.env.example

# mock = full end-to-end local demo without touching DevPanel
# real = call DevPanel REST API
DP_MODE=mock

# Transport:
#   stdio = local MCP client spawns this process (default). Loopback login callback.
#   http  = public HTTP server (Railway etc.). MCP OAuth protects /mcp;
#           /login signs in to DevPanel; /review/:planId is the approval UI.
DP_TRANSPORT=stdio

# Auth mode:
#   off   = single shared DP_ACCESS_TOKEN forwarded for every caller (legacy
#           behavior). Good for solo local dev; wrong for a shared deployment
#           — everyone would act as the same DevPanel identity.
#   token = bring-your-own-token. No secret lives on this server: each MCP
#           client sends its own DevPanel access token as its /mcp bearer,
#           and it's forwarded 1:1 to DevPanel for that session only. Use
#           this for a public/shared deployment before SSO is wired up.
#           DevPanel itself rejects invalid tokens — this server does no
#           separate validation. http transport only.
#   sso   = server-side Cognito login. The MCP server logs into Cognito via
#           hosted-UI (auth code + PKCE) and stores the token server-side
#           only — the MCP client never sees it. In http mode the login
#           happens at {DP_PUBLIC_BASE_URL}/login instead of the stdio
#           loopback.
DP_AUTH_MODE=off

DP_API_BASE_URL=https://YOUR-DEVPANEL-API
# --- Static token mode (DP_AUTH_MODE=off only; ignored in token/sso modes) ---
# Two different tokens, two different purposes:
# 1. DP_ACCESS_TOKEN = your DevPanel personal access token (or Cognito
#    access_token). This server forwards it to the DevPanel REST API when
#    calling DP_MODE=real tools (list workspaces/applications, etc.).
# 2. DP_MCP_BEARER_TOKEN = the bearer token your MCP client (opencode, Claude
#    Desktop, MCP Inspector) must send to authenticate with THIS server's /mcp
#    endpoint. It is never sent to DevPanel.
# If DP_MCP_BEARER_TOKEN is left empty, /mcp accepts DP_ACCESS_TOKEN instead.
# Your MCP client must send it as "Authorization: Bearer <token>" — the
# "Bearer " prefix is required, some client configs omit it by mistake.
# The server reads .env once at startup: restart after changing either value.
DP_ACCESS_TOKEN=
DP_MCP_BEARER_TOKEN=
DP_DEFAULT_WORKSPACE_ID=

# --- HTTP transport (only when DP_TRANSPORT=http) ---
# Public origin of this server, e.g. https://dpmcp.up.railway.app (no trailing slash).
# Required in http mode — Railway usually sets PORT automatically.
DP_PUBLIC_BASE_URL=
# Host header allowlist (anti DNS-rebinding). Default: derived from
# DP_PUBLIC_BASE_URL plus localhost/127.0.0.1.
DP_ALLOWED_HOSTS=

# --- Cognito SSO (only when DP_AUTH_MODE=sso) ---
# Dedicated Cognito app client for the MCP server (hosted-UI enabled).
# DevPanel uses the shared client 6vs705tbkogckspnlo5iq3o00s.
COGNITO_CLIENT_ID=
# Leave empty for a public client (no secret). If set, the token endpoint
# uses HTTP Basic auth (confidential client).
COGNITO_CLIENT_SECRET=
# Cognito hosted-UI custom domain of the DevPanel user pool:
# https://login.site.devpanel.com — all hosted-UI/token URLs derive from it.
# (Or your own pool's custom domain, e.g. https://<prefix>.auth.<region>.amazoncognito.com)
COGNITO_DOMAIN=
# Scopes requested at the hosted UI. Every scope listed must be enabled on the
# Cognito app client, or the hosted UI rejects the whole request with
# invalid_scope -- so this default is the set verified against the DevPanel
# shared client, not the widest set Cognito can offer.
#   openid -> Cognito issues an id_token (carries the `email` claim). Without
#             it, identity falls back to the access_token, which has no email.
#
# NOTE: offline_access is NOT enabled on the DevPanel Cognito app client, so
# Cognito issues no refresh_token and the server-side session CANNOT be
# renewed: it ends when the access token expires (~1h) and the human must sign
# in again. That is expected here, not a bug -- /mcp answers 401 with a
# WWW-Authenticate challenge once the session is gone, which is what makes the
# MCP client re-run the OAuth flow rather than failing every tool call. Add
# offline_access back only against a pool whose app client permits it.
#
# The built-in default in src/config.ts is wider (it also requests
# aws.cognito.signin.user.admin and offline_access), so leave this line set --
# an empty/absent value falls back to that wider set and will be rejected.
COGNITO_SCOPES=phone email openid profile
# Default: {DP_PUBLIC_BASE_URL}/callback in http mode,
#          http://localhost:{DP_LOGIN_CALLBACK_PORT}/callback in stdio mode.
# Register whichever applies as a Cognito callback URL.
COGNITO_REDIRECT_URI=

# Loopback callback listener for the Cognito login redirect (stdio mode only;
# http mode uses {DP_PUBLIC_BASE_URL}/callback instead).
DP_LOGIN_CALLBACK_PORT=8788
# Re-print the login URL every this many ms while a login attempt is pending.
DP_LOGIN_TIMEOUT_MS=180000

# Debug (http mode): log every /mcp request's bearer tokens to the server
# console, IN FULL -- the inbound MCP bearer, the DevPanel token forwarded
# upstream (only for requests that pass auth), and a per-request session line.
# Set to 1 or true to enable; empty/unset = off.
# WARNING: these are live credentials in plaintext. Anyone with the terminal
# scrollback or a captured log file can replay them. Local debugging only --
# leave this unset on any deployed or shared server.
DP_DEBUG_AUTH=

# Real CREATE is intentionally gated until a UI request/response is captured.
# Set this only after config/create-profiles/drupal11-demo.json is verified.
DP_ENABLE_REAL_CREATE=false
DP_CREATE_PROFILE=drupal11-demo

# Approval: the plan is rendered as text in the agent conversation and the human
# answers APPROVE or REJECT there. No client dialog, no review web page, no
# approval URL -- so there is nothing to configure here. The human's answer is
# relayed back by the model together with the plan hash, and the executor still
# refuses anything whose hash does not match the approved plan.

# Plan controls
PLAN_TTL_SECONDS=900