# Nushell Runtime Environment Configuration
# Security: All paths are sandboxed and validated

# Core Nushell paths
NUSHELL_HOME={{taskserv.admin_user_home}}/nushell
NUSHELL_CONFIG_DIR={{taskserv.admin_user_home}}/.config/nushell
NUSHELL_DATA_DIR={{taskserv.admin_user_home}}/.local/share/nushell
NUSHELL_SCRIPTS_DIR={{taskserv.admin_user_home}}/nushell/scripts
NUSHELL_LIB_DIR={{taskserv.admin_user_home}}/nushell/lib

# Security settings
NUSHELL_EXECUTION_MODE={{taskserv.nushell_execution_mode | default("restricted")}}
NUSHELL_READONLY_MODE={{taskserv.nushell_readonly | default("true")}}
NUSHELL_NETWORK_ENABLED={{taskserv.nushell_network | default("false")}}
NUSHELL_MAX_MEMORY={{taskserv.nushell_max_memory | default("256MB")}}
NUSHELL_MAX_CPU_TIME={{taskserv.nushell_max_cpu_time | default("30s")}}

# Plugin configuration
NUSHELL_PLUGINS_ENABLED={{taskserv.nushell_plugins | default("false")}}
NUSHELL_PLUGIN_ALLOWLIST="{{taskserv.nushell_plugin_allowlist | default('nu_plugin_kcl,nu_plugin_tera,nu_plugin_polars')}}"

# Remote execution settings
NUSHELL_REMOTE_USER={{taskserv.admin_user}}
NUSHELL_REMOTE_TIMEOUT={{taskserv.nushell_remote_timeout | default("300")}}
NUSHELL_SESSION_TIMEOUT={{taskserv.nushell_session_timeout | default("900")}}

# Logging and audit
NUSHELL_LOG_LEVEL={{taskserv.nushell_log_level | default("info")}}
NUSHELL_AUDIT_ENABLED={{taskserv.nushell_audit | default("true")}}
NUSHELL_AUDIT_FILE={{taskserv.admin_user_home}}/nushell/audit.log

# KCL integration (optional)
KCL_ENABLED={{taskserv.kcl_enabled | default("false")}}
KCL_BINARY_PATH={{taskserv.kcl_binary_path | default("/usr/local/bin/kcl")}}

# Observability settings
NUSHELL_METRICS_ENABLED={{taskserv.nushell_metrics | default("true")}}
NUSHELL_TELEMETRY_ENDPOINT={{taskserv.nushell_telemetry_endpoint | default("")}}
NUSHELL_LOG_COLLECTION={{taskserv.nushell_log_collection | default("false")}}

# Environment restrictions
NUSHELL_ALLOWED_COMMANDS="{{taskserv.nushell_allowed_commands | default('ls,cat,grep,ps,df,free,uptime,systemctl,kubectl')}}"
NUSHELL_BLOCKED_COMMANDS="{{taskserv.nushell_blocked_commands | default('rm,mv,cp,chmod,chown,sudo,su')}}"
NUSHELL_ALLOWED_PATHS="{{taskserv.nushell_allowed_paths | default('/tmp,/var/log,/proc,/sys')}}"