.env.example

# Claude Code Plugin Configuration (optional)
# Base directory for Claude Code plugins - used to substitute $UIPATH_PLUGIN_MARKETPLACE_DIR in task YAML
# UIPATH_PLUGIN_MARKETPLACE_DIR=<path-to-claude-code-plugins>

# UiPath settings
UIPATH_FOLDER_PATH="Shared"

# Anthropic API Key (used by the Claude Code agent and by the llm_judge / agent_judge
# criteria under the Direct backend)
ANTHROPIC_API_KEY=your_anthropic_api_key_here

# Logging Configuration (optional)
LOG_LEVEL=INFO  # Options: DEBUG, INFO, WARNING, ERROR, CRITICAL
LOG_TO_FILE=false  # Set to true to enable file logging

# API Backend (direct or bedrock — default: direct)
# API_BACKEND=direct
#
# Under API_BACKEND=direct, the agent uses whatever credential the Claude Agent
# SDK picks up (ANTHROPIC_API_KEY > CLAUDE_CODE_OAUTH_TOKEN > cached `claude login`).
# The llm_judge / agent_judge criteria route through the run's backend:
#   - API_BACKEND=direct  → judge calls the Anthropic SDK (needs ANTHROPIC_API_KEY)
#   - API_BACKEND=bedrock → judge calls AWS Bedrock (needs the AWS_* vars below)
# With no usable credential the run still starts, but any enabled judge criterion
# fails at dispatch with a clear error. The resolved transport is logged at startup
# and recorded in EvaluationResult.environment_info.

# AWS Bedrock settings (used when API_BACKEND=bedrock)
# AWS_BEARER_TOKEN_BEDROCK="<your_bedrock_bearer_token_here>"
# AWS_REGION="us-east-1"
# BEDROCK_MODEL="eu.anthropic.claude-sonnet-4-5-20250929-v1:0"
# BEDROCK_SMALL_MODEL="eu.anthropic.claude-haiku-4-5"

# TypeSafe System One (the system_one_judge criterion, model `jev`). NOT routed
# through API_BACKEND — a System One model answers typed questions with
# probabilities rather than text, so it is its own endpoint and its own key.
# The criterion stores only this variable's NAME (api_key_env), never the token.
# Unlike llm_judge, a missing key escalates the row to ERROR instead of scoring
# it 0.0: an ungraded row must not read as a failed one.
# TYPESAFE_API_KEY="<your_typesafe_api_key_here>"

# Codex agent settings (requires the [codex] extra: `uv sync --extra codex`).
# Only CODEX_API_KEY is read for auth (sent as a Bearer token). CODEX_BASE_URL
# routes to a custom OpenAI-/responses-compatible endpoint; unset = standard
# OpenAI platform. CODEX_MODEL is the fallback model when a task doesn't pin
# agent.model. See docs/CODEX_AGENT_GUIDE.md.
#
# Standard OpenAI platform:
# CODEX_API_KEY="sk-..."
# CODEX_MODEL="gpt-5-codex"
#
# Azure OpenAI (verified known-good shape — model is the DEPLOYMENT name, and
# CODEX_API_VERSION is required by Azure). The base URL is "<resource>/openai":
# CODEX_BASE_URL="https://<your-resource>.openai.azure.com/openai"
# CODEX_API_VERSION="2025-04-01-preview"
# CODEX_MODEL="<your-deployment-name>"   # the Azure deployment name, NOT a base model id (e.g. a gpt-5-codex deployment)
# CODEX_API_KEY="<azure-openai-key>"

# Antigravity agent settings (requires the [antigravity] extra: `uv sync --extra
# antigravity`). GEMINI_API_KEY (an AI Studio / Gemini Developer API key)
# authenticates the bundled local harness — the only headless-capable surface
# (the branded `agy` CLI is interactive-OAuth only). ANTIGRAVITY_MODEL is the
# fallback Gemini model when a task doesn't pin agent.model; default is the
# recommended Gemini 3.1 Pro coding model (gemini-3.1-pro-preview). Thinking effort is set per task via
# agent.thinking_level (minimal/low/medium/high; default medium).
# GEMINI_API_KEY="AIza..."
# ANTIGRAVITY_MODEL="gemini-3.1-pro-preview"

# LiteLLM (Anthropic-compatible) open-weight backend (API_BACKEND=litellm). Point
# the agent at a self-hosted LiteLLM proxy (see litellm/start-litellm.sh, which
# prints these). LITELLM_COST_LOG must be the SAME path the proxy writes its
# per-call JSONL to — that is how the run joins ACTUAL OpenRouter cost + cache back
# onto each turn; if it is unset (or points elsewhere) the run silently falls back
# to static rate-card pricing with 0 cache reads.
# LITELLM_BASE_URL="http://localhost:4000"
# LITELLM_AUTH_TOKEN="sk-..."
# LITELLM_MODEL="zai.glm-5"
# LITELLM_COST_LOG="./tmp/litellm-costs.jsonl"

# UiPath CLI plugin-discovery pin. When unset, the sandbox auto-derives
# the canonical `node_modules/@uipath` from the resolved `uip` binary at setup
# time. Operators on dedicated eval hosts can pin explicitly to override.
# PLUGIN_TOOLS_DIR=/path/to/node_modules/@uipath
#
# DESTRUCTIVE eval-host flag: when truthy (`1`/`true`/`yes`), the sandbox deletes
# `$HOME/node_modules/@uipath` at setup to clear sibling-task pollution. Refuses
# to act if `$HOME` resolves to filesystem root or the target escapes `$HOME`.
# Off by default. Do NOT enable on developer workstations.
# CODER_EVAL_REMEDIATE_HOME_PLUGINS=0

# Delegate agent settings (UiPath Autopilot's Delegate agent, requires Node.js
# on PATH plus `npm install @uipath/delegate-sdk` — a genuinely public package,
# no token needed). See docs/agents/DELEGATE.md.
#
# DELEGATE_SDK_NODE_MODULES / DELEGATE_SDK_PATH — override the auto-located
# install (ancestor-walk from cwd, plus home); set at most one.
# DELEGATE_SDK_NODE_MODULES="/path/to/install/root"
# DELEGATE_SDK_PATH="/path/to/node_modules/@uipath/delegate-sdk/dist/index.mjs"
#
# DELEGATE_ENV — cloud environment slug (alpha/staging/production/localhost),
# used to derive the backend URL from the auth record's org/tenant slugs.
# DELEGATE_ENV="alpha"
#
# DELEGATE_BACKEND_URL — pin the full agent-service URL directly instead
# (wins over DELEGATE_ENV when both are set).
# DELEGATE_BACKEND_URL="https://cloud.uipath.com/<org>/<tenant>/delegate_"
#
# Auth: either the token set below, or a prior `delegate-sdk`/`delegate-cli`
# login that wrote ~/.aria/sdk-auth.json (read by the Node host itself, not
# by coder_eval). Each var also accepts a DELEGATE_-namespaced spelling
# (DELEGATE_AUTH_TOKEN, DELEGATE_TENANT_ID, ...), checked first -- prefer that
# spelling in a shared environment, since the bare names collide with what
# other tooling (npm, Vault, Terraform) commonly exports.
# AUTH_TOKEN="..."
# TENANT_ID="..."
# ORG_ID="..."
# With DELEGATE_ENV (not DELEGATE_BACKEND_URL) also set these two -- the
# human-readable org/tenant names, not the GUIDs above -- or init fails with
# "--env alpha needs org/tenant slugs". See docs/agents/DELEGATE.md.
# ORG_SLUG="..."
# TENANT_SLUG="..."

# Usage Telemetry (anonymous; on by default).
# Disable entirely:
# TELEMETRY_ENABLED=false
# Route to your own Azure App Insights resource instead of the shared default:
# TELEMETRY_CONNECTION_STRING="InstrumentationKey=...;IngestionEndpoint=https://..."
# Origin stamp (the `Source` dimension); set per pipeline to tell runs apart:
# TELEMETRY_SOURCE=coder-eval