Environment Variables

`NM_HOME`

Override the data directory.


Type	`string`
Default	`~/.no-mistakes`

When set, everything else moves under this root:

Global config: $NM_HOME/config.yaml
Gate repos: $NM_HOME/repos/<id>.git
Worktrees: $NM_HOME/worktrees/<repoID>/<runID>/, unless worktree_roots places a repository’s run worktrees elsewhere
Logs: $NM_HOME/logs/
Database: $NM_HOME/state.sqlite
Socket / PID / singleton lock: $NM_HOME/socket, $NM_HOME/daemon.pid, and $NM_HOME/daemon.lock
Managed agent server PID records: $NM_HOME/servers/
Local evaluation cases and registry: $NM_HOME/eval/ (created by automatic collection or an explicit no-mistakes eval command)
Managed service names get a short stable suffix derived from $NM_HOME so multiple installs don’t collide.

`NM_DAEMON_CONNECT_TIMEOUT`

Override how long a CLI client waits for an existing daemon socket to accept a connection before failing instead of hanging.


Type	`string` (Go duration)
Default	unset (falls back to the `daemon_connect_timeout` global config value, itself defaulting to `3s`)

Takes precedence over daemon_connect_timeout in config.yaml. An empty, unparsable, or non-positive value is ignored and the config value (or its default) is used instead.

`FORGEJO_BASE_URL`

Canonical Forgejo web base URL used for provider discovery and forgejo-axi commands.


Type	`URL`
Default	(none)

Set this for every SSH origin, because an SSH remote does not identify the canonical Forgejo web scheme, port, or path prefix. Also set it when an HTTPS origin uses a self-hosted hostname other than codeberg.org or one containing forgejo. Recognized HTTPS origins are detected automatically, including non-default ports and path prefixes inferred from the origin. When set, the host and prefix must match the repository’s upstream origin; credentials, query strings, and fragments are rejected.

`FORGEJO_TOKEN_<HOST_KEY>`

Preferred host-scoped token used by forgejo-axi for Forgejo PR and CI operations.


Type	`string`
Default	(none)

HOST_KEY is the uppercase URL host, including a non-default port, with each non-alphanumeric ASCII character replaced by its uppercase hexadecimal code point between underscores. For example, forgejo.example:8443 uses FORGEJO_TOKEN_FORGEJO_2E_EXAMPLE_3A_8443. Host-scoped names prevent credentials from being reused for a look-alike host.

`FORGEJO_TOKEN`

Generic Forgejo token fallback. When present, no-mistakes passes its name explicitly to forgejo-axi; prefer a host-scoped token when the daemon serves multiple Forgejo instances.


Type	`string`
Default	(none)

Tokens remain in the subprocess environment: no-mistakes never puts a token value in command arguments and redacts Forgejo token values from surfaced provider errors.

`FORGEJO_TIMEOUT_MS`

Per-request forgejo-axi timeout in positive integer milliseconds.


Type	`int`
Default	`15000`

The pipeline context still bounds and cancels the complete subprocess independently.

`FORGEJO_CA_FILE`

Path to a replacement CA trust bundle used by forgejo-axi for HTTPS requests.


Type	`string`
Default	(none)

This replaces rather than appends to the platform trust store. See Provider Integration for provider setup.

`NO_MISTAKES_BITBUCKET_EMAIL`

Bitbucket Cloud account email used for PR creation and CI monitoring.


Type	`string`
Default	(none; Bitbucket PR/CI steps skip when unset)

Used alongside NO_MISTAKES_BITBUCKET_API_TOKEN. See Provider Integration.

`NO_MISTAKES_BITBUCKET_API_TOKEN`

Bitbucket Cloud API token.


Type	`string`
Default	(none)

Get one from Bitbucket account settings.

`NO_MISTAKES_BITBUCKET_API_BASE_URL`

Override the Bitbucket Cloud API base URL.


Type	`string`
Default	`https://api.bitbucket.org/2.0`

Useful for mocking in tests or pointing at a proxy.

`AZURE_DEVOPS_EXT_PAT`

Azure DevOps Personal Access Token inherited by the daemon for non-interactive az CLI auth. Alternatively, authenticate the Azure DevOps extension with az devops login.


Type	`string`
Default	(none)

See Provider Integration.

`GITHUB_TOKEN`

GitHub token used to authenticate updater release asset downloads.


Type	`string`
Default	(none)

When set, the updater sends the token as a Bearer authorization header for release asset downloads. Version metadata is fetched anonymously from a GitHub release-asset manifest that is not subject to the unauthenticated REST rate limit. GITHUB_TOKEN takes precedence over GH_TOKEN; when neither variable is set, asset downloads remain anonymous. The token is not printed, logged, or persisted.

`GH_TOKEN`

Fallback GitHub token used by no-mistakes update when GITHUB_TOKEN is unset or empty.


Type	`string`
Default	(none)

See GITHUB_TOKEN for the updater’s authentication behavior and precedence.

`NO_MISTAKES_NO_UPDATE_CHECK`

Disable background update checks.


Type	`1` to disable, anything else to leave enabled
Default	unset (checks enabled)

Update checks run on every CLI invocation except update itself and version queries (--version / -v, which stay side-effect-free), fetch the GitHub release-asset channel manifest, cache the result in $NM_HOME/update-check.json, and print a one-line notification to stderr when a newer version is available. Dev builds (non-semver versions) suppress the check automatically.

`XDG_DATA_HOME`

Data directory used to discover OpenCode transcripts for intent extraction.


Type	`string`
Default	`~/.local/share`

When set, no-mistakes looks for OpenCode’s intent transcript database at $XDG_DATA_HOME/opencode/opencode.db. When unset, it falls back to ~/.local/share/opencode/opencode.db.

`GLAB_CONFIG_DIR`

Directory holding glab’s config.yml, consulted when detecting self-hosted GitLab.


Type	`string`
Default	(none)

When the upstream hostname carries no gitlab marker, no-mistakes reads glab’s configured hosts from $GLAB_CONFIG_DIR/config.yml to decide whether the host is a GitLab instance. It takes precedence over XDG_CONFIG_HOME. A selected forge_profiles entry overrides this variable for that run and removes GITLAB_TOKEN, GITLAB_ACCESS_TOKEN, OAUTH_TOKEN, CI_JOB_TOKEN, GLAB_ENABLE_CI_AUTOLOGIN, GITLAB_HOST, GL_HOST, GITLAB_URI, GITLAB_API_HOST, GITLAB_REPO, GITLAB_GROUP, REMOTE_ALIAS, and GIT_REMOTE_URL_VAR from all child processes. See Provider Integration.

`GH_CONFIG_DIR`

Directory holding gh’s hosts.yml, consulted when detecting self-hosted GitHub Enterprise.


Type	`string`
Default	(none)

When the upstream hostname is not github.com, no-mistakes reads gh’s configured hosts from $GH_CONFIG_DIR/hosts.yml to decide whether the host is a GitHub Enterprise instance. It takes precedence over XDG_CONFIG_HOME. A selected forge_profiles entry overrides this variable for that run and removes GH_TOKEN, GITHUB_TOKEN, GH_ENTERPRISE_TOKEN, GITHUB_ENTERPRISE_TOKEN, GH_HOST, and GH_REPO from all child processes. See Provider Integration.

`XDG_CONFIG_HOME`

Config directory used to locate glab’s config.yml for self-hosted GitLab detection, gh’s hosts.yml for self-hosted GitHub Enterprise detection, and tea’s config.yml for Gitea detection.


Type	`string`
Default	`~/.config`

When GLAB_CONFIG_DIR is unset, no-mistakes looks for glab’s configured hosts at $XDG_CONFIG_HOME/glab-cli/config.yml, falling back to ~/.config/glab-cli/config.yml when XDG_CONFIG_HOME is unset. When GH_CONFIG_DIR is unset, no-mistakes looks for gh’s configured hosts at $XDG_CONFIG_HOME/gh/hosts.yml, falling back to ~/.config/gh/hosts.yml when XDG_CONFIG_HOME is unset. tea has no CLI-specific override env var (unlike GLAB_CONFIG_DIR/GH_CONFIG_DIR); no-mistakes always looks for its configured logins at $XDG_CONFIG_HOME/tea/config.yml, falling back to ~/.config/tea/config.yml when XDG_CONFIG_HOME is unset. See Provider Integration.

`NO_MISTAKES_UMAMI_HOST`

Override the telemetry collection host.


Type	`URL`
Default	`https://a.kunchenguid.com`

When set, telemetry sends events to this host’s /api/send endpoint. If it is unset in a dev build, no-mistakes also checks a repo-local .env file for NO_MISTAKES_UMAMI_HOST. If no runtime value is found, it falls back to any host embedded at build time and then the default self-hosted Umami instance.

`NO_MISTAKES_UMAMI_WEBSITE_ID`

Override or enable the telemetry website ID.


Type	`string`
Default	embedded in Makefile and release builds; unset in unembedded dev builds

When set, telemetry uses this website ID at runtime. If it is unset in a dev build, no-mistakes also checks a repo-local .env file for NO_MISTAKES_UMAMI_WEBSITE_ID. If no runtime value is found, it falls back to any website ID embedded at build time.

When telemetry is enabled, no-mistakes sends command, run, approval, fix, and wizard events, completed step events with awaiting_approval, fix_review, or failed status, and pageviews for the human surfaces /wizard and /tui and the state-changing agent surfaces /axi/run, /axi/respond, and /axi/abort to Umami. Mutation pageviews are sent alongside command events, so command status and duration remain available. They include only flag-derived context: /axi/run records whether --yes, --intent, or --skip was present, and /axi/respond records the sanitized action and whether --yes was present.

Read-only surfaces (axi home, axi status, axi logs, status, runs) emit no telemetry at all, so agent status polling cannot flood remote analytics. Mutation surfaces (axi run, axi respond, axi abort, run lifecycle, approvals, and fixes) stay full-fidelity. Each explicit human CLI, AXI, or TUI branch-sync check/apply attempt emits one command event and no additional pageview. Its fields are bounded enums and booleans only: surface, mode, state, relation, target kind, pipeline phase, PR state, result, refusal reason, dirty state, and duration. It never sends a SHA, run ID, path, branch name, URL, remote name, or command argument.

What stays local and what leaves the machine

Everything sent remotely is low-cardinality: command names, statuses, durations, counts, flag booleans, agent names, fixed step categories, and - on the single terminal run finished event - the bounded performance rollup agent_invocations, resumed_invocations, and fallback_invocations (small counts only). Run IDs, repository paths, branch names, session identities, prompts, model outputs, diffs, and per-invocation performance records are never sent. Repository-declared gate labels stay local. Remote step, approval, fix, and failed-step fields record them as the fixed token gate.

Detailed performance evidence stays on the machine in the local state database (<NM_HOME>/state.sqlite): one agent_invocations row per agent invocation, plus each run’s accumulated parked-at-gate time. Each row records run and step identity, purpose (such as review/review-fix/housekeeping), the reported model and its provider, the cold/started/resumed/fallback session mode, a truncated session-identity hash, timestamps, duration, exit status, and failure category, alongside the session-fidelity metrics below. It never stores prompts, model outputs, diffs, raw command arguments, secret values, or credentials - only bounded counts, low-cardinality categories, and durations.

The additive session-fidelity fields are nullable and read back as unknown (rendered -) rather than a fabricated zero when the adapter did not report them, so rows written before a field existed, and adapters that do not surface a datum, stay honest. The legacy raw input, output, and cache-read token counters render numerically; use the nullable per-round and derived fields to determine whether the adapter reported comparable usage:

Token detail: input_tokens/output_tokens/cache_read_tokens (raw, cumulative across a resumed session for codex; per-invocation for pi), fresh_input_tokens (input minus cache reads), cache_creation_tokens (unknown when the provider does not surface it), reasoning_tokens, and delta_input_tokens/delta_output_tokens/delta_cache_read_tokens (the correct per-round amounts, so a resumed session’s cumulative counter is never mistaken for one round’s usage).
Activity: model_roundtrips (a proxy for productive model turns), tool_calls, and a bounded tool-category histogram (tool_wait_calls, tool_test_lint_calls, tool_edit_calls, tool_read_calls, tool_git_calls, tool_other_calls); a compound command counts once per sub-command, so the histogram can sum higher than tool_calls.
Timing split: subprocess_wait_ms is the wall-clock spent inside tool subprocesses; model/reasoning time is the invocation duration minus it, clamped at zero.
Context: workload_files/workload_lines (bounded change size), finding_count (findings in the structured output), and fallback_reason (why a failed resume forced a fresh session, one of transient/parse/exit/spawn/unsupported/other).

The count and timing definitions live in one authoritative place (internal/agent/invocationmetrics.go). Inspect the evidence with no-mistakes stats --agents (per-purpose aggregates, including a METRICS coverage count so a real zero is distinguishable from missing instrumentation) or no-mistakes stats --run <id> (one run’s invocations, the per-round-vs-cumulative token split, and parked time).

`NO_MISTAKES_TELEMETRY`

Disable telemetry collection.


Type	`0`, `false`, or `off` to disable; anything else to leave enabled
Default	unset

When set to a disabling value, telemetry stays off even if a runtime or embedded website ID is available.

Environment the daemon sees

When the daemon runs through a managed service (launchd, systemd user service, Task Scheduler), the macOS and Linux service definitions include a default PATH with common user and system binary directories. They also bake in any proxy variables (HTTP_PROXY, HTTPS_PROXY, NO_PROXY, ALL_PROXY) that were set when you installed or refreshed the service, so the daemon and the agents it spawns can reach the network through your proxy even when the login-shell probe is unavailable. Once baked in, the values are preserved across later service refreshes and restarts even when the proxy variables are not exported in that shell, so a routine daemon restart or a binary upgrade will not strip them; export the variables again only when you need to change or remove them. Both the upper- and lower-case spellings are forwarded exactly as you set them, because tooling is inconsistent about which it reads (curl, for example, honors only the lower-case http_proxy for plain-HTTP requests). Because a proxy URL can embed credentials (for example http://user:pass@host), the generated service file is restricted to owner-only 0600 permissions whenever proxy values are forwarded into it. When no proxy variables are set, the generated definition is unchanged and keeps the conventional 0644 mode. Windows Task Scheduler inherits your logon environment and needs no forwarding. At daemon startup, the daemon resolves environment from your login shell on macOS and Linux, preserves your shell PATH order, and appends any missing well-known directories such as ~/.local/bin, ~/go/bin, ~/.cargo/bin, ~/bin, /opt/homebrew/bin, /usr/local/bin, /usr/bin, and /bin. If login-shell resolution fails or returns no entries, the daemon logs a warning and uses an augmented process-environment fallback that may omit version-manager directories such as nvm, fnm, or volta. On Windows it reuses the current process environment.

If your env vars aren’t set in your login shell’s rc files (.zprofile, .zshrc, .profile, .bash_profile, .bashrc, PowerShell profile), the daemon won’t see them. Put them somewhere a login shell will load, then restart the daemon to pick them up.