Files
openhuman/.env.example
T
Steven EnamakelandGitHub e405e2cc99 Prune obsolete config API keys (#739)
* feat(memory_recipes): introduce memory recipes module for source-type-specific ingestion

- Added a new `memory_recipes` module that includes functionality for handling various source types, such as email and chat, with dedicated recipes for ingestion.
- Implemented core types and the `Recipe` trait to facilitate the ingestion process, allowing for structured handling of raw content and metadata.
- Created specific recipes for email and chat, enhancing the ability to process and normalize content before storing it in memory.
- Updated the core controller registration to include new endpoints for memory recipes, enabling JSON-RPC interactions for ingesting content and listing available recipes.
- Enhanced task management by integrating task storage and query helpers, allowing for better tracking and management of action items extracted during ingestion.

These changes significantly improve the ingestion capabilities of the application, providing a robust framework for handling diverse content types.

* refactor: remove API key references from configuration and schema

- Eliminated the `api_key` field from various configuration schemas and related structures, including `Config`, `ModelSettingsPatch`, and `ComposioConfig`, to streamline the configuration process.
- Updated the handling of API keys in the application to rely solely on session JWTs, enhancing security and simplifying the authentication flow.
- Adjusted related documentation and comments to reflect the removal of the API key, ensuring clarity in the new authentication approach.
- Refactored multiple components and functions to remove dependencies on the API key, improving code maintainability and reducing complexity.

These changes significantly enhance the security posture of the application by removing reliance on static API keys and promoting the use of session-based authentication.

* chore: update .env.example and documentation for API key removal

- Removed references to `OPENHUMAN_API_KEY` from the `.env.example` file to reflect recent changes in the authentication approach.
- Updated documentation in `AGENTS.md` and `CLAUDE.md` to clarify that `OPENHUMAN_API_URL` now overrides `config.api_url`, ensuring consistency across configuration references.
- Bumped the version in `Cargo.lock` to 0.52.23 to align with the latest changes.

These updates enhance clarity in configuration management and documentation following the removal of static API keys.

* fix: address config pruning review comments

* feat(tests): add validation tests for SearchResponse deserialization

- Introduced new tests to ensure that the SearchResponse struct correctly rejects JSON inputs missing required fields: searchId, results, and costUsd.
- Updated DelegateTool instantiation to remove the unused fallback_credential parameter, simplifying the constructor and related tests.

These changes enhance the robustness of the SearchResponse handling and improve code clarity by removing unnecessary parameters.

* refactor: remove api_key params from provider factory signatures

The OpenHuman backend now only uses the app-session JWT for auth —
the api_key parameter was ignored (as _api_key) after the config
pruning. Drop it from the signatures entirely instead of leaving
dead None arguments at every call site.

Also removes the unused ChannelContext.api_key field.

* refactor: remove api_key/composio_key params from factory signatures

Every caller was passing None after the config pruning:

- create_embedding_provider / create_memory* — the api_key param
  was only threaded to the openai / custom embedding branches, but
  no caller has ever supplied a non-None value since the pruning.
  Embeddings use an empty key; the param is gone.

- all_tools / all_tools_with_runtime — both composio_key and
  composio_entity_id only fed the ComposioTool registration block,
  which was already dead after the JWT migration. Drop both args
  and the block; the modern path is all_composio_agent_tools via
  build_composio_client(config).

* style: apply cargo fmt
2026-04-21 22:49:11 -07:00

172 lines
7.7 KiB
Bash

# Root environment variables — Rust core, Tauri shell, and shared settings.
# Copy to .env and fill in values as needed.
# Loaded via: source scripts/load-dotenv.sh
#
# Tags: [required] must be set, [optional] has a sensible default or can be blank
# ---------------------------------------------------------------------------
# App environment
# ---------------------------------------------------------------------------
# [optional] set to either 'production' or 'staging'
OPENHUMAN_APP_ENV=staging
# ---------------------------------------------------------------------------
# Backend API
# ---------------------------------------------------------------------------
# [optional] App environment selector for default paths/URLs: production | staging
OPENHUMAN_APP_ENV=staging
# [required] Primary backend URL (read by Rust core and QuickJS skills sandbox)
BACKEND_URL=https://staging-api.tinyhumans.ai
# [required] Also read by Vite frontend (VITE_ prefix required for browser exposure)
VITE_OPENHUMAN_APP_ENV=staging
VITE_BACKEND_URL=https://staging-api.tinyhumans.ai
# ---------------------------------------------------------------------------
# Authentication (for skills OAuth proxy and debug scripts)
# ---------------------------------------------------------------------------
# [optional] Session JWT — used by QuickJS skills sandbox for oauth.fetch proxy calls.
# Also used by debug scripts (scripts/debug-skill.sh, scripts/debug-notion-live.sh).
# Get from login flow or browser devtools.
JWT_TOKEN=
# ---------------------------------------------------------------------------
# Core process
# ---------------------------------------------------------------------------
# [optional] Default: 127.0.0.1 (use 0.0.0.0 for Docker / cloud).
# Leave unset to keep the default; the Docker image sets 0.0.0.0 automatically.
# OPENHUMAN_CORE_HOST=
# [optional] Default: 7788
OPENHUMAN_CORE_PORT=7788
# [optional] Default: http://127.0.0.1:7788/rpc
OPENHUMAN_CORE_RPC_URL=http://127.0.0.1:7788/rpc
# [optional] Run mode: child (default, spawns sidecar) | inprocess
OPENHUMAN_CORE_RUN_MODE=child
# [optional] Override path to openhuman core binary (leave blank for auto-detection)
OPENHUMAN_CORE_BIN=
# [optional] Explicit .env path for `openhuman serve` / `openhuman run` (loaded before the server starts).
# Must be set in the parent environment (exported in your shell or service manager). It is read before
# any dotenv file is loaded, so defining OPENHUMAN_DOTENV_PATH inside a .env file cannot select that file.
# OPENHUMAN_DOTENV_PATH=
# ---------------------------------------------------------------------------
# Config overrides (override config.toml values at runtime)
# ---------------------------------------------------------------------------
# [optional] Default model to use
OPENHUMAN_MODEL=
# [optional] Workspace directory (default: ~/.openhuman or ~/.openhuman-staging when OPENHUMAN_APP_ENV=staging)
OPENHUMAN_WORKSPACE=
# [optional] Default: 0.7
OPENHUMAN_TEMPERATURE=0.7
# [optional] Skill + agent tool execution timeout in seconds (default 120, max 3600)
# OPENHUMAN_TOOL_TIMEOUT_SECS=
# ---------------------------------------------------------------------------
# Runtime flags
# ---------------------------------------------------------------------------
# [optional] Default: 0
OPENHUMAN_BROWSER_ALLOW_ALL=0
# [optional] Default: 0
OPENHUMAN_LOG_PROMPTS=0
# [optional] Enable reasoning mode
OPENHUMAN_REASONING_ENABLED=
# ---------------------------------------------------------------------------
# Web search
# ---------------------------------------------------------------------------
# Web search is always enabled — no opt-in flag. Configure result budgets below.
# [optional] Default: 5
OPENHUMAN_WEB_SEARCH_MAX_RESULTS=5
# [optional] Default: 10
OPENHUMAN_WEB_SEARCH_TIMEOUT_SECS=10
# ---------------------------------------------------------------------------
# Proxy
# ---------------------------------------------------------------------------
# [optional] Default: false
OPENHUMAN_PROXY_ENABLED=false
# [optional] HTTP proxy URL
OPENHUMAN_HTTP_PROXY=
# [optional] HTTPS proxy URL
OPENHUMAN_HTTPS_PROXY=
# [optional] Catch-all proxy URL
OPENHUMAN_ALL_PROXY=
# [optional] Comma-separated hosts to bypass proxy
OPENHUMAN_NO_PROXY=
# [optional] Proxy scope
OPENHUMAN_PROXY_SCOPE=
# [optional] Comma-separated services to proxy
OPENHUMAN_PROXY_SERVICES=
# ---------------------------------------------------------------------------
# Local AI model tier
# ---------------------------------------------------------------------------
# [optional] Override selected model tier: low, medium, high
# Applies the corresponding preset at config load time (overrides config.toml).
OPENHUMAN_LOCAL_AI_TIER=
# ---------------------------------------------------------------------------
# Local AI binary overrides
# ---------------------------------------------------------------------------
# [optional] Override path to whisper binary
WHISPER_BIN=
# [optional] Override path to piper binary
PIPER_BIN=
# [optional] Override path to ollama binary
OLLAMA_BIN=
# ---------------------------------------------------------------------------
# Telegram managed login
# ---------------------------------------------------------------------------
# [optional] Bot username for managed Telegram DM linking (default: openhuman_bot)
OPENHUMAN_TELEGRAM_BOT_USERNAME=openhuman_bot
# ---------------------------------------------------------------------------
# Skills
# ---------------------------------------------------------------------------
# [optional] Override skills registry URL.
# Supports remote HTTP URLs and local file paths for development:
# SKILLS_REGISTRY_URL=https://example.com/registry.json (remote)
# SKILLS_REGISTRY_URL=/path/to/openhuman-skills/skills/registry.json (local)
# When set to a local path, the registry is read directly from disk on every
# call (no caching), so changes are picked up immediately.
SKILLS_REGISTRY_URL=
# [optional] Local skills source directory for development.
# Points to the built skills directory (the folder containing per-skill subdirs
# with manifest.json + index.js). When set, this takes highest priority for
# skill discovery and install will copy from this directory instead of downloading.
# Example: SKILLS_LOCAL_DIR=/Users/you/work/openhuman-skills/skills
SKILLS_LOCAL_DIR=
# [optional] Enable sync-derived user working memory extraction (default: true).
# Set to false to disable persisting `working.user.*` docs from skill sync payloads.
OPENHUMAN_SKILLS_WORKING_MEMORY_ENABLED=true
# ---------------------------------------------------------------------------
# Error Reporting (Sentry)
# ---------------------------------------------------------------------------
# [optional] Sentry DSN for Rust core error reporting (no PII is sent)
OPENHUMAN_SENTRY_DSN=
# [optional] Short git SHA baked into the Sentry release tag
# (`openhuman@<version>+<sha>`) via `option_env!("OPENHUMAN_BUILD_SHA")`.
# CI sets this automatically; leave blank locally (release tag falls back
# to `openhuman@<version>`).
OPENHUMAN_BUILD_SHA=
# [optional] Default: true — set to false to disable anonymized analytics & crash reports
OPENHUMAN_ANALYTICS_ENABLED=true
# ---------------------------------------------------------------------------
# Logging
# ---------------------------------------------------------------------------
# [optional] Default: info
RUST_LOG=info
# [optional] Default: 0 (set to 1 for full backtraces)
RUST_BACKTRACE=1
# ---------------------------------------------------------------------------
# Testing (do not set in production)
# ---------------------------------------------------------------------------
# [optional] Enable mock service mode
# OPENHUMAN_SERVICE_MOCK=0
# [optional] Path to mock state file
# OPENHUMAN_SERVICE_MOCK_STATE_FILE=