DELAY_SECONDS"
+    )
+
+    # Phase 7.0: KG lens default for HTTP surface (MCP default is separate: MARVIS_MCP_DEEP_DEFAULT)
+    kg_http_deep_default: bool = (
+        False  # pydantic-settings maps KG_HTTP_DEEP_DEFAULT env var
+    )
+
+    # WIP limit: max tasks in_progress per project (doc/none tasks count as 0.5)
+    wip_max_in_progress: int = 3
+
+    # Voyage AI embeddings
+    voyage_api_key: str = ""
+
+    # sqlite-vec
+    vec0_path: str = "/data/pir/lib/vec0"
+
+    # LifeOS
+    lifeos_data_dir: str = ""
+    lifeos_git_repo_dir: str = ""
+    lifeos_git_sync_interval: int = 30
+
+    # Brain v1.2 Wave 3.1 — LLM polish layer (master switch + sub-switches).
+    # Tier-write Gemma 3 12B QAT via Mac Gateway tenant `marvisx-brain`.
+    # Master defaults True so narrative_polished is populated out-of-the-box;
+    # sub-switches stay True (journal/finding_summary/finding_reasoning).
+    # Disable master via BRAIN_LLM_POLISH_ENABLED=false to fall back to deterministic.
+    brain_llm_polish_enabled: bool = Field(
+        default=True, alias="BRAIN_LLM_POLISH_ENABLED"
+    )
+    brain_llm_journal_polish_enabled: bool = Field(
+        default=True, alias="BRAIN_LLM_JOURNAL_POLISH_ENABLED"
+    )
+    brain_llm_finding_summary_enabled: bool = Field(
+        default=True, alias="BRAIN_LLM_FINDING_SUMMARY_ENABLED"
+    )
+    brain_llm_finding_reasoning_enabled: bool = Field(
+        default=True, alias="BRAIN_LLM_FINDING_REASONING_ENABLED"
+    )
+    brain_llm_gateway_base_url: str = Field(
+        default="",
+        alias="BRAIN_LLM_GATEWAY_BASE_URL",
+    )
+    brain_llm_gateway_api_key: SecretStr | None = Field(
+        default=None, alias="BRAIN_LLM_GATEWAY_API_KEY"
+    )
+    brain_llm_tenant: str = Field(
+        default="marvisx-brain", alias="BRAIN_LLM_TENANT"
+    )
+    brain_llm_model: str = Field(
+        default="tier-write", alias="BRAIN_LLM_MODEL"
+    )
+    brain_llm_polish_timeout_seconds: int = Field(
+        default=30, alias="BRAIN_LLM_POLISH_TIMEOUT_SECONDS"
+    )
+    brain_llm_polish_cache_ttl_seconds: int = Field(
+        default=3600, alias="BRAIN_LLM_POLISH_CACHE_TTL_SECONDS"
+    )
+    # Wave 3.1 polish UX (Emilio 2026-05-19): default DISABLED. Quando True,
+    # il polish path forza il LLM a citare ≥1 evidence_ref dal whitelist e
+    # rifiuta narrative "not grounded" — ha bloccato ~50% delle entries
+    # (~72% scope=company) senza prevenire hallucination reale (il body_json
+    # passato al LLM è già ground truth deterministico). Lasciato come escape
+    # hatch operatore via .env BRAIN_LLM_GROUNDING_STRICT=true.
+    brain_llm_grounding_strict: bool = Field(
+        default=False, alias="BRAIN_LLM_GROUNDING_STRICT"
+    )
+    brain_llm_retry_max_attempts: int = Field(
+        default=3, alias="BRAIN_LLM_RETRY_MAX_ATTEMPTS"
+    )
+    brain_llm_retry_backoff_seconds: float = Field(
+        default=1.0, alias="BRAIN_LLM_RETRY_BACKOFF_SECONDS"
+    )
+    brain_llm_semaphore_size: int = Field(
+        default=8, alias="BRAIN_LLM_SEMAPHORE_SIZE"
+    )
+
+    @property
+    def cors_origins(self) -> list[str]:
+        if self.pir_env == "production":
+            return self.cors_origins_prod
+        return self.cors_origins_dev
+
+    @property
+    def is_production(self) -> bool:
+        return self.pir_env == "production"
+
+    @property
+    def is_marvis_personal(self) -> bool:
+        return self.deploy_mode == "marvis-personal"
+
+    @property
+    def phase_index(self) -> int:
+        return ["A", "B", "C", "D"].index(self.marvisx_phase)
+
+    @property
+    def effective_console_base_url(self) -> str:
+        return self.console_base_url or "http://localhost:3000"
+
+    @property
+    def effective_workspace_root(self) -> str:
+        return self.workspace_root or os.getcwd()
+
+    @property
+    def effective_repo_share_root(self) -> str:
+        return self.repo_share_root or self.effective_workspace_root
+
+    @property
+    def effective_runtime_home(self) -> str:
+        return self.runtime_home or os.path.expanduser("~")
+
+    @property
+    def effective_agents_base(self) -> str:
+        return self.agents_base or f"{self.effective_runtime_home}/marvisx/data/agents"
+
+    @property
+    def effective_constitution_path(self) -> str:
+        return (
+            self.constitution_path
+            or f"{self.effective_workspace_root}/.claude/rules/constitution.md"
+        )
+
+    @property
+    def effective_git_runas_user(self) -> str:
+        """Run-as user for git/chown, or '' to act as the current process.
+
+        Returns '' when GIT_RUNAS_USER is unset or already matches the current
+        OS user (no privilege hop needed)."""
+        import pwd
+
+        user = (self.git_runas_user or "").strip()
+        if not user:
+            return ""
+        try:
+            if pwd.getpwuid(os.getuid()).pw_name == user:
+                return ""
+        except (KeyError, OSError):
+            pass
+        return user
+
+
+settings = Settings()
+
+
+def _resolve_repo_parents() -> list[Path]:
+    """Read ALLOWED_REPO_PARENTS from env (comma-separated absolute paths).
+
+    Falls back to a derivation from settings.effective_workspace_root +
+    /data/projects/ when ALLOWED_REPO_PARENTS is unset, so generic deploys
+    work out of the box. Personal/enterprise deploys override via .env.
+    """
+    raw = os.environ.get("ALLOWED_REPO_PARENTS", "").strip()
+    if raw:
+        return [Path(p.strip()).resolve() for p in raw.split(",") if p.strip()]
+    workspace = Path(settings.effective_workspace_root).resolve()
+    return [
+        (workspace / "projects").resolve(),
+        workspace,
+        Path("/data/projects/").resolve(),
+    ]
+
+
+# Centralized allowlist for repo_path validation (Decision S14, was duplicated in git_ops + projects)
+ALLOWED_REPO_PARENTS: list[Path] = _resolve_repo_parents()