.env.example

# jshookmcp runtime overrides
#
# Copy to `.env` only when you need to override built-in defaults.
# If a key is omitted, runtime falls back to the defaults in `src/utils/config.ts`.

# ── Browser / Puppeteer ────────────────────────────────────────────────
PUPPETEER_EXECUTABLE_PATH=
CHROME_PATH=
BROWSER_EXECUTABLE_PATH=
# PUPPETEER_HEADLESS=true
# PUPPETEER_TIMEOUT=30000
# BROWSER_IDLE_TIMEOUT_MS=300000

# ── Runtime paths (customize only if you want non-default locations) ──
MCP_SCREENSHOT_DIR=screenshots
CAPTCHA_SCREENSHOT_DIR=screenshots/captcha
MCP_DEBUGGER_SESSIONS_DIR=debugger-sessions
MCP_EXTENSION_REGISTRY_DIR=artifacts/extension-registry
MCP_TLS_KEYLOG_DIR=artifacts/tmp
MCP_REGISTRY_CACHE_DIR=.jshookmcp/cache

# ── Transport / auth ───────────────────────────────────────────────────
# MCP_TRANSPORT=stdio
# MCP_TOOL_PROFILE=search
# MCP_HOST=127.0.0.1
# MCP_PORT=3000
# MCP_BROWSER_SESSION_QUEUE_MAX_PENDING=256
# MCP_BROWSER_SESSION_QUEUE_MAX_PENDING_PER_SESSION=16
# MCP_BROWSER_SESSION_QUEUE_WAIT_TIMEOUT_MS=180000
# MCP_BROWSER_SESSION_SCHEDULER_QUANTUM_MS=250
# MCP_BROWSER_SESSION_SCHEDULER_AGING_MS=15000
# MCP_BROWSER_SESSION_EXPECTED_CONCURRENCY=10
# MCP_BROWSER_SESSION_RESERVED_PENDING_PER_SESSION=1
# MCP_BROWSER_SESSION_COST_EWMA_ALPHA=0.2
# MCP_BROWSER_FLEET_WORKER_ID=local
# MCP_BROWSER_FLEET_WORKERS_JSON=[{"id":"local"}]
# MCP_BROWSER_FLEET_VIRTUAL_NODES=128
# MCP_BROWSER_FLEET_LEASE_TTL_MS=600000
# MCP_BROWSER_FLEET_MAX_LOCAL_LEASES=4096
MCP_AUTH_TOKEN=
# JSHOOK_INSTANCE_WARN_AT=2
# JSHOOK_MAX_INSTANCES=0

# ── MCP structured logging (opt-in) ───────────────────────────────────
# MCP_LOG_ENABLED=false
# MCP_LOG_LEVEL=info
# MCP_LOG_FILE_DIR=

# ── Extension / workflow discovery ─────────────────────────────────────
EXTENSION_REGISTRY_BASE_URL=https://raw.githubusercontent.com/vmoranv/jshookmcpextension/master/registry
MCP_PLUGIN_ROOTS=
MCP_WORKFLOW_ROOTS=
MCP_PLUGIN_ALLOWED_DIGESTS=

# ── External bridges / services ────────────────────────────────────────
CAPTCHA_PROVIDER=
CAPTCHA_API_KEY=
CAPTCHA_SOLVER_BASE_URL=
BURP_MCP_SSE_URL=
BURP_MCP_AUTH_TOKEN=
ZAP_API_URL=
ZAP_API_KEY=
GHIDRA_BRIDGE_URL=http://127.0.0.1:18080
IDA_BRIDGE_URL=http://127.0.0.1:18081

# ── Optional performance / cache overrides ─────────────────────────────
# ENABLE_CACHE=true
# CACHE_DIR=.cache
# CACHE_TTL=3600
# MAX_CONCURRENT_ANALYSIS=3
# MAX_CODE_SIZE_MB=10

# ── Optional search overrides ──────────────────────────────────────────
# Run `npx tsx scripts/search-tune/optimize.ts` to auto-tune and apply to .env.
# Only override below if you need device-specific values different from defaults.
# SEARCH_QUERY_CATEGORY_PROFILES_JSON=[]
# SEARCH_CJK_QUERY_ALIASES_JSON=[]
# SEARCH_INTENT_TOOL_BOOST_RULES_JSON=[]
#
# Scoring (defaults are auto-tuned — override only for device-specific tuning):
# SEARCH_TRIGRAM_WEIGHT=0.03
# SEARCH_TRIGRAM_THRESHOLD=0.18
# SEARCH_RRF_BM25_BLEND=0.14
# SEARCH_RRF_K=14
# SEARCH_RRF_RESCALE_FACTOR=3300
# SEARCH_PREFIX_MATCH_MULTIPLIER=0.76
# SEARCH_COVERAGE_PRECISION_FACTOR=1.1
# SEARCH_DOMAIN_HUB_THRESHOLD=2
# SEARCH_DOMAIN_HUB_BOOST_MULTIPLIER=1
# SEARCH_BM25_K1=1.9
# SEARCH_BM25_B=0.65
# SEARCH_EXACT_NAME_MATCH_MULTIPLIER=4.6
# SEARCH_AFFINITY_BOOST_FACTOR=0.48
# SEARCH_AFFINITY_BASE_WEIGHT=0.3
# SEARCH_AFFINITY_TOP_N=7
# SEARCH_PARAM_TOKEN_WEIGHT=0.3
# SEARCH_SYNONYM_EXPANSION_LIMIT=1
# SEARCH_SCENE_KEYWORD_WEIGHT=3.8
# SEARCH_RECENCY_MAX_BOOST=0.5
# SEARCH_TIER_PENALTY=0.35
# SEARCH_TIER_PENALTY_SEARCH=0.32
# SEARCH_TIER_PENALTY_WORKFLOW=0.94
# SEARCH_TIER_PENALTY_FULL=0.86
# SEARCH_WORKFLOW_DOMAIN_BOOST_MULTIPLIER=1.4
# SEARCH_VECTOR_BM25_SKIP_THRESHOLD=12
# SEARCH_VECTOR_COSINE_WEIGHT=0.17
# SEARCH_VECTOR_LEARN_UP=0.01
# SEARCH_VECTOR_LEARN_DOWN=0.1
# SEARCH_VECTOR_LEARN_TOP_N=3
# SEARCH_CACHE_VECTOR_WEIGHT_TOLERANCE=0.05
# SEARCH_RECENCY_TRACKER_MAX=200
# SEARCH_VECTOR_PREWARM=false
# SEARCH_VECTOR_ENABLED=false  # default false on stdio, true on HTTP
# SEARCH_VECTOR_MODEL_ID=minishlab/potion-code-16M-v2  # Model2Vec-compatible static model
# SEARCH_VECTOR_WORKER_IDLE_MS=15000
# SEARCH_VECTOR_FETCH_TIMEOUT_MS=15000
# SEARCH_VECTOR_RETRY_COOLDOWN_MS=60000
# SEARCH_VECTOR_CACHE_ENABLED=true
# JSHOOK_EMBEDDING_CACHE_DIR=
# JSHOOK_EMBEDDING_MODEL_CACHE_DIR=
# NETWORK_BODY_CACHE_MAX_ENTRIES=200
# NETWORK_BODY_CACHE_MAX_BODY_BYTES=1048576
# NETWORK_BODY_CACHE_MAX_TOTAL_BYTES=67108864
# RERANK_BROWSER_LAUNCH_BOOST=1.9
# RERANK_BROWSER_ATTACH_BOOST=1.4
# RERANK_MAINTENANCE_PENALTY=0.43
# RERANK_NETWORK_GET_REQUESTS_BOOST=1.25
# RERANK_NETWORK_MONITOR_BOOST=1.7
# RERANK_STATELESS_COMPUTE_BOOST=1.5
# RERANK_STATELESS_CORE_PENALTY=0.15
# RERANK_STATELESS_INTERACTIVE_PENALTY=0.7
# RERANK_STATELESS_SPECIFIC_TOOL_BOOST=2.4
# ── Timeout / performance overrides ──────────────────────────────────────
# Binary instrumentation
# FRIDA_TIMEOUT_MS=15000
# GHIDRA_TIMEOUT_MS=120000
# UNIDBG_TIMEOUT_MS=60000

# Native emulator (in-process ARM64) session pool
# NEMU_SESSION_IDLE_TTL_MS=300000   # idle session auto-expiry (ms), default 5 min
# NEMU_SESSION_SWEEP_MS=60000       # idle sweep interval (ms), default 1 min
# NEMU_MAX_SESSIONS=64              # max concurrent emulator sessions

# ADB bridge
# ADB_DEFAULT_TIMEOUT_MS=30000
# ADB_SHELL_TIMEOUT_MS=60000
# ADB_WEBVIEW_HTTP_TIMEOUT_MS=5000
# ADB_WEBVIEW_WS_TIMEOUT_MS=10000

# Mojo IPC
# MOJO_MONITOR_TIMEOUT_MS=10000

# Process memory
# MEMORY_AVAILABILITY_CACHE_TTL_MS=45000

# HTTP transport
# HTTP_RATE_LIMIT_MAX_IPS=10000
# HTTP_CLEANUP_INTERVAL_MS=300000
# SSE_HEARTBEAT_MS=30000

# WASM handler
# WASM_HANDLER_DEFAULT_TIMEOUT_MS=60000
# WASM_OPTIMIZE_DEFAULT_TIMEOUT_MS=120000

# Sandbox / native bridge / sourcemap / V8
# SANDBOX_MAX_TIMEOUT_MS=30000
# NATIVE_BRIDGE_TIMEOUT_MS=15000
# SOURCEMAP_EXT_TIMEOUT_MS=15000
# V8_BYTECODE_SUBPROC_TIMEOUT_MS=60000

# Webhook / orchestrator / macros
# WEBHOOK_PROCESS_TIMEOUT_MS=10000
# ORCHESTRATOR_STEP_TIMEOUT_MS=10000
# MACRO_DEFAULT_TIMEOUT_MS=120000
# MACRO_BUILTIN_TIMEOUT_MS=60000

# Activation windows
# ACTIVATION_BOOST_WINDOW_MS=60000
# COMPOUND_EVENT_WINDOW_MS=120000
# COMPOUND_LONG_WINDOW_MS=300000

# ── Test runner only (not read by runtime) ─────────────────────────────
# `pnpm test` already computes workers from current idle CPU.
# Uncomment only if you want to force a local ceiling/floor.
# VITEST_MAX_WORKERS=4
# VITEST_MAX_WORKERS_CAP=8
# VITEST_MIN_WORKERS=1
# VITEST_IDLE_RESOURCE_TARGET=0.8
# VITEST_CPU_SAMPLE_MS=750