Environment variables
Every environment variable Harmony reads, what it changes, and which ones are validated rather than trusted.
Runtime isolation
| Variable | Effect |
|---|---|
NALA_DATA_SUFFIX | Namespaces the entire runtime: data directory, socket, auth token, pipes |
WMUX_DATA_SUFFIX | The same mechanism under the historical name |
Development builds set -dev. This is why a development build and a packaged
build coexist without interfering — and the first thing to check when the CLI
reports it cannot reach a daemon that is plainly running.
nala doctor --json
Compare the resolved data directory against the application you expect to reach.
Privacy
| Variable | Effect |
|---|---|
NALA_TELEMETRY | Set to 0 to disable lifecycle reporting |
$env:NALA_TELEMETRY = "0"
For a persistent preference, use nala telemetry rather than an environment
variable. Lifecycle reporting is bounded and identifier-free either way.
Process resolution
| Variable | Effect | Trust |
|---|---|---|
NALA_DESKTOP_PATH | Installer-owned hint to the desktop executable | Validated |
NALA_CLI_PATH | Path to the CLI bundle, injected at launch | Injected |
WMUX_INVOKED_AS | Which binary name the CLI was invoked as | Internal |
SECURITY
NALA_DESKTOP_PATH is treated as a hint, not an instruction. It is used only
after validating that it is an absolute path to an existing file with the
expected executable name. An environment variable must not be able to redirect
the CLI into launching an arbitrary binary.
Build-time
| Variable | Effect |
|---|---|
NALA_REQUIRE_PI_RUNTIME | Set to 1 so a build fails loudly when the Pi runtime is absent |
WARNING
An empty vendor/ directory silently produces a build without the Pi runtime.
Always build with NALA_REQUIRE_PI_RUNTIME=1. See
testing.
Precedence
- An explicit variable set in the invoking process.
- Installer-provided values.
- Built-in defaults.
A variable set in a shell profile reaches processes that shell starts. It does not reach a process launched by the desktop application, which is the usual reason a provider works in your terminal and not under Harmony.
What is not configured this way
Provider credentials are not Harmony environment variables. Each provider authenticates through its own mechanism, and Harmony does not collect, proxy, or store them.
SECURITY
An API key exported globally in your shell is readable by every process you run, including agents. Prefer the provider's own credential store.