Configuration

🌐 English | 中文

Configuration

Everything is configured via environment variables — a .env file in the repo root, or the launcher's setup wizard. The fully annotated list is .env.example. This page covers the variables you'll actually reach for.

Model / provider

Variable	Default	Purpose
LLM_PROVIDER	anthropic	anthropic | openai | glm | kimi | minimax | gemini.
ANTHROPIC_API_KEY	—	Main model key (required for the default provider).
ANTHROPIC_MODEL	current Claude	Model id.
OPENAI_API_KEY / OPENAI_BASE_URL / OPENAI_MODEL	—	Any OpenAI-compatible endpoint — this is how you run DeepSeek V4 Flash, Together, a local server, etc.
AUX_LLM_BASE_URL / AUX_LLM_API_KEY / AUX_LLM_MODEL / AUX_LLM_PROTOCOL	—	The second model. It reviews plans (Plan Protocol §7), classifies intent and authorization replies, judges learning, and distils fetched pages. Small and cheap is fine — different matters more than bigger.

⚠️ Footgun: if LLM_PROVIDER is empty/unset, the agent falls into mock mode (canned responses, no real model). Set it explicitly.

⚠️ Footgun: AUX_LLM_BASE_URL accepts a bare host (https://api.deepseek.com), a versioned base (…/v1), or a full endpoint — the resolver tolerates all three. Older builds only appended /chat/completions, which turned a bare host into a silent 404 that looked like a bad key. VISION_LLM_BASE_URL carries the identical footgun.

Leaving aux unset is not neutral: other aux jobs fall back to the main model, but the plan reviewer stops existing and plan verification degrades to its deterministic check alone.

Running on DeepSeek V4 Flash (the cheap path)

Set LLM_PROVIDER=openai and point OPENAI_BASE_URL / OPENAI_MODEL / OPENAI_API_KEY at DeepSeek's OpenAI-compatible endpoint. The plan/honesty/deep-reasoning mechanisms (why this works) are identical regardless of provider — a stronger model just trips the gates less often.

Capabilities

Variable	Default	Purpose
PHILONT_DEEP_EXPLORE	on	Multi-step deep-reasoning tool (Deep Reasoning).
PHILONT_MCP_BROWSER	off	Browser automation via Playwright MCP (MCP & Plugins).
PHILONT_AUTONOMOUS	on	Idle-time autonomous loop (Autonomy).
PHILONT_AUTONOMOUS_DAILY_TOKENS	20000	Daily token ceiling for the autonomous loop (plus per-tick / per-initiative caps — see Autonomy).
PHILONT_CONSCIENCE_GATE	off	LLM safety check on each outbound human-facing message (fail-open; one extra LLM call/reply when on).
PHILONT_PLAN_LOOP	on	The deterministic plan state machine for guide-driven tasks (Plan Protocol §7).
PHILONT_SPEC_COMPILE	off	Let the aux model compile a service guide into an authoritative contract. Off by default — a wrong call gets corrected by the service, a wrong contract has nothing to correct it.
PHILONT_ID_PROVENANCE	on	Refuse a write whose identifier appears in nothing the agent actually read this turn. Scoped to the plan loop's own tool runner (a first run reads everything fresh, so the corpus really does contain every legitimate id); scheduled and legacy turns do not pass through it.
PHILONT_LEARNING_JUDGE	on (shadow)	The learning judge scores each turn; today it logs and drives nothing.
PHILONT_SKILL_REPAIR	on	Idle-time repair of a callable recipe that failed its own re-verification.

Identity / direction / language

Variable	Default	Purpose
PHILONT_COMPASS_PATH	<install dir>/compass.md	Your compass — the drive leash + focus areas. Auto-created from compass.example.md on first start; git-ignored, so git pull never clobbers your edits. Restart after editing (no hot reload yet).
AGENT_LANGUAGE	auto	zh | en | auto. Resolution order is declaration > observed user locale > channel > mirror the message. It is the only source available on a turn with no user message — i.e. a proactive push, where the agent speaks first with nothing to mirror.

Storage / network / server

Variable	Default	Purpose
MEMORY_DB_PATH	~/.philont/memory/memory.sqlite	SQLite memory database path.
PHILONT_PORT	20266	Server port.
PHILONT_PROXY / HTTPS_PROXY	—	Global outbound proxy for all fetch traffic.

⚠️ Footgun: PHILONT_DOWNLOAD_DIR is case-sensitive.

Channels

Variable	Default	Purpose
TELEGRAM_ENABLED / WECHAT_ENABLED	off	Messaging channel gateways (most channel settings live in the Web UI Settings panel).

See Channels for the full setup of each.

Security note on exposure

⚠️ The Web UI ships without authentication and binds to localhost. Do not expose the port to the internet — put a reverse proxy with auth and TLS in front. See DEPLOYMENT.md and Permission & Security.

---

中文

English | 中文

配置

一切通过环境变量配置 —— 仓库根目录的 .env 文件,或 launcher 的首次向导。完整带注释清单见 .env.example。本页覆盖你真正会用到的变量。

模型 / 提供方

变量	默认	用途
LLM_PROVIDER	anthropic	anthropic | openai | glm | kimi | minimax | gemini。
ANTHROPIC_API_KEY	—	主模型 key(默认提供方必填)。
ANTHROPIC_MODEL	当前 Claude	模型 id。
OPENAI_API_KEY / OPENAI_BASE_URL / OPENAI_MODEL	—	任意 OpenAI 兼容端点 —— 这就是跑 DeepSeek V4 Flash 的方式,也适用于 Together、本地服务等。
AUX_LLM_BASE_URL / AUX_LLM_API_KEY / AUX_LLM_MODEL / AUX_LLM_PROTOCOL	—	第二个模型。它评审计划(计划协议 §7)、判定意图与授权回复、给学习打分、蒸馏抓取的网页。小而便宜完全够 —— 不同比更大更重要。

⚠️ 陷阱: 若 LLM_PROVIDER 为空/未设,agent 会落入 mock 模式(预设回复,无真实模型)。请显式设置。

⚠️ 陷阱: AUX_LLM_BASE_URL 三种写法都接受:光主机名(https://api.deepseek.com)、带版本的 base(…/v1)、或完整端点 —— 解析器都容忍。旧版本只会追加 /chat/completions,于是「光主机名」变成一个静默 404,看起来像 key 配错了。VISION_LLM_BASE_URL 有同一个坑。

不配 aux 不是中性选择:其它 aux 任务会退回主模型,但计划评审员会直接不存在,计划验证退化为只剩确定性检查。

跑在 DeepSeek V4 Flash 上(便宜路线)

设 LLM_PROVIDER=openai,把 OPENAI_BASE_URL / OPENAI_MODEL / OPENAI_API_KEY 指向 DeepSeek 的 OpenAI 兼容端点。plan/诚实/深度推理机制(为何有效)与提供方无关 —— 更强的模型只是更少触发这些门。

能力

变量	默认	用途
PHILONT_DEEP_EXPLORE	on	多步深度推理工具(深度推理)。
PHILONT_MCP_BROWSER	off	经 Playwright MCP 的浏览器自动化(MCP 与插件)。
PHILONT_AUTONOMOUS	on	空闲时自主回路(自主)。
PHILONT_AUTONOMOUS_DAILY_TOKENS	20000	自主回路的每日 token 上限(另有每 tick / 每 initiative 上限 —— 见自主)。
PHILONT_CONSCIENCE_GATE	off	对每条对人出站消息的 LLM 安全检查(fail-open;开启时每条回复多一次 LLM 调用)。
PHILONT_PLAN_LOOP	on	guide 驱动任务的确定性计划状态机(计划协议 §7)。
PHILONT_SPEC_COMPILE	off	让 aux 模型把服务 guide 编译成权威契约。默认关 —— 错的调用会被服务纠正,错的契约没有东西能纠正它。
PHILONT_ID_PROVENANCE	on	当写请求里的标识符在「本轮真正读到过的东西」里找不到时,拒绝它。仅作用于 plan loop 自己的工具运行器(首跑什么都是新读的,语料里确实含有每个合法 id);定时与 legacy 轮次不经过它。
PHILONT_LEARNING_JUDGE	on(shadow)	学习裁判给每轮打分;目前只记录,不驱动任何东西。
PHILONT_SKILL_REPAIR	on	空闲时修复「没通过自身复用校验」的 callable recipe。

身份 / 方向 / 语言

变量	默认	用途
PHILONT_COMPASS_PATH	<安装目录>/compass.md	你的指南针 —— 驱动 leash + 焦点。首次启动时从 compass.example.md 自动创建;被 git-ignore,git pull 不会覆盖你的编辑。改完需重启(暂无热重载)。
AGENT_LANGUAGE	auto	zh | en | auto。解析顺序为 显式声明 > 观察到的用户 locale > 渠道 > 镜像来信语言。它也是没有用户消息那种轮次唯一可用的来源 —— 即主动推送:agent 先开口,没有任何东西可镜像。

存储 / 网络 / 服务

变量	默认	用途
MEMORY_DB_PATH	~/.philont/memory/memory.sqlite	SQLite 记忆数据库路径。
PHILONT_PORT	20266	服务端口。
PHILONT_PROXY / HTTPS_PROXY	—	所有 fetch 流量的全局出站代理。

⚠️ 陷阱: PHILONT_DOWNLOAD_DIR 大小写敏感。

渠道

变量	默认	用途
TELEGRAM_ENABLED / WECHAT_ENABLED	off	消息渠道网关(多数渠道设置在 Web UI 的 Settings 面板)。

各渠道完整配置见 渠道。

关于暴露的安全提示

⚠️ Web UI 不带鉴权且绑定 localhost。不要把端口暴露到公网 —— 在前面放一个带鉴权和 TLS 的反向代理。见 DEPLOYMENT.md 与 权限与安全。