npm run setup writes wrangler.jsonc from wrangler.example.jsonc. The local file contains your account ID, D1 ID, R2 bucket name, app host, and sender address; it is ignored by Git. Keep the same values on upgrades. Set APP_HOST and GATEWAY_HOST to the exact hostname that serves the Worker. EMAIL_FROM must be a Cloudflare Email Service verified sender. SUPPORT_EMAIL is the address displayed in Help and account notices. The send_email binding's allowed sender must match EMAIL_FROM.
SELFHOST_STORAGE_GB sets the owner's storage safety limit in decimal gigabytes (default 100). Increase it in your private wrangler.jsonc and redeploy if you want to retain more files in R2. This changes the app's limit; your Cloudflare account pays for the actual R2 usage.
SENTINEL_DEFAULT is on for a new install. The computer sends HTTP and HTTPS through the Worker checkpoint so saved keys can be swapped only for their configured sites and outgoing requests can follow the owner's approval rules. Keep it on for saved keys and approvals to work. The computer needs the checkpoint's CA trust setup and Cloudflare Containers outbound interception; verify both in your own account before relying on it.
The .env.example file lists optional defaults for setup prompts. If you use a local .env, export it in your shell before running setup. Do not put secrets in .env for deployment. ONEHELM_EE is absent from the example config and must remain absent for public installs.
The setup command generates VAULT_KEY, VAPID_PUBLIC, and VAPID_PRIVATE and uploads them with the first Worker deployment. Its recovery JSON is written outside the repo at ~/.config/onehelm/<worker>-recovery.json. Copy it to encrypted offline storage. VAULT_KEY encrypts saved logins and provider keys and signs share links; preserve it when moving or restoring an installation. The Web Push pair should also be preserved so existing subscriptions keep working. Never print these values in logs or commit them.
The AI provider endpoint and key are entered in the app by the owner and stored encrypted with VAULT_KEY. Optional services such as Brave search can be configured later with npx wrangler secret put BRAVE_SEARCH_KEY; a secret update creates a new Worker deployment. The core requires no 1HC account or 1HC key.
The design sources (a design brief that the Worker adds to the first web page a task writes, and the design_mcp.py script in the artifacts skill) are off unless DESIGN_MCP_URL is set to the address of a design MCP Worker, for example https://mcp.1helm.com or your own deploy of design-mcp/ (see design-mcp/wrangler.example.jsonc). Set it as a variable of the main Worker to turn on the brief, which sends the person's latest message (or a helper's job text, first 600 characters) to that address, and in the environment of the computer for design_mcp.py. When it is unset or empty, no call is made, the write result is unchanged, and the script prints one line saying the design sources are not configured.
To finish a partially completed setup, inspect wrangler.jsonc, D1, and R2 first. If the config is present, run npm ci --prefix web, npm run check:migrations, npx wrangler d1 migrations apply DB --remote, and npm run build. Then deploy with npx wrangler deploy --secrets-file ~/.config/onehelm/<worker>-recovery.json if the recovery file exists. Do not regenerate VAULT_KEY for an existing database.
Memory is off by default. It runs inside the Worker on the Mem0 library, with the D1 database for facts and a Vectorize index for search, so no memory server is needed. To use it, first create the index with npx wrangler vectorize create <name> --dimensions=1024 --metric=cosine. Then add the two metadata indexes with npx wrangler vectorize create-metadata-index <name> --property-name=ts --type=number and npx wrangler vectorize create-metadata-index <name> --property-name=source --type=string, and create both before the first write. Add "vectorize": [{ "binding": "MEMORY_INDEX", "index_name": "<name>" }] to your private wrangler.jsonc, apply D1 migration 0063 and set MEMORY to on. The example configuration already carries the alias list and MEM0_TELEMETRY set to false, which the Worker needs to bundle Mem0 and to stop Mem0 from sending usage events. Each channel has its own memory, and secrets are removed before anything is saved. Memory makes two kinds of model call. Embeddings run on Workers AI (@cf/baai/bge-m3, 1024 numbers per text) and need the AI binding, and facts are extracted by the model of the job mem_extract, which runs through the provider key the Worker is configured with (OPENROUTER_API_KEY) and never through an owner's own AI key. A different embedding model that makes a different number of values needs a new index. Vectorize accepts at most 100 ids in one delete or read call, so the Worker sends deletes and reads in groups of 100. A memory rebuild that failed goes on from its saved cursor the next time the channel is used. If memory cannot be reached, the helper says that memory is unavailable. The Hindsight server and the variable MEMORY_BACKEND are no longer read. The Worker route /_hs/ is Cloud code and answers 404 unless ONEHELM_EE is 1hc. The optional memory variables HS_FOUNDATIONS, HS_WRITERS, HS_USE, HS_WALLS and HS_ENVELOPE are off unless set to on, and each one needs memory to be enabled. APP_OTEL_URL and the secret APP_OTEL_TOKEN are optional. When both are set, the Worker sends one trace per helper turn to that address as OTLP over HTTP, made only of numbers, ids and fixed names and never message text, tool arguments or tool results. With either one missing nothing is sent. AUDIO_CONVERT set to on converts audio inside uploaded files to WAV in the Worker before transcription. A failed embedding call is retried twice (after 300 and 900 milliseconds) before the write fails, and a write fails and is sent again when the model extracted a fact that was not kept, so no fact is dropped without an error. The first fill of a channel counts each document once, accepts documents the extraction found no facts in, and a finished run that reported a mismatch is counted again once on its next use. When APP_OTEL_URL and APP_OTEL_TOKEN are set, the Worker also sends hourly and on each status change a trace with numbers only (counts of channels by fill status). A Bee recording keeps each speaker label exactly as Bee sent it, and its context line says only that the text is raw transcript that may hold other people's voices and that labels may be missing or wrong. The chunks of a Bee recording are dated by their own first and last line, and a recall for a time window looks back far enough to find them. A recording kept before that change is saved again once by the Bee sync alarm (3 recordings per alarm, embeddings only, tracked by the raw_v column of the Durable Object table convs, never for a test account). A Bee speaker is not a memory entity of any kind: the link from a Bee speaker label to a Contacts person is kept in the Bee sync table speaker_map (one row per label, this account only), and a generic label such as Unknown or Speaker N is never remembered. The Worker calls Bee's public API directly with fetch (src/ee/bee-api.js), so a Bee sync, a fact write or a Live notes chunk starts no container. The BeeContainer class is removed from the source, and the example configuration never had a binding or migration for it. Speech models can run in 1Helm's own container (SpeechContainer, src/speech-container.js, image/speech/Dockerfile) when the binding SPEECH_CONTAINER and the variable SPEECH_MAX_INSTANCES are set; the example configuration defines neither, so a model whose id starts with @1hc/ fails at once and the next model of the job answers. A call never waits for a cold container: it starts one in the background and the next model answers. Audio sent to the container is limited to 25 MB per call, and speaker labels for a file are skipped above 40 MB. Memory search can rerank the facts it found with a Workers AI reranking model (the job mem_rerank), and a failure keeps the original order. Changes under /workspace/files that the helper makes on the computer are saved back to the matching Library file.