- Public client env:
NEXT_PUBLIC_*only, validated incommon/src/env-schema.ts(used via@codebuff/common/env). - LLM provider keys: validated in
packages/internal/src/env-schema.ts(used via@codebuff/internal/env). The hosted-backend DB/auth/email server secrets have been removed from this repo. - Runtime/OS env: pass typed snapshots instead of reading
process.envthroughout the codebase. IPINFO_TOKENis only relevant to legacy/upstream hosted flows. Openbuff local/BYOK CLI usage does not require it.CODEBUFF_FULL_TELEMETRY=trueorCODEBUFF_FULL_TELEMETRY_IDS=user-id,email@example.comdisables client analytics sampling for targeted debugging. Use sparingly because it can send full CLI log payloads.
- Base contracts:
common/src/types/contracts/env.ts(BaseEnv,BaseCiEnv,ClientEnv,CiEnv) - Helpers:
common/src/env-process.ts,common/src/env-ci.ts - Test helpers:
common/src/testing-env-process.ts,common/src/testing-env-ci.ts - CLI:
cli/src/utils/env.ts(getCliEnv) - CLI test helpers:
cli/src/testing/env.ts(createTestCliEnv) - SDK:
sdk/src/env.ts(getSdkEnv) - SDK test helpers:
sdk/src/testing/env.ts(createTestSdkEnv)
Bun loads (highest precedence last):
.env.local(Infisical-synced secrets, gitignored).env.development.local(worktree overrides like ports, gitignored)
Document only environment variables that are implemented in code. During the fork transition, several CODEBUFF_* names remain supported only as legacy compatibility aliases or existing internal names:
OPENBUFF_LOCAL_MODEcontrols local/BYOK mode.CODEBUFF_LOCAL_MODEis NOT supported (removed in the BYOK purge).OPENBUFF_PROVIDER_CONFIGpoints to provider configuration JSON.CODEBUFF_PROVIDER_CONFIGis NOT supported (removed in the BYOK purge).OPENBUFF_TELEMETRY=0(alsofalseoroff) disables runtime analytics.DO_NOT_TRACK=1is honored as a standard compatibility opt-out. The interactive local CLI currently emits no analytics, but these controls also cover shared runtime code used by integrations.CODEBUFF_API_KEYis a legacy upstream compatibility name for Codebuff API authentication and any live tests that still exercise that compatibility path. Openbuff local/BYOK provider mode does not require a Codebuff API key.OPENBUFF_GIT_BASH_PATHis the primary Windows bash path override used by the SDK terminal command helper.CODEBUFF_GIT_BASH_PATHremains a compatibility fallback.CODEBUFF_CHATGPT_OAUTH_TOKENis the legacy ChatGPT OAuth token name.OPENBUFF_CHATGPT_OAUTH_TOKENis implemented as an alias; the SDK resolvesCODEBUFF_CHATGPT_OAUTH_TOKEN ?? OPENBUFF_CHATGPT_OAUTH_TOKEN(sdk/src/env.ts), so the legacy name takes precedence over the alias (reversed from the API-key ordering).NEXT_PUBLIC_CODEBUFF_APP_URLremains the required public app URL field.NEXT_PUBLIC_OPENBUFF_APP_URLis implemented as an optional public client env field incommon/src/env-schema.ts, but current accessors still require and read the Codebuff-named URL for the primary app URL.
CODEBUFF_API_KEY functions as a runtime fallback (OPENBUFF_API_KEY ?? CODEBUFF_API_KEY in sdk/src/env.ts, Openbuff primary). CODEBUFF_CHATGPT_OAUTH_TOKEN also has an OPENBUFF_* alias but with reversed precedence (legacy name primary). OPENBUFF_GIT_BASH_PATH takes precedence over the legacy CODEBUFF_GIT_BASH_PATH fallback.
Context-budget and proactive-retrieval behaviors remain code-default (no new
env vars). Progressive prompt disclosure has no env var at all:
progressivePromptDisclosure is a createBase2 option (not a JSON config
key), defaults to true when omitted, and an explicit true/false on the
option is the only way to change it. The tool surface likewise has no env var:
narrow it with the createBase2 unlockedTiers option. Only the
gate repair budgets have optional env canaries:
OPENBUFF_MAX_REVIEWER_REPAIR_ROUNDS— optional positive integer string that caps the reviewer→repair→re-review loop (max20). Unset or invalid → unlimited (progress-gated). ExplicitcreateBase2({ maxReviewerRepairRounds })always wins over the env. NON_BLOCKING findings still burn the round counter under LOOKS_GOOD-only finalization.OPENBUFF_MAX_REPAIR_ROUNDS— optional positive integer string that caps validation-hook repair-editor rounds (max20). Unset or invalid → unlimited (progress-gated). ExplicitcreateBase2({ maxRepairRounds })always wins over the env.OPENBUFF_MAX_SPECIALIST_REPAIR_ROUNDS— optional positive integer string that caps the specialist→repair→re-review loop (max20). Unset or invalid → unlimited (progress-gated). ExplicitcreateBase2({ maxSpecialistRepairRounds })always wins over the env.
Do not document an OPENBUFF_* alias unless the code implements it.
Release scripts read OPENBUFF_GITHUB_TOKEN (primary) or CODEBUFF_GITHUB_TOKEN (compatibility fallback).