.env.example

# ThrillhouseBot Environment Variables
# Copy this to .env and fill in your values

# GitHub App
GITHUB_APP_ID=your_app_id
# The PKCS#1 .pem GitHub downloads when you generate an App private key, on ONE line with literal
# \n escapes and no surrounding quotes — quotes are read as part of the key and the bot refuses to
# boot. Throwaway key for local development:
#   openssl genrsa -traditional 2048 | awk '{printf "%s\\n", $0}'
GITHUB_PRIVATE_KEY=-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----
GITHUB_WEBHOOK_SECRET=your_webhook_secret
# Optional: the bot's own GitHub login(s), comma-separated. Override when the App is deployed under a
# different slug (its bot login is <app-slug>[bot]); keeps loop protection, /resolve, summary dedup,
# and follow-up tracking recognizing the bot's own activity.
#GITHUB_BOT_LOGINS=thrillhousebot[bot],thrillhouse-bot[bot]
# Optional: pacing of content-creating GitHub calls (comments, review comments, thread replies,
# reviews), shared process-wide. GitHub secondary-rate-limits rapid content creation and answers
# with a 403; spacing the requests keeps the bot inside that envelope instead of discovering it by
# rejection. Its published guidance is no more than one such request per second; 0 disables pacing.
#GITHUB_WRITE_MIN_INTERVAL=1s
# Optional: ceiling on how long one caller waits for its content-creation slot. Past it the call
# goes out unpaced and the bounded backoff handles a refusal, so a long queue never parks a
# finished command.
#GITHUB_WRITE_MAX_WAIT=60s
# Optional: webhook deduplication window for GitHub redeliveries
#WEBHOOK_DEDUP_TTL=24h
# Optional: comma-separated allowlist of logins permitted to trigger manual /review without repo access
#THRILLHOUSEBOT_REVIEW_MANUAL_TRIGGER_ALLOWED_LOGINS=alice,bob
# Optional: upper bound on the manual /review write-access check (token mint + permission call) on the
# webhook ack thread; fails closed (denies the trigger) if GitHub is slower.
#MANUAL_TRIGGER_AUTH_TIMEOUT=5s
# Optional: upper bound on the 👀 command-ack reaction on the webhook ack thread; the wait is
# abandoned (the reaction may still land late) if GitHub is slower.
#ACK_REACTION_TIMEOUT=3s
# Optional: minimum interval between automatic reviews of the same PR (pushes within the window are
# skipped; a manual /review always bypasses; unset or 0 = review every push — use /pause to silence)
#AUTO_REVIEW_MIN_INTERVAL=1h
# Optional: CI gating for APPROVE — strict (default) holds approval while required CI is pending,
# failing, or unreadable; warn allows APPROVE but notes CI uncertainty in the summary/check; off
# skips CI entirely (findings-only). Softer modes trade safety for flaky-CI / incomplete context setups.
#REVIEW_CI_GATING=strict
# Optional: automatic review trigger filters. Defaults review every PR; a manual /review always runs.
#WEBHOOK_SKIP_DRAFTS=true
#WEBHOOK_REQUIRED_LABELS=ai-review
#WEBHOOK_EXCLUDED_LABELS=no-ai-review,wip
# Glob note: gitignore-style — '*' does not cross '/'; use '**' to span slashes ('**' alone = every branch)
#WEBHOOK_BASE_BRANCHES=main,release/*
#WEBHOOK_IGNORED_BASE_BRANCHES=dependabot/**

# Optional: answer maintainer replies to findings and @thrillhousebot mentions in PR threads (set to false to disable)
#REVIEW_CONVERSATIONAL_REPLIES_ENABLED=true

# Optional: allow the on-demand /add-docs command to suggest docstrings (set to false to disable)
#REVIEW_ADD_DOCS_ENABLED=true

# Optional: allow the on-demand /improve command to suggest whole-PR improvements (set to false to disable)
#REVIEW_IMPROVE_ENABLED=true

# Optional: allow the on-demand /generate-tests command to propose unit tests for the changed code
# (set to false to disable)
#REVIEW_GENERATE_TESTS_ENABLED=true

# Optional: include an opt-in Mermaid control-flow diagram in the PR summary (set to true to enable)
#REVIEW_DIAGRAM_ENABLED=false

# Optional: feed patch coverage (added lines no test executed) into the review context
# (set to true to enable). Only does anything for a repository that names its coverage artifact
# in .github/thrillhousebot.yml under review.coverage-artifact
#REVIEW_PATCH_COVERAGE_ENABLED=false

# Optional: post a short delta comment (new / resolved / still-open counts) on follow-up reviews
# (set to true to enable); a follow-up pass with no delta still posts nothing
#REVIEW_FOLLOW_UP_SUMMARY_ENABLED=false

# Optional: note in the PR summary when a large PR's review opened no inline finding — it may be
# genuinely clean, or the pass may have been shallow (set to true to enable). No extra AI call and
# the verdict is unchanged. Either threshold triggers on its own; 0 switches that dimension off.
#REVIEW_LARGE_PR_NUDGE_ENABLED=false
#REVIEW_LARGE_PR_NUDGE_MIN_FILES=20
#REVIEW_LARGE_PR_NUDGE_MIN_CHANGED_LINES=1000

# Optional: token budgeting for whole-PR review (multi-call map-reduce); defaults shown.
# MAX_INPUT_TOKENS=0 disables budgeting; MAX_AI_CALLS caps batch calls + the final summary call.
# The effective budget is additionally capped by the active model's max-input-tokens entry
# (thrillhousebot.ai.models.*; 128000 default for models without one) — see .env AI section below.
#REVIEW_MAX_INPUT_TOKENS=48000
#REVIEW_OUTPUT_BUFFER_TOKENS=8192
#REVIEW_MAX_AI_CALLS=6
#REVIEW_TOKEN_SAFETY_MARGIN=0.9
# Optional: per-review token spend ceiling — actual input+output tokens across every AI call one
# review makes, retries and the final summary call included (MAX_AI_CALLS only counts planned
# calls). Once reached no further call is made: remaining batches are disclosed as not reviewed
# and the summary degrades to counts-only. 0 (default) = off.
#REVIEW_MAX_TOKENS_PER_REVIEW=0
# Optional: response cap (max_tokens) for the fixed-shape/short AI calls — the final summary of a
# multi-call review, the finding verifier, and maintainer replies — which run on the "concise"
# named model so they never share a cap sized for batch review output. The review itself and the
# command generators (/describe, /changelog, /add-docs, /improve, /generate-tests) stay on the
# default model's max-output-tokens (their responses scale with the diff). Hitting this cap
# surfaces as a truncation error naming the variable; set it empty to use the provider default.
#REVIEW_CONCISE_MAX_OUTPUT_TOKENS=8192
# Optional: line cap on single-call diff renders (replies, base comparison, budgeting-disabled
# review). Token-budgeted reviews and the batched commands — /improve, /describe, /changelog,
# /generate-tests, /add-docs — ignore it (DiffBudgetPlanner owns coverage by tokens); 0 = off
#REVIEW_MAX_DIFF_LINES=5000

# Optional: review tuning knobs (defaults shown). Every thrillhousebot.* key can be set as an env
# var via the standard Quarkus mapping — uppercase, '.'/'-' become '_'.
# Max inline comments posted per review:
#THRILLHOUSEBOT_REVIEW_MAX_REVIEW_COMMENTS=50
# AI call retry policy (attempts, exponential backoff base) and per-attempt client-side wait
# (keep the wait >= AI_TIMEOUT so timed-out attempts don't leave orphaned provider streams):
#THRILLHOUSEBOT_REVIEW_MAX_AI_RETRIES=5
#THRILLHOUSEBOT_REVIEW_AI_RETRY_BASE_DELAY_MS=2000
#THRILLHOUSEBOT_REVIEW_AI_TIMEOUT_SECONDS=300
# Repo-relative path of the per-repo instructions file the bot reads on each review:
#THRILLHOUSEBOT_REVIEW_INSTRUCTIONS_FILE=.github/thrillhousebot.md
# Comma-separated gitignore-style globs excluded from review (lockfiles, generated code, build
# output). '*' does not cross '/'; use '**' to span directories:
#THRILLHOUSEBOT_REVIEW_IGNORED_FILES=**/pom.xml,**/package-lock.json,**/*.lock,**/*.generated.*,**/target/**
# Let each repository add ignore globs of its own under review.ignored-files in
# .github/thrillhousebot.yml, and scope extra review rules to a path glob under
# review.path-instructions. Both are additive — a repo can skip more files, never fewer, and its
# scoped rules apply on top of the global instructions, never instead of them. Set false to make
# the deployment list and the global instructions the only ones that count:
#THRILLHOUSEBOT_REVIEW_REPO_CONFIG_ENABLED=true

# Optional: context-aware PR labels (off by default). Enable, then choose apply vs. suggest-only.
#REVIEW_LABELS_ENABLED=true
#REVIEW_LABELS_APPLY=true
#REVIEW_LABELS_ALLOW_CREATE=false
#REVIEW_LABELS_MAX=3

# AI — any OpenAI-compatible API. Set AI_BASE_URL/AI_MODEL for your provider.
# Defaults below use DeepSeek; e.g. Alibaba Cloud Model Studio would be:
#   AI_BASE_URL=https://dashscope-intl.aliyuncs.com/compatible-mode/v1
#   AI_MODEL=qwen-plus
AI_API_KEY=sk-your-api-key
AI_MODEL=deepseek-chat
AI_BASE_URL=https://api.deepseek.com/v1
AI_TIMEOUT=300s
# Telemetry provider label (gen_ai.provider.name). Derived from AI_BASE_URL when unset;
# set it to override for proxies/self-hosted gateways, e.g. AI_PROVIDER=ollama
# AI_PROVIDER=

# Per-model AI settings (thrillhousebot.ai.models.<model>.*, keyed by the AI_MODEL name like the
# pricing map). Keep entries for several models and switch AI_MODEL freely — only the active
# model's entry is read. max-input-tokens is the model's input hard cap: the review budget is
# min(REVIEW_MAX_INPUT_TOKENS, cap), 128000 default cap without an entry. context-tokens is the
# model's total context window; declare it and boot fails when max-input-tokens + max-output-tokens
# (or the effective budget plus the largest response cap in play) cannot fit inside it on a shared
# window. output-buffer-tokens/token-safety-margin override the REVIEW_* defaults per model; the
# generation parameters temperature, top-p, max-output-tokens, frequency-penalty,
# presence-penalty, and seed are sent on every chat call when set (no top_k on the
# OpenAI-compatible wire). A low temperature (e.g. 0.2) makes reviews more deterministic.
#
# separate-output-budget (default false) says whether the model's response allowance is its own or
# a slice of the input window. Left false, prompt and completion share one window: the budgeter
# reserves output-buffer-tokens out of the input budget, max-output-tokens may not exceed that
# reservation, and the caps are held to context-tokens (boot fails if either is broken). Set it
# true ONLY for a model that really publishes its output allowance on top of the input window;
# check the provider's documented context length first. deepseek-v4-flash used to ship that way
# (1M in, 384000 out) and it was wrong — the provider counts the completion against the same
# 1048576-token context, so it rejected every call for length, five retries deep. Getting the flag
# wrong is loud in one direction and quiet in the other: marking a separate-budget model shared
# refuses to boot when its max-output-tokens exceeds the buffer, while marking a shared-window
# model separate switches off every guard and the requests fail at the provider instead:
#THRILLHOUSEBOT_AI_MODELS_SOME_MODEL_SEPARATE_OUTPUT_BUDGET=true
#THRILLHOUSEBOT_AI_MODELS_DEEPSEEK_V4_FLASH_CONTEXT_TOKENS=1048576
#
# Env form: the underscores depend on whether the key needs quoting in application.properties.
# A hyphen-only key (deepseek-v4-pro) is unquoted there and takes SINGLE underscores; a key with a
# dot (gpt-5.5) is quoted and takes DOUBLE underscores either side. The wrong form resolves to
# nothing and the setting silently never applies, so the bot warns at startup naming the spelling
# that works — check the boot log if a tuning value seems ignored.
#   THRILLHOUSEBOT_AI_MODELS_DEEPSEEK_V4_PRO_MAX_INPUT_TOKENS=1000000
#   THRILLHOUSEBOT_AI_MODELS__GPT_5_5__MAX_INPUT_TOKENS=256000
#   THRILLHOUSEBOT_AI_MODELS_DEEPSEEK_CHAT_TEMPERATURE=0.2
#   THRILLHOUSEBOT_AI_MODELS_DEEPSEEK_CHAT_FREQUENCY_PENALTY=0.1
#   THRILLHOUSEBOT_AI_MODELS_DEEPSEEK_CHAT_SEED=42
# application.properties ships empty stubs for known models so hyphenated keys disambiguate.
# For an unknown model, also add an empty stub:
#   thrillhousebot.ai.models."<model>".max-input-tokens=

# Reasoning control for reasoning-capable models (o-series/gpt-5.x, Gemini 2.5, qwen3, ...).
# Disabled by default: no reasoning parameter is sent and the provider default applies. When
# enabled, the effort (none/low/medium/high/xhigh/max) is sent as the OpenAI-compatible
# reasoning_effort on every AI call; providers map it to their thinking budgets, 'none' explicitly
# asks the model not to reason, and xhigh/max are the extended tiers newer reasoning models expose
# above high — a provider that does not recognize a tier rejects the call rather than downgrading
# it. Reasoning tokens are billed as output tokens, so higher effort means higher cost and latency.
#AI_REASONING_ENABLED=true
#AI_REASONING_EFFORT=low
# Effort for the fixed-shape calls on the "concise" model (final summary, finding verifier,
# replies) — these deliberately do NOT follow AI_REASONING_EFFORT. Reasoning tokens count against
# REVIEW_CONCISE_MAX_OUTPUT_TOKENS, so a high effort here lets the verifier spend its whole
# allowance reasoning and return an empty response, which no larger cap reliably fixes. Unset =
# low, lowered to AI_REASONING_EFFORT when that is set below low. Nothing is sent at all while
# AI_REASONING_ENABLED=false.
#AI_REASONING_EFFORT_CONCISE=low

# Token pricing (USD per 1K tokens) — application.properties ships sensible defaults
# for common OpenAI/DeepSeek/Qwen/Groq models keyed by the AI_MODEL name. Cost stays $0 if
# AI_MODEL has no matching pricing entry. Override deepseek-chat here, or add a block in
# application.properties for any other model:
#   thrillhousebot.ai.pricing.<model>.input-per-1k / .output-per-1k
#DS_INPUT_PRICE=0.00014
#DS_OUTPUT_PRICE=0.00028

# Second AI verification pass on findings (default true). A review that reports
# findings makes TWO model calls — review + verify — roughly doubling token
# spend on flagged PRs (N+N+1 calls on large PRs under token budgeting). Set
# false to skip the AI verifier: cheaper, more false positives; a deterministic
# hedging guard still runs, and verifier errors always fail open.
#REVIEW_VERIFIER_ENABLED=true

# Re-check a maintainer's decline against the reviewed code before recording a
# prior finding "justified" (default true). The finding stays open for one more
# round only when the reviewed diff plainly contradicts the stated reason; style,
# intent and accepted-risk rebuttals are respected, and a second reply on the
# thread always ends the re-check. false = a reply closes the finding outright.
#REVIEW_DECLINE_RECHECK_ENABLED=true

# When findings block the merge (REQUEST_CHANGES). Default balanced matches v0.x:
# only CRITICAL/HIGH risk with HIGH confidence. Use strict for security-heavy
# repos (any CRITICAL/HIGH blocks, even after the verifier demotes confidence).
# Use lenient to block only HIGH-confidence CRITICAL findings.
#REVIEW_BLOCKING_STRICTNESS=balanced

# Dashboard OAuth
GITHUB_CLIENT_ID=your_oauth_client_id
GITHUB_CLIENT_SECRET=your_oauth_client_secret
# Public URL of the dashboard (OAuth callback and session links). Required for remote deploys.
#DASHBOARD_URL=https://your-host

# Database — default h2 in dev; set postgresql for prod/docker (see %prod in application.properties)
#DATASOURCE_DB_KIND=postgresql

# Outbound HTTP and dashboard WebSocket keepalive — optional tuning for slow
# proxies / idle timeouts. WEBSOCKET_KEEPALIVE_MS <= 0 disables the keepalive.
#HTTP_CONNECT_TIMEOUT=10s
#HTTP_REQUEST_TIMEOUT=10s
#WEBSOCKET_KEEPALIVE_MS=25000

# Docker Compose deployment (docker-compose.yml) — optional overrides.
# DB_USER / DB_PASSWORD are the single source of truth: both the bot's datasource
# and the postgres container derive their credentials from them. Defaults are fine
# for a first run, but change DB_PASSWORD before exposing the database, and set
# DATABASE_URL to use managed Postgres.
#DB_USER=thrillhouse
#DB_PASSWORD=change-me
#DATABASE_URL=jdbc:postgresql://db:5432/thrillhouse