Configuration

Configuration

app/.env (baked into the bundle)

Copied from app/.env.example. Compiled by scripts/build-env.js into src/main/env.generated.ts.

Treat every key as public. The allowlist lives in scripts/env-schema.js. Build fails if names look like secrets (SECRET, PASSWORD, PRIVATE, *_TOKEN, CSC_*, APPLE_*, …).

Typical keys:

Key	Purpose
ANYLM_FIREBASE_PROJECT	Firebase project id
ANYLM_FIREBASE_API_KEY	Firebase web API key (identifier, not authz)
ANYLM_SITE_URL	Hosting / site URL override
ANYLM_OLLAMA_HOST / related	Ollama base URL
ANYLM_EMBED_MODEL	Embedding model name
ANYLM_PROXY_PORT	Default proxy port hint
ANYLM_MS_CLIENT_ID	Outlook public client

Runtime: app/src/main/env.ts merges generated values with process.env overrides (useful for dev).

Root .env.example

CI-only: GitHub publish token, Apple/Windows code-signing variables. Never copy these into app/.env.

web/.env.local

NEXT_PUBLIC_GITHUB_OWNER, NEXT_PUBLIC_GITHUB_REPO, optional GITHUB_TOKEN for higher rate limits. Keep tokens out of git.

Runtime settings file

llmeter-settings.json in Electron userData (via settings.ts):

• Theme / chrome preferences
• proxyEnabled, proxyPort
• Agents configuration
• Load protection cutoff
• Other user toggles

Not the same as bake-in env.

Registries on disk

File	Contents
anylm-tools.json	Custom tools + disabled builtins
anylm-skills.json	enabledBuiltins + custom skills
llmeter-projects.json	Projects / threads / refs metadata

Secrets inventory

Secret	Where it belongs
Google/GitHub OAuth client secrets	Firebase console only
Outlook	Public client id in app env; PKCE; no secret
User refresh/access tokens	OS keystore via token-store.ts
Code signing / GH publish	CI environment
anylm_ API keys	User/org created; hashed in Firestore

userData brand pin

main.ts pins the app userData brand to AnyLM. Changing the Electron display name to something that doesn’t keep that pin can split settings/projects into a new empty profile — especially (Dev) builds. Read the comment in main.ts before renaming.