basant307/AI_Governance_Project

1/**2 * @license3 * Copyright 2025 Qwen Team4 * SPDX-License-Identifier: Apache-2.05 */6 7export const DEFAULT_EXCLUDED_ENV_VARS = ['DEBUG', 'DEBUG_MODE'];8 9export const ENV_CORRUPTED_PATH = 'QWEN_CODE_SETTINGS_CORRUPTED_PATH';10export const ENV_WAS_RECOVERED = 'QWEN_CODE_SETTINGS_WAS_RECOVERED';11 12// QWEN_HOME and QWEN_RUNTIME_DIR control where global state (settings, OAuth13// credentials, installation IDs, etc.) is written. A project `.env` must never14// redirect these — that would split global state between the real home and a15// project-controlled directory. Always excluded from project .env files,16// regardless of user-configurable `advanced.excludedEnvVars`.17export const PROJECT_ENV_HARDCODED_EXCLUSIONS = [18  'QWEN_HOME',19  'QWEN_RUNTIME_DIR',20  'QWEN_CODE_MCP_APPROVALS_PATH',21  'QWEN_CODE_TRUSTED_FOLDERS_PATH',22  ENV_CORRUPTED_PATH,23  ENV_WAS_RECOVERED,24  // QWEN_TLS_INSECURE (and NODE_TLS_REJECT_UNAUTHORIZED, which it mirrors)25  // disable TLS certificate verification for all outbound API connections. A26  // project `.env` must never enable either — that would let an untrusted repo27  // silently turn off MITM protection. Opt-in stays with the user via the28  // `--insecure` flag, the shell environment, or a home `.env`. The initial29  // `.env` load only consults this list, so both keys must be here (not just30  // RELOAD_EXCLUDED_KEYS, which only applies on reload).31  'QWEN_TLS_INSECURE',32  'NODE_TLS_REJECT_UNAUTHORIZED',33];34 35export const HOME_ENV_BOOTSTRAP_KEYS = [36  'QWEN_HOME',37  'QWEN_RUNTIME_DIR',38  'QWEN_CODE_MCP_APPROVALS_PATH',39  'QWEN_CODE_TRUSTED_FOLDERS_PATH',40] as const;41