Configuration reference

Website and storage

The Vercel project uses the repository root, Next.js and the .next build output selected in vercel.json. The public research pages require no secret environment values.

Persistent features need the optional Cloudflare D1 deployment path with applied migrations, or a newly implemented durable adapter for the Node runtime. Setting an environment string called DB does not supply the database object expected by the current code.

pnpm install --frozen-lockfile
pnpm build

# Alternative Cloudflare build, with a real D1 binding
pnpm build:cloudflare

Application-side configuration

• GITHUB_TOKEN: optional server credential for GitHub source checks and API limits.
• FORKD_AUTH_GATEWAY_SECRET: private shared credential for the trusted identity gateway.
• BUILD_RUNNER_URL and BUILD_RUNNER_SECRET: HTTPS job endpoint and shared runner authentication.
• BUILD_MODEL_LABEL: public model label; keep it consistent with the actual runner model.
• FORKD_PUBLIC_REPOSITORY: public owner/repository destination shown by the interface.
• FORKD_PRIVATE_TERMS: private JSON array used for publication and public-text filtering; never commit its actual values.
• ROBINHOOD_RPC_URL, FORKD_ROUTERS and OPERATOR_API_SECRET: chain verification, registered request-to-router mapping and settlement authority.
• FORKD_TOKEN_ADDRESS and FORKD_TREASURY_ADDRESS: real public deployment addresses, only after they exist.

Trusted runner configuration

Deploy runner/server.mjs as a separate long-running Node service, using its own package.json dependencies and a persistent RUNNER_DB_PATH volume. FORKD_APP_ORIGIN and RUNNER_PUBLIC_ORIGIN must use HTTPS.

OPENROUTER_API_KEY, OPENROUTER_MODEL, E2B_API_KEY and E2B_TEMPLATE supply the actual execution services. BUILD_RUNNER_SECRET must match the web configuration. MODEL_MAX_USD_PER_MILLION and SANDBOX_USD_PER_SECOND must be positive conservative cost ceilings verified for the selected services.

The runner also requires a nonempty private-term configuration before its public artifact service starts. Keep all secrets in the trusted service environment and out of the sandbox.

Optional public code publication

Configure FORKD_PUBLIC_REPOSITORY=Sixtytwocaptial/forkd and a repository-scoped GITHUB_PUBLISH_TOKEN in the trusted runner. Enable publication with FORKD_PUBLICATION_ENABLED=true only after those values and private publication rules are set.

The token needs repository contents access for the public destination. Prefer a scoped, expiring credential renewed outside the sandbox. The publisher creates job branches and commits; it does not merge or update the default branch.

Keep configuration in the correct service

OpenRouter, E2B and GitHub publishing credentials belong to the trusted runner. The web app needs only the authenticated runner endpoint and its own application credentials. A browser must never receive these secrets.

A variable being present does not prove a provider account is funded or a service works. Verify source reads, authenticated callbacks and accounting separately before enabling a paid execution path. Uploading the repository or deploying the interface does not start paid work.