.env.example

# Copy to .env and fill in the two secrets. .env is gitignored - never commit it.
#
# Node reads this file OFF DISK at startup (--env-file-if-exists), so it must exist
# BEFORE you start the bridge, and a change needs a restart. It is also immune to the
# tmux trap that loses `export`ed variables (see FINDINGS section 22), which is why
# this is the recommended way to supply secrets.
#
# Everything below the secrets is OPTIONAL. Uncomment only what you want to change.


# ===========================================================================
# SECRETS - required. Both are BEARER secrets: whoever holds one can use it.
# ===========================================================================

# Security token shown ONCE when you created the Teams outgoing webhook.
# Teams signs every request with it; the bridge recomputes HMAC-SHA256 over the
# raw body and compares in constant time.
# If this is unset the bridge starts with HMAC OFF and accepts UNAUTHENTICATED
# requests - on a public tunnel with yolo on, that is anyone running code on your box.
# The startup banner prints "HMAC ON" or "HMAC OFF". Read it.
TEAMS_WEBHOOK_SECRET=

# "HTTP POST URL" from the Power Automate flow trigger. The sig= query parameter
# IS the authentication, so treat the whole URL like a password - the fact that it
# looks like a link is exactly why people paste it somewhere public.
# Unset means the bridge runs but every reply silently no-ops.
TEAMS_FLOW_URL=


# ===========================================================================
# SETTINGS - these MIRROR bridge.config.json. Env wins over the file.
# Prefer editing bridge.config.json; use these for one-off runs.
# ===========================================================================

# Repo the agent works in. Default: the bridge's own directory, which is
# usually NOT what you want - point it at a scratch clone.
#REPO_DIR=~/workspace/bridge-scratch

# Pinned deliberately. The runtime default drifts as new models ship, and it
# resolved to effort "medium" - the agent quietly thinking less hard than it could.
#COPILOT_MODEL=claude-opus-5
#COPILOT_EFFORT=xhigh

# yolo auto-approves every tool call. "0" turns it off, which denies tools
# entirely - there is no human-in-the-loop approval path over Teams.
#YOLO=1

# Comma-separated AAD object ids allowed to drive the agent. Empty = ANYONE in
# the channel. HMAC proves a message came from Teams, not WHO sent it, so this
# is the only thing limiting who can run code. Fail-closed and case-insensitive.
#TEAMS_ALLOWED_AAD_IDS=00000000-0000-0000-0000-000000000000

# Appended to the system prompt so replies suit a phone, not a terminal.
# Missing file = the banner warns and replies revert to wall-of-diff.
#TEAMS_VOICE_FILE=prompts/teams-voice.md

# Where to look for the settings file itself.
#BRIDGE_CONFIG=./bridge.config.json


# ===========================================================================
# RUNTIME
# ===========================================================================

# Must match the port the dev tunnel forwards.
#PORT=3978

# Append-only JSONL of who asked what. Written next to the bridge by default.
#AUDIT_LOG=./audit.jsonl


# ===========================================================================
# TIMING - the defaults are tuned for someone reading on a phone.
# ===========================================================================

# Budget for the agent's OWN work. Time spent waiting for a human to answer a
# question is credited back, so a slow reply never kills a healthy turn. (30 min)
#TURN_TIMEOUT_MS=1800000

# How long a parked question waits for you. A parked question holds the turn
# open, and turns are serialized, so without this one ignored question would
# freeze the bridge forever. (1 hour)
#ANSWER_TIMEOUT_MS=3600000

# Minimum gap between progress posts, so a chatty turn cannot flood the thread
# or hit Teams rate limits. (15s)
#MILESTONE_MIN_GAP_MS=15000

# How long the agent may work in silence before the bridge falls back to naming
# the tool it is running, just to prove it is still alive. (45s)
#HEARTBEAT_MS=45000

# Teams chokes on very long messages, and nobody reads them at a traffic light.
# Longer replies are cut with a [...truncated] marker.
#MAX_POST_CHARS=3500


# ===========================================================================
# LOCAL TEST HARNESS ONLY - not read by the bridge itself.
# Used by npm run msg / harness / mockflow.
# ===========================================================================

#BRIDGE_URL=http://localhost:3978/api/messages
#FAKE_THREAD=9999999999999
#FAKE_NAME=Local Tester
#FAKE_AAD_ID=00000000-0000-0000-0000-000000000000
#MOCK_FLOW_PORT=3999
#DELAYED_REPLY_MS=300000
#QUESTION_DELAY_MS=5000