hack/tools/scripts/llm-key-hunter/results/_cache/content/auto-medica-labs_keb.json

{"repo": "auto-medica-labs/keb", "files": {"packages/bridge/.env.example": {"13c55d7e65986b6616d1f7c7f6bff15837aabb9e": {"t": 1785746753.938312, "n": 6967, "h": "01f31d858b985787", "c": "# =============================================================================\n# chrome-keb bridge — environment variables\n#\n# Copy this file to .env and fill in your values:\n#   cp .env.example .env\n#\n# The bridge auto-loads .env when present. No extra flags needed.\n# For Docker, pass it with --env-file:\n#   docker run -d \\\n#     --name chrome-keb-bridge \\\n#     -p 9876:9876 \\\n#     --env-file .env \\\n#     -v keb-data:/root/.pi/agent/keb \\\n#     chrome-keb-bridge\n#\n# NEVER commit .env to version control.\n# =============================================================================\n\n# ---------------------------------------------------------------------------\n# Bridge mode: \"hosted\" (auth required) or \"local\" (no auth)\n# ---------------------------------------------------------------------------\n#   hosted — Users must sign up and log in. Requires JWT_SECRET below.\n#            This is the default when running via Docker.\n#   local  — No login/signup. Extension connects directly.\n\nKEB_MODE=hosted\n\n# ---------------------------------------------------------------------------\n# Required for hosted mode: JWT secret for user authentication\n# ---------------------------------------------------------------------------\n# Generate a random secret:\n#   node -e \"console.log(require('crypto').randomBytes(32).toString('hex'))\"\n# In hosted mode, you MUST set this for sessions to survive restarts.\n# IMPORTANT: Keep this stable across restarts or all tokens are invalidated.\n\nJWT_SECRET=change-me-to-a-random-64-char-string\n\n# ---------------------------------------------------------------------------\n# LLM Provider — custom provider via models.json (recommended)\n# ---------------------------------------------------------------------------\n# Defines a custom provider + model in ~/.pi/agent/models.json.\n# Works with any OpenAI-compatible API, Ollama, vLLM, LM Studio,\n# Anthropic-compatible proxies, Google AI Studio, etc.\n#\n# Required:\n#   LLM_PROVIDER   — Provider name/slug (e.g., \"ollama\", \"my-provider\")\n#   LLM_BASE_URL   — API base URL\n#   LLM_MODEL      — Model ID (e.g., \"llama3.1:8b\", \"gpt-4\")\n#\n# Optional:\n#   LLM_API        — API type (default: \"openai-completions\")\n#                    See pi docs/models.md for supported APIs:\n#                    \"anthropic-messages\", \"google-generative-ai\",\n#                    \"openai-responses\"\n#   LLM_API_KEY    — API key (required by pi, can be dummy for local models)\n#   LLM_MODEL_NAME — Optional human-readable model name\n#   LLM_REASONING  — Set \"true\" for reasoning-capable models\n\n# Example: Ollama (local)\n# LLM_PROVIDER=ollama\n# LLM_BASE_URL=http://host.docker.internal:11434/v1\n# LLM_MODEL=llama3.1:8b\n# LLM_API_KEY=ollama\n\n# Example: Anthropic (native API — simplest)\n# LLM_PROVIDER=anthropic\n# LLM_BASE_URL=https://api.anthropic.com/v1\n# LLM_API=anthropic-messages\n# LLM_MODEL=claude-sonnet-4-20250514\n# LLM_API_KEY=sk-ant-...\n\n# Example: Poolside (Anthropic-compatible API)\n# LLM_PROVIDER=poolside\n# LLM_BASE_URL=https://api.poolside.ai/v1\n# LLM_API=anthropic-messages\n# LLM_MODEL=poolside-alpha\n# LLM_API_KEY=ps-...\n\n# Example: OpenAI-compatible proxy\n# LLM_PROVIDER=my-proxy\n# LLM_BASE_URL=https://proxy.example.com/v1\n# LLM_MODEL=gpt-4\n# LLM_API_KEY=sk-proxy-key...\n\n# ---------------------------------------------------------------------------\n# Legacy: native pi API keys (alternative to LLM_* vars above)\n# ---------------------------------------------------------------------------\n# Only needed if you prefer pi's built-in provider resolution via auth.json.\n# Not required when using the LLM_* custom provider approach above.\n\n# Anthropic\n# ANTHROPIC_API_KEY=sk-ant-...\n\n# OpenAI\n#OPENAI_API_KEY=sk-...\n\n# Google Gemini\n#GEMINI_API_KEY=...\n\n# DeepSeek\n#DEEPSEEK_API_KEY=...\n\n# Groq\n#GROQ_API_KEY=...\n\n# Mistral\n#MISTRAL_API_KEY=...\n\n# xAI (Grok)\n#XAI_API_KEY=...\n\n# OpenRouter\n#OPENROUTER_API_KEY=...\n\n# Hugging Face\n#HF_TOKEN=...\n\n# Cerebras\n#CEREBRAS_API_KEY=...\n\n# Fireworks\n#FIREWORKS_API_KEY=...\n\n# Together\n#TOGETHER_API_KEY=...\n\n# Vercel AI Gateway\n#AI_GATEWAY_API_KEY=...\n\n# Other supported providers (see pi docs/providers.md):\n#   Azure OpenAI    → AZURE_OPENAI_API_KEY\n#   Z.AI            → ZAI_API_KEY\n#   Opencode        → OPENCODE_API_KEY\n#   Kimi Coding     → KIMI_API_KEY\n#   MiniMax         → MINIMAX_API_KEY\n#   Xiaomi          → XIAOMI_API_KEY\n#   Together        → TOGETHER_API_KEY\n\n# ---------------------------------------------------------------------------\n# Legacy: default provider & model (alternative to LLM_*)\n# ---------------------------------------------------------------------------\n# Only needed with the auth.json-based native provider approach above.\n# When using LLM_PROVIDER/LLM_MODEL, those are used automatically.\n\n# PI_DEFAULT_PROVIDER=anthropic\n# PI_DEFAULT_MODEL=claude-sonnet-4-20250514\n\n# ---------------------------------------------------------------------------\n# Optional: thinking level (applies to both LLM_* and PI_DEFAULT_*)\n# ---------------------------------------------------------------------------\n# \"off\" | \"low\" | \"medium\" | \"high\" | \"xhigh\"\n#LLM_THINKING=off\n#PI_DEFAULT_THINKING=off\n\n# ---------------------------------------------------------------------------\n# Optional: admin monitoring\n# ---------------------------------------------------------------------------\n# ADMIN_KEY — secret key for GET /api/status endpoint (sent via X-API-Key header).\n# If unset, the endpoint returns 501 (not configured).\n# Generate: node -e \"console.log(require('crypto').randomBytes(16).toString('hex'))\"\n#ADMIN_KEY=\n\n# ---------------------------------------------------------------------------\n# Cloudflare R2 Backup — daily Keb data backup\n# ---------------------------------------------------------------------------\n# A dedicated backup sidecar container runs daily at midnight Bangkok time\n# (00:00 UTC+7). It archives the Keb data directory and uploads to R2.\n#\n# To set up:\n#   1. Go to https://dash.cloudflare.com/<account>/r2\n#   2. Create a bucket (e.g., \"keb-backups\")\n#   3. Go to R2 > Manage R2 API Tokens > Create API Token\n#      — Permission: \"Object Read & Write\"\n#      — Apply to: the bucket you created\n#   4. Fill in the values below\n#\n# Required:\n#   R2_ACCOUNT_ID — Cloudflare account ID (from R2 dashboard URL)\n#   R2_ACCESS_KEY_ID — R2 API token access key ID\n#   R2_SECRET_ACCESS_KEY — R2 API token secret\n#   R2_BUCKET — Bucket name (e.g., \"keb-backups\")\n#\n# Optional:\n#   R2_BACKUP_RETENTION_DAYS — prune backups older than this (default: 30)\n\n#R2_ACCOUNT_ID=\n#R2_ACCESS_KEY_ID=\n#R2_SECRET_ACCESS_KEY=\n#R2_BUCKET=keb-backups\n#R2_BACKUP_RETENTION_DAYS=30\n\n# ---------------------------------------------------------------------------\n# Optional: network settings\n# ---------------------------------------------------------------------------\n# PORT  — WebSocket listen port (default: 9876)\n# HOST  — Listen address (default: 0.0.0.0; set to 127.0.0.1 for host-net mode)\n#PORT=9876\n#HOST=0.0.0.0\n"}, "771e15fab8108c626ce09e90785f8685b52f9d9b": {"t": 1785767490.5275042, "n": 6967, "h": "01f31d858b985787", "c": "# =============================================================================\n# chrome-keb bridge — environment variables\n#\n# Copy this file to .env and fill in your values:\n#   cp .env.example .env\n#\n# The bridge auto-loads .env when present. No extra flags needed.\n# For Docker, pass it with --env-file:\n#   docker run -d \\\n#     --name chrome-keb-bridge \\\n#     -p 9876:9876 \\\n#     --env-file .env \\\n#     -v keb-data:/root/.pi/agent/keb \\\n#     chrome-keb-bridge\n#\n# NEVER commit .env to version control.\n# =============================================================================\n\n# ---------------------------------------------------------------------------\n# Bridge mode: \"hosted\" (auth required) or \"local\" (no auth)\n# ---------------------------------------------------------------------------\n#   hosted — Users must sign up and log in. Requires JWT_SECRET below.\n#            This is the default when running via Docker.\n#   local  — No login/signup. Extension connects directly.\n\nKEB_MODE=hosted\n\n# ---------------------------------------------------------------------------\n# Required for hosted mode: JWT secret for user authentication\n# ---------------------------------------------------------------------------\n# Generate a random secret:\n#   node -e \"console.log(require('crypto').randomBytes(32).toString('hex'))\"\n# In hosted mode, you MUST set this for sessions to survive restarts.\n# IMPORTANT: Keep this stable across restarts or all tokens are invalidated.\n\nJWT_SECRET=change-me-to-a-random-64-char-string\n\n# ---------------------------------------------------------------------------\n# LLM Provider — custom provider via models.json (recommended)\n# ---------------------------------------------------------------------------\n# Defines a custom provider + model in ~/.pi/agent/models.json.\n# Works with any OpenAI-compatible API, Ollama, vLLM, LM Studio,\n# Anthropic-compatible proxies, Google AI Studio, etc.\n#\n# Required:\n#   LLM_PROVIDER   — Provider name/slug (e.g., \"ollama\", \"my-provider\")\n#   LLM_BASE_URL   — API base URL\n#   LLM_MODEL      — Model ID (e.g., \"llama3.1:8b\", \"gpt-4\")\n#\n# Optional:\n#   LLM_API        — API type (default: \"openai-completions\")\n#                    See pi docs/models.md for supported APIs:\n#                    \"anthropic-messages\", \"google-generative-ai\",\n#                    \"openai-responses\"\n#   LLM_API_KEY    — API key (required by pi, can be dummy for local models)\n#   LLM_MODEL_NAME — Optional human-readable model name\n#   LLM_REASONING  — Set \"true\" for reasoning-capable models\n\n# Example: Ollama (local)\n# LLM_PROVIDER=ollama\n# LLM_BASE_URL=http://host.docker.internal:11434/v1\n# LLM_MODEL=llama3.1:8b\n# LLM_API_KEY=ollama\n\n# Example: Anthropic (native API — simplest)\n# LLM_PROVIDER=anthropic\n# LLM_BASE_URL=https://api.anthropic.com/v1\n# LLM_API=anthropic-messages\n# LLM_MODEL=claude-sonnet-4-20250514\n# LLM_API_KEY=sk-ant-...\n\n# Example: Poolside (Anthropic-compatible API)\n# LLM_PROVIDER=poolside\n# LLM_BASE_URL=https://api.poolside.ai/v1\n# LLM_API=anthropic-messages\n# LLM_MODEL=poolside-alpha\n# LLM_API_KEY=ps-...\n\n# Example: OpenAI-compatible proxy\n# LLM_PROVIDER=my-proxy\n# LLM_BASE_URL=https://proxy.example.com/v1\n# LLM_MODEL=gpt-4\n# LLM_API_KEY=sk-proxy-key...\n\n# ---------------------------------------------------------------------------\n# Legacy: native pi API keys (alternative to LLM_* vars above)\n# ---------------------------------------------------------------------------\n# Only needed if you prefer pi's built-in provider resolution via auth.json.\n# Not required when using the LLM_* custom provider approach above.\n\n# Anthropic\n# ANTHROPIC_API_KEY=sk-ant-...\n\n# OpenAI\n#OPENAI_API_KEY=sk-...\n\n# Google Gemini\n#GEMINI_API_KEY=...\n\n# DeepSeek\n#DEEPSEEK_API_KEY=...\n\n# Groq\n#GROQ_API_KEY=...\n\n# Mistral\n#MISTRAL_API_KEY=...\n\n# xAI (Grok)\n#XAI_API_KEY=...\n\n# OpenRouter\n#OPENROUTER_API_KEY=...\n\n# Hugging Face\n#HF_TOKEN=...\n\n# Cerebras\n#CEREBRAS_API_KEY=...\n\n# Fireworks\n#FIREWORKS_API_KEY=...\n\n# Together\n#TOGETHER_API_KEY=...\n\n# Vercel AI Gateway\n#AI_GATEWAY_API_KEY=...\n\n# Other supported providers (see pi docs/providers.md):\n#   Azure OpenAI    → AZURE_OPENAI_API_KEY\n#   Z.AI            → ZAI_API_KEY\n#   Opencode        → OPENCODE_API_KEY\n#   Kimi Coding     → KIMI_API_KEY\n#   MiniMax         → MINIMAX_API_KEY\n#   Xiaomi          → XIAOMI_API_KEY\n#   Together        → TOGETHER_API_KEY\n\n# ---------------------------------------------------------------------------\n# Legacy: default provider & model (alternative to LLM_*)\n# ---------------------------------------------------------------------------\n# Only needed with the auth.json-based native provider approach above.\n# When using LLM_PROVIDER/LLM_MODEL, those are used automatically.\n\n# PI_DEFAULT_PROVIDER=anthropic\n# PI_DEFAULT_MODEL=claude-sonnet-4-20250514\n\n# ---------------------------------------------------------------------------\n# Optional: thinking level (applies to both LLM_* and PI_DEFAULT_*)\n# ---------------------------------------------------------------------------\n# \"off\" | \"low\" | \"medium\" | \"high\" | \"xhigh\"\n#LLM_THINKING=off\n#PI_DEFAULT_THINKING=off\n\n# ---------------------------------------------------------------------------\n# Optional: admin monitoring\n# ---------------------------------------------------------------------------\n# ADMIN_KEY — secret key for GET /api/status endpoint (sent via X-API-Key header).\n# If unset, the endpoint returns 501 (not configured).\n# Generate: node -e \"console.log(require('crypto').randomBytes(16).toString('hex'))\"\n#ADMIN_KEY=\n\n# ---------------------------------------------------------------------------\n# Cloudflare R2 Backup — daily Keb data backup\n# ---------------------------------------------------------------------------\n# A dedicated backup sidecar container runs daily at midnight Bangkok time\n# (00:00 UTC+7). It archives the Keb data directory and uploads to R2.\n#\n# To set up:\n#   1. Go to https://dash.cloudflare.com/<account>/r2\n#   2. Create a bucket (e.g., \"keb-backups\")\n#   3. Go to R2 > Manage R2 API Tokens > Create API Token\n#      — Permission: \"Object Read & Write\"\n#      — Apply to: the bucket you created\n#   4. Fill in the values below\n#\n# Required:\n#   R2_ACCOUNT_ID — Cloudflare account ID (from R2 dashboard URL)\n#   R2_ACCESS_KEY_ID — R2 API token access key ID\n#   R2_SECRET_ACCESS_KEY — R2 API token secret\n#   R2_BUCKET — Bucket name (e.g., \"keb-backups\")\n#\n# Optional:\n#   R2_BACKUP_RETENTION_DAYS — prune backups older than this (default: 30)\n\n#R2_ACCOUNT_ID=\n#R2_ACCESS_KEY_ID=\n#R2_SECRET_ACCESS_KEY=\n#R2_BUCKET=keb-backups\n#R2_BACKUP_RETENTION_DAYS=30\n\n# ---------------------------------------------------------------------------\n# Optional: network settings\n# ---------------------------------------------------------------------------\n# PORT  — WebSocket listen port (default: 9876)\n# HOST  — Listen address (default: 0.0.0.0; set to 127.0.0.1 for host-net mode)\n#PORT=9876\n#HOST=0.0.0.0\n"}, "7777474012ebacfe47cf14ef1f3776c904f2e177": {"t": 1785767491.8407652, "n": 6960, "h": "865064952db5b0fd", "c": "# =============================================================================\n# chrome-kb bridge — environment variables\n#\n# Copy this file to .env and fill in your values:\n#   cp .env.example .env\n#\n# The bridge auto-loads .env when present. No extra flags needed.\n# For Docker, pass it with --env-file:\n#   docker run -d \\\n#     --name chrome-kb-bridge \\\n#     -p 9876:9876 \\\n#     --env-file .env \\\n#     -v kb-data:/root/.pi/agent/kb \\\n#     chrome-kb-bridge\n#\n# NEVER commit .env to version control.\n# =============================================================================\n\n# ---------------------------------------------------------------------------\n# Bridge mode: \"hosted\" (auth required) or \"local\" (no auth)\n# ---------------------------------------------------------------------------\n#   hosted — Users must sign up and log in. Requires JWT_SECRET below.\n#            This is the default when running via Docker.\n#   local  — No login/signup. Extension connects directly.\n\nKEB_MODE=hosted\n\n# ---------------------------------------------------------------------------\n# Required for hosted mode: JWT secret for user authentication\n# ---------------------------------------------------------------------------\n# Generate a random secret:\n#   node -e \"console.log(require('crypto').randomBytes(32).toString('hex'))\"\n# In hosted mode, you MUST set this for sessions to survive restarts.\n# IMPORTANT: Keep this stable across restarts or all tokens are invalidated.\n\nJWT_SECRET=change-me-to-a-random-64-char-string\n\n# ---------------------------------------------------------------------------\n# LLM Provider — custom provider via models.json (recommended)\n# ---------------------------------------------------------------------------\n# Defines a custom provider + model in ~/.pi/agent/models.json.\n# Works with any OpenAI-compatible API, Ollama, vLLM, LM Studio,\n# Anthropic-compatible proxies, Google AI Studio, etc.\n#\n# Required:\n#   LLM_PROVIDER   — Provider name/slug (e.g., \"ollama\", \"my-provider\")\n#   LLM_BASE_URL   — API base URL\n#   LLM_MODEL      — Model ID (e.g., \"llama3.1:8b\", \"gpt-4\")\n#\n# Optional:\n#   LLM_API        — API type (default: \"openai-completions\")\n#                    See pi docs/models.md for supported APIs:\n#                    \"anthropic-messages\", \"google-generative-ai\",\n#                    \"openai-responses\"\n#   LLM_API_KEY    — API key (required by pi, can be dummy for local models)\n#   LLM_MODEL_NAME — Optional human-readable model name\n#   LLM_REASONING  — Set \"true\" for reasoning-capable models\n\n# Example: Ollama (local)\n# LLM_PROVIDER=ollama\n# LLM_BASE_URL=http://host.docker.internal:11434/v1\n# LLM_MODEL=llama3.1:8b\n# LLM_API_KEY=ollama\n\n# Example: Anthropic (native API — simplest)\n# LLM_PROVIDER=anthropic\n# LLM_BASE_URL=https://api.anthropic.com/v1\n# LLM_API=anthropic-messages\n# LLM_MODEL=claude-sonnet-4-20250514\n# LLM_API_KEY=sk-ant-...\n\n# Example: Poolside (Anthropic-compatible API)\n# LLM_PROVIDER=poolside\n# LLM_BASE_URL=https://api.poolside.ai/v1\n# LLM_API=anthropic-messages\n# LLM_MODEL=poolside-alpha\n# LLM_API_KEY=ps-...\n\n# Example: OpenAI-compatible proxy\n# LLM_PROVIDER=my-proxy\n# LLM_BASE_URL=https://proxy.example.com/v1\n# LLM_MODEL=gpt-4\n# LLM_API_KEY=sk-proxy-key...\n\n# ---------------------------------------------------------------------------\n# Legacy: native pi API keys (alternative to LLM_* vars above)\n# ---------------------------------------------------------------------------\n# Only needed if you prefer pi's built-in provider resolution via auth.json.\n# Not required when using the LLM_* custom provider approach above.\n\n# Anthropic\n# ANTHROPIC_API_KEY=sk-ant-...\n\n# OpenAI\n#OPENAI_API_KEY=sk-...\n\n# Google Gemini\n#GEMINI_API_KEY=...\n\n# DeepSeek\n#DEEPSEEK_API_KEY=...\n\n# Groq\n#GROQ_API_KEY=...\n\n# Mistral\n#MISTRAL_API_KEY=...\n\n# xAI (Grok)\n#XAI_API_KEY=...\n\n# OpenRouter\n#OPENROUTER_API_KEY=...\n\n# Hugging Face\n#HF_TOKEN=...\n\n# Cerebras\n#CEREBRAS_API_KEY=...\n\n# Fireworks\n#FIREWORKS_API_KEY=...\n\n# Together\n#TOGETHER_API_KEY=...\n\n# Vercel AI Gateway\n#AI_GATEWAY_API_KEY=...\n\n# Other supported providers (see pi docs/providers.md):\n#   Azure OpenAI    → AZURE_OPENAI_API_KEY\n#   Z.AI            → ZAI_API_KEY\n#   Opencode        → OPENCODE_API_KEY\n#   Kimi Coding     → KIMI_API_KEY\n#   MiniMax         → MINIMAX_API_KEY\n#   Xiaomi          → XIAOMI_API_KEY\n#   Together        → TOGETHER_API_KEY\n\n# ---------------------------------------------------------------------------\n# Legacy: default provider & model (alternative to LLM_*)\n# ---------------------------------------------------------------------------\n# Only needed with the auth.json-based native provider approach above.\n# When using LLM_PROVIDER/LLM_MODEL, those are used automatically.\n\n# PI_DEFAULT_PROVIDER=anthropic\n# PI_DEFAULT_MODEL=claude-sonnet-4-20250514\n\n# ---------------------------------------------------------------------------\n# Optional: thinking level (applies to both LLM_* and PI_DEFAULT_*)\n# ---------------------------------------------------------------------------\n# \"off\" | \"low\" | \"medium\" | \"high\" | \"xhigh\"\n#LLM_THINKING=off\n#PI_DEFAULT_THINKING=off\n\n# ---------------------------------------------------------------------------\n# Optional: admin monitoring\n# ---------------------------------------------------------------------------\n# ADMIN_KEY — secret key for GET /api/status endpoint (sent via X-API-Key header).\n# If unset, the endpoint returns 501 (not configured).\n# Generate: node -e \"console.log(require('crypto').randomBytes(16).toString('hex'))\"\n#ADMIN_KEY=\n\n# ---------------------------------------------------------------------------\n# Cloudflare R2 Backup — daily KB data backup\n# ---------------------------------------------------------------------------\n# A dedicated backup sidecar container runs daily at midnight Bangkok time\n# (00:00 UTC+7). It archives the KB data directory and uploads to R2.\n#\n# To set up:\n#   1. Go to https://dash.cloudflare.com/<account>/r2\n#   2. Create a bucket (e.g., \"keb-backups\")\n#   3. Go to R2 > Manage R2 API Tokens > Create API Token\n#      — Permission: \"Object Read & Write\"\n#      — Apply to: the bucket you created\n#   4. Fill in the values below\n#\n# Required:\n#   R2_ACCOUNT_ID — Cloudflare account ID (from R2 dashboard URL)\n#   R2_ACCESS_KEY_ID — R2 API token access key ID\n#   R2_SECRET_ACCESS_KEY — R2 API token secret\n#   R2_BUCKET — Bucket name (e.g., \"keb-backups\")\n#\n# Optional:\n#   R2_BACKUP_RETENTION_DAYS — prune backups older than this (default: 30)\n\n#R2_ACCOUNT_ID=\n#R2_ACCESS_KEY_ID=\n#R2_SECRET_ACCESS_KEY=\n#R2_BUCKET=keb-backups\n#R2_BACKUP_RETENTION_DAYS=30\n\n# ---------------------------------------------------------------------------\n# Optional: network settings\n# ---------------------------------------------------------------------------\n# PORT  — WebSocket listen port (default: 9876)\n# HOST  — Listen address (default: 0.0.0.0; set to 127.0.0.1 for host-net mode)\n#PORT=9876\n#HOST=0.0.0.0\n"}, "92572f23b263d0161820174ae4fc0fc975b0b464": {"t": 1785767493.2001686, "n": 5896, "h": "cbc32438d12afcd0", "c": "# =============================================================================\n# chrome-kb bridge — environment variables\n#\n# Copy this file to .env and fill in your values:\n#   cp .env.example .env\n#\n# The bridge auto-loads .env when present. No extra flags needed.\n# For Docker, pass it with --env-file:\n#   docker run -d \\\n#     --name chrome-kb-bridge \\\n#     -p 9876:9876 \\\n#     --env-file .env \\\n#     -v kb-data:/root/.pi/agent/kb \\\n#     chrome-kb-bridge\n#\n# NEVER commit .env to version control.\n# =============================================================================\n\n# ---------------------------------------------------------------------------\n# Bridge mode: \"hosted\" (auth required) or \"local\" (no auth)\n# ---------------------------------------------------------------------------\n#   hosted — Users must sign up and log in. Requires JWT_SECRET below.\n#            This is the default when running via Docker.\n#   local  — No login/signup. Extension connects directly.\n\nKEB_MODE=hosted\n\n# ---------------------------------------------------------------------------\n# Required for hosted mode: JWT secret for user authentication\n# ---------------------------------------------------------------------------\n# Generate a random secret:\n#   node -e \"console.log(require('crypto').randomBytes(32).toString('hex'))\"\n# In hosted mode, you MUST set this for sessions to survive restarts.\n# IMPORTANT: Keep this stable across restarts or all tokens are invalidated.\n\nJWT_SECRET=change-me-to-a-random-64-char-string\n\n# ---------------------------------------------------------------------------\n# LLM Provider — custom provider via models.json (recommended)\n# ---------------------------------------------------------------------------\n# Defines a custom provider + model in ~/.pi/agent/models.json.\n# Works with any OpenAI-compatible API, Ollama, vLLM, LM Studio,\n# Anthropic-compatible proxies, Google AI Studio, etc.\n#\n# Required:\n#   LLM_PROVIDER   — Provider name/slug (e.g., \"ollama\", \"my-provider\")\n#   LLM_BASE_URL   — API base URL\n#   LLM_MODEL      — Model ID (e.g., \"llama3.1:8b\", \"gpt-4\")\n#\n# Optional:\n#   LLM_API        — API type (default: \"openai-completions\")\n#                    See pi docs/models.md for supported APIs:\n#                    \"anthropic-messages\", \"google-generative-ai\",\n#                    \"openai-responses\"\n#   LLM_API_KEY    — API key (required by pi, can be dummy for local models)\n#   LLM_MODEL_NAME — Optional human-readable model name\n#   LLM_REASONING  — Set \"true\" for reasoning-capable models\n\n# Example: Ollama (local)\n# LLM_PROVIDER=ollama\n# LLM_BASE_URL=http://host.docker.internal:11434/v1\n# LLM_MODEL=llama3.1:8b\n# LLM_API_KEY=ollama\n\n# Example: Anthropic (native API — simplest)\n# LLM_PROVIDER=anthropic\n# LLM_BASE_URL=https://api.anthropic.com/v1\n# LLM_API=anthropic-messages\n# LLM_MODEL=claude-sonnet-4-20250514\n# LLM_API_KEY=sk-ant-...\n\n# Example: Poolside (Anthropic-compatible API)\n# LLM_PROVIDER=poolside\n# LLM_BASE_URL=https://api.poolside.ai/v1\n# LLM_API=anthropic-messages\n# LLM_MODEL=poolside-alpha\n# LLM_API_KEY=ps-...\n\n# Example: OpenAI-compatible proxy\n# LLM_PROVIDER=my-proxy\n# LLM_BASE_URL=https://proxy.example.com/v1\n# LLM_MODEL=gpt-4\n# LLM_API_KEY=sk-proxy-key...\n\n# ---------------------------------------------------------------------------\n# Legacy: native pi API keys (alternative to LLM_* vars above)\n# ---------------------------------------------------------------------------\n# Only needed if you prefer pi's built-in provider resolution via auth.json.\n# Not required when using the LLM_* custom provider approach above.\n\n# Anthropic\n# ANTHROPIC_API_KEY=sk-ant-...\n\n# OpenAI\n#OPENAI_API_KEY=sk-...\n\n# Google Gemini\n#GEMINI_API_KEY=...\n\n# DeepSeek\n#DEEPSEEK_API_KEY=...\n\n# Groq\n#GROQ_API_KEY=...\n\n# Mistral\n#MISTRAL_API_KEY=...\n\n# xAI (Grok)\n#XAI_API_KEY=...\n\n# OpenRouter\n#OPENROUTER_API_KEY=...\n\n# Hugging Face\n#HF_TOKEN=...\n\n# Cerebras\n#CEREBRAS_API_KEY=...\n\n# Fireworks\n#FIREWORKS_API_KEY=...\n\n# Together\n#TOGETHER_API_KEY=...\n\n# Vercel AI Gateway\n#AI_GATEWAY_API_KEY=...\n\n# Other supported providers (see pi docs/providers.md):\n#   Azure OpenAI    → AZURE_OPENAI_API_KEY\n#   Z.AI            → ZAI_API_KEY\n#   Opencode        → OPENCODE_API_KEY\n#   Kimi Coding     → KIMI_API_KEY\n#   MiniMax         → MINIMAX_API_KEY\n#   Xiaomi          → XIAOMI_API_KEY\n#   Together        → TOGETHER_API_KEY\n\n# ---------------------------------------------------------------------------\n# Legacy: default provider & model (alternative to LLM_*)\n# ---------------------------------------------------------------------------\n# Only needed with the auth.json-based native provider approach above.\n# When using LLM_PROVIDER/LLM_MODEL, those are used automatically.\n\n# PI_DEFAULT_PROVIDER=anthropic\n# PI_DEFAULT_MODEL=claude-sonnet-4-20250514\n\n# ---------------------------------------------------------------------------\n# Optional: thinking level (applies to both LLM_* and PI_DEFAULT_*)\n# ---------------------------------------------------------------------------\n# \"off\" | \"low\" | \"medium\" | \"high\" | \"xhigh\"\n#LLM_THINKING=off\n#PI_DEFAULT_THINKING=off\n\n# ---------------------------------------------------------------------------\n# Optional: admin monitoring\n# ---------------------------------------------------------------------------\n# ADMIN_KEY — secret key for GET /api/status endpoint (sent via X-API-Key header).\n# If unset, the endpoint returns 501 (not configured).\n# Generate: node -e \"console.log(require('crypto').randomBytes(16).toString('hex'))\"\n#ADMIN_KEY=\n\n# ---------------------------------------------------------------------------\n# Optional: network settings\n# ---------------------------------------------------------------------------\n# PORT  — WebSocket listen port (default: 9876)\n# HOST  — Listen address (default: 0.0.0.0; set to 127.0.0.1 for host-net mode)\n#PORT=9876\n#HOST=0.0.0.0\n"}, "decd9c1ae9e046772122c56cc6701e8154e0e985": {"t": 1785767494.7117622, "n": 5475, "h": "9e4c7793480e143b", "c": "# =============================================================================\n# chrome-kb bridge — environment variables\n#\n# Copy this file to .env and fill in your values:\n#   cp .env.example .env\n#\n# The bridge auto-loads .env when present. No extra flags needed.\n# For Docker, pass it with --env-file:\n#   docker run -d \\\n#     --name chrome-kb-bridge \\\n#     -p 9876:9876 \\\n#     --env-file .env \\\n#     -v kb-data:/root/.pi/agent/kb \\\n#     chrome-kb-bridge\n#\n# NEVER commit .env to version control.\n# =============================================================================\n\n# ---------------------------------------------------------------------------\n# Bridge mode: \"hosted\" (auth required) or \"local\" (no auth)\n# ---------------------------------------------------------------------------\n#   hosted — Users must sign up and log in. Requires JWT_SECRET below.\n#            This is the default when running via Docker.\n#   local  — No login/signup. Extension connects directly.\n\nKEB_MODE=hosted\n\n# ---------------------------------------------------------------------------\n# Required for hosted mode: JWT secret for user authentication\n# ---------------------------------------------------------------------------\n# Generate a random secret:\n#   node -e \"console.log(require('crypto').randomBytes(32).toString('hex'))\"\n# In hosted mode, you MUST set this for sessions to survive restarts.\n# IMPORTANT: Keep this stable across restarts or all tokens are invalidated.\n\nJWT_SECRET=change-me-to-a-random-64-char-string\n\n# ---------------------------------------------------------------------------\n# LLM Provider — custom provider via models.json (recommended)\n# ---------------------------------------------------------------------------\n# Defines a custom provider + model in ~/.pi/agent/models.json.\n# Works with any OpenAI-compatible API, Ollama, vLLM, LM Studio,\n# Anthropic-compatible proxies, Google AI Studio, etc.\n#\n# Required:\n#   LLM_PROVIDER   — Provider name/slug (e.g., \"ollama\", \"my-provider\")\n#   LLM_BASE_URL   — API base URL\n#   LLM_MODEL      — Model ID (e.g., \"llama3.1:8b\", \"gpt-4\")\n#\n# Optional:\n#   LLM_API        — API type (default: \"openai-completions\")\n#                    See pi docs/models.md for supported APIs:\n#                    \"anthropic-messages\", \"google-generative-ai\",\n#                    \"openai-responses\"\n#   LLM_API_KEY    — API key (required by pi, can be dummy for local models)\n#   LLM_MODEL_NAME — Optional human-readable model name\n#   LLM_REASONING  — Set \"true\" for reasoning-capable models\n\n# Example: Ollama (local)\n# LLM_PROVIDER=ollama\n# LLM_BASE_URL=http://host.docker.internal:11434/v1\n# LLM_MODEL=llama3.1:8b\n# LLM_API_KEY=ollama\n\n# Example: Anthropic (native API — simplest)\n# LLM_PROVIDER=anthropic\n# LLM_BASE_URL=https://api.anthropic.com/v1\n# LLM_API=anthropic-messages\n# LLM_MODEL=claude-sonnet-4-20250514\n# LLM_API_KEY=sk-ant-...\n\n# Example: Poolside (Anthropic-compatible API)\n# LLM_PROVIDER=poolside\n# LLM_BASE_URL=https://api.poolside.ai/v1\n# LLM_API=anthropic-messages\n# LLM_MODEL=poolside-alpha\n# LLM_API_KEY=ps-...\n\n# Example: OpenAI-compatible proxy\n# LLM_PROVIDER=my-proxy\n# LLM_BASE_URL=https://proxy.example.com/v1\n# LLM_MODEL=gpt-4\n# LLM_API_KEY=sk-proxy-key...\n\n# ---------------------------------------------------------------------------\n# Legacy: native pi API keys (alternative to LLM_* vars above)\n# ---------------------------------------------------------------------------\n# Only needed if you prefer pi's built-in provider resolution via auth.json.\n# Not required when using the LLM_* custom provider approach above.\n\n# Anthropic\n# ANTHROPIC_API_KEY=sk-ant-...\n\n# OpenAI\n#OPENAI_API_KEY=sk-...\n\n# Google Gemini\n#GEMINI_API_KEY=...\n\n# DeepSeek\n#DEEPSEEK_API_KEY=...\n\n# Groq\n#GROQ_API_KEY=...\n\n# Mistral\n#MISTRAL_API_KEY=...\n\n# xAI (Grok)\n#XAI_API_KEY=...\n\n# OpenRouter\n#OPENROUTER_API_KEY=...\n\n# Hugging Face\n#HF_TOKEN=...\n\n# Cerebras\n#CEREBRAS_API_KEY=...\n\n# Fireworks\n#FIREWORKS_API_KEY=...\n\n# Together\n#TOGETHER_API_KEY=...\n\n# Vercel AI Gateway\n#AI_GATEWAY_API_KEY=...\n\n# Other supported providers (see pi docs/providers.md):\n#   Azure OpenAI    → AZURE_OPENAI_API_KEY\n#   Z.AI            → ZAI_API_KEY\n#   Opencode        → OPENCODE_API_KEY\n#   Kimi Coding     → KIMI_API_KEY\n#   MiniMax         → MINIMAX_API_KEY\n#   Xiaomi          → XIAOMI_API_KEY\n#   Together        → TOGETHER_API_KEY\n\n# ---------------------------------------------------------------------------\n# Legacy: default provider & model (alternative to LLM_*)\n# ---------------------------------------------------------------------------\n# Only needed with the auth.json-based native provider approach above.\n# When using LLM_PROVIDER/LLM_MODEL, those are used automatically.\n\n# PI_DEFAULT_PROVIDER=anthropic\n# PI_DEFAULT_MODEL=claude-sonnet-4-20250514\n\n# ---------------------------------------------------------------------------\n# Optional: thinking level (applies to both LLM_* and PI_DEFAULT_*)\n# ---------------------------------------------------------------------------\n# \"off\" | \"low\" | \"medium\" | \"high\" | \"xhigh\"\n#LLM_THINKING=off\n#PI_DEFAULT_THINKING=off\n\n# ---------------------------------------------------------------------------\n# Optional: network settings\n# ---------------------------------------------------------------------------\n# PORT  — WebSocket listen port (default: 9876)\n# HOST  — Listen address (default: 0.0.0.0; set to 127.0.0.1 for host-net mode)\n#PORT=9876\n#HOST=0.0.0.0\n"}, "ea33043a167bb2b2895f929f5c224834f8c17d70": {"t": 1785767496.0601013, "n": 5283, "h": "321b1eb95bddcdde", "c": "# =============================================================================\n# chrome-kb bridge — environment variables\n#\n# Copy this file to .env and fill in your values:\n#   cp .env.example .env\n#\n# The bridge auto-loads .env when present. No extra flags needed.\n# For Docker, pass it with --env-file:\n#   docker run -d \\\n#     --name chrome-kb-bridge \\\n#     -p 9876:9876 \\\n#     --env-file .env \\\n#     -v kb-data:/root/.pi/agent/kb \\\n#     chrome-kb-bridge\n#\n# NEVER commit .env to version control.\n# =============================================================================\n\n# ---------------------------------------------------------------------------\n# Bridge mode: \"hosted\" (auth required) or \"local\" (no auth)\n# ---------------------------------------------------------------------------\n#   hosted — Users must sign up and log in. Requires JWT_SECRET below.\n#            This is the default when running via Docker.\n#   local  — No login/signup. Extension connects directly.\n\nKEB_MODE=hosted\n\n# ---------------------------------------------------------------------------\n# Required for hosted mode: JWT secret for user authentication\n# ---------------------------------------------------------------------------\n# Generate a random secret:\n#   node -e \"console.log(require('crypto').randomBytes(32).toString('hex'))\"\n# In hosted mode, you MUST set this for sessions to survive restarts.\n# IMPORTANT: Keep this stable across restarts or all tokens are invalidated.\n\nJWT_SECRET=change-me-to-a-random-64-char-string\n\n# ---------------------------------------------------------------------------\n# LLM Provider — custom provider via models.json (recommended)\n# ---------------------------------------------------------------------------\n# Defines a custom provider + model in ~/.pi/agent/models.json.\n# Works with any OpenAI-compatible API, Ollama, vLLM, LM Studio,\n# Anthropic-compatible proxies, Google AI Studio, etc.\n#\n# Required:\n#   LLM_PROVIDER   — Provider name/slug (e.g., \"ollama\", \"my-provider\")\n#   LLM_BASE_URL   — API base URL\n#   LLM_MODEL      — Model ID (e.g., \"llama3.1:8b\", \"gpt-4\")\n#\n# Optional:\n#   LLM_API        — API type (default: \"openai-completions\")\n#                    See pi docs/models.md for supported APIs:\n#                    \"anthropic-messages\", \"google-generative-ai\",\n#                    \"openai-responses\"\n#   LLM_API_KEY    — API key (required by pi, can be dummy for local models)\n#   LLM_MODEL_NAME — Optional human-readable model name\n#   LLM_REASONING  — Set \"true\" for reasoning-capable models\n\n# Example: Ollama (local)\n# LLM_PROVIDER=ollama\n# LLM_BASE_URL=http://host.docker.internal:11434/v1\n# LLM_MODEL=llama3.1:8b\n# LLM_API_KEY=ollama\n\n# Example: Anthropic via custom provider\n# LLM_PROVIDER=my-anthropic\n# LLM_BASE_URL=https://api.anthropic.com/v1\n# LLM_API=anthropic-messages\n# LLM_MODEL=claude-sonnet-4-20250514\n# LLM_API_KEY=sk-ant-...\n\n# Example: OpenAI-compatible proxy\n# LLM_PROVIDER=my-proxy\n# LLM_BASE_URL=https://proxy.example.com/v1\n# LLM_MODEL=gpt-4\n# LLM_API_KEY=sk-proxy-key...\n\n# ---------------------------------------------------------------------------\n# Legacy: native pi API keys (alternative to LLM_* vars above)\n# ---------------------------------------------------------------------------\n# Only needed if you prefer pi's built-in provider resolution via auth.json.\n# Not required when using the LLM_* custom provider approach above.\n\n# Anthropic\n# ANTHROPIC_API_KEY=sk-ant-...\n\n# OpenAI\n#OPENAI_API_KEY=sk-...\n\n# Google Gemini\n#GEMINI_API_KEY=...\n\n# DeepSeek\n#DEEPSEEK_API_KEY=...\n\n# Groq\n#GROQ_API_KEY=...\n\n# Mistral\n#MISTRAL_API_KEY=...\n\n# xAI (Grok)\n#XAI_API_KEY=...\n\n# OpenRouter\n#OPENROUTER_API_KEY=...\n\n# Hugging Face\n#HF_TOKEN=...\n\n# Cerebras\n#CEREBRAS_API_KEY=...\n\n# Fireworks\n#FIREWORKS_API_KEY=...\n\n# Together\n#TOGETHER_API_KEY=...\n\n# Vercel AI Gateway\n#AI_GATEWAY_API_KEY=...\n\n# Other supported providers (see pi docs/providers.md):\n#   Azure OpenAI    → AZURE_OPENAI_API_KEY\n#   Z.AI            → ZAI_API_KEY\n#   Opencode        → OPENCODE_API_KEY\n#   Kimi Coding     → KIMI_API_KEY\n#   MiniMax         → MINIMAX_API_KEY\n#   Xiaomi          → XIAOMI_API_KEY\n#   Together        → TOGETHER_API_KEY\n\n# ---------------------------------------------------------------------------\n# Legacy: default provider & model (alternative to LLM_*)\n# ---------------------------------------------------------------------------\n# Only needed with the auth.json-based native provider approach above.\n# When using LLM_PROVIDER/LLM_MODEL, those are used automatically.\n\n# PI_DEFAULT_PROVIDER=anthropic\n# PI_DEFAULT_MODEL=claude-sonnet-4-20250514\n\n# ---------------------------------------------------------------------------\n# Optional: thinking level (applies to both LLM_* and PI_DEFAULT_*)\n# ---------------------------------------------------------------------------\n# \"off\" | \"low\" | \"medium\" | \"high\" | \"xhigh\"\n#LLM_THINKING=off\n#PI_DEFAULT_THINKING=off\n\n# ---------------------------------------------------------------------------\n# Optional: network settings\n# ---------------------------------------------------------------------------\n# PORT  — WebSocket listen port (default: 9876)\n# HOST  — Listen address (default: 0.0.0.0; set to 127.0.0.1 for host-net mode)\n#PORT=9876\n#HOST=0.0.0.0\n"}, "63a3e47f8788340b6037fb9a3315e7ac873a2bf0": {"t": 1785767497.2675345, "n": 3542, "h": "b8fa14c1eb3ba007", "c": "# =============================================================================\n# chrome-kb bridge — environment variables\n#\n# Copy this file to .env and fill in your values:\n#   cp .env.example .env\n#\n# The bridge auto-loads .env when present. No extra flags needed.\n# For Docker, pass it with --env-file:\n#   docker run -d \\\n#     --name chrome-kb-bridge \\\n#     -p 9876:9876 \\\n#     --env-file .env \\\n#     -v kb-data:/root/.pi/agent/kb \\\n#     chrome-kb-bridge\n#\n# NEVER commit .env to version control.\n# =============================================================================\n\n# ---------------------------------------------------------------------------\n# Bridge mode: \"local\" (no auth) or \"hosted\" (auth required)\n# ---------------------------------------------------------------------------\n#   local  — No login/signup. Extension connects directly. Default.\n#   hosted — Users must sign up and log in. Requires JWT_SECRET below.\n\nKEB_MODE=local\n\n# ---------------------------------------------------------------------------\n# Required for hosted mode: JWT secret for user authentication\n# ---------------------------------------------------------------------------\n# Generate a random secret:\n#   node -e \"console.log(require('crypto').randomBytes(32).toString('hex'))\"\n# In hosted mode, you MUST set this for sessions to survive restarts.\n\nJWT_SECRET=change-me-to-a-random-64-char-string\n\n# ---------------------------------------------------------------------------\n# Required: at least one LLM provider API key\n# ---------------------------------------------------------------------------\n# Pick the provider you use and uncomment its key.  Only one is needed,\n# but you can set multiple to switch providers via PI_DEFAULT_PROVIDER.\n\n# Anthropic\n# ANTHROPIC_API_KEY=sk-ant-...\n\n# OpenAI\n#OPENAI_API_KEY=sk-...\n\n# Google Gemini\n#GEMINI_API_KEY=...\n\n# DeepSeek\n#DEEPSEEK_API_KEY=...\n\n# Groq\n#GROQ_API_KEY=...\n\n# Mistral\n#MISTRAL_API_KEY=...\n\n# xAI (Grok)\n#XAI_API_KEY=...\n\n# OpenRouter\n#OPENROUTER_API_KEY=...\n\n# Hugging Face\n#HF_TOKEN=...\n\n# Cerebras\n#CEREBRAS_API_KEY=...\n\n# Fireworks\n#FIREWORKS_API_KEY=...\n\n# Together\n#TOGETHER_API_KEY=...\n\n# Vercel AI Gateway\n#AI_GATEWAY_API_KEY=...\n\n# Other supported providers (see pi docs/providers.md):\n#   Azure OpenAI    → AZURE_OPENAI_API_KEY\n#   Z.AI            → ZAI_API_KEY\n#   Opencode        → OPENCODE_API_KEY\n#   Kimi Coding     → KIMI_API_KEY\n#   MiniMax         → MINIMAX_API_KEY\n#   Xiaomi          → XIAOMI_API_KEY\n#   Together        → TOGETHER_API_KEY\n\n# ---------------------------------------------------------------------------\n# Recommended: default provider & model\n# ---------------------------------------------------------------------------\n# These tell pi which provider and model to use for KB operations.\n# If omitted, pi will ask interactively (which breaks in a headless container).\n\n# PI_DEFAULT_PROVIDER=anthropic\n# PI_DEFAULT_MODEL=claude-sonnet-4-20250514\n\n# ---------------------------------------------------------------------------\n# Optional: thinking level\n# ---------------------------------------------------------------------------\n# \"off\" | \"low\" | \"medium\" | \"high\" | \"xhigh\"\n#PI_DEFAULT_THINKING=off\n\n# ---------------------------------------------------------------------------\n# Optional: network settings\n# ---------------------------------------------------------------------------\n# PORT  — WebSocket listen port (default: 9876)\n# HOST  — Listen address (default: 0.0.0.0; set to 127.0.0.1 for host-net mode)\n#PORT=9876\n#HOST=0.0.0.0\n"}, "7b8f92975ba652db24c17dd632c0d7a04f389755": {"t": 1785767498.5760362, "n": 3145, "h": "f2771a1b28364850", "c": "# =============================================================================\n# chrome-kb bridge — environment variables\n#\n# Copy this file and fill in your values:\n#   cp .env.example .env\n#\n# Then run with --env-file (keeps secrets out of shell history / ps):\n#   docker run -d \\\n#     --name chrome-kb-bridge \\\n#     -p 9876:9876 \\\n#     --env-file .env \\\n#     -v kb-data:/root/.pi/agent/kb \\\n#     chrome-kb-bridge\n#\n# NEVER commit .env to version control.\n# =============================================================================\n\n# ---------------------------------------------------------------------------\n# Required: JWT secret for user authentication\n# ---------------------------------------------------------------------------\n# Generate a random secret:\n#   node -e \"console.log(require('crypto').randomBytes(32).toString('hex'))\"\n# In development, a random per-process secret is used if you omit this,\n# but sessions won't survive restarts.\n\nJWT_SECRET=change-me-to-a-random-64-char-string\n\n# ---------------------------------------------------------------------------\n# Required: at least one LLM provider API key\n# ---------------------------------------------------------------------------\n# Pick the provider you use and uncomment its key.  Only one is needed,\n# but you can set multiple to switch providers via PI_DEFAULT_PROVIDER.\n\n# Anthropic\nANTHROPIC_API_KEY=sk-ant-...\n\n# OpenAI\n#OPENAI_API_KEY=sk-...\n\n# Google Gemini\n#GEMINI_API_KEY=...\n\n# DeepSeek\n#DEEPSEEK_API_KEY=...\n\n# Groq\n#GROQ_API_KEY=...\n\n# Mistral\n#MISTRAL_API_KEY=...\n\n# xAI (Grok)\n#XAI_API_KEY=...\n\n# OpenRouter\n#OPENROUTER_API_KEY=...\n\n# Hugging Face\n#HF_TOKEN=...\n\n# Cerebras\n#CEREBRAS_API_KEY=...\n\n# Fireworks\n#FIREWORKS_API_KEY=...\n\n# Together\n#TOGETHER_API_KEY=...\n\n# Vercel AI Gateway\n#AI_GATEWAY_API_KEY=...\n\n# Other supported providers (see pi docs/providers.md):\n#   Azure OpenAI    → AZURE_OPENAI_API_KEY\n#   Z.AI            → ZAI_API_KEY\n#   Opencode        → OPENCODE_API_KEY\n#   Kimi Coding     → KIMI_API_KEY\n#   MiniMax         → MINIMAX_API_KEY\n#   Xiaomi          → XIAOMI_API_KEY\n#   Together        → TOGETHER_API_KEY\n\n# ---------------------------------------------------------------------------\n# Recommended: default provider & model\n# ---------------------------------------------------------------------------\n# These tell pi which provider and model to use for KB operations.\n# If omitted, pi will ask interactively (which breaks in a headless container).\n\nPI_DEFAULT_PROVIDER=anthropic\nPI_DEFAULT_MODEL=claude-sonnet-4-20250514\n\n# ---------------------------------------------------------------------------\n# Optional: thinking level\n# ---------------------------------------------------------------------------\n# \"off\" | \"low\" | \"medium\" | \"high\" | \"xhigh\"\n#PI_DEFAULT_THINKING=off\n\n# ---------------------------------------------------------------------------\n# Optional: network settings\n# ---------------------------------------------------------------------------\n# PORT  — WebSocket listen port (default: 9876)\n# HOST  — Listen address (default: 0.0.0.0; set to 127.0.0.1 for host-net mode)\n#PORT=9876\n#HOST=0.0.0.0\n"}, "95ff0e0fc770d088319f4a7c2280eb58494e159a": {"t": 1785767499.874633, "n": 2676, "h": "824706f4474b1bde", "c": "# =============================================================================\n# chrome-kb bridge — environment variables\n#\n# Copy this file and fill in your values:\n#   cp .env.example .env\n#\n# Then run with --env-file (keeps secrets out of shell history / ps):\n#   docker run -d \\\n#     --name chrome-kb-bridge \\\n#     -p 9876:9876 \\\n#     --env-file .env \\\n#     -v kb-data:/root/.pi/agent/kb \\\n#     chrome-kb-bridge\n#\n# NEVER commit .env to version control.\n# =============================================================================\n\n# ---------------------------------------------------------------------------\n# Required: at least one LLM provider API key\n# ---------------------------------------------------------------------------\n# Pick the provider you use and uncomment its key.  Only one is needed,\n# but you can set multiple to switch providers via PI_DEFAULT_PROVIDER.\n\n# Anthropic\nANTHROPIC_API_KEY=sk-ant-...\n\n# OpenAI\n#OPENAI_API_KEY=sk-...\n\n# Google Gemini\n#GEMINI_API_KEY=...\n\n# DeepSeek\n#DEEPSEEK_API_KEY=...\n\n# Groq\n#GROQ_API_KEY=...\n\n# Mistral\n#MISTRAL_API_KEY=...\n\n# xAI (Grok)\n#XAI_API_KEY=...\n\n# OpenRouter\n#OPENROUTER_API_KEY=...\n\n# Hugging Face\n#HF_TOKEN=...\n\n# Cerebras\n#CEREBRAS_API_KEY=...\n\n# Fireworks\n#FIREWORKS_API_KEY=...\n\n# Together\n#TOGETHER_API_KEY=...\n\n# Vercel AI Gateway\n#AI_GATEWAY_API_KEY=...\n\n# Other supported providers (see pi docs/providers.md):\n#   Azure OpenAI    → AZURE_OPENAI_API_KEY\n#   Z.AI            → ZAI_API_KEY\n#   Opencode        → OPENCODE_API_KEY\n#   Kimi Coding     → KIMI_API_KEY\n#   MiniMax         → MINIMAX_API_KEY\n#   Xiaomi          → XIAOMI_API_KEY\n#   Together        → TOGETHER_API_KEY\n\n# ---------------------------------------------------------------------------\n# Recommended: default provider & model\n# ---------------------------------------------------------------------------\n# These tell pi which provider and model to use for KB operations.\n# If omitted, pi will ask interactively (which breaks in a headless container).\n\nPI_DEFAULT_PROVIDER=anthropic\nPI_DEFAULT_MODEL=claude-sonnet-4-20250514\n\n# ---------------------------------------------------------------------------\n# Optional: thinking level\n# ---------------------------------------------------------------------------\n# \"off\" | \"low\" | \"medium\" | \"high\" | \"xhigh\"\n#PI_DEFAULT_THINKING=off\n\n# ---------------------------------------------------------------------------\n# Optional: network settings\n# ---------------------------------------------------------------------------\n# PORT  — WebSocket listen port (default: 9876)\n# HOST  — Listen address (default: 0.0.0.0; set to 127.0.0.1 for host-net mode)\n#PORT=9876\n#HOST=0.0.0.0\n"}}, "packages/bridge/Dockerfile": {"13c55d7e65986b6616d1f7c7f6bff15837aabb9e": {"t": 1785747005.0978115, "n": 7335, "h": "1aaeda9aad93c76a", "c": "# =============================================================================\n# Dockerfile for keb bridge\n#\n# Build:\n#   docker build -f packages/bridge/Dockerfile -t keb-bridge .\n#\n# Run (recommended: env file with custom provider — keeps secrets out of\n# shell history):\n#   cp .env.example .env   # fill in LLM_PROVIDER, LLM_BASE_URL, LLM_MODEL, etc.\n#   docker run -d \\\n#     --name keb-bridge \\\n#     -p 9876:9876 \\\n#     --env-file .env \\\n#     -v keb-data:/root/.pi/agent/keb \\\n#     keb-bridge\n#\n# Run (mount host pi config files directly):\n#   docker run -d \\\n#     --name keb-bridge \\\n#     -p 9876:9876 \\\n#     -v ~/.pi/agent/models.json:/root/.pi/agent/models.json:ro \\\n#     -v keb-data:/root/.pi/agent/keb \\\n#     keb-bridge\n#\n# Environment variables:\n#\n#   Primary — custom provider via models.json (recommended):\n#     LLM_PROVIDER   — Provider name/slug (e.g., \"ollama\", \"my-provider\")\n#     LLM_BASE_URL   — API base URL\n#     LLM_MODEL      — Model ID (e.g., \"llama3.1:8b\", \"gpt-4\")\n#     LLM_API        — API type (default: \"openai-completions\"; see pi\n#                      docs/models.md for \"anthropic-messages\", etc.)\n#     LLM_API_KEY    — API key (can be dummy for local models like Ollama)\n#     LLM_MODEL_NAME — Optional human-readable model name\n#     LLM_REASONING  — Set \"true\" for reasoning-capable models\n#\n#   Legacy — native pi providers (auth.json + PI_DEFAULT_*):\n#     ANTHROPIC_API_KEY, OPENAI_API_KEY, DEEPSEEK_API_KEY, GEMINI_API_KEY,\n#     ... (see pi docs/providers.md for full list)\n#     PI_DEFAULT_PROVIDER, PI_DEFAULT_MODEL, PI_DEFAULT_THINKING\n#\n#   Bridge mode:\n#     KEB_MODE  — \"hosted\" (default, requires auth) or \"local\"\n#     JWT_SECRET — required in hosted mode; generate with:\n#                  node -e \"console.log(require('crypto').randomBytes(32).toString('hex'))\"\n#\n#   Network:\n#     PORT  — WebSocket listen port (default: 9876)\n#     HOST  — Listen address (default: 0.0.0.0; set to 127.0.0.1 for\n#             local-only access when binding to host network)\n#\n# Volume mounts:\n#   models.json            — mount host's ~/.pi/agent/models.json (overrides\n#                            LLM_* env vars when present)\n#   auth.json              — legacy: mount host's ~/.pi/agent/auth.json\n#   settings.json          — mount for additional settings overrides\n#   keb-data                — persistent volume for Keb documents and user database\n#                            (recommended — stores both workspace content and\n#                            users.db with registered accounts)\n# =============================================================================\n\nFROM node:22-slim AS base\n\n# Install system dependencies needed by pi (git for extension installs)\nRUN apt-get update && apt-get install -y --no-install-recommends \\\n    git \\\n    ca-certificates \\\n    && rm -rf /var/lib/apt/lists/*\n\n# ---------------------------------------------------------------------------\n# pi CLI layer — install globally once\n# ---------------------------------------------------------------------------\nFROM base AS pi-layer\n\n# TODO: pin to a specific version for reproducible builds\nARG PI_VERSION=latest\n\nRUN npm install -g --ignore-scripts @earendil-works/pi-coding-agent@${PI_VERSION} && \\\n    pi install git:github.com/auto-medica-labs/pi-keb\n\n# ---------------------------------------------------------------------------\n# Bridge dependencies layer — install npm deps\n# ---------------------------------------------------------------------------\nFROM base AS deps-layer\n\nWORKDIR /app\n\n# Copy only the bridge package manifest\nCOPY packages/bridge/package.json /app/bridge/package.json\n\n# Install ALL dependencies (including devDeps like typescript for pi-keb build)\nWORKDIR /app/bridge\nRUN npm install\n\n# ---------------------------------------------------------------------------\n# pi-keb standalone build layer — compile adapter files\n# ---------------------------------------------------------------------------\nFROM deps-layer AS pi-keb-build\n\n# Copy the pi-keb source files needed for compilation (preserve dir structure)\nCOPY packages/pi-keb/extensions /app/pi-keb/extensions\n\n# Copy the bridge's pi-keb build tsconfig and build script\nCOPY packages/bridge/tsconfig.build-pi-keb.json /app/bridge/tsconfig.build-pi-keb.json\nCOPY packages/bridge/scripts/build-pi-keb.js /app/bridge/scripts/build-pi-keb.js\n\n# Compile pi-keb standalone adapter to JS (uses build-pi-keb.js which\n# post-processes output to add .js extensions for Node ESM resolution)\nWORKDIR /app/bridge\nRUN PATH=\"/app/bridge/node_modules/.bin:$PATH\" node scripts/build-pi-keb.js\n\n# ---------------------------------------------------------------------------\n# Final stage — minimal runtime image\n# ---------------------------------------------------------------------------\nFROM node:22-slim\n\n# Install only ca-certificates and git for pi extension checks\nRUN apt-get update && apt-get install -y --no-install-recommends \\\n    git \\\n    ca-certificates \\\n    && rm -rf /var/lib/apt/lists/*\n\n# Copy pi CLI + pi-keb from the pi-layer\nCOPY --from=pi-layer /usr/local/lib/node_modules/@earendil-works/pi-coding-agent \\\n    /usr/local/lib/node_modules/@earendil-works/pi-coding-agent\n# Don't COPY pi directly — it's a symlink in the pi-layer and Docker\n# COPY follows symlinks, resolving to the file content, which breaks\n# its relative imports (./config.js, ./core/*). Instead, create the\n# symlink manually so Node resolves imports relative to the package dir.\nRUN ln -sf ../lib/node_modules/@earendil-works/pi-coding-agent/dist/cli.js /usr/local/bin/pi\n\n# Copy pi-keb extension + installed packages manifest from the pi-layer.\n# pi-layer ran `pi install git:github.com/auto-medica-labs/pi-keb` which cloned\n# the extension to ~/.pi/agent/git/ and wrote a settings.json with the\n# packages list. The entrypoint merges LLM_* or PI_DEFAULT_* env vars\n# into this settings.json to set defaultProvider/defaultModel.\nCOPY --from=pi-layer /root/.pi/agent /root/.pi/agent\n\n# Copy bridge node_modules (production) from deps-layer\n# Use a fresh npm install --omit=dev to keep the image small\nCOPY packages/bridge/package.json /app/bridge/package.json\nWORKDIR /app/bridge\nRUN npm install --omit=dev\n\n# Copy pi-keb compiled standalone output from pi-keb-build stage\nCOPY --from=pi-keb-build /app/pi-keb/dist/standalone /app/pi-keb/dist/standalone\n\n# Copy entrypoint and bridge source code\nCOPY packages/bridge/entrypoint.sh /app/bridge/entrypoint.sh\nCOPY packages/bridge/src /app/bridge/src\n\nWORKDIR /app/bridge\n\n# Expose the WebSocket port\nEXPOSE 9876\n\n# Health check — hit /api/healthcheck (works in both local and hosted modes)\nHEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \\\n    CMD node -e \"require('http').get('http://127.0.0.1:'+(process.env.PORT||9876)+'/api/healthcheck',function(r){var d='';r.on('data',function(c){d+=c});r.on('end',function(){var j=JSON.parse(d);process.exit(j.status==='ok'?0:1)})}).on('error',function(){process.exit(1)})\"\n\n# Default to hosted mode (auth with JWT required).\n# Override KEB_MODE=local for local-only deployments.\nENV KEB_MODE=hosted\n\n# Default listen on all interfaces (inside the container) so Docker\n# port mapping works. Override HOST=127.0.0.1 for host-network mode.\nENV HOST=0.0.0.0\nENV PORT=9876\n\nENTRYPOINT [\"/bin/sh\", \"entrypoint.sh\"]\nCMD []\n"}, "f8c3b42273c25a59d02ae270831365bdb9903186": {"t": 1785767489.96056, "n": 7335, "h": "1aaeda9aad93c76a", "c": "# =============================================================================\n# Dockerfile for keb bridge\n#\n# Build:\n#   docker build -f packages/bridge/Dockerfile -t keb-bridge .\n#\n# Run (recommended: env file with custom provider — keeps secrets out of\n# shell history):\n#   cp .env.example .env   # fill in LLM_PROVIDER, LLM_BASE_URL, LLM_MODEL, etc.\n#   docker run -d \\\n#     --name keb-bridge \\\n#     -p 9876:9876 \\\n#     --env-file .env \\\n#     -v keb-data:/root/.pi/agent/keb \\\n#     keb-bridge\n#\n# Run (mount host pi config files directly):\n#   docker run -d \\\n#     --name keb-bridge \\\n#     -p 9876:9876 \\\n#     -v ~/.pi/agent/models.json:/root/.pi/agent/models.json:ro \\\n#     -v keb-data:/root/.pi/agent/keb \\\n#     keb-bridge\n#\n# Environment variables:\n#\n#   Primary — custom provider via models.json (recommended):\n#     LLM_PROVIDER   — Provider name/slug (e.g., \"ollama\", \"my-provider\")\n#     LLM_BASE_URL   — API base URL\n#     LLM_MODEL      — Model ID (e.g., \"llama3.1:8b\", \"gpt-4\")\n#     LLM_API        — API type (default: \"openai-completions\"; see pi\n#                      docs/models.md for \"anthropic-messages\", etc.)\n#     LLM_API_KEY    — API key (can be dummy for local models like Ollama)\n#     LLM_MODEL_NAME — Optional human-readable model name\n#     LLM_REASONING  — Set \"true\" for reasoning-capable models\n#\n#   Legacy — native pi providers (auth.json + PI_DEFAULT_*):\n#     ANTHROPIC_API_KEY, OPENAI_API_KEY, DEEPSEEK_API_KEY, GEMINI_API_KEY,\n#     ... (see pi docs/providers.md for full list)\n#     PI_DEFAULT_PROVIDER, PI_DEFAULT_MODEL, PI_DEFAULT_THINKING\n#\n#   Bridge mode:\n#     KEB_MODE  — \"hosted\" (default, requires auth) or \"local\"\n#     JWT_SECRET — required in hosted mode; generate with:\n#                  node -e \"console.log(require('crypto').randomBytes(32).toString('hex'))\"\n#\n#   Network:\n#     PORT  — WebSocket listen port (default: 9876)\n#     HOST  — Listen address (default: 0.0.0.0; set to 127.0.0.1 for\n#             local-only access when binding to host network)\n#\n# Volume mounts:\n#   models.json            — mount host's ~/.pi/agent/models.json (overrides\n#                            LLM_* env vars when present)\n#   auth.json              — legacy: mount host's ~/.pi/agent/auth.json\n#   settings.json          — mount for additional settings overrides\n#   keb-data                — persistent volume for Keb documents and user database\n#                            (recommended — stores both workspace content and\n#                            users.db with registered accounts)\n# =============================================================================\n\nFROM node:22-slim AS base\n\n# Install system dependencies needed by pi (git for extension installs)\nRUN apt-get update && apt-get install -y --no-install-recommends \\\n    git \\\n    ca-certificates \\\n    && rm -rf /var/lib/apt/lists/*\n\n# ---------------------------------------------------------------------------\n# pi CLI layer — install globally once\n# ---------------------------------------------------------------------------\nFROM base AS pi-layer\n\n# TODO: pin to a specific version for reproducible builds\nARG PI_VERSION=latest\n\nRUN npm install -g --ignore-scripts @earendil-works/pi-coding-agent@${PI_VERSION} && \\\n    pi install git:github.com/auto-medica-labs/pi-keb\n\n# ---------------------------------------------------------------------------\n# Bridge dependencies layer — install npm deps\n# ---------------------------------------------------------------------------\nFROM base AS deps-layer\n\nWORKDIR /app\n\n# Copy only the bridge package manifest\nCOPY packages/bridge/package.json /app/bridge/package.json\n\n# Install ALL dependencies (including devDeps like typescript for pi-keb build)\nWORKDIR /app/bridge\nRUN npm install\n\n# ---------------------------------------------------------------------------\n# pi-keb standalone build layer — compile adapter files\n# ---------------------------------------------------------------------------\nFROM deps-layer AS pi-keb-build\n\n# Copy the pi-keb source files needed for compilation (preserve dir structure)\nCOPY packages/pi-keb/extensions /app/pi-keb/extensions\n\n# Copy the bridge's pi-keb build tsconfig and build script\nCOPY packages/bridge/tsconfig.build-pi-keb.json /app/bridge/tsconfig.build-pi-keb.json\nCOPY packages/bridge/scripts/build-pi-keb.js /app/bridge/scripts/build-pi-keb.js\n\n# Compile pi-keb standalone adapter to JS (uses build-pi-keb.js which\n# post-processes output to add .js extensions for Node ESM resolution)\nWORKDIR /app/bridge\nRUN PATH=\"/app/bridge/node_modules/.bin:$PATH\" node scripts/build-pi-keb.js\n\n# ---------------------------------------------------------------------------\n# Final stage — minimal runtime image\n# ---------------------------------------------------------------------------\nFROM node:22-slim\n\n# Install only ca-certificates and git for pi extension checks\nRUN apt-get update && apt-get install -y --no-install-recommends \\\n    git \\\n    ca-certificates \\\n    && rm -rf /var/lib/apt/lists/*\n\n# Copy pi CLI + pi-keb from the pi-layer\nCOPY --from=pi-layer /usr/local/lib/node_modules/@earendil-works/pi-coding-agent \\\n    /usr/local/lib/node_modules/@earendil-works/pi-coding-agent\n# Don't COPY pi directly — it's a symlink in the pi-layer and Docker\n# COPY follows symlinks, resolving to the file content, which breaks\n# its relative imports (./config.js, ./core/*). Instead, create the\n# symlink manually so Node resolves imports relative to the package dir.\nRUN ln -sf ../lib/node_modules/@earendil-works/pi-coding-agent/dist/cli.js /usr/local/bin/pi\n\n# Copy pi-keb extension + installed packages manifest from the pi-layer.\n# pi-layer ran `pi install git:github.com/auto-medica-labs/pi-keb` which cloned\n# the extension to ~/.pi/agent/git/ and wrote a settings.json with the\n# packages list. The entrypoint merges LLM_* or PI_DEFAULT_* env vars\n# into this settings.json to set defaultProvider/defaultModel.\nCOPY --from=pi-layer /root/.pi/agent /root/.pi/agent\n\n# Copy bridge node_modules (production) from deps-layer\n# Use a fresh npm install --omit=dev to keep the image small\nCOPY packages/bridge/package.json /app/bridge/package.json\nWORKDIR /app/bridge\nRUN npm install --omit=dev\n\n# Copy pi-keb compiled standalone output from pi-keb-build stage\nCOPY --from=pi-keb-build /app/pi-keb/dist/standalone /app/pi-keb/dist/standalone\n\n# Copy entrypoint and bridge source code\nCOPY packages/bridge/entrypoint.sh /app/bridge/entrypoint.sh\nCOPY packages/bridge/src /app/bridge/src\n\nWORKDIR /app/bridge\n\n# Expose the WebSocket port\nEXPOSE 9876\n\n# Health check — hit /api/healthcheck (works in both local and hosted modes)\nHEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \\\n    CMD node -e \"require('http').get('http://127.0.0.1:'+(process.env.PORT||9876)+'/api/healthcheck',function(r){var d='';r.on('data',function(c){d+=c});r.on('end',function(){var j=JSON.parse(d);process.exit(j.status==='ok'?0:1)})}).on('error',function(){process.exit(1)})\"\n\n# Default to hosted mode (auth with JWT required).\n# Override KEB_MODE=local for local-only deployments.\nENV KEB_MODE=hosted\n\n# Default listen on all interfaces (inside the container) so Docker\n# port mapping works. Override HOST=127.0.0.1 for host-network mode.\nENV HOST=0.0.0.0\nENV PORT=9876\n\nENTRYPOINT [\"/bin/sh\", \"entrypoint.sh\"]\nCMD []\n"}, "771e15fab8108c626ce09e90785f8685b52f9d9b": {"t": 1785767491.529394, "n": 7250, "h": "1dc6d234183ed2f2", "c": "# =============================================================================\n# Dockerfile for keb bridge\n#\n# Build:\n#   docker build -f packages/bridge/Dockerfile -t keb-bridge .\n#\n# Run (recommended: env file with custom provider — keeps secrets out of\n# shell history):\n#   cp .env.example .env   # fill in LLM_PROVIDER, LLM_BASE_URL, LLM_MODEL, etc.\n#   docker run -d \\\n#     --name keb-bridge \\\n#     -p 9876:9876 \\\n#     --env-file .env \\\n#     -v keb-data:/root/.pi/agent/keb \\\n#     keb-bridge\n#\n# Run (mount host pi config files directly):\n#   docker run -d \\\n#     --name keb-bridge \\\n#     -p 9876:9876 \\\n#     -v ~/.pi/agent/models.json:/root/.pi/agent/models.json:ro \\\n#     -v keb-data:/root/.pi/agent/keb \\\n#     keb-bridge\n#\n# Environment variables:\n#\n#   Primary — custom provider via models.json (recommended):\n#     LLM_PROVIDER   — Provider name/slug (e.g., \"ollama\", \"my-provider\")\n#     LLM_BASE_URL   — API base URL\n#     LLM_MODEL      — Model ID (e.g., \"llama3.1:8b\", \"gpt-4\")\n#     LLM_API        — API type (default: \"openai-completions\"; see pi\n#                      docs/models.md for \"anthropic-messages\", etc.)\n#     LLM_API_KEY    — API key (can be dummy for local models like Ollama)\n#     LLM_MODEL_NAME — Optional human-readable model name\n#     LLM_REASONING  — Set \"true\" for reasoning-capable models\n#\n#   Legacy — native pi providers (auth.json + PI_DEFAULT_*):\n#     ANTHROPIC_API_KEY, OPENAI_API_KEY, DEEPSEEK_API_KEY, GEMINI_API_KEY,\n#     ... (see pi docs/providers.md for full list)\n#     PI_DEFAULT_PROVIDER, PI_DEFAULT_MODEL, PI_DEFAULT_THINKING\n#\n#   Bridge mode:\n#     KEB_MODE  — \"hosted\" (default, requires auth) or \"local\"\n#     JWT_SECRET — required in hosted mode; generate with:\n#                  node -e \"console.log(require('crypto').randomBytes(32).toString('hex'))\"\n#\n#   Network:\n#     PORT  — WebSocket listen port (default: 9876)\n#     HOST  — Listen address (default: 0.0.0.0; set to 127.0.0.1 for\n#             local-only access when binding to host network)\n#\n# Volume mounts:\n#   models.json            — mount host's ~/.pi/agent/models.json (overrides\n#                            LLM_* env vars when present)\n#   auth.json              — legacy: mount host's ~/.pi/agent/auth.json\n#   settings.json          — mount for additional settings overrides\n#   keb-data                — persistent volume for Keb documents and user database\n#                            (recommended — stores both workspace content and\n#                            users.db with registered accounts)\n# =============================================================================\n\nFROM node:22-slim AS base\n\n# Install system dependencies needed by pi (git for extension installs)\nRUN apt-get update && apt-get install -y --no-install-recommends \\\n    git \\\n    ca-certificates \\\n    && rm -rf /var/lib/apt/lists/*\n\n# ---------------------------------------------------------------------------\n# pi CLI layer — install globally once\n# ---------------------------------------------------------------------------\nFROM base AS pi-layer\n\n# TODO: pin to a specific version for reproducible builds\nARG PI_VERSION=latest\n\nRUN npm install -g --ignore-scripts @earendil-works/pi-coding-agent@${PI_VERSION} && \\\n    pi install git:github.com/auto-medica-labs/pi-keb\n\n# ---------------------------------------------------------------------------\n# Bridge dependencies layer — install npm deps\n# ---------------------------------------------------------------------------\nFROM base AS deps-layer\n\nWORKDIR /app\n\n# Copy only the bridge package manifest\nCOPY packages/bridge/package.json /app/bridge/package.json\n\n# Install ALL dependencies (including devDeps like typescript for pi-keb build)\nWORKDIR /app/bridge\nRUN npm install\n\n# ---------------------------------------------------------------------------\n# pi-keb standalone build layer — compile adapter files\n# ---------------------------------------------------------------------------\nFROM deps-layer AS pi-keb-build\n\n# Copy the pi-keb source files needed for compilation (preserve dir structure)\nCOPY packages/pi-keb/extensions /app/pi-keb/extensions\n\n# Copy the bridge's pi-keb build tsconfig\nCOPY packages/bridge/tsconfig.build-pi-keb.json /app/bridge/tsconfig.build-pi-keb.json\n\n# Compile pi-keb standalone adapter to JS\nWORKDIR /app/bridge\nRUN npx tsc -p tsconfig.build-pi-keb.json && \\\n    node -e \"require('fs').writeFileSync('../pi-keb/dist/standalone/package.json', JSON.stringify({type:'module'})+String.fromCharCode(10))\"\n\n# ---------------------------------------------------------------------------\n# Final stage — minimal runtime image\n# ---------------------------------------------------------------------------\nFROM node:22-slim\n\n# Install only ca-certificates and git for pi extension checks\nRUN apt-get update && apt-get install -y --no-install-recommends \\\n    git \\\n    ca-certificates \\\n    && rm -rf /var/lib/apt/lists/*\n\n# Copy pi CLI + pi-keb from the pi-layer\nCOPY --from=pi-layer /usr/local/lib/node_modules/@earendil-works/pi-coding-agent \\\n    /usr/local/lib/node_modules/@earendil-works/pi-coding-agent\n# Don't COPY pi directly — it's a symlink in the pi-layer and Docker\n# COPY follows symlinks, resolving to the file content, which breaks\n# its relative imports (./config.js, ./core/*). Instead, create the\n# symlink manually so Node resolves imports relative to the package dir.\nRUN ln -sf ../lib/node_modules/@earendil-works/pi-coding-agent/dist/cli.js /usr/local/bin/pi\n\n# Copy pi-keb extension + installed packages manifest from the pi-layer.\n# pi-layer ran `pi install git:github.com/auto-medica-labs/pi-keb` which cloned\n# the extension to ~/.pi/agent/git/ and wrote a settings.json with the\n# packages list. The entrypoint merges LLM_* or PI_DEFAULT_* env vars\n# into this settings.json to set defaultProvider/defaultModel.\nCOPY --from=pi-layer /root/.pi/agent /root/.pi/agent\n\n# Copy bridge node_modules (production) from deps-layer\n# Use a fresh npm install --omit=dev to keep the image small\nCOPY packages/bridge/package.json /app/bridge/package.json\nWORKDIR /app/bridge\nRUN npm install --omit=dev\n\n# Copy pi-keb compiled standalone output from pi-keb-build stage\nCOPY --from=pi-keb-build /app/pi-keb/dist/standalone /app/pi-keb/dist/standalone\n\n# Copy entrypoint and bridge source code\nCOPY packages/bridge/entrypoint.sh /app/bridge/entrypoint.sh\nCOPY packages/bridge/src /app/bridge/src\n\nWORKDIR /app/bridge\n\n# Expose the WebSocket port\nEXPOSE 9876\n\n# Health check — hit /api/healthcheck (works in both local and hosted modes)\nHEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \\\n    CMD node -e \"require('http').get('http://127.0.0.1:'+(process.env.PORT||9876)+'/api/healthcheck',function(r){var d='';r.on('data',function(c){d+=c});r.on('end',function(){var j=JSON.parse(d);process.exit(j.status==='ok'?0:1)})}).on('error',function(){process.exit(1)})\"\n\n# Default to hosted mode (auth with JWT required).\n# Override KEB_MODE=local for local-only deployments.\nENV KEB_MODE=hosted\n\n# Default listen on all interfaces (inside the container) so Docker\n# port mapping works. Override HOST=127.0.0.1 for host-network mode.\nENV HOST=0.0.0.0\nENV PORT=9876\n\nENTRYPOINT [\"/bin/sh\", \"entrypoint.sh\"]\nCMD []\n"}, "04edde8eace290ca0357c5db49136b78c86627b2": {"t": 1785767492.929355, "n": 7245, "h": "8e413deeef52238c", "c": "# =============================================================================\n# Dockerfile for chrome-kb bridge\n#\n# Build:\n#   docker build -f packages/bridge/Dockerfile -t chrome-kb-bridge .\n#\n# Run (recommended: env file with custom provider — keeps secrets out of\n# shell history):\n#   cp .env.example .env   # fill in LLM_PROVIDER, LLM_BASE_URL, LLM_MODEL, etc.\n#   docker run -d \\\n#     --name chrome-kb-bridge \\\n#     -p 9876:9876 \\\n#     --env-file .env \\\n#     -v kb-data:/root/.pi/agent/kb \\\n#     chrome-kb-bridge\n#\n# Run (mount host pi config files directly):\n#   docker run -d \\\n#     --name chrome-kb-bridge \\\n#     -p 9876:9876 \\\n#     -v ~/.pi/agent/models.json:/root/.pi/agent/models.json:ro \\\n#     -v kb-data:/root/.pi/agent/kb \\\n#     chrome-kb-bridge\n#\n# Environment variables:\n#\n#   Primary — custom provider via models.json (recommended):\n#     LLM_PROVIDER   — Provider name/slug (e.g., \"ollama\", \"my-provider\")\n#     LLM_BASE_URL   — API base URL\n#     LLM_MODEL      — Model ID (e.g., \"llama3.1:8b\", \"gpt-4\")\n#     LLM_API        — API type (default: \"openai-completions\"; see pi\n#                      docs/models.md for \"anthropic-messages\", etc.)\n#     LLM_API_KEY    — API key (can be dummy for local models like Ollama)\n#     LLM_MODEL_NAME — Optional human-readable model name\n#     LLM_REASONING  — Set \"true\" for reasoning-capable models\n#\n#   Legacy — native pi providers (auth.json + PI_DEFAULT_*):\n#     ANTHROPIC_API_KEY, OPENAI_API_KEY, DEEPSEEK_API_KEY, GEMINI_API_KEY,\n#     ... (see pi docs/providers.md for full list)\n#     PI_DEFAULT_PROVIDER, PI_DEFAULT_MODEL, PI_DEFAULT_THINKING\n#\n#   Bridge mode:\n#     KEB_MODE  — \"hosted\" (default, requires auth) or \"local\"\n#     JWT_SECRET — required in hosted mode; generate with:\n#                  node -e \"console.log(require('crypto').randomBytes(32).toString('hex'))\"\n#\n#   Network:\n#     PORT  — WebSocket listen port (default: 9876)\n#     HOST  — Listen address (default: 0.0.0.0; set to 127.0.0.1 for\n#             local-only access when binding to host network)\n#\n# Volume mounts:\n#   models.json            — mount host's ~/.pi/agent/models.json (overrides\n#                            LLM_* env vars when present)\n#   auth.json              — legacy: mount host's ~/.pi/agent/auth.json\n#   settings.json          — mount for additional settings overrides\n#   kb-data                — persistent volume for KB documents and user database\n#                            (recommended — stores both workspace content and\n#                            users.db with registered accounts)\n# =============================================================================\n\nFROM node:22-slim AS base\n\n# Install system dependencies needed by pi (git for extension installs)\nRUN apt-get update && apt-get install -y --no-install-recommends \\\n    git \\\n    ca-certificates \\\n    && rm -rf /var/lib/apt/lists/*\n\n# ---------------------------------------------------------------------------\n# pi CLI layer — install globally once\n# ---------------------------------------------------------------------------\nFROM base AS pi-layer\n\n# TODO: pin to a specific version for reproducible builds\nARG PI_VERSION=latest\n\nRUN npm install -g --ignore-scripts @earendil-works/pi-coding-agent@${PI_VERSION} && \\\n    pi install git:github.com/dheerapat/pi-kb\n\n# ---------------------------------------------------------------------------\n# Bridge dependencies layer — install npm deps\n# ---------------------------------------------------------------------------\nFROM base AS deps-layer\n\nWORKDIR /app\n\n# Copy only the bridge package manifest\nCOPY packages/bridge/package.json /app/bridge/package.json\n\n# Install ALL dependencies (including devDeps like typescript for pi-kb build)\nWORKDIR /app/bridge\nRUN npm install\n\n# ---------------------------------------------------------------------------\n# pi-kb standalone build layer — compile adapter files\n# ---------------------------------------------------------------------------\nFROM deps-layer AS pi-kb-build\n\n# Copy the pi-kb source files needed for compilation (preserve dir structure)\nCOPY packages/pi-kb/extensions /app/pi-kb/extensions\n\n# Copy the bridge's pi-kb build tsconfig\nCOPY packages/bridge/tsconfig.build-pi-kb.json /app/bridge/tsconfig.build-pi-kb.json\n\n# Compile pi-kb standalone adapter to JS\nWORKDIR /app/bridge\nRUN npx tsc -p tsconfig.build-pi-kb.json && \\\n    node -e \"require('fs').writeFileSync('../pi-kb/dist/standalone/package.json', JSON.stringify({type:'module'})+String.fromCharCode(10))\"\n\n# ---------------------------------------------------------------------------\n# Final stage — minimal runtime image\n# ---------------------------------------------------------------------------\nFROM node:22-slim\n\n# Install only ca-certificates and git for pi extension checks\nRUN apt-get update && apt-get install -y --no-install-recommends \\\n    git \\\n    ca-certificates \\\n    && rm -rf /var/lib/apt/lists/*\n\n# Copy pi CLI + pi-kb from the pi-layer\nCOPY --from=pi-layer /usr/local/lib/node_modules/@earendil-works/pi-coding-agent \\\n    /usr/local/lib/node_modules/@earendil-works/pi-coding-agent\n# Don't COPY pi directly — it's a symlink in the pi-layer and Docker\n# COPY follows symlinks, resolving to the file content, which breaks\n# its relative imports (./config.js, ./core/*). Instead, create the\n# symlink manually so Node resolves imports relative to the package dir.\nRUN ln -sf ../lib/node_modules/@earendil-works/pi-coding-agent/dist/cli.js /usr/local/bin/pi\n\n# Copy pi-kb extension + installed packages manifest from the pi-layer.\n# pi-layer ran `pi install git:github.com/dheerapat/pi-kb` which cloned\n# the extension to ~/.pi/agent/git/ and wrote a settings.json with the\n# packages list. The entrypoint merges LLM_* or PI_DEFAULT_* env vars\n# into this settings.json to set defaultProvider/defaultModel.\nCOPY --from=pi-layer /root/.pi/agent /root/.pi/agent\n\n# Copy bridge node_modules (production) from deps-layer\n# Use a fresh npm install --omit=dev to keep the image small\nCOPY packages/bridge/package.json /app/bridge/package.json\nWORKDIR /app/bridge\nRUN npm install --omit=dev\n\n# Copy pi-kb compiled standalone output from pi-kb-build stage\nCOPY --from=pi-kb-build /app/pi-kb/dist/standalone /app/pi-kb/dist/standalone\n\n# Copy entrypoint and bridge source code\nCOPY packages/bridge/entrypoint.sh /app/bridge/entrypoint.sh\nCOPY packages/bridge/src /app/bridge/src\n\nWORKDIR /app/bridge\n\n# Expose the WebSocket port\nEXPOSE 9876\n\n# Health check — hit /api/healthcheck (works in both local and hosted modes)\nHEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \\\n    CMD node -e \"require('http').get('http://127.0.0.1:'+(process.env.PORT||9876)+'/api/healthcheck',function(r){var d='';r.on('data',function(c){d+=c});r.on('end',function(){var j=JSON.parse(d);process.exit(j.status==='ok'?0:1)})}).on('error',function(){process.exit(1)})\"\n\n# Default to hosted mode (auth with JWT required).\n# Override KEB_MODE=local for local-only deployments.\nENV KEB_MODE=hosted\n\n# Default listen on all interfaces (inside the container) so Docker\n# port mapping works. Override HOST=127.0.0.1 for host-network mode.\nENV HOST=0.0.0.0\nENV PORT=9876\n\nENTRYPOINT [\"/bin/sh\", \"entrypoint.sh\"]\nCMD []\n"}, "ea33043a167bb2b2895f929f5c224834f8c17d70": {"t": 1785767494.2623348, "n": 7118, "h": "af5f8d5a9f0e0753", "c": "# =============================================================================\n# Dockerfile for chrome-kb bridge\n#\n# Build:\n#   docker build -f packages/bridge/Dockerfile -t chrome-kb-bridge .\n#\n# Run (recommended: env file with custom provider — keeps secrets out of\n# shell history):\n#   cp .env.example .env   # fill in LLM_PROVIDER, LLM_BASE_URL, LLM_MODEL, etc.\n#   docker run -d \\\n#     --name chrome-kb-bridge \\\n#     -p 9876:9876 \\\n#     --env-file .env \\\n#     -v kb-data:/root/.pi/agent/kb \\\n#     chrome-kb-bridge\n#\n# Run (mount host pi config files directly):\n#   docker run -d \\\n#     --name chrome-kb-bridge \\\n#     -p 9876:9876 \\\n#     -v ~/.pi/agent/models.json:/root/.pi/agent/models.json:ro \\\n#     -v kb-data:/root/.pi/agent/kb \\\n#     chrome-kb-bridge\n#\n# Environment variables:\n#\n#   Primary — custom provider via models.json (recommended):\n#     LLM_PROVIDER   — Provider name/slug (e.g., \"ollama\", \"my-provider\")\n#     LLM_BASE_URL   — API base URL\n#     LLM_MODEL      — Model ID (e.g., \"llama3.1:8b\", \"gpt-4\")\n#     LLM_API        — API type (default: \"openai-completions\"; see pi\n#                      docs/models.md for \"anthropic-messages\", etc.)\n#     LLM_API_KEY    — API key (can be dummy for local models like Ollama)\n#     LLM_MODEL_NAME — Optional human-readable model name\n#     LLM_REASONING  — Set \"true\" for reasoning-capable models\n#\n#   Legacy — native pi providers (auth.json + PI_DEFAULT_*):\n#     ANTHROPIC_API_KEY, OPENAI_API_KEY, DEEPSEEK_API_KEY, GEMINI_API_KEY,\n#     ... (see pi docs/providers.md for full list)\n#     PI_DEFAULT_PROVIDER, PI_DEFAULT_MODEL, PI_DEFAULT_THINKING\n#\n#   Bridge mode:\n#     KEB_MODE  — \"hosted\" (default, requires auth) or \"local\"\n#     JWT_SECRET — required in hosted mode; generate with:\n#                  node -e \"console.log(require('crypto').randomBytes(32).toString('hex'))\"\n#\n#   Network:\n#     PORT  — WebSocket listen port (default: 9876)\n#     HOST  — Listen address (default: 0.0.0.0; set to 127.0.0.1 for\n#             local-only access when binding to host network)\n#\n# Volume mounts:\n#   models.json            — mount host's ~/.pi/agent/models.json (overrides\n#                            LLM_* env vars when present)\n#   auth.json              — legacy: mount host's ~/.pi/agent/auth.json\n#   settings.json          — mount for additional settings overrides\n#   kb-data                — persistent volume for KB documents and user database\n#                            (recommended — stores both workspace content and\n#                            users.db with registered accounts)\n# =============================================================================\n\nFROM node:22-slim AS base\n\n# Install system dependencies needed by pi (git for extension installs)\nRUN apt-get update && apt-get install -y --no-install-recommends \\\n    git \\\n    ca-certificates \\\n    && rm -rf /var/lib/apt/lists/*\n\n# ---------------------------------------------------------------------------\n# pi CLI layer — install globally once\n# ---------------------------------------------------------------------------\nFROM base AS pi-layer\n\n# TODO: pin to a specific version for reproducible builds\nARG PI_VERSION=latest\n\nRUN npm install -g --ignore-scripts @earendil-works/pi-coding-agent@${PI_VERSION} && \\\n    pi install git:github.com/dheerapat/pi-kb\n\n# ---------------------------------------------------------------------------\n# Bridge dependencies layer — install npm deps\n# ---------------------------------------------------------------------------\nFROM base AS deps-layer\n\nWORKDIR /app\n\n# Copy only the bridge package manifest\nCOPY packages/bridge/package.json /app/bridge/package.json\n\n# Install ALL dependencies (including devDeps like typescript for pi-kb build)\nWORKDIR /app/bridge\nRUN npm install\n\n# ---------------------------------------------------------------------------\n# pi-kb standalone build layer — compile adapter files\n# ---------------------------------------------------------------------------\nFROM deps-layer AS pi-kb-build\n\n# Copy the pi-kb source files needed for compilation (preserve dir structure)\nCOPY packages/pi-kb/extensions /app/pi-kb/extensions\n\n# Copy the bridge's pi-kb build tsconfig\nCOPY packages/bridge/tsconfig.build-pi-kb.json /app/bridge/tsconfig.build-pi-kb.json\n\n# Compile pi-kb standalone adapter to JS\nWORKDIR /app/bridge\nRUN npx tsc -p tsconfig.build-pi-kb.json && \\\n    node -e \"require('fs').writeFileSync('../pi-kb/dist/standalone/package.json', JSON.stringify({type:'module'})+String.fromCharCode(10))\"\n\n# ---------------------------------------------------------------------------\n# Final stage — minimal runtime image\n# ---------------------------------------------------------------------------\nFROM node:22-slim\n\n# Install only ca-certificates and git for pi extension checks\nRUN apt-get update && apt-get install -y --no-install-recommends \\\n    git \\\n    ca-certificates \\\n    && rm -rf /var/lib/apt/lists/*\n\n# Copy pi CLI + pi-kb from the pi-layer\nCOPY --from=pi-layer /usr/local/lib/node_modules/@earendil-works/pi-coding-agent \\\n    /usr/local/lib/node_modules/@earendil-works/pi-coding-agent\n# Don't COPY pi directly — it's a symlink in the pi-layer and Docker\n# COPY follows symlinks, resolving to the file content, which breaks\n# its relative imports (./config.js, ./core/*). Instead, create the\n# symlink manually so Node resolves imports relative to the package dir.\nRUN ln -sf ../lib/node_modules/@earendil-works/pi-coding-agent/dist/cli.js /usr/local/bin/pi\n\n# Copy pi-kb extension + installed packages manifest from the pi-layer.\n# pi-layer ran `pi install git:github.com/dheerapat/pi-kb` which cloned\n# the extension to ~/.pi/agent/git/ and wrote a settings.json with the\n# packages list. The entrypoint merges LLM_* or PI_DEFAULT_* env vars\n# into this settings.json to set defaultProvider/defaultModel.\nCOPY --from=pi-layer /root/.pi/agent /root/.pi/agent\n\n# Copy bridge node_modules (production) from deps-layer\n# Use a fresh npm install --omit=dev to keep the image small\nCOPY packages/bridge/package.json /app/bridge/package.json\nWORKDIR /app/bridge\nRUN npm install --omit=dev\n\n# Copy pi-kb compiled standalone output from pi-kb-build stage\nCOPY --from=pi-kb-build /app/pi-kb/dist/standalone /app/pi-kb/dist/standalone\n\n# Copy entrypoint and bridge source code\nCOPY packages/bridge/entrypoint.sh /app/bridge/entrypoint.sh\nCOPY packages/bridge/src /app/bridge/src\n\nWORKDIR /app/bridge\n\n# Expose the WebSocket port\nEXPOSE 9876\n\n# Health check — verify the bridge is responding\nHEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \\\n    CMD node -e \"new (require('ws').WebSocket)('ws://127.0.0.1:'+(process.env.PORT||9876)+'/').on('open',function(){process.exit(0)}).on('error',function(){process.exit(1)})\"\n\n# Default to hosted mode (auth with JWT required).\n# Override KEB_MODE=local for local-only deployments.\nENV KEB_MODE=hosted\n\n# Default listen on all interfaces (inside the container) so Docker\n# port mapping works. Override HOST=127.0.0.1 for host-network mode.\nENV HOST=0.0.0.0\nENV PORT=9876\n\nENTRYPOINT [\"/bin/sh\", \"entrypoint.sh\"]\nCMD []\n"}, "7b8f92975ba652db24c17dd632c0d7a04f389755": {"t": 1785767495.4704328, "n": 6212, "h": "68cd1995bcd7fb62", "c": "# =============================================================================\n# Dockerfile for chrome-kb bridge\n#\n# Build:\n#   docker build -f packages/bridge/Dockerfile -t chrome-kb-bridge .\n#\n# Run (recommended: env file — keeps secrets out of shell history):\n#   cp .env.example .env   # then fill in your API keys\n#   docker run -d \\\n#     --name chrome-kb-bridge \\\n#     -p 9876:9876 \\\n#     --env-file .env \\\n#     -v kb-data:/root/.pi/agent/kb \\\n#     chrome-kb-bridge\n#\n# Run (mount host pi config):\n#   docker run -d \\\n#     --name chrome-kb-bridge \\\n#     -p 9876:9876 \\\n#     -v ~/.pi/agent/auth.json:/root/.pi/agent/auth.json:ro \\\n#     -v ~/.pi/agent/settings.json:/root/.pi/agent/settings.json:ro \\\n#     -v kb-data:/root/.pi/agent/kb \\\n#     chrome-kb-bridge\n#\n# Environment variables:\n#   PORT                   — WebSocket listen port (default: 9876)\n#   HOST                   — Listen address (default: 0.0.0.0; set to 127.0.0.1\n#                            for local-only access when binding to host network)\n#\n#   LLM provider API keys (standard pi names):\n#     ANTHROPIC_API_KEY    — Anthropic Claude\n#     OPENAI_API_KEY       — OpenAI\n#     DEEPSEEK_API_KEY     — DeepSeek\n#     GEMINI_API_KEY       — Google Gemini\n#     ... (see pi docs/providers.md for full list)\n#\n#   PI_DEFAULT_PROVIDER    — default provider name (e.g. \"anthropic\")\n#   PI_DEFAULT_MODEL       — default model ID (e.g. \"claude-sonnet-4-20250514\")\n#   PI_DEFAULT_THINKING    — default thinking level (\"off\"|\"low\"|\"medium\"|\"high\"|\"xhigh\")\n#\n# Volume mounts:\n#   auth.json              — mount host's ~/.pi/agent/auth.json for credentials\n#   settings.json          — mount for default provider/model selection\n#   models.json            — mount for custom provider/model definitions\n#   kb-data                — persistent volume for KB documents (recommended)\n# =============================================================================\n\nFROM node:22-slim AS base\n\n# Install system dependencies needed by pi (git for extension installs)\nRUN apt-get update && apt-get install -y --no-install-recommends \\\n    git \\\n    ca-certificates \\\n    && rm -rf /var/lib/apt/lists/*\n\n# ---------------------------------------------------------------------------\n# pi CLI layer — install globally once\n# ---------------------------------------------------------------------------\nFROM base AS pi-layer\n\n# TODO: pin to a specific version for reproducible builds\nARG PI_VERSION=latest\n\nRUN npm install -g --ignore-scripts @earendil-works/pi-coding-agent@${PI_VERSION} && \\\n    pi install git:github.com/dheerapat/pi-kb\n\n# ---------------------------------------------------------------------------\n# Bridge dependencies layer — install npm deps\n# ---------------------------------------------------------------------------\nFROM base AS deps-layer\n\nWORKDIR /app\n\n# Copy only the bridge package manifest\nCOPY packages/bridge/package.json /app/bridge/package.json\n\n# Install ALL dependencies (including devDeps like typescript for pi-kb build)\nWORKDIR /app/bridge\nRUN npm install\n\n# ---------------------------------------------------------------------------\n# pi-kb standalone build layer — compile adapter files\n# ---------------------------------------------------------------------------\nFROM deps-layer AS pi-kb-build\n\n# Copy the pi-kb source files needed for compilation (preserve dir structure)\nCOPY packages/pi-kb/extensions /app/pi-kb/extensions\n\n# Copy the bridge's pi-kb build tsconfig\nCOPY packages/bridge/tsconfig.build-pi-kb.json /app/bridge/tsconfig.build-pi-kb.json\n\n# Compile pi-kb standalone adapter to JS\nWORKDIR /app/bridge\nRUN npx tsc -p tsconfig.build-pi-kb.json && \\\n    node -e \"require('fs').writeFileSync('../pi-kb/dist/standalone/package.json', JSON.stringify({type:'module'})+String.fromCharCode(10))\"\n\n# ---------------------------------------------------------------------------\n# Final stage — minimal runtime image\n# ---------------------------------------------------------------------------\nFROM node:22-slim\n\n# Install only ca-certificates and git for pi extension checks\nRUN apt-get update && apt-get install -y --no-install-recommends \\\n    git \\\n    ca-certificates \\\n    && rm -rf /var/lib/apt/lists/*\n\n# Copy pi CLI + pi-kb from the pi-layer\nCOPY --from=pi-layer /usr/local/lib/node_modules/@earendil-works/pi-coding-agent \\\n    /usr/local/lib/node_modules/@earendil-works/pi-coding-agent\n# Don't COPY pi directly — it's a symlink in the pi-layer and Docker\n# COPY follows symlinks, resolving to the file content, which breaks\n# its relative imports (./config.js, ./core/*). Instead, create the\n# symlink manually so Node resolves imports relative to the package dir.\nRUN ln -sf ../lib/node_modules/@earendil-works/pi-coding-agent/dist/cli.js /usr/local/bin/pi\n\n# Copy pi-kb extension + installed packages manifest from the pi-layer.\n# pi-layer ran `pi install git:github.com/dheerapat/pi-kb` which cloned\n# the extension to ~/.pi/agent/git/ and wrote a settings.json with the\n# packages list. The entrypoint merges PI_DEFAULT_* env vars into this.\nCOPY --from=pi-layer /root/.pi/agent /root/.pi/agent\n\n# Copy bridge node_modules (production) from deps-layer\n# Use a fresh npm install --omit=dev to keep the image small\nCOPY packages/bridge/package.json /app/bridge/package.json\nWORKDIR /app/bridge\nRUN npm install --omit=dev\n\n# Copy pi-kb compiled standalone output from pi-kb-build stage\nCOPY --from=pi-kb-build /app/pi-kb/dist/standalone /app/pi-kb/dist/standalone\n\n# Copy entrypoint and bridge source code\nCOPY packages/bridge/entrypoint.sh /app/bridge/entrypoint.sh\nCOPY packages/bridge/src /app/bridge/src\n\nWORKDIR /app/bridge\n\n# Expose the WebSocket port\nEXPOSE 9876\n\n# Health check — verify the bridge is responding\nHEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \\\n    CMD node -e \"new (require('ws').WebSocket)('ws://127.0.0.1:'+(process.env.PORT||9876)+'/').on('open',function(){process.exit(0)}).on('error',function(){process.exit(1)})\"\n\n# Default listen on all interfaces (inside the container) so Docker\n# port mapping works. Override HOST=127.0.0.1 for host-network mode.\nENV HOST=0.0.0.0\nENV PORT=9876\n\nENTRYPOINT [\"/bin/sh\", \"entrypoint.sh\"]\nCMD []\n"}, "95ff0e0fc770d088319f4a7c2280eb58494e159a": {"t": 1785767496.9309392, "n": 5261, "h": "02092282ddb77a95", "c": "# =============================================================================\n# Dockerfile for chrome-kb bridge\n#\n# Build:\n#   docker build -f packages/bridge/Dockerfile -t chrome-kb-bridge .\n#\n# Run (recommended: env file — keeps secrets out of shell history):\n#   cp .env.example .env   # then fill in your API keys\n#   docker run -d \\\n#     --name chrome-kb-bridge \\\n#     -p 9876:9876 \\\n#     --env-file .env \\\n#     -v kb-data:/root/.pi/agent/kb \\\n#     chrome-kb-bridge\n#\n# Run (mount host pi config):\n#   docker run -d \\\n#     --name chrome-kb-bridge \\\n#     -p 9876:9876 \\\n#     -v ~/.pi/agent/auth.json:/root/.pi/agent/auth.json:ro \\\n#     -v ~/.pi/agent/settings.json:/root/.pi/agent/settings.json:ro \\\n#     -v kb-data:/root/.pi/agent/kb \\\n#     chrome-kb-bridge\n#\n# Environment variables:\n#   PORT                   — WebSocket listen port (default: 9876)\n#   HOST                   — Listen address (default: 0.0.0.0; set to 127.0.0.1\n#                            for local-only access when binding to host network)\n#\n#   LLM provider API keys (standard pi names):\n#     ANTHROPIC_API_KEY    — Anthropic Claude\n#     OPENAI_API_KEY       — OpenAI\n#     DEEPSEEK_API_KEY     — DeepSeek\n#     GEMINI_API_KEY       — Google Gemini\n#     ... (see pi docs/providers.md for full list)\n#\n#   PI_DEFAULT_PROVIDER    — default provider name (e.g. \"anthropic\")\n#   PI_DEFAULT_MODEL       — default model ID (e.g. \"claude-sonnet-4-20250514\")\n#   PI_DEFAULT_THINKING    — default thinking level (\"off\"|\"low\"|\"medium\"|\"high\"|\"xhigh\")\n#\n# Volume mounts:\n#   auth.json              — mount host's ~/.pi/agent/auth.json for credentials\n#   settings.json          — mount for default provider/model selection\n#   models.json            — mount for custom provider/model definitions\n#   kb-data                — persistent volume for KB documents (recommended)\n# =============================================================================\n\nFROM node:22-slim AS base\n\n# Install system dependencies needed by pi (git for extension installs)\nRUN apt-get update && apt-get install -y --no-install-recommends \\\n    git \\\n    ca-certificates \\\n    && rm -rf /var/lib/apt/lists/*\n\n# ---------------------------------------------------------------------------\n# pi CLI layer — install globally once\n# ---------------------------------------------------------------------------\nFROM base AS pi-layer\n\n# TODO: pin to a specific version for reproducible builds\nARG PI_VERSION=latest\n\nRUN npm install -g --ignore-scripts @earendil-works/pi-coding-agent@${PI_VERSION} && \\\n    pi install git:github.com/dheerapat/pi-kb\n\n# ---------------------------------------------------------------------------\n# Bridge dependencies layer — install npm deps\n# ---------------------------------------------------------------------------\nFROM base AS deps-layer\n\nWORKDIR /app\n\n# Copy only the bridge package manifest\nCOPY packages/bridge/package.json /app/bridge/package.json\n\n# Install production dependencies (only `ws` at runtime)\nWORKDIR /app/bridge\nRUN npm install --omit=dev\n\n# ---------------------------------------------------------------------------\n# Final stage — minimal runtime image\n# ---------------------------------------------------------------------------\nFROM node:22-slim\n\n# Install only ca-certificates and git for pi extension checks\nRUN apt-get update && apt-get install -y --no-install-recommends \\\n    git \\\n    ca-certificates \\\n    && rm -rf /var/lib/apt/lists/*\n\n# Copy pi CLI + pi-kb from the pi-layer\nCOPY --from=pi-layer /usr/local/lib/node_modules/@earendil-works/pi-coding-agent \\\n    /usr/local/lib/node_modules/@earendil-works/pi-coding-agent\n# Don't COPY pi directly — it's a symlink in the pi-layer and Docker\n# COPY follows symlinks, resolving to the file content, which breaks\n# its relative imports (./config.js, ./core/*). Instead, create the\n# symlink manually so Node resolves imports relative to the package dir.\nRUN ln -sf ../lib/node_modules/@earendil-works/pi-coding-agent/dist/cli.js /usr/local/bin/pi\n\n# Copy pi-kb extension + installed packages manifest from the pi-layer.\n# pi-layer ran `pi install git:github.com/dheerapat/pi-kb` which cloned\n# the extension to ~/.pi/agent/git/ and wrote a settings.json with the\n# packages list. The entrypoint merges PI_DEFAULT_* env vars into this.\nCOPY --from=pi-layer /root/.pi/agent /root/.pi/agent\n\n# Copy bridge node_modules from deps-layer\nCOPY --from=deps-layer /app/bridge/node_modules /app/bridge/node_modules\n\n# Copy entrypoint and bridge source code\nCOPY packages/bridge/entrypoint.sh /app/bridge/entrypoint.sh\nCOPY packages/bridge/src /app/bridge/src\nCOPY packages/bridge/package.json /app/bridge/package.json\n\nWORKDIR /app/bridge\n\n# Expose the WebSocket port\nEXPOSE 9876\n\n# Health check — verify the bridge is responding\nHEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \\\n    CMD node -e \"new (require('ws').WebSocket)('ws://127.0.0.1:'+(process.env.PORT||9876)+'/').on('open',function(){process.exit(0)}).on('error',function(){process.exit(1)})\"\n\n# Default listen on all interfaces (inside the container) so Docker\n# port mapping works. Override HOST=127.0.0.1 for host-network mode.\nENV HOST=0.0.0.0\nENV PORT=9876\n\nENTRYPOINT [\"/bin/sh\", \"entrypoint.sh\"]\nCMD []\n"}}}}