Environment variables
Environment variables read by the donmai CLI and daemon.
Environment variables complement ~/.donmai/daemon.yaml. Most are optional
overrides; a few are the primary source for credentials that should not be
stored in config files.
Never commit credentials to config files
Tokens such as WORKER_API_KEY and DONMAI_DAEMON_TOKEN should be set as
environment variables or in a secrets manager - not written to
~/.donmai/daemon.yaml. The config file supports ${ENV_VAR} substitution
for any value so you can reference them safely.
Setting credentials
# Add to ~/.zshrc or ~/.bashrc
export WORKER_API_KEY=rsk_...
export DONMAI_DAEMON_TOKEN=...# ~/.donmai/daemon.yaml
orchestrator:
authToken: ${DONMAI_DAEMON_TOKEN}Authentication
WORKER_API_KEY
Type: string - rsk_* prefixed API token
Primary API key for authenticating the CLI against the orchestrator. Takes
precedence over DONMAI_API_TOKEN when both are set.
export WORKER_API_KEY=rsk_...DONMAI_API_TOKEN
Type: string - API token
Fallback API token when WORKER_API_KEY is not set. Accepts both rsk_
prefixed API auth tokens and rsp_ prefixed registration tokens.
export DONMAI_API_TOKEN=rsk_...DONMAI_DAEMON_TOKEN
Type: string - bearer token
Auth token the daemon uses to authenticate with the orchestrator. Equivalent
to setting orchestrator.authToken in ~/.donmai/daemon.yaml, but safer to
keep out of the config file. Takes precedence over the config file value.
export DONMAI_DAEMON_TOKEN=...Networking
WORKER_API_URL
Type: string - URL
Base URL of the orchestrator API. Overrides the default (http://localhost:3000)
and the orchestrator.url value in daemon.yaml.
export WORKER_API_URL=https://platform.donmai.devDONMAI_BASE_URL
Type: string - URL
Alternative base URL override. Checked by the envcompat shim layer.
Fallback from legacy AF_BASE_URL.
Architectural intelligence
These variables tune donmai arch assess, the built-in architectural drift
detector. See the architectural intelligence
page for the full command reference and gate policies.
DONMAI_DRIFT_GATE
Type: string - gate policy
Controls the exit code of donmai arch assess. One of:
| Value | Behavior |
|---|---|
none | Never gate - always exit 0. |
no-severity-high | Block (exit 1) on any high-severity deviation. (default) |
zero-deviations | Block on any deviation at all. |
max:N | Block when total deviations exceed N. |
The --gate-policy flag overrides this variable per invocation.
export DONMAI_DRIFT_GATE=zero-deviationsDONMAI_ARCH_BIN
Type: string - file path
Optional - the native path is primary
donmai arch assess runs entirely in-process by default. DONMAI_ARCH_BIN
is only needed to opt into the legacy exec-shim to the external
@donmai/architectural-intelligence TypeScript package; leave it unset to use
the native Go implementation.
Explicit override for the legacy architectural-intelligence binary. When set,
donmai arch execs this binary instead of the native diff/gate path. When
unset, donmai runs its built-in implementation (it does not fall back to
discovering an external binary unless one named donmai-arch is on PATH).
Legacy name AGENTFACTORY_ARCH_BIN is accepted with a deprecation warning.
export DONMAI_ARCH_BIN=/usr/local/bin/donmai-archPaths
DONMAI_CODE_BIN
Type: string - file path
Path to the code-intelligence binary. Legacy name AGENTFACTORY_CODE_BIN is
accepted with a deprecation warning.
Kit trust
DONMAI_KIT_TRUST_MODE
Type: string - trust mode
Overrides the compiled-in default signature-verification policy
(signed-by-allowlist). Set to permissive to opt out of signature
enforcement (not recommended outside development). See the trust block
in the config reference.
export DONMAI_KIT_TRUST_MODE=permissiveProvisioning
DONMAI_PROVISIONING_TOKEN
Type: string - one-time token
Short-lived provisioning token used during donmai daemon setup to register
a new machine. Normally injected by the platform; operators rarely set this
manually.
Internal / daemon lifecycle
DONMAI_DAEMON
Type: string - sentinel value
Set by the daemon itself as a re-exec guard in the daemonize path. Do not
set this manually. Legacy name AF_DAEMON is accepted with a deprecation
warning.
Deprecation: legacy AGENTFACTORY_* and AF_* variables
The following legacy variable names are accepted with a deprecation warning for one release cycle. Set the new name to silence the warning.
| Legacy variable | Current name |
|---|---|
AGENTFACTORY_ARCH_BIN | DONMAI_ARCH_BIN |
AGENTFACTORY_CODE_BIN | DONMAI_CODE_BIN |
AF_BASE_URL | DONMAI_BASE_URL |
AF_DAEMON | DONMAI_DAEMON |
AF_PROVISIONING_TOKEN | DONMAI_PROVISIONING_TOKEN |
These fallbacks will be removed in a future release. Update scripts and CI pipelines to use the current names.