SAM uses environment variables for platform configuration. User-specific settings (cloud provider tokens, agent API keys) are stored encrypted in the database, not as environment variables.
These are Cloudflare Worker secrets, set during deployment. Pulumi auto-generates security keys on first deploy.
Secret Description ENCRYPTION_KEYAES-256-GCM key for credential encryption (auto-generated) JWT_PRIVATE_KEYRSA-2048 private key for signing tokens (auto-generated) JWT_PUBLIC_KEYRSA-2048 public key for token verification (exposed via JWKS) DEPLOY_SIGNING_PRIVATE_KEYEd25519 private key for signing deployment apply payloads (auto-generated) DEPLOY_SIGNING_PUBLIC_KEYEd25519 public key derived during deployment for deployment node verification (auto-generated) CF_API_TOKENCloudflare API token for infrastructure, DNS, Origin CA certificate issuance, observability, AI Gateway, Containers, and admin logs. Requires Account → Containers → Edit and Account → SSL and Certificates → Edit . CF_AIG_TOKENOptional narrower Cloudflare AI Gateway Unified Billing token CF_ZONE_IDCloudflare zone ID for DNS record management CF_ACCOUNT_IDCloudflare account ID DEVCONTAINER_CACHE_CLOUDFLARE_API_TOKENOptional narrower Cloudflare token for managed devcontainer registry credentials DEVCONTAINER_CACHE_CLOUDFLARE_ACCOUNT_IDOptional Cloudflare account override for managed devcontainer registry credentials GITHUB_CLIENT_IDOptional fallback GitHub App client ID for OAuth; runtime admin config takes precedence GITHUB_CLIENT_SECRETOptional fallback GitHub App client secret for OAuth; runtime admin config takes precedence GITHUB_APP_IDOptional fallback GitHub App ID for installation tokens; runtime admin config takes precedence GITHUB_APP_PRIVATE_KEYOptional fallback GitHub App private key (PEM or base64); runtime admin config takes precedence GITHUB_APP_SLUGOptional fallback GitHub App URL slug; runtime admin config takes precedence GITHUB_WEBHOOK_SECRETOptional fallback GitHub App webhook HMAC secret; runtime admin config takes precedence TRIAL_CLAIM_TOKEN_SECRETTrial onboarding HMAC secret (auto-generated)
Set as [vars] in wrangler.toml or as environment variables:
Variable Default Description BASE_DOMAIN— Root domain for the deployment (e.g., example.com) VERSION— Deployment version string SETUP_TOKEN— Plaintext first-run setup token generated during deploy and readable in the Cloudflare dashboard while setup is incomplete SETUP_FORCE(unset) Set to true to reopen /setup for lockout recovery SETUP_RATE_LIMIT_MAX_ATTEMPTS10Max setup-token attempts per identifier/window SETUP_RATE_LIMIT_WINDOW_SECONDS900Setup-token attempt window in seconds
Set in GitHub Settings → Environments → production:
Variable Description Example BASE_DOMAINDeployment domain example.comRESOURCE_PREFIXDomain-derived Cloudflare resource name prefix sa379a6PULUMI_STATE_BUCKETR2 bucket for Pulumi state sa379a6-pulumi-stateCF_CONTAINER_ENABLEDOptional instant-session runtime toggle. Generated deploys default to true; set false to force VM runtime. false
RESOURCE_PREFIX is generated from BASE_DOMAIN as s plus the first six hex
characters of the domain’s SHA-256 hash. The self-host onboarding flow fills it
in for you.
Required GitHub Actions secrets include CF_API_TOKEN, CF_ACCOUNT_ID, CF_ZONE_ID, R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY, and PULUMI_CONFIG_PASSPHRASE. GitHub App/OAuth secrets (GH_CLIENT_ID, GH_CLIENT_SECRET, GH_APP_ID, GH_APP_PRIVATE_KEY, GH_APP_SLUG, GH_WEBHOOK_SECRET) and the Google login OAuth secrets (GOOGLE_LOGIN_CLIENT_ID, GOOGLE_LOGIN_CLIENT_SECRET) are optional environment fallbacks; fresh deployments can set them through /setup instead. The Google infra/GCP OAuth secrets (GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET) are a separate client used only for GCP deployment authorization and are not part of the /setup wizard. Deploy signing keys are generated and persisted by Pulumi during deployment; GitHub Environment values are only needed for explicit key overrides.
GitHub App secrets use GH_* prefix (e.g., GH_CLIENT_ID, GH_WEBHOOK_SECRET) because GitHub Actions secret names cannot start with GITHUB_*. When present, the deploy workflow maps those GH_* secrets to GITHUB_* Worker secrets. Runtime admin config in D1 is resolved first, then these environment fallbacks, then unset.
Variable Default Description CF_CONTAINER_ENABLEDtrueEnables Cloudflare Container instant sessions for matching profiles and zero-config runtime selection. Set false to force cloud VM runtime. REQUIRE_APPROVAL(unset) Default signup approval gate. Superadmins can override it at runtime in Admin → Users without redeploying; when no runtime override exists, this value is used. The first genuine human becomes superadmin regardless of this flag — see First Login & Admin Access . TRIAL_ANONYMOUS_USER_IDsystem_anonymous_trialsId of the internal anonymous-trial sentinel user, excluded from first-user superadmin checks. Override only if your deployment uses a different sentinel id. CAPACITY_SIZE_FALLBACK_ENABLEDtrueWhen a new node’s VM size is exhausted on transient capacity, descend the size chain (large→medium→small). Only applies to default-derived sizes (project/platform default), never user-requested sizes. Set false to disable. ORIGIN_CA_CERT_VALIDITY_DAYS7Validity for per-node Cloudflare Origin CA certificates issued from node-generated CSRs. Must be one of Cloudflare’s supported values: 7, 30, 90, 365, 730, 1095, or 5475.
Variable Default Description TASK_TITLE_MODEL@cf/zai-org/glm-4.7-flashWorkers AI model for title generation TASK_TITLE_MAX_LENGTH100Max characters in generated title TASK_TITLE_TIMEOUT_MS5000Timeout before falling back to truncation TASK_TITLE_GENERATION_ENABLEDtrueSet false to disable AI generation TASK_TITLE_SHORT_MESSAGE_THRESHOLD100Messages at or below this length bypass AI TASK_TITLE_MAX_RETRIES2Max retry attempts on failure TASK_TITLE_RETRY_DELAY_MS1000Base delay between retries (exponential backoff) TASK_TITLE_RETRY_MAX_DELAY_MS4000Max delay cap for backoff
SAM loads OpenCode Zen and OpenCode Go model choices through the authenticated model-catalog API, backed by Models.dev and cached in KV. If the upstream catalog or cache is unavailable, SAM falls back to the static catalog shipped with the app.
Variable Default Description MODEL_CATALOG_SOURCE_URLhttps://models.dev/api.jsonSource URL for the dynamic model catalog MODEL_CATALOG_CACHE_TTL_SECONDS3600KV cache TTL for normalized dynamic model catalog payloads MODEL_CATALOG_FETCH_TIMEOUT_MS5000Timeout for the upstream catalog fetch before static fallback
Variable Default Description NODE_WARM_TIMEOUT_MS1800000 (30 min)Time a node stays warm after idea execution completes MAX_AUTO_NODE_LIFETIME_MS14400000 (4 hr)Absolute max lifetime for auto-provisioned nodes NODE_WARM_GRACE_PERIOD_MS2100000 (35 min)Cron sweep grace period (must be > warm timeout) NODE_LIFECYCLE_ALARM_RETRY_MS60000 (1 min)Retry delay for DO alarm failures DEFAULT_TASK_AGENT_TYPEopencodeDefault agent for autonomous idea execution
Variable Default Description PROJECT_INVITE_TOKEN_BYTES32Random bytes used for generated project invite link tokens PROJECT_INVITE_DEFAULT_EXPIRY_DAYS7Default lifetime for invite links created without an explicit expiry PROJECT_INVITE_MAX_EXPIRY_DAYS30Maximum allowed invite link lifetime, including explicit expiry-date input PROJECT_OFFBOARDING_PLAN_TTL_SECONDS900Lifetime for project member offboarding preview plans before recomputation
Variable Default Description NOTIFICATION_PROGRESS_BATCH_WINDOW_MS300000 (5 min)Min interval between progress notifications per idea NOTIFICATION_DEDUP_WINDOW_MS60000 (60s)Dedup window for task_complete notifications NOTIFICATION_AUTO_DELETE_AGE_MS7776000000 (90 days)Auto-delete old notifications MAX_NOTIFICATIONS_PER_USER500Max stored notifications per user NOTIFICATION_PAGE_SIZE50Default page size for notification list MAX_NOTIFICATION_PAGE_SIZE100Max allowed page size
Variable Default Description ACP_SESSION_DETECTION_WINDOW_MS300000 (5 min)Heartbeat timeout before marking session interrupted ACP_SESSION_HEARTBEAT_INTERVAL_MS60000 (60s)How often VM agent sends heartbeats ACP_SESSION_RECONCILIATION_TIMEOUT_MS30000 (30s)VM agent startup reconciliation timeout ACP_SESSION_MAX_FORK_DEPTH10Maximum session fork chain depth ACP_SESSION_FORK_CONTEXT_MESSAGES20Context messages included when forking
Variable Default Description ACP_MESSAGE_BUFFER_SIZE5000Buffer size for ACP messages ACP_STDERR_BUFFER_BYTES4096Agent stderr bytes retained for crash reports ACP_PING_INTERVAL30sWebSocket keepalive ping interval ACP_PONG_TIMEOUT10sPong response timeout ACP_TASK_PROMPT_TIMEOUT6hTask execution prompt timeout ACP_PROMPT_RETRY_MAX_RETRIES2Max transient provider prompt retries after the initial attempt ACP_PROMPT_RETRY_INITIAL_BACKOFF15sInitial backoff before retrying transient provider prompt errors ACP_PROMPT_RETRY_MAX_BACKOFF2mMax exponential backoff for transient provider prompt retries ACTIVITY_REREPORT_INTERVAL60sRe-send prompting activity while a prompt is active ACTIVITY_TERMINAL_REPORT_ATTEMPTS5Retry attempts for terminal activity reports ACTIVITY_TERMINAL_REPORT_BACKOFF1sBackoff between terminal activity report retries ACP_IDLE_SUSPEND_TIMEOUT30mIdle session auto-suspend timeout ACP_NOTIF_SERIALIZE_TIMEOUT5sNotification serialization timeout
Variable Default Description MCP_TOKEN_TTL_SECONDS28800 (8 hours)Sliding inactivity timeout for agent MCP access MCP_RATE_LIMIT120Max MCP requests per window MCP_RATE_LIMIT_WINDOW_SECONDS60Rate limit window MCP_DISPATCH_MAX_DEPTH3Max recursion depth for dispatch_task MCP_DISPATCH_MAX_PER_TASK5Max dispatched tasks per parent task MCP_DISPATCH_MAX_ACTIVE_PER_PROJECT10Max active dispatched tasks per project
Variable Default Description WHISPER_MODEL_ID@cf/openai/whisper-large-v3-turboTranscription model MAX_AUDIO_SIZE_BYTES10485760 (10 MB)Max upload audio size MAX_AUDIO_DURATION_SECONDS60Max recording duration RATE_LIMIT_TRANSCRIBE30Max transcriptions per minute TTS_ENABLEDtrueEnable/disable text-to-speech TTS_MODEL@cf/deepgram/aura-2-enTTS model TTS_SPEAKERlunaTTS voice selection TTS_ENCODINGmp3Audio output format TTS_MAX_TEXT_LENGTH100000Max characters per TTS synthesis TTS_TIMEOUT_MS60000TTS synthesis timeout
Variable Default Description CONTEXT_SUMMARY_MODEL@cf/google/gemma-4-26b-a4b-itModel for conversation context summarization CONTEXT_SUMMARY_MAX_LENGTH4000Max summary length in characters CONTEXT_SUMMARY_TIMEOUT_MS10000Summarization timeout CONTEXT_SUMMARY_MAX_MESSAGES50Max messages to include in summary CONTEXT_SUMMARY_SHORT_THRESHOLD5Skip AI for conversations this short
Variable Default Description TASK_RUN_MAX_EXECUTION_MS14400000 (4 hr)Max task execution time TASK_STUCK_QUEUED_TIMEOUT_MS600000 (10 min)Timeout for tasks stuck in queued state TASK_STUCK_DELEGATED_TIMEOUT_MS1860000 (31 min)Timeout for tasks stuck in delegated state CLAUDE_CODE_COMPACTION_LOOP_DETECTOR_ENABLEDtrueEnable Claude Code compaction-loop shutdown from recent message evidence CLAUDE_CODE_COMPACTION_LOOP_RECENT_MESSAGE_LIMIT40Recent task-session messages to inspect for compaction-loop evidence CLAUDE_CODE_COMPACTION_LOOP_WINDOW_MESSAGES20Rolling recent-message window used for compaction-loop detection CLAUDE_CODE_COMPACTION_LOOP_MIN_PAIRS3Minimum Compacting... / Compacting completed marker pairs before failing a task TASK_CALLBACK_TIMEOUT_MS10000Callback response timeout TASK_CALLBACK_RETRY_MAX_ATTEMPTS3Max callback retry attempts TASK_RUN_CLEANUP_DELAY_MS5000Delay before task cleanup TASK_RECONCILIATION_IDLE_MS300000 (5 min)Idle threshold before SAM sends a visible task check-in TASK_RECONCILIATION_RESPONSE_DEADLINE_MS60000 (1 min)Response deadline after a visible task check-in TASK_RECONCILIATION_PROMPT_SOFT_STALL_MS1800000 (30 min)In-flight prompt observation threshold before a non-interrupting reconciliation event TASK_RECONCILIATION_PROMPT_HARD_STALL_MS7200000 (2 hr)In-flight prompt hard-stall threshold before SAM requests prompt cancellation TASK_RECONCILIATION_MIN_ALARM_DELAY_MS10000 (10 sec)Minimum delay before the next reconciliation alarm can fire
Variable Default Description NODE_AGENT_READY_TIMEOUT_MS600000 (10 min)Wait for VM agent to report ready NODE_AGENT_READY_POLL_INTERVAL_MS5000Poll interval for agent readiness TASK_RUNNER_WORKSPACE_READY_TIMEOUT_MS1800000 (30 min)Max wait for workspace-ready callback PROVISIONING_TIMEOUT_MS1800000 (30 min)Cron marks stuck workspaces as error
Variable Default Description DEPLOY_PAYLOAD_EXPIRY_SECONDS3600Signed deployment apply payload lifetime DEPLOYMENT_ROUTE_PORT_BASE35000First node-local loopback port reserved for app routes DEPLOYMENT_ROUTE_PORT_SPAN100Number of loopback ports reserved per deployment environment AGENT_DEPLOYMENT_RESERVED_ENVIRONMENT_NAMESprod,productionComma-separated environment names agents cannot create through MCP MAX_ENVIRONMENTS_PER_DEPLOYMENT_NODE5Maximum deployment environments to place on one deployment node DEPLOYMENT_DEFAULT_VM_SIZEsmallDefault VM size for deployment nodes DEPLOYMENT_MODEL_RUNNER_VM_SIZEmediumVM size for deployment nodes that need Docker Model Runner DEPLOYMENT_DEFAULT_MEMORY_LIMIT_MB256Default per-service memory limit for compose-publish releases DEPLOYMENT_LOG_MAX_SIZE10mDefault json-file log max-size for compose-publish releases DEPLOYMENT_LOG_MAX_FILE3Default json-file log max-file for compose-publish releases MCP_DEPLOYMENT_COMPOSE_PREVIEW_MAX_BYTES128000Max Compose YAML size accepted by deployment route preview MCP tool BUILD_PUBLISH_TOOL_TIMEOUT_MS1260000Worker-to-VM proxy timeout for build_and_publish DEPLOY_ACME_EMAIL(unset) Optional ACME contact email emitted into deployment-node Caddy config DEPLOY_ACME_CA(unset) Optional ACME CA directory override, useful for Let’s Encrypt staging DOH_RESOLVER_URLhttps://cloudflare-dns.com/dns-queryDNS-over-HTTPS resolver used to verify deployment custom domains DOH_TIMEOUT_MS10000Timeout for deployment custom-domain DNS verification lookups DEPLOY_COMPOSE_CMDdocker composeDocker Compose command used by the deployment engine DEPLOY_HEALTH_TIMEOUT5mDeployment health-check timeout used by the VM agent DEPLOY_RUNTIME_TIMEOUT15mVM-agent max time for deployment-node host dependency setup DEPLOY_TEARDOWN_TIMEOUT2mVM-agent max time for deployment environment teardown (stop/start) DEPLOY_APPLY_IDLE_TIMEOUT15mVM-agent idle watchdog for deployment apply (no-progress only) DEPLOY_BUILD_PUBLISH_TIMEOUT20mVM-agent max time for host build + push + release publish DEPLOY_ARTIFACT_DIAL_TIMEOUT30sVM-agent TCP dial timeout for artifact downloads DEPLOY_ARTIFACT_TLS_HANDSHAKE_TIMEOUT15sVM-agent TLS handshake timeout for artifact downloads DEPLOY_ARTIFACT_RESPONSE_HEADER_TIMEOUT60sVM-agent first-response-header timeout for artifact downloads DEPLOY_ARTIFACT_IDLE_TIMEOUT2mVM-agent idle watchdog for artifact body-read progress
Variable Default Description MAX_NODES_PER_USER10Max nodes per user MAX_AGENT_SESSIONS_PER_WORKSPACE10Max concurrent agent sessions MAX_PROJECTS_PER_USER100Max projects per user MAX_TASKS_PER_PROJECT10000Max ideas per project MAX_TASK_MESSAGE_LENGTH16000Max idea description length
Variable Default Description MAX_SESSIONS_PER_PROJECT10000Max chat sessions per project MAX_MESSAGES_PER_SESSION100000Max messages per chat session DOCUMENT_CARD_RAW_OUTPUT_MAX_BYTES16384Max compact metadata bytes preserved for library document cards MESSAGE_SIZE_THRESHOLD102400Max message size in bytes ACTIVITY_RETENTION_DAYS90Days to retain activity events SESSION_IDLE_TIMEOUT_MINUTES60Idle session timeout SESSION_ACTIVITY_STALE_THRESHOLD_MS300000 (5 min)Evidence threshold before stale working activity can be healed to idle DO_SUMMARY_SYNC_DEBOUNCE_MS5000Debounce for DO-to-D1 summary sync
Variable Default Description DO_RETRY_MAX_ATTEMPTS8Max attempts for transient Durable Object RPC reset/overload errors DO_RETRY_BASE_DELAY_MS100Base retry delay in milliseconds for transient Durable Object RPC failures DO_RETRY_MAX_DELAY_MS250Max per-attempt retry delay for transient Durable Object RPC failures
Variable Default Description MAX_PROJECT_RUNTIME_ENV_VARS_PER_PROJECT150Max env vars per project MAX_PROJECT_RUNTIME_FILES_PER_PROJECT50Max files per project MAX_PROJECT_RUNTIME_ENV_VALUE_BYTES8192Max bytes per env var value MAX_PROJECT_RUNTIME_FILE_CONTENT_BYTES131072Max bytes per file content MAX_PROJECT_RUNTIME_FILE_PATH_LENGTH256Max file path length MAX_DEPLOYMENT_ENV_VARS_PER_ENVIRONMENT100Max deployment config vars per environment MAX_DEPLOYMENT_ENV_VALUE_BYTES65536Max bytes per deployment config value MAX_DEPLOYMENT_ENV_TOTAL_BYTES262144Max aggregate deployment config env size
Variable Default Description HETZNER_API_TIMEOUT_MS30000Hetzner API request timeout CF_API_TIMEOUT_MS30000Cloudflare API request timeout NODE_AGENT_REQUEST_TIMEOUT_MS30000VM Agent request timeout
Variable Default Description OBSERVABILITY_ERROR_RETENTION_DAYS30Error log retention OBSERVABILITY_ERROR_MAX_ROWS100000Max stored error rows OBSERVABILITY_ERROR_BATCH_SIZE25Error ingestion batch size OBSERVABILITY_LOG_QUERY_RATE_LIMIT30Log queries per minute per admin
Variable Default Description VM_AGENT_PROTOCOLhttpsProtocol for VM agent communication VM_AGENT_PORT8443VM agent listening port ORIGIN_CA_CERT_VALIDITY_DAYS7Validity for per-node Origin CA certificates signed by the API Worker
New nodes generate /etc/sam/tls/origin-ca-key.pem locally in cloud-init and fetch only the signed certificate from POST /api/nodes/:id/origin-ca-certificate (packages/cloud-init/src/template.ts, apps/api/src/routes/node-lifecycle.ts). Legacy ORIGIN_CA_CERT and ORIGIN_CA_KEY Worker secrets are not required for new node provisioning.
Applied via cloud-init on each node:
Setting Default Description SystemMaxUse500MMax disk space for journal SystemKeepFree1GMinimum free disk to maintain MaxRetentionSec7dayMax log retention period StoragepersistentPersist logs across reboots CompressyesCompress stored entries
Variable Default Description FILE_UPLOAD_MAX_BYTES52428800 (50 MB)Max size per uploaded file FILE_UPLOAD_BATCH_MAX_BYTES262144000 (250 MB)Max total size per upload batch FILE_UPLOAD_TIMEOUT120sUpload timeout (VM agent) FILE_UPLOAD_TIMEOUT_MS120000 (120s)Upload proxy timeout (Worker) FILE_DOWNLOAD_TIMEOUT_MS60000 (60s)Download proxy timeout FILE_DOWNLOAD_MAX_BYTES52428800 (50 MB)Max download file size
Variable Default Description FILE_PROXY_TIMEOUT_MS15000File proxy request timeout FILE_PROXY_MAX_RESPONSE_BYTES2097152 (2 MB)Max file proxy response size FILE_RAW_MAX_SIZE52428800 (50 MB)Max raw binary file size (VM agent) FILE_RAW_TIMEOUT60sRaw file streaming timeout (VM agent) FILE_RAW_PROXY_MAX_BYTES52428800 (50 MB)Max raw file proxy size (Worker)
Variable Default Description REPO_BROWSE_MAX_INLINE_BYTES1000000 (1 MB)Max bytes to inline as text in the file viewer; larger stream raw REPO_BROWSE_MAX_COMPARE_FILES300Max changed files in an Artifacts diff before truncation
Variable Default Description MCP_IDEA_CONTEXT_MAX_LENGTH500Max characters of idea context shown to agents MCP_IDEA_LIST_LIMIT20Default page size for list_ideas MCP_IDEA_LIST_MAX100Max page size for list_ideas MCP_IDEA_SEARCH_MAX20Max results from search_ideas MCP_MESSAGE_SEARCH_MAX20Max results from search_messages MCP_MESSAGE_LIST_LIMIT50Default page size for get_session_messages MCP_MESSAGE_LIST_MAX200Max messages per get_session_messages request
Variable Default Description VITE_FILE_PREVIEW_INLINE_MAX_BYTES10485760 (10 MB)Images below this size render inline automatically VITE_FILE_PREVIEW_LOAD_MAX_BYTES52428800 (50 MB)Images below this size show click-to-load; above shows download link
Variable Default Description ANALYTICS_GEO_LIMIT50Max countries in geographic distribution view ANALYTICS_RETENTION_WEEKS12Number of weeks for retention cohort analysis
Variable Default Description ANALYTICS_FORWARD_ENABLEDfalseEnable external analytics event forwarding ANALYTICS_FORWARD_EVENTS(all) Comma-separated list of events to forward ANALYTICS_FORWARD_LOOKBACK_HOURS25Hours to look back for events SEGMENT_WRITE_KEY(unset) Segment Write Key for event forwarding SEGMENT_API_URLhttps://api.segment.io/v1/batchSegment API endpoint SEGMENT_MAX_BATCH_SIZE100Max events per Segment batch request GA4_MEASUREMENT_ID(unset) Google Analytics 4 Measurement ID GA4_API_SECRET(unset) Google Analytics 4 API secret GA4_API_URLhttps://www.google-analytics.com/mp/collectGA4 Measurement Protocol endpoint GA4_MAX_BATCH_SIZE25Max events per GA4 batch request
