docs/reference/ENVIRONMENT.md
Complete reference for every environment variable recognized by OmniRoute. For a quick-start template, see
.env.example.
[!IMPORTANT] Every variable documented here must also appear in
.env.example, and every variable in.env.examplemust appear here.npm run check:env-doc-syncenforces this on commit and in CI. To omit a variable on purpose, add it to the allowlist insidescripts/check/check-env-doc-sync.mjs.
These must be set before the first run. Without them, the application will either refuse to start or operate with insecure defaults.
| Variable | Required | Default | Source File | Description |
|---|---|---|---|---|
JWT_SECRET | Yes | (none) | src/lib/auth | Signs/verifies all dashboard session cookies (JWT). Generate with openssl rand -base64 48. |
API_KEY_SECRET | Yes | (none) | src/lib/db/apiKeys.ts | AES encryption key for API key values at rest in SQLite. Generate with openssl rand -hex 32. |
INITIAL_PASSWORD | Yes | CHANGEME | Bootstrap script | Sets the initial admin dashboard password (matches .env.example default — kept obviously insecure to force a change). Change before first use. After login, change via Dashboard → Settings → Security. |
OMNIROUTE_WS_BRIDGE_SECRET | Yes (production) | (unset) | src/app/api/internal/codex-responses-ws/route.ts | Shared secret for the internal Codex Responses WebSocket bridge. Authenticates bridge requests between the Electron/browser WS relay and OmniRoute. ⚠️ REQUIRED in production — when unset, all WS bridge requests are rejected. Generate with openssl rand -base64 32. |
OMNIROUTE_PEER_STAMP_TOKEN | No (auto) | (auto per boot) | src/server/authz/policies/management.ts | Per-process secret proving the trusted peer-IP stamp came from OmniRoute's own HTTP server (scripts/dev/peer-stamp.mjs). The authz middleware trusts request locality (loopback/LAN gating of LOCAL_ONLY routes) only when the stamp carries this token. Auto-generated each boot — leave unset; only pin it for multi-process setups that must share the stamp. |
# Generate all four secrets at once:
echo "JWT_SECRET=$(openssl rand -base64 48)"
echo "API_KEY_SECRET=$(openssl rand -hex 32)"
echo "INITIAL_PASSWORD=$(openssl rand -base64 16)"
echo "OMNIROUTE_WS_BRIDGE_SECRET=$(openssl rand -base64 32)"
[!CAUTION] Never commit
.envfiles with real secrets to version control. The.gitignorealready excludes.env, but verify before pushing.
OmniRoute uses SQLite (via better-sqlite3) for all persistence. These variables control data location, encryption, and lifecycle.
| Variable | Default | Source File | Description |
|---|---|---|---|
DATA_DIR | ~/.omniroute/ | src/lib/db/core.ts | Root directory for SQLite DB, backups, and data files. Override for Docker volumes or custom paths. |
OMNIROUTE_DATA_DIR | (unset) | open-sse/executors/promptql/threadSticky.ts | Fallback alias for DATA_DIR, checked only when DATA_DIR is unset. Used to locate the PromptQL executor's on-disk thread-sticky session cache (<dir>/promptql-thread-sessions.json); if neither var is set, the cache stays in-memory only (not persisted across restarts). |
STORAGE_ENCRYPTION_KEY | (empty = disabled) | src/lib/db/encryption.ts | AES key for full SQLite database encryption at rest. Generate with openssl rand -hex 32. |
STORAGE_ENCRYPTION_KEY_VERSION | v1 | scripts/build/bootstrap-env.mjs, electron/main.js | Version label for the encryption key. Increment when performing key rotation to support decryption of old backups. |
DISABLE_SQLITE_AUTO_BACKUP | false | src/lib/db/backup.ts | When true, skips the automatic database backup that runs before migrations on every startup. |
OMNIROUTE_CRYPT_KEY | (unset) | src/lib/db/encryption.ts | Legacy alias for STORAGE_ENCRYPTION_KEY. Accepted as a fallback when the primary variable is absent. |
OMNIROUTE_API_KEY_BASE64 | (unset) | src/lib/db/encryption.ts | Legacy alias (Base64-encoded form) accepted as a fallback. Decoded automatically before use. |
OMNIROUTE_DB_HEALTHCHECK_INTERVAL_MS | (unset) | src/lib/db/core.ts | Override the periodic SQLite healthcheck interval (ms). When unset, defaults are derived from NODE_ENV. |
OMNIROUTE_SKIP_DB_HEALTHCHECK | 0 | src/lib/db/core.ts, src/lib/db/healthCheck.ts | Set to 1 to skip the DB healthcheck entirely on startup. Useful for short-lived tasks and integration tests. |
OMNIROUTE_FORCE_DB_HEALTHCHECK | 0 | src/lib/db/core.ts | Set to 1 to force the DB healthcheck loop on, even when it would normally be skipped (e.g., short-lived tasks). |
OMNIROUTE_SKIP_POSTINSTALL | 0 | scripts/postinstall.mjs | Set to 1 to skip the native-runtime warm-up during npm install. Useful in CI/headless installs where sqlite is already built. |
OMNIROUTE_MIGRATIONS_DIR | (auto-detect) | src/lib/db/migrationRunner.ts | Override the directory that the migration runner scans. Useful when shipping bundled migrations in custom builds. |
OMNIROUTE_EXTRA_MIGRATIONS_DIRS | (unset) | src/lib/db/migrationRunner/extraDirs.ts | Additional migration directories as namespace=dir entries separated by the platform path delimiter (e.g. ee=/opt/app/enterprise/db/migrations). Files found there are recorded as <namespace>-<number>, so a distribution shipping its own migrations never collides with the upstream numeric slots. A malformed entry, an invalid namespace or a missing directory throws at startup instead of silently skipping the schema. |
OMNIROUTE_MAX_PENDING_MIGRATIONS | 50 | src/lib/db/migrationRunner.ts | Mass-pending-migrations safety threshold (#3416). Startup aborts if more than this many migrations are pending on an existing DB (guards against a wiped tracking table). Raise it to restore an older backup; set to 0 to disable the check. |
OMNIROUTE_SPEND_FLUSH_INTERVAL_MS | (default in code) | src/lib/spend/batchWriter.ts | Flush interval (ms) for the batched spend/cost writer. Lower values reduce write coalescing; higher values reduce DB contention. |
OMNIROUTE_SPEND_MAX_BUFFER_SIZE | (default in code) | src/lib/spend/batchWriter.ts | Max buffered spend entries before a forced flush. Raise on high-QPS deployments; lower when bounded memory matters more. |
OMNIROUTE_PROXY_FETCH_DEBUG | (unset) | open-sse/utils/proxyFetch.ts | Set to "true" to emit [ProxyFetch] debug logs on the Vercel relay path. Off by default to avoid leaking routing hints. |
OMNIROUTE_DEBUG_COMPLETION | (unset) | bin/cli/commands/completion.mjs | Set to any non-empty value to emit [omniroute completion] diagnostics from the CLI shell-completion cache paths (read/refresh/write). Off by default — those caches fail silently so a missing/corrupt cache never breaks tab-completion. |
BATCH_RETRY_DURATION_MS | 86400000 (24h) | open-sse/services/batchProcessor.ts | Maximum retry window for individual batch items (ms). Items exceeding this duration are marked failed. |
BATCH_BACKOFF_BASE_MS | 5000 | open-sse/services/batchProcessor.ts | Base delay (ms) for exponential backoff on batch item retries. |
BATCH_BACKOFF_MAX_MS | 3600000 (1h) | open-sse/services/batchProcessor.ts | Cap (ms) for exponential backoff between batch item retries. |
BATCH_MAX_CONCURRENT | 1 | open-sse/services/batchProcessor.ts | Maximum number of batches processed concurrently. Raise to increase throughput; keep low to avoid rate-limit storms. |
| Scenario | Configuration |
|---|---|
| Local development | Leave all defaults. DB lives at ~/.omniroute/omniroute.db. |
| Docker | DATA_DIR=/data + mount a volume at /data. |
| Encrypted at rest | Set STORAGE_ENCRYPTION_KEY + keep backups of the key! Losing it = losing data. |
| CI/Testing | DATA_DIR=/tmp/omniroute-test — ephemeral, no encryption needed. |
| Variable | Default | Source File | Description |
|---|---|---|---|
PORT | 20128 | src/lib/runtime/ports.ts | Primary port for both Dashboard UI and API endpoints (single-port mode). |
OMNIROUTE_BASE_PATH | (empty = root) | next.config.mjs, scripts/docker/ensure-docker-base-path.mjs | URL subpath for serving OmniRoute behind a reverse proxy (sets Next.js basePath; auth redirects are basePath-aware). E.g. /omniroute. In Docker the value is baked during docker build (ARG OMNIROUTE_BASE_PATH); pre-built root images can apply a different runtime value once at container start before Next.js boots. Set NEXT_PUBLIC_BASE_URL to the public origin including the same subpath. |
NEXT_PUBLIC_OMNIROUTE_BASE_PATH | (empty = root) | src/shared/hooks/useDisplayBaseUrl.ts | Browser-visible mirror of OMNIROUTE_BASE_PATH, inlined at build time so the dashboard endpoint display shows https://host/omniroute/v1 instead of https://host/v1. Falls back to OMNIROUTE_BASE_PATH when unset. Rebuild after changing (Next basePath is build-time). |
API_PORT | (unset) | src/lib/runtime/ports.ts | When set, serves the /v1/* proxy API on this separate port. |
API_HOST | 0.0.0.0 | src/lib/runtime/ports.ts | Bind address for the API port. |
DASHBOARD_PORT | (unset) | src/lib/runtime/ports.ts | When set, serves the Dashboard UI on this separate port. |
OMNI_MAX_CONCURRENT_CONNECTIONS | 0 (disabled) | src/sse/utils/backpressure.ts | Caps concurrent in-flight chat connections; requests over the cap get 503 with Retry-After. Positive integer enables the guard; unset/0 disables it. |
OMNIROUTE_INSTANCE_ID | (unset) | src/shared/resilience/peerRouting.ts | Stable, unique ID for this gateway when chaining OmniRoute instances. Enables inbound peer-loop checks. Allowed characters: letters, digits, ., _, :, and -; maximum 64 characters. |
OMNIROUTE_PEER_URLS | (unset) | src/shared/resilience/peerRouting.ts, open-sse/executors/base.ts | Comma-separated OmniRoute base URLs that may receive X-OmniRoute-Peer-Trace. Only explicitly allowlisted upstream URLs receive peer metadata; all other providers are untouched. |
OMNIROUTE_PEER_MAX_HOPS | 4 | src/shared/resilience/peerRouting.ts | Maximum number of previously visited OmniRoute instances accepted on a chained request (1-32). Repeated instances or an exhausted budget return HTTP 508 Loop Detected. |
PROD_DASHBOARD_PORT | 20130 | docker-compose.prod.yml | Host-side published port for the Dashboard in Docker production mode. |
PROD_API_PORT | 20131 | docker-compose.prod.yml | Host-side published port for the API in Docker production mode. |
OMNIROUTE_PORT | (unset) | src/lib/runtime/ports.ts | Takes precedence over PORT when running inside Electron or other wrappers. |
LIVE_WS_PORT | 20129 | src/server/ws/liveServer.ts | Port for the real-time WebSocket live monitoring server. |
LIVE_WS_HOST | 127.0.0.1 | src/server/ws/liveServer.ts | Bind address for the live WebSocket server. Set to 0.0.0.0 to expose on LAN (also configure LIVE_WS_ALLOWED_ORIGINS). |
LIVE_WS_ALLOWED_ORIGINS | (unset) | src/server/ws/liveServer.ts | Comma-separated extra origins allowed to open a live WebSocket. Loopback dashboard origins are already permitted by default. |
LIVE_WS_ALLOWED_HOSTS | (unset) | src/server/ws/liveServerAllowList.ts | Comma-separated extra hostnames allowed for live WebSocket origins. Unlike LIVE_WS_ALLOWED_ORIGINS (full origin URLs), matches only the host portion — useful for LAN/Tailscale setups. |
NEXT_PUBLIC_LIVE_WS_PUBLIC_URL | (unset) | src/hooks/useLiveDashboard.ts | Public URL for the live dashboard WebSocket (browser-side). Set when fronting the WS server with a reverse proxy or Cloudflare Tunnel (e.g. wss://ws.my-ai.com/live-ws); the browser connects there instead of ws://hostname:20132. The pathname portion is also used as the WebSocket upgrade path (default: /live-ws). |
OMNIROUTE_ENABLE_LIVE_WS | true | src/server/ws/liveServer.ts and scripts/start-ws-server.mjs | Set to 0 or false to disable the real-time WebSocket server (enabled by default, loopback-bound). CI/harness toggle that disables the standalone live WebSocket helper script. |
RELAY_IP_PER_MINUTE | 30 | src/app/api/v1/relay/chat/completions/route.ts | Per-(token, IP) relay rate limit, requests/minute. In-memory, per instance. 0 or negative disables the IP-dimension gate (per-token DB limit still applies). |
NODE_ENV | production | Next.js core | Controls logging verbosity, caching, error detail exposure, and Next.js optimizations. |
OMNIROUTE_USE_TURBOPACK | 1 (Turbopack — code default) | package.json / Next.js 16 | Turbopack is the default bundler for npm run dev and npm run build (2-3× faster builds, benchmarked). Set to 0 to fall back to webpack on Windows, when running into native binding / bundler-compat incompatibilities, or on RAM-constrained machines — Turbopack production builds on this Next.js version line (16.2.x) are known upstream to peak far higher in memory than webpack on large module graphs (Next 16.3's Turbopack memory-eviction fix is not yet stable); webpack fallback peaks much lower. See #6409. |
OMNIROUTE_SKIP_DB_HEALTHCHECK | (unset) | src/lib/db/core.ts / src/lib/db/healthCheck.ts | Set to 1 to skip the SQLite integrity health check on startup. Useful for faster boot on large databases. |
CREDENTIAL_HEALTH_CHECK_INTERVAL | 300000 | open-sse/config/constants.ts / src/lib/credentialHealth/scheduler.ts | Interval (ms) for the background credential health check scheduler. Minimum: 10000 (10s). |
CREDENTIAL_HEALTH_CACHE_TTL | 300000 | open-sse/config/constants.ts / src/lib/credentialHealth/cache.ts | TTL (ms) for cached credential health status. |
OMNIROUTE_DISABLE_CREDENTIAL_HEALTH_CHECK | false | src/lib/credentialHealth/scheduler.ts | Set to 1 or true to disable background periodic testing of provider connections. |
HOST | 0.0.0.0 | scripts/dev/run-next.mjs | Bind address for the Next.js dev/start server. Overrides the default 0.0.0.0 when set. |
HOSTNAME | 127.0.0.1 | scripts/dev/run-next-playwright.mjs | Bind address used by the Playwright runner when launching Next.js. Defaults to 127.0.0.1 for hermetic tests. Do not use for omniroute serve — use OMNIROUTE_SERVER_HOST instead (POSIX shells auto-set HOSTNAME to the machine name; .env cannot override it). |
OMNIROUTE_SERVER_HOST | 0.0.0.0 | bin/cli/commands/serve.mjs | Bind address for omniroute serve. Avoids collision with the POSIX shell HOSTNAME variable (always set to the machine name by bash/zsh). Falls back to 0.0.0.0 when unset. (#6194) |
┌─────────────────────────── Single Port (default) ──────────────────────────┐
│ PORT=20128 │
│ → Dashboard: http://localhost:20128 │
│ → API: http://localhost:20128/v1/chat/completions │
└─────────────────────────────────────────────────────────────────────────────┘
┌─────────────────────────── Split Ports ─────────────────────────────────────┐
│ DASHBOARD_PORT=20128 │
│ API_PORT=20129 │
│ API_HOST=0.0.0.0 │
│ → Dashboard: http://localhost:20128 │
│ → API: http://0.0.0.0:20129/v1/chat/completions │
│ Use case: Expose API to LAN while restricting Dashboard to localhost. │
└─────────────────────────────────────────────────────────────────────────────┘
┌─────────────────────────── Docker Production ──────────────────────────────┐
│ PROD_DASHBOARD_PORT=443 PROD_API_PORT=8443 │
│ → Maps container ports to host ports in docker-compose.prod.yml. │
└─────────────────────────────────────────────────────────────────────────────┘
| Variable | Default | Source File | Description |
|---|---|---|---|
MACHINE_ID_SALT | endpoint-proxy-salt | src/lib/auth | Salt combined with hardware identifiers for machine fingerprinting. Change per-deployment for isolation. |
OMNIROUTE_CLI_SALT | omniroute-cli-auth-v1 | src/lib/machineToken.ts | HMAC salt for deriving the local CLI auth token. Changing this value rotates all CLI tokens on the machine. See docs/security/CLI_TOKEN.md. |
AUTH_COOKIE_SECURE | false | src/lib/auth | Sets the Secure flag on session cookies. Must be true when running behind HTTPS. |
REQUIRE_API_KEY | false | API middleware | When true, all /v1/* proxy requests must include a valid API key. |
ALLOW_API_KEY_REVEAL | false | src/shared/constants/featureFlagDefinitions.ts | Allows revealing full API key values in the Dashboard UI. Configurable from Dashboard Feature Flags; security risk on shared instances. |
NO_LOG_API_KEY_IDS | (empty) | src/lib/compliance/index.ts | Comma-separated API key IDs that bypass request logging (GDPR compliance). |
DEFAULT_RATE_LIMIT_PER_DAY | 1000 | src/shared/utils/apiKeyPolicy.ts | Fallback per-day request budget applied to API keys whose rate_limits column is null. Default (unset/empty/malformed) keeps the legacy 1000/day, 5000/week, 20000/month windows. Set explicitly to 0 to opt out (unlimited). Any positive integer N enables N/day, 5N/week, 20N/month. Zod-validated; invalid values log a warning and use the legacy default. |
MAX_BODY_SIZE_BYTES | 10485760 (10 MB) | src/shared/middleware/bodySizeGuard.ts | Maximum allowed request body size. Rejects payloads exceeding this limit. |
OMNIROUTE_CHAT_LARGE_BODY_BYTES | 262144 (256 KB) | src/shared/middleware/chatBodyAdmission.ts | Actual request bodies at or above this threshold require an atomic process-local heavyweight admission lease before JSON parsing. |
OMNIROUTE_CHAT_HARD_MAX_BODY_BYTES | 52428800 (50 MB) | src/shared/middleware/chatBodyAdmission.ts | Chat-route hard cap enforced against bytes read during bounded ingestion, including requests with missing, invalid, or dishonest Content-Length; excess receives 413. |
OMNIROUTE_CHAT_MAX_HEAVY_IN_FLIGHT | 1 | src/shared/middleware/chatBodyAdmission.ts | Maximum heavyweight chat requests admitted concurrently in one process. When capacity is unavailable, OmniRoute returns retryable 503 with Retry-After. |
OMNIROUTE_CHAT_HEAVY_MESSAGE_COUNT | 200 | src/shared/middleware/chatBodyAdmission.ts | Message count that classifies a chat request as heavyweight even when its body is below the byte threshold. |
OMNIROUTE_CHAT_HEAVY_TOOL_COUNT | 64 | src/shared/middleware/chatBodyAdmission.ts | Tool count that classifies a chat request as heavyweight even when its body is below the byte threshold. |
OMNIROUTE_CHAT_HEAVY_ESTIMATED_TOKENS | 32000 | src/shared/middleware/chatBodyAdmission.ts | Conservative string-size token estimate that classifies a request as heavyweight; this is an admission-cost proxy, not provider billing tokenization. |
OMNIROUTE_CHAT_HARD_MAX_MESSAGES | 0 (disabled) | src/shared/middleware/chatBodyAdmission.ts | Optional opt-in chat history cap. Disabled by default: a message count is deployment policy, not a universal property of a request, and capping here rejects conversations with a terminal 413 before the compression pipeline can make them servable. Heap growth is bounded by OMNIROUTE_CHAT_MAX_HEAVY_IN_FLIGHT and the heap-pressure shed. Set a positive value on memory-constrained deployments that need a hard ceiling; excess then receives structured compact-required 413. |
OMNIROUTE_MAX_NONSTREAMING_RESPONSE_BYTES | 67108864 (64 MB) | open-sse/handlers/chatCore/nonStreamingResponseBody.ts | Hard cap for a non-streaming upstream response buffered fully into memory. Past this the upstream reader is cancelled and the request fails fast instead of growing an unbounded string until the heap is exhausted. |
OMNIROUTE_FORWARDING_HEADER_BUDGET_BYTES | 768 | open-sse/handlers/chatCore/responseHeaders.ts | Max wire bytes forwarded from upstream response headers. When the budget is exceeded, lower-priority headers (e.g., custom x-codex-*, x-oai-request-id) are dropped to stay within common reverse-proxy header limits. Set higher to forward more upstream metadata at the cost of larger response header size. |
CORS_ORIGIN | (unset) | src/server/cors/origins.ts | Legacy single-origin CORS allowlist. Prefer CORS_ALLOWED_ORIGINS for new deployments. CORS is only for cross-origin browser API clients; authenticated dashboard writes use same-origin requests plus session-bound CSRF protection instead. |
CORS_ALLOWED_ORIGINS | (unset) | src/server/cors/origins.ts | Comma-separated CORS allowlist. No wildcard is sent unless CORS_ALLOW_ALL=true is explicitly configured. |
CORS_ALLOW_ALL | false | src/server/cors/origins.ts | Development-only escape hatch to echo any browser Origin. Do not enable on shared or production deployments. |
OUTBOUND_SSRF_GUARD_ENABLED | true | src/shared/network/outboundUrlGuard.ts | Block provider calls targeting private/loopback/link-local IP ranges. Disable only in isolated test envs. |
OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS | false | src/shared/network/outboundUrlGuard.ts | Allow provider URLs pointing to private/local networks (localhost, 192.168.x.x, 10.x.x.x, etc.). REQUIRED for self-hosted providers (LM Studio, Ollama, vLLM, Llamafile, Triton, SearXNG). When false, the dashboard rejects validation of local URLs. |
OMNIROUTE_ALLOW_LOCAL_PROVIDER_URLS | true | src/shared/network/outboundUrlGuard.ts | Allow adding/validating providers on local/private addresses (127.0.0.1, localhost, LAN, private ranges) — scoped to the provider validation path. Default true (local-first); set false to enforce strict public-only blocking. Cloud-metadata endpoints (169.254.169.254, metadata.google.internal) stay blocked regardless. (#5066) |
AUDIO_REMOTE_PROVIDER_NODES | false | src/app/api/v1/_shared/audioProviderNodes.ts | Let the /v1/audio/* routes (transcriptions, speech, translations) use an OpenAI-compatible provider node hosted outside localhost. Off by default — routing audio to a remote host changes egress identity and must be an explicit operator decision. Loopback/private nodes (localhost, 127.0.0.1, 172.16-31.x) are always allowed and unaffected. (#3963) |
# Production security minimum:
AUTH_COOKIE_SECURE=true # Requires HTTPS
REQUIRE_API_KEY=true # Authenticate all proxy calls
ALLOW_API_KEY_REVEAL=false # Never expose keys in UI
CORS_ALLOWED_ORIGINS=https://your.domain.com
MAX_BODY_SIZE_BYTES=5242880 # 5 MB limit
OmniRoute provides a two-layer defense: request-side injection scanning and response-side PII stripping.
⚠️ Limitations: These guardrails are best-effort heuristic detections, not a complete prompt-injection firewall or PII DLP system. They can produce false positives (benign persona/RPG prompts flagged) and false negatives (leetspeak, spacing, non-English patterns). They are not sufficient alone for compliance. Tune modes and test against your traffic before relying on them.
| Variable | Default | Source File | Description |
|---|---|---|---|
INPUT_SANITIZER_ENABLED | true | src/middleware/promptInjectionGuard.ts | Enable scanning of incoming messages for prompt injection patterns. |
INPUT_SANITIZER_MODE | warn | src/middleware/promptInjectionGuard.ts | Injection policy: warn = log only, block = reject request with 400. Legacy redact does not strip injection text; use PII_REDACTION_ENABLED for request PII rewrite. |
INJECTION_GUARD_MODE | (unset) | src/middleware/promptInjectionGuard.ts | Legacy alias for INPUT_SANITIZER_MODE — same behavior. |
INPUT_SANITIZER_BLOCK_THRESHOLD | high | src/shared/utils/injectionSeverity.ts | Minimum severity that MODE=block rejects: high (default), medium, or low. Medium patterns are observe-only unless lowered. |
INJECTION_GUARD_BLOCK_THRESHOLD | (unset) | src/shared/utils/injectionSeverity.ts | Legacy alias for INPUT_SANITIZER_BLOCK_THRESHOLD — same behavior. |
PII_REDACTION_ENABLED | false | src/lib/guardrails/piiMasker.ts | When true, redact PII in incoming requests (independent of injection mode). |
CREDENTIAL_REDACTION_ENABLED | false | src/lib/guardrails/credentialMasker.ts | Redact well-known API-key / secret-token patterns from request/response payloads. Opt-in; mirrors PII_REDACTION_ENABLED. |
| Variable | Default | Source File | Description |
|---|---|---|---|
PII_RESPONSE_SANITIZATION | false | src/lib/piiSanitizer.ts | Scan LLM responses for leaked PII before returning to client. |
PII_RESPONSE_SANITIZATION_MODE | redact | src/lib/piiSanitizer.ts | redact = mask PII, warn = log only, block = drop entire response. |
| Variable | Default | Source File | Description |
|---|---|---|---|
OMNIROUTE_VSCODE_SANITIZE_CONTEXT | 1 | src/app/api/v1/vscode/contextSanitizer.ts | Strips implicit active-editor context (editorContext, activeEditor, currentFile, selection, openTabs…) from /v1/vscode/[token]/* requests and redacts content of explicitly-attached sensitive files. Secure-by-default; set to 0 to disable. |
| Scenario | Configuration |
|---|---|
| Enterprise compliance | INPUT_SANITIZER_ENABLED=true, INPUT_SANITIZER_MODE=block, PII_REDACTION_ENABLED=true, PII_RESPONSE_SANITIZATION=true (injection blocks + request/response PII redaction; modes are independent) |
| Monitoring only | INPUT_SANITIZER_ENABLED=true, INPUT_SANITIZER_MODE=warn — logs but never blocks |
| Personal use | Leave all disabled — zero overhead |
| Variable | Default | Source File | Description |
|---|---|---|---|
TOOL_POLICY_MODE | disabled | src/lib/toolPolicy.ts | Controls LLM tool/function-calling access. allowlist = only listed tools, denylist = all except listed, disabled = no restrictions. |
OMNIROUTE_PAYLOAD_RULES_PATH | ./config/payloadRules.json | open-sse/services/payloadRules.ts | Path to payload manipulation rules JSON file (per-model/protocol upstream tweaks). |
OMNIROUTE_PAYLOAD_RULES_RELOAD_MS | 5000 | open-sse/services/payloadRules.ts | Reload interval (ms) for hot-reloading the payload rules file. Minimum 1000. |
OMNIROUTE_PREFER_CLAUDE_CODE_FOR_UNPREFIXED_CLAUDE_MODELS | false | open-sse/services/model.ts | Opt-in: route bare claude-* model IDs from Claude Code clients through the Claude Code OAuth account instead of requiring a provider prefix. Explicit provider prefixes still win. Also configurable via a dashboard toggle on the Claude provider page. |
COMBO_CONCURRENCY_PER_MODEL | 3 | open-sse/services/comboConfig.ts | Per-model concurrency cap for round-robin combos (#9100). The round-robin combo semaphore was hard-capped at 3 concurrent requests per model with no override, serializing higher-concurrency traffic behind that cap. Validated to >= 1, clamped to <= 32. |
| Variable | Default | Source File | Description |
|---|---|---|---|
BASE_URL | http://localhost:20128 | src/lib/cloudSync.ts | Server-side URL for internal sync jobs to call /api/sync/cloud. Keep this as a loopback/container URL even when the app is publicly proxied. |
CLOUD_URL | (empty) | src/lib/cloudSync.ts | Cloud relay endpoint URL (premium feature). |
CLOUD_SYNC_TIMEOUT_MS | 12000 | src/lib/cloudSync.ts | HTTP timeout for cloud sync requests. |
OMNIROUTE_BUILD_PROFILE | full | Webpack build config | Build-time profile (set to minimal to physically exclude privileged modules from bundle). |
OMNIROUTE_CLOUD_SYNC_SECRET | (empty) | src/lib/cloudSync.ts | Shared secret used to verify the HMAC-SHA256 signature of Cloud Sync responses. |
OMNIROUTE_CLOUD_SYNC_SECRETS | false | src/lib/cloudSync.ts | Set to true to allow the Cloud Sync endpoint to overwrite local credentials. Default is false. |
OMNIROUTE_ZED_IMPORT_LEGACY_ONE_STEP | false | src/app/api/providers/zed/import/route.ts | Set to true to fall back to the v3.8.5 one-step "import everything" behavior without user confirmation. |
NEXT_PUBLIC_BASE_URL | http://localhost:20128 | OAuth, Dashboard, sync | Public-facing URL for OAuth redirect_uri, Dashboard links, and generated public URLs. Set this to the stable public URL when OAuth callbacks or generated browser links must use a canonical reverse-proxy host. |
NEXT_PUBLIC_CLOUD_URL | (empty) | Client-side | Client-side mirror of CLOUD_URL. |
NEXT_PUBLIC_APP_URL | (unset) | src/shared/services/cloudSyncScheduler.ts | Legacy fallback for NEXT_PUBLIC_BASE_URL. |
OMNIROUTE_PUBLIC_BASE_URL | (unset) | Public-origin resolver, image URLs | Highest-priority browser-facing OmniRoute origin used for public URL generation and non-dashboard browser-origin validation (for example /v1/chatgpt-web/image/<id>). Set this when OpenWebUI or another relay reaches OmniRoute by an internal URL but the user's browser must fetch images from a LAN, tunnel, or public origin. Do not include /v1. |
OMNIROUTE_PROVIDER_MANIFEST_URL | (unset) | open-sse/config/providerPluginManifestUrl.ts | Absolute provider plugin manifest URL advertised to sidecar clients. When unset, OmniRoute derives /api/v1/provider-plugin-manifest from request origin or HOST/PORT. |
OMNIROUTE_PUBLIC_PROTOCOL | http | open-sse/config/providerPluginManifestUrl.ts | Protocol used when deriving the provider plugin manifest URL from HOST/PORT without a request origin. Set to https behind a TLS-terminating public proxy when no explicit OMNIROUTE_PROVIDER_MANIFEST_URL is set. |
OMNIROUTE_TRUST_PROXY | (unset) | src/server/origin/publicOrigin.ts | Optional trust mode for forwarded public-origin headers. Unset = do not trust Forwarded / X-Forwarded-* for security decisions. true / loopback trusts forwarded host/proto only from a token-stamped loopback proxy. private / lan also trusts private-LAN proxy peers. Prefer explicit NEXT_PUBLIC_BASE_URL in production. |
OMNIROUTE_CGPT_WEB_IMAGE_TIMEOUT_MS | 180000 (3 min) | open-sse/executors/chatgpt-web.ts | Max wait time for an async chatgpt-web image to land via the celsius WebSocket. Increase during upstream queue-deep windows. |
OMNIROUTE_CGPT_WEB_IMAGE_CACHE_MAX_MB | 256 | open-sse/services/chatgptImageCache.ts | Total in-memory byte budget (MB) for the chatgpt-web image cache serving /v1/chatgpt-web/image/<id>. Lower on memory-constrained hosts; raise if image generation is heavy and clients race the 30-minute TTL. |
OMNIROUTE_CGPT_WEB_PRO_TIMEOUT_MS | 1200000 (20 min) | open-sse/executors/chatgpt-web.ts | Overall wait budget for a chatgpt-web GPT-5.5 Pro background-poll handoff. Pro reasoning runs complete out-of-band, so OmniRoute polls until the answer lands or this budget elapses. Raise if Pro requests time out before finishing. |
OMNIROUTE_CGPT_WEB_PRO_POLL_INTERVAL_MS | 4000 (4s) | open-sse/executors/chatgpt-web.ts | Interval between chatgpt-web GPT-5.5 Pro background-poll attempts. Lower for snappier completion at the cost of more upstream polling; raise to reduce request volume. |
THEOLDLLM_NAV_TIMEOUT_MS | 30000 (30s) | open-sse/executors/theoldllm.ts | Playwright navigation timeout (ms) for the browser-backed token capture used by the The Old LLM (theoldllm) free provider. Raise on slow networks if the relay page is slow to settle. |
KIE_CALLBACK_URL | (unset) | open-sse/utils/kieTask.ts | Public callback URL for asynchronous kie.ai jobs. Highest-priority override before OMNIROUTE_KIE_CALLBACK_URL and OMNIROUTE_PUBLIC_URL. |
OMNIROUTE_KIE_CALLBACK_URL | (unset) | open-sse/utils/kieTask.ts | Alternate spelling of KIE_CALLBACK_URL. Falls back when the primary variable is unset. |
OMNIROUTE_PUBLIC_URL | (unset) | open-sse/utils/kieTask.ts | Public origin used to compose async callback URLs. Lowest-priority fallback for kie.ai callbacks; also used as a generic public URL for other relays. |
OMNIROUTE_CROF_USAGE_URL | https://crof.ai/usage_api/ | open-sse/services/usage.ts | CrofAI quota lookup endpoint used by the Usage page. Override for relays / test fixtures. |
OMNIROUTE_OPENCODE_QUOTA_URL | https://opencode.ai/zen/go/v1/quota | open-sse/services/opencodeQuotaFetcher.ts | OpenCode (zen/go) quota lookup endpoint used by the Usage page. Override for relays / test fixtures. |
OMNIROUTE_OPENCODE_GO_QUOTA_URL | (unset) | open-sse/services/opencodeOllamaUsage.ts | OpenCode Go quota lookup endpoint used by the Usage page. OpenCode Go has no public quota API, so this has no default and the network call is skipped unless the operator opts in to a self-hosted/mirrored endpoint. |
OMNIROUTE_OPENCODE_GO_DASHBOARD_URL | https://opencode.ai/workspace | open-sse/services/usage.ts | OpenCode Go dashboard base URL used for quota scraping when a workspace ID and auth cookie are configured. Override for relays / test fixtures. |
OPENCODE_GO_WORKSPACE_ID | (unset) | open-sse/services/usage.ts | OpenCode Go workspace ID used for dashboard quota scraping. Prefer the per-connection Dashboard field when multiple accounts are configured. |
OMNIROUTE_OPENCODE_GO_WORKSPACE_ID | (unset) | open-sse/services/usage.ts | Alternate OpenCode Go workspace ID env var used before the shorter alias. Prefer the per-connection Dashboard field when multiple accounts are configured. |
OPENCODE_GO_AUTH_COOKIE | (unset) | open-sse/services/usage.ts | OpenCode Go auth cookie used for dashboard quota scraping. Sensitive; prefer the per-connection Dashboard field when multiple accounts are configured. |
OPENCODE_SYNTHESIZE_CLI_HEADERS | false | open-sse/executors/opencode.ts | Opt-in: synthesize OpenCode CLI identity headers (User-Agent, x-opencode-client/project, request/session UUIDs) on opencode-go/zen upstream requests the client didn't send, so Cloudflare on VPS egress accepts them (#6210/#5997). Off by default (forward-only is safer). |
OPENCODE_USER_AGENT | opencode-cli/1.0.0 | open-sse/executors/opencode.ts | Default User-Agent used when OPENCODE_SYNTHESIZE_CLI_HEADERS is on and no per-provider <PROVIDER>_USER_AGENT override is set. Only applied to opencode executors. |
OPENCODE_CLIENT | cli | open-sse/executors/opencode.ts | Value for the synthesized x-opencode-client header when OPENCODE_SYNTHESIZE_CLI_HEADERS is on. |
OPENCODE_PROJECT | default | open-sse/executors/opencode.ts | Value for the synthesized x-opencode-project header when OPENCODE_SYNTHESIZE_CLI_HEADERS is on. |
OMNIROUTE_OPENCODE_GO_AUTH_COOKIE | (unset) | open-sse/services/usage.ts | Alternate OpenCode Go auth cookie env var used before the shorter alias. Sensitive; prefer the per-connection Dashboard field when multiple accounts are configured. |
OMNIROUTE_OLLAMA_CLOUD_USAGE_URL | https://ollama.com/settings | open-sse/services/usage.ts | Ollama Cloud settings URL used for quota scraping. Override for relays / test fixtures. |
OLLAMA_USAGE_COOKIE | (unset) | open-sse/services/usage.ts | Ollama Cloud __Secure-session cookie used for settings-page quota scraping. Sensitive; prefer the per-connection Dashboard field when multiple accounts are configured. |
OLLAMA_CLOUD_USAGE_COOKIE | (unset) | open-sse/services/usage.ts | Alternate Ollama Cloud __Secure-session cookie env var. Sensitive; prefer the per-connection Dashboard field when multiple accounts are configured. |
OMNIROUTE_OLLAMA_USAGE_COOKIE | (unset) | open-sse/services/usage.ts | Alternate Ollama Cloud __Secure-session cookie env var used before the shorter aliases. Sensitive; prefer the per-connection Dashboard field when multiple accounts are configured. |
OMNIROUTE_CODEWHISPERER_BASE_URL | https://codewhisperer.us-east-1.amazonaws.com | open-sse/services/usage.ts | CodeWhisperer (AWS Kiro) usage limits endpoint. Override for relays / test fixtures. |
[!IMPORTANT] When deploying behind a reverse proxy (nginx, Caddy), set
NEXT_PUBLIC_BASE_URLto your stable public URL (e.g.,https://omniroute.example.com) when OAuth callbacks or generated public links must use that hostname. Without this, OAuth callbacks can fail because the redirect_uri won't match and generated public links can point at the internal container origin.Keep
BASE_URLas an internal loopback/container URL for server-to-server jobs. Do not use a browserOriginor public hostname for credential-bearing internal self-fetches.Authenticated dashboard writes do not require a static public base URL: the dashboard sends same-origin unsafe requests with a session-bound CSRF token. OmniRoute still centralizes public-origin validation for non-dashboard browser integrations: explicit public URL env vars are trusted first; raw
Forwarded/X-Forwarded-*headers are ignored unlessOMNIROUTE_TRUST_PROXYis enabled and the immediate proxy peer is token-stamped as trusted. Do not use CORS settings to fix same-origin dashboard requests; CORS is only for cross-origin browser clients.
Route upstream LLM provider calls through an HTTP or SOCKS5 proxy for egress control, geo-routing, or IP masking.
| Variable | Default | Source File | Description |
|---|---|---|---|
ENABLE_SOCKS5_PROXY | true | open-sse/executors | Enable SOCKS5 proxy agent for upstream calls. Opt-out with false. |
NEXT_PUBLIC_ENABLE_SOCKS5_PROXY | true | Client-side | Client-side awareness of SOCKS5 availability. |
HTTP_PROXY | (unset) | Node.js standard | HTTP proxy for upstream calls. |
HTTPS_PROXY | (unset) | Node.js standard | HTTPS proxy for upstream calls. |
ALL_PROXY | (unset) | Node.js standard | Universal proxy (supports socks5://). |
NO_PROXY | (unset) | Node.js standard | Comma-separated hostnames/IPs to bypass the proxy. |
OMNIROUTE_PROXY_DISPATCHER_CONNECTIONS | 32 | open-sse/utils/proxyDispatcher.ts | Max concurrent sockets per cached HTTP/SOCKS proxy dispatcher. Long-lived SSE streams such as Codex /v1/responses need more than one connection when several requests share the same account-level proxy. Values above 256 are capped. |
SOCKS_HANDSHAKE_TIMEOUT_MS | 10000 | open-sse/utils/socksConnectorWithFamily.ts | SOCKS5 handshake (connect) timeout in ms. Raise it when a single residential gateway host is hit by high concurrency (e.g. 100 simultaneous requests) — the real handshake can exceed 10s under a saturated pool even though the proxy is reachable, which otherwise surfaces as a false [Proxy Fast-Fail] Proxy unreachable. Capped at 120000. |
PROXY_FAIL_OPEN | false | src/sse/handlers/chatHelpers.ts | When false (default), a request whose assigned proxy fails to resolve is refused (fail-closed) rather than falling back to a direct connection — prevents real-IP leaks. Set true to restore the legacy DIRECT fallback. |
ENABLE_TLS_FINGERPRINT | false | open-sse/executors | Spoof TLS fingerprint using wreq-js (mimics Chrome 124). Counters JA3/JA4 blocking. |
TLS_FINGERPRINT_PROVIDERS | (unset) | open-sse/utils/proxyFetch.ts | Comma-separated provider allowlist for the new proxied TLS routing (open-sse/utils/proxyFetch.ts). Direct TLS keeps its legacy behavior when unset; only these providers route through the Chrome-124 fingerprint bridge. |
OMNIROUTE_TURNSTILE_IGNORE_TLS_ERRORS | false | open-sse/services/claudeTurnstileSolver.ts | Allow the Claude Turnstile Playwright browser context to ignore HTTPS certificate errors. |
| Scenario | Configuration |
|---|---|
| SOCKS5 through SSH tunnel | ALL_PROXY=socks5://127.0.0.1:7890, ENABLE_SOCKS5_PROXY=true |
| Corporate HTTP proxy | HTTP_PROXY=http://proxy.corp.com:3128, HTTPS_PROXY=http://proxy.corp.com:3128, NO_PROXY=localhost,internal.corp.com |
| Anti-fingerprint | ENABLE_TLS_FINGERPRINT=true — requires wreq-js (included) |
| Egress-controlled / no direct access | Leave PROXY_FAIL_OPEN=false (default). Requests fail hard when the proxy is unavailable instead of leaking via direct. |
| Legacy / dev — allow direct fallback | PROXY_FAIL_OPEN=true. Restores pre-hardening behaviour: direct connection used when proxy resolution fails. |
Note (NVIDIA validation bypass — #3226): NVIDIA's API-key validation endpoint stalls when routed through the global proxy/TLS-patched fetch (undici dispatcher → 504).
src/lib/providers/validation.ts::directHttpsRequest()intentionally bypasses the proxy patch for that one validation call usingsafeOutboundFetch({ bypassProxyPatch: true }). This is a documented, scoped exception — it does not affect chat/usage egress. The bypass is scope-pinned bytests/unit/proxy-bypass-scope-guard-3226.test.ts.
Controls how OmniRoute discovers and launches CLI sidecars (Claude Code, Codex, etc.).
| Variable | Default | Source File | Description |
|---|---|---|---|
CLI_MODE | auto | src/shared/services/cliRuntime.ts | auto = search system PATH; manual = use explicit paths only. |
CLI_EXTRA_PATHS | (unset) | src/shared/services/cliRuntime.ts | Additional PATH entries for CLI binary discovery (colon-separated). |
CLI_CONFIG_HOME | (unset) | src/shared/services/cliRuntime.ts | Override home directory for reading CLI configs (~/.claude, ~/.codex). |
CLI_ALLOW_CONFIG_WRITES | false | src/shared/services/cliRuntime.ts | Allow OmniRoute to write CLI config files (token refresh, session data). |
CLI_CLAUDE_BIN | claude | src/shared/services/cliRuntime.ts | Custom path to Claude CLI binary. |
CLI_CODEX_BIN | codex | src/shared/services/cliRuntime.ts | Custom path to Codex CLI binary. |
CLI_DROID_BIN | droid | src/shared/services/cliRuntime.ts | Custom path to Droid CLI binary. |
CLI_OPENCLAW_BIN | openclaw | src/shared/services/cliRuntime.ts | Custom path to OpenClaw CLI binary. |
CLI_CURSOR_BIN | agent | src/shared/services/cliRuntime.ts | Custom path to Cursor agent binary. |
CLI_CLINE_BIN | cline | src/shared/services/cliRuntime.ts | Custom path to Cline CLI binary. |
CLI_CONTINUE_BIN | cn | src/shared/services/cliRuntime.ts | Custom path to Continue CLI binary. |
CLI_QODER_BIN | qoder | src/shared/services/cliRuntime.ts | Custom path to Qoder CLI binary. |
CLI_QWEN_BIN | qwen | src/shared/services/cliRuntime.ts | Custom path to the Qwen Code CLI binary. |
CLI_DEVIN_BIN | devin | open-sse/executors/devin-cli.ts | Custom path to the Devin CLI binary (v3.8.0). Used by the Windsurf/Devin executor. |
DEVIN_DESKTOP_VERSION | 3.6.27 | open-sse/executors/devin-desktop.ts | Devin Desktop ide_version. Overrides must use x.y.z format; invalid values fall back to the verified default. |
DEVIN_DESKTOP_EXTENSION_VERSION | 1.48.2 | open-sse/executors/devin-desktop.ts | Bundled Codeium/language-server extension_version, distinct from Desktop ide_version. Overrides must use x.y.z; invalid values use the bundled default. |
CLI_DEVIN_AGENTIC_BIN | devin | open-sse/executors/devin-cli-agentic.ts | Agentic bridge-only Devin CLI override. The executor accepts only the local ACP stdio upstream. |
DEVIN_AGENTIC_HOME | (required) | open-sse/executors/devin-cli-agentic.ts | Absolute isolated home for the agentic Devin subprocess; accepted bridge paths are /home/bridge and task-local .sandbox paths. |
DEVIN_AGENTIC_ACP_TIMEOUT_MS | 120000 | open-sse/executors/devin-cli-agentic.ts | Maximum duration of one Devin ACP turn before the bridge terminates the child and returns an explicit timeout. |
DEVIN_BRIDGE_MODEL | devin-cli-agentic/swe-1-7 | docker/devin-bridge/compose.yml | Main Claude Code model alias for the isolated bridge. The live harness replaces the example with a model returned by the current Devin account. |
DEVIN_BRIDGE_SONNET_MODEL | DEVIN_BRIDGE_MODEL | docker/devin-bridge/compose.yml | Isolated bridge alias used when Claude Code requests its Sonnet default. |
DEVIN_BRIDGE_OPUS_MODEL | DEVIN_BRIDGE_MODEL | docker/devin-bridge/compose.yml | Isolated bridge alias used when Claude Code requests its Opus default. |
DEVIN_BRIDGE_HAIKU_MODEL | DEVIN_BRIDGE_MODEL | docker/devin-bridge/compose.yml | Isolated bridge alias used when Claude Code requests its Haiku default. |
DEVIN_BRIDGE_SUBAGENT_MODEL | DEVIN_BRIDGE_MODEL | docker/devin-bridge/compose.yml | Isolated bridge alias used for Claude Code subagents. |
AUGGIE_BIN | auggie | open-sse/executors/auggie.ts | Absolute-path override for the Augment (Auggie) CLI binary used by the local auggie provider. Falls back to CLI_AUGGIE_BIN, then a PATH lookup. |
CLI_AUGGIE_BIN | auggie | open-sse/executors/auggie.ts | Alias override for the Augment (Auggie) CLI binary path (checked after AUGGIE_BIN). |
HERMES_HOME | ~/.hermes | src/lib/cli-helper/config-generator/hermesHome.ts | Hermes Agent home directory where OmniRoute reads/writes the Hermes CLI config. Matches the env var the Hermes PowerShell installer sets on Windows (%LOCALAPPDATA%\hermes). |
These feature flags are opt-in and default off. They can also be toggled from the CLI Code dashboard.
| Variable | Default | Source File | Description |
|---|---|---|---|
OMNIROUTE_AUTO_SYNC_CODEX_PROFILES | false | src/shared/constants/featureFlagDefinitions.ts | After a provider model sync, automatically rewrites ~/.codex/*.config.toml profile files from the live catalog. Requires CLI_ALLOW_CONFIG_WRITES; never changes the active/default Codex config, auth, Codex-lb settings, or provider choice. |
OMNIROUTE_AUTO_SYNC_CLAUDE_PROFILES | false | src/shared/constants/featureFlagDefinitions.ts | After a provider model sync, automatically rewrites ~/.claude/profiles/<name>/settings.json Claude Code profile files from the live catalog. Requires CLI_ALLOW_CONFIG_WRITES; never changes the active/default Claude config, auth, or provider choice. |
# Mount host binaries into the container and tell OmniRoute where they are:
CLI_EXTRA_PATHS=/host-cli/bin
CLI_CONFIG_HOME=/root
CLI_ALLOW_CONFIG_WRITES=true
CLI_CLAUDE_BIN=/host-cli/bin/claude
omniroute) helpersThese variables tune the omniroute CLI binary's own behavior (not the sidecar
detection above).
| Variable | Default | Source File | Description |
|---|---|---|---|
OMNIROUTE_LANG | (system) | bin/cli/i18n.mjs | Force CLI output language. BCP-47 locale (e.g. en, pt-BR). Overrides system locale env vars (LC_ALL, LC_MESSAGES). |
OMNIROUTE_SHOW_LOG | (unset) | bin/cli/runtime/processSupervisor.mjs | Set to 1 to forward server stdout/stderr to the terminal in supervised mode. Equivalent to --log flag on omniroute serve. |
OMNIROUTE_CLI_TOKEN | (unset) | bin/cli/api.mjs | Machine-auth token injected as x-omniroute-cli-token header. Auto-generated in task 8.12. |
OMNIROUTE_HTTP_TIMEOUT_MS | 30000 | bin/cli/api.mjs | Per-attempt HTTP timeout (ms) for CLI → server requests. |
OMNIROUTE_VERBOSE | 0 | bin/cli/api.mjs | Set to 1 to print retry/backoff diagnostics to stderr during CLI commands. |
OMNIROUTE_PLUGIN_PATH | (unset) | bin/cli/plugins.mjs | Custom directory for CLI plugin discovery (omniroute-cmd-* packages). Defaults to ~/.omniroute/plugins/ when unset. |
| Variable | Default | Source File | Description |
|---|---|---|---|
OMNIROUTE_BASE_URL | auto-detect | open-sse/mcp-server/server.ts | Explicit URL for MCP/A2A tools to reach OmniRoute. Overrides localhost auto-detection. |
OMNIROUTE_API_KEY | (unset) | MCP/A2A modules | API key for internal MCP tool and A2A skill calls. |
OMNIROUTE_API_KEY_ID | (unset) | open-sse/mcp-server/audit.ts | Key ID for MCP audit log attribution. |
ROUTER_API_KEY | (unset) | Legacy | Legacy alias for OMNIROUTE_API_KEY. |
OMNIROUTE_ISSUE_AGENT_ENABLED | false | src/app/api/issue-agent/runs/route.ts | Enables the offline/local Issue Agent recorded-triage endpoint. Leave disabled unless explicitly running local recorded-triage workflows. |
OMNIROUTE_ISSUE_AGENT_TIMEOUT_MS | (unset) | src/lib/issueAgent/execution.ts | Timeout (ms) for a single Issue Agent recorded-triage run. Clamped to an internal maximum; falls back to the built-in default when unset or invalid. |
OMNIROUTE_CONTEXT | (active context) | bin/cli/program.mjs, bin/cli/api.mjs | CLI remote-mode context/profile for omniroute commands; overrides the active context in the local contexts store. Equivalent to --context <name>. |
OMNIROUTE_MCP_ENFORCE_SCOPES | true | open-sse/mcp-server/server.ts | Enforce scope-based access control on MCP tool calls. |
OMNIROUTE_MCP_SCOPES | (all) | open-sse/mcp-server/server.ts | Comma-separated scopes: admin, combos, health, models, routing, budget, metrics, pricing, memory, skills. |
OMNIROUTE_MCP_COMPRESS_DESCRIPTIONS | false | open-sse/mcp-server/descriptionCompressor.ts | Compress MCP tool descriptions before serializing the manifest. Enable values: 1, true, on. |
OMNIROUTE_MCP_DESCRIPTION_COMPRESSION | rtk | open-sse/mcp-server/descriptionCompressor.ts | Compression algorithm/profile. Disable values: 0, false, off. |
MODEL_SYNC_INTERVAL_HOURS | 24 | src/shared/services/modelSyncScheduler.ts | Model catalog sync interval in hours. |
PROVIDER_LIMITS_SYNC_INTERVAL_MINUTES | 70 | src/server-init.ts | Provider rate-limit and quota polling interval. |
PROVIDER_LIMITS_SYNC_SPACING_MS | 1500 | src/lib/usage/providerLimits.ts | Gap (ms) between consecutive OAuth quota fetches in a bulk sync; OAuth connections are fetched one at a time to avoid bursting an upstream. 0 opts out (concurrent). |
OMNIROUTE_QUOTA_FETCH_MIN_INTERVAL_MS | 250 | open-sse/services/quotaFetchThrottle.ts | Min interval (ms) between consecutive upstream quota fetches on the per-request preflight/monitor path; spaces concurrent network calls so many accounts on one IP don't burst the upstream. Wired into the Codex (/wham/usage), DeepSeek, Bailian (both fetch sites), OpenCode, and Crof quota fetchers (#6009, #6911). The generic usage.ts::getUsageForProvider dispatch path (github/glm/minimax/nanogpt/xai/etc.) is not yet covered — tracked separately. Cache hits unaffected. 0 disables; clamped 0..5000. |
PROVIDER_LIMITS_POST_USAGE_REFRESH_DELAY_MS | 5000 | src/lib/usage/providerLimits.ts | Delay (ms) before refreshing provider limits after a real usage event, giving the upstream quota API time to register consumption. |
OMNIROUTE_LOGIN_BROWSER_PATH | auto-detect | open-sse/services/adobeFireflyBrowserLogin.ts | Absolute path to a system Chrome or Edge executable used for interactive Adobe Firefly sign-in and off-screen renewal. |
ADOBE_FIREFLY_BROWSER_REFRESH | enabled | open-sse/services/adobeFireflySession.ts | Keeps IMS and browser-risk state fresh with account-scoped Chrome CDP sessions. Set to 0 to disable browser renewal. |
ADOBE_FIREFLY_SESSION_DISK | enabled | open-sse/services/adobeFireflySession.ts | Persists repaired Adobe sessions under DATA_DIR across process restarts. Set to 0 to keep sessions memory-only. |
ADOBE_FIREFLY_MIN_SUBMIT_GAP_MS | 12000 | open-sse/services/adobeFireflySession.ts | Minimum spacing in milliseconds between Adobe Firefly generate submissions; 0 disables spacing. |
ADOBE_FIREFLY_BATCH_EXTRA_GAP_MS | 15000 | open-sse/services/adobeFireflySession.ts | Extra quiet period in milliseconds after every third successful Adobe submission. |
ADOBE_FIREFLY_SUBMIT_BASE_DELAY_MS | 8000 | open-sse/services/adobeFireflyClient.ts | Base backoff in milliseconds after transient Adobe 408 responses; combined with submit spacing across at most five attempts. |
OMNIROUTE_DISABLE_BACKGROUND_SERVICES | false | src/instrumentation-node.ts | Disable all background services (sync, pricing, model refresh). Useful for CI/test. |
OMNIROUTE_ENABLE_RUNTIME_BACKGROUND_TASKS | (unset) | src/lib/config/runtimeSettings.ts | Force background tasks on under automated test detection. Set 1 to override the test heuristic. |
OMNIROUTE_BUDGET_RESET_JOB_INTERVAL_MS | 600000 | src/lib/jobs/budgetResetJob.ts | Budget reset check cadence (ms). Floor 10000. |
OMNIROUTE_CONNECTION_RECOVERY_INTERVAL_MS | 60000 | src/lib/quota/connectionRecovery.ts | Proactive connection-cooldown recovery cadence (ms): re-validates connections whose transient rate_limited_until has elapsed, off the request hot path. Floor 5000. |
OMNIROUTE_DISABLE_CONNECTION_RECOVERY | false | src/lib/quota/connectionRecovery.ts | Disable the proactive connection-cooldown recovery scheduler (lazy recovery in getProviderCredentials still applies). |
OMNIROUTE_REASONING_CACHE_CLEANUP_INTERVAL_MS | 1800000 | src/lib/jobs/reasoningCacheCleanupJob.ts | Reasoning cache cleanup cadence (ms). Floor 60000. |
OMNIROUTE_CONFIG_HOT_RELOAD_MS | 5000 | src/lib/config/hotReload.ts | Polling interval (ms) for config hot-reload. Lower than 1000 is rejected. |
OMNIROUTE_DISABLE_REDIS_AUTH_CACHE | (enabled) | src/lib/db/apiKeys.ts | Set 1 to bypass the Redis-backed API-key auth cache (forces DB reads). |
OMNIROUTE_RTK_TRUST_PROJECT_FILTERS | 0 | open-sse/services/compression/engines/rtk/filterLoader.ts | Trust user-managed RTK project filter rules without strict signature checks. |
COMPRESSION_PIPELINE_BREAKER_ENABLED | false | open-sse/services/compression/pipelineEngineBreaker.ts | T02 stacked-pipeline per-engine circuit-breaker master switch. Opt-in (default off) — when on, an engine that throws repeatedly across requests is skipped (fail-open) for a cooldown; off = byte-identical legacy behavior. |
COMPRESSION_PIPELINE_BREAKER_THRESHOLD | 3 | open-sse/services/compression/pipelineEngineBreaker.ts | Consecutive cross-request failures before an engine's breaker opens. |
COMPRESSION_PIPELINE_BREAKER_COOLDOWN_MS | 30000 | open-sse/services/compression/pipelineEngineBreaker.ts | Milliseconds an opened engine stays skipped before a half-open probe. |
COMPRESSION_CCR_RETRIEVAL_RAMP_FACTOR | 2 | open-sse/services/compression/engines/ccr/index.ts | T08/H8 CCR retrieval-feedback ramp: each prior retrieval of a stored block raises its effective minChars linearly (frequently-retrieved content compresses less; >=3 retrievals = never compressed). 1 disables the ramp (binary skip at the threshold only). |
COMPRESSION_CCR_DURABLE_STORE | true | open-sse/services/compression/engines/ccr/index.ts | CCR durable block store (#9061). Backs the in-memory store with SQLite so a block survives LRU eviction, the TTL, a restart, or a retrieve landing on another instance. Set false to keep blocks in memory only. Blocks over 512KB and cloud runtimes stay memory-only regardless. |
COMPRESSION_PREFIX_FREEZE_ENABLED | false | open-sse/services/compression/prefixFreeze.ts | T08/H5 usage-observed prefix freeze master switch. Opt-in (default off) — when on, a system prompt observed >= the threshold is treated as a stable cacheable prefix and preserved from compression even for providers the static cache heuristic misses (freeze only preserves, never mutates). |
COMPRESSION_PREFIX_FREEZE_THRESHOLD | 3 | open-sse/services/compression/prefixFreeze.ts | Observations of a system prompt before it is treated as a frozen stable prefix. |
OMNIROUTE_BOOTSTRAPPED | false | src/app/(dashboard)/dashboard/page.tsx | Set true by bootstrap script after initial setup. Controls setup wizard visibility. |
OMNIROUTE_ALLOW_BODY_PROJECT_OVERRIDE | 0 | open-sse/executors/antigravity.ts | Escape hatch: allow request body to override the Antigravity project field. |
ANTIGRAVITY_CREDITS | off | open-sse/services/antigravityCredits.ts | Google One AI credits policy: off never injects credits, retry injects once after an eligible quota 429, and always injects on the first request. |
ANTIGRAVITY_ALLOW_SIGNATURE_BYPASS | 0 | open-sse/translator/request/openai-to-gemini.ts | Allow the Antigravity request translator to skip its strict CLI request-signature validation when the upstream refuses real signatures (debug/antiquated-CLI mode). Non-zero enables the bypass. |
AGY_TOKEN_FILE | ~/.gemini/antigravity-cli/antigravity-oauth-token | src/app/api/providers/agy-auth/apply-local/route.ts | Override the Antigravity CLI (agy) token-file path for the auto-detect local login import. |
| Variable | Default | Source File | Description |
|---|---|---|---|
OMNIROUTE_SERVER | auto-detect | src/lib/oauth/config/index.ts | Server URL for CLI↔OmniRoute auth bridge. |
OMNIROUTE_TOKEN | (unset) | src/lib/oauth/config/index.ts | Auth token for CLI bridge. |
OMNIROUTE_USER_ID | cli | src/lib/oauth/config/index.ts | User ID for CLI bridge sessions. |
SERVER_URL | (unset) | src/lib/oauth/config/index.ts | Legacy alias for OMNIROUTE_SERVER. |
CLI_TOKEN | (unset) | src/lib/oauth/config/index.ts | Legacy alias for OMNIROUTE_TOKEN. |
CLI_USER_ID | (unset) | src/lib/oauth/config/index.ts | Legacy alias for OMNIROUTE_USER_ID. |
Built-in credentials for localhost development. For remote deployments, register your own at each provider's developer console.
| Variable | Provider | Notes |
|---|---|---|
CLAUDE_OAUTH_CLIENT_ID | Claude Code (Anthropic) | Public client — no secret needed. |
CLAUDE_CODE_REDIRECT_URI | Claude Code | Override redirect URI. Default: https://platform.claude.com/oauth/code/callback |
CODEX_OAUTH_CLIENT_ID | Codex / OpenAI | Public client. |
GEMINI_OAUTH_CLIENT_ID | Gemini (Google) | Requires matching _SECRET. |
GEMINI_OAUTH_CLIENT_SECRET | Gemini (Google) | — |
KIMI_CODING_OAUTH_CLIENT_ID | Kimi Coding (Moonshot) | Public client. |
ANTIGRAVITY_OAUTH_CLIENT_ID | Antigravity (Google) | Requires matching _SECRET. |
ANTIGRAVITY_OAUTH_CLIENT_SECRET | Antigravity (Google) | — |
GITHUB_OAUTH_CLIENT_ID | GitHub Copilot | Public client. |
GHE_COPILOT_OAUTH_CLIENT_ID | GHE Copilot | Optional override for GitHub Enterprise Copilot's OAuth client id. Falls back to GITHUB_OAUTH_CLIENT_ID's public default when unset. |
WINDSURF_API_KEY | Windsurf / Devin (v3.8) | API key fallback used by open-sse/executors/devin-cli.ts when no per-connection credential is available. Optional. |
CLI_DEVIN_BIN | Devin CLI (v3.8) | Custom path to the Devin CLI binary (devin). Resolved by open-sse/executors/devin-cli.ts. |
GITLAB_DUO_OAUTH_CLIENT_ID | GitLab Duo (v3.8) | OAuth client ID for GitLab Duo. Register an app at https://gitlab.com/-/profile/applications with redirect URI <NEXT_PUBLIC_BASE_URL>/callback and scopes api, read_user, openid, profile, email. Falls back to GITLAB_OAUTH_CLIENT_ID. |
GITLAB_DUO_OAUTH_CLIENT_SECRET | GitLab Duo (v3.8) | OAuth client secret for GitLab Duo. Optional — PKCE flow does not require a secret. Falls back to GITLAB_OAUTH_CLIENT_SECRET. |
GITLAB_DUO_BASE_URL | GitLab Duo (v3.8) | Override GitLab base URL (self-hosted GitLab). Defaults to https://gitlab.com. Falls back to GITLAB_BASE_URL. |
GITLAB_BASE_URL | GitLab Duo (v3.8) | Legacy fallback for GITLAB_DUO_BASE_URL. Used when the _DUO_ variant is unset. |
GITLAB_OAUTH_CLIENT_ID | GitLab Duo (v3.8) | Legacy fallback for GITLAB_DUO_OAUTH_CLIENT_ID consumed by src/lib/oauth/constants/oauth.ts. |
GITLAB_OAUTH_CLIENT_SECRET | GitLab Duo (v3.8) | Legacy fallback for GITLAB_DUO_OAUTH_CLIENT_SECRET consumed by src/lib/oauth/constants/oauth.ts. |
QODER_OAUTH_CLIENT_SECRET | Qoder | — |
QODER_OAUTH_AUTHORIZE_URL | Qoder | Set to enable Qoder OAuth. |
QODER_OAUTH_TOKEN_URL | Qoder | — |
QODER_OAUTH_USERINFO_URL | Qoder | — |
QODER_OAUTH_CLIENT_ID | Qoder | — |
QODER_PERSONAL_ACCESS_TOKEN | Qoder | Direct API key fallback (bypasses OAuth). |
QODER_CLI_WORKSPACE | Qoder | Workspace ID for Qoder CLI. |
OMNIROUTE_QODER_WORKSPACE | Qoder | Alias for QODER_CLI_WORKSPACE. |
QODER_CLI_CONFIG_DIR | Qoder | Override the Qoder CLI config dir (isolated PAT session, avoids clobbering a browser login). |
BLACKBOX_WEB_VALIDATED_TOKEN | Blackbox Web | Frontend tk token to send as validated on /api/chat. Required when Blackbox enforces token matching; otherwise OmniRoute falls back to a random UUID. See issue #2252. |
VISION_BRIDGE_BASE_URL | Vision Bridge guardrail | OpenAI-compatible base URL for non-Anthropic vision-bridge calls. Defaults to the legacy OpenAI URL env or api.openai.com. Point at OmniRoute's /v1 self-loop or any OpenAI-compat endpoint (Gemini OpenAI-compat, OpenRouter). Issue #2232. When the URL is OmniRoute's own /v1, the describe sub-request sends x-omniroute-admission-bypass: internal and authenticates with the resolved self-loop credential (sk_omniroute sentinel in local mode, or OMNIROUTE_API_KEY / ROUTER_API_KEY — #1350) so REQUIRE_API_KEY=true deployments work. |
VISION_BRIDGE_API_KEY | Vision Bridge guardrail | API key for the URL above. Overrides per-provider OpenAI / Google env vars for non-Anthropic vision-bridge calls. Anthropic models keep their dedicated Anthropic key path. Issue #2232. |
RAYCAST_BEARER_TOKEN | Raycast Pro | Optional manual override for the Raycast access token (normally captured via macOS Auto-Import). No OAuth client_id/secret — reverse-engineered, local/personal use only. |
RAYCAST_DEVICE_ID | Raycast Pro | Optional manual override for the Raycast device ID used to sign requests. |
RAYCAST_AID | Raycast Pro | Optional manual override for the Raycast account/app ID; falls back to the device ID when unset. |
RAYCAST_SIG_SECRET | Raycast Pro | Optional override for the request-signing HMAC secret. Defaults to a community-extracted value in open-sse/services/raycast.ts. |
[!WARNING]
- Go to Google Cloud Console → Credentials
- Create an OAuth 2.0 Client ID (type: "Web application")
- Add your server URL as Authorized redirect URI
- Replace the credential values in
.env.
Override the User-Agent header sent to each upstream provider. This is dynamically resolved at runtime by the executor base class:
process.env[`${PROVIDER_ID}_USER_AGENT`]
Source:
open-sse/executors/base.ts→buildHeaders()
| Variable | Default Value | When to Update |
| -------------------------------- | --------------------------------------------- | ------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| CLAUDE_USER_AGENT | claude-cli/2.1.219 (external, cli) | When Anthropic releases a new CLI version |
| CLAUDE_DISABLE_TOOL_NAME_CLOAK | false | executors/base.ts + executors/cliproxyapi.ts | Set to 1/true to forward third-party harness tool names verbatim to Anthropic on both Anthropic-bound paths (native OAuth and CLIProxyAPI). By default the executor deterministically aliases non-Claude-Code tool names (Claude Code canonical mapping where one exists, otherwise PascalCase) and reverses them on the response via _toolNameMap, so harnesses with snake_case tools are not refused as fingerprinted third-party clients. Debugging only. |
| CODEX_USER_AGENT | codex-cli/0.142.0 (Windows 10.0.26200; x64) | When OpenAI updates the Codex CLI |
| CODEX_CLIENT_VERSION | 0.131.0 | Override Codex client version independently of full UA string |
| GITHUB_USER_AGENT | GitHubCopilotChat/0.54.0 | When GitHub Copilot Chat updates |
| ANTIGRAVITY_USER_AGENT | antigravity/2.0.1 darwin/arm64 | When Antigravity IDE updates |
| KIRO_USER_AGENT | AWS-SDK-JS/3.0.0 kiro-ide/1.0.0 | When Kiro IDE updates |
| KIRO_OAUTH_CLIENT_ID | kiro-cli | Override the Kiro social device-code clientId (public id) |
| KIRO_VERIFY_FULL_CRC | false | Opt-in: full per-frame message CRC validation on the Kiro event stream (debug corrupted streams) |
| QODER_USER_AGENT | Qoder-Cli | When Qoder CLI updates |
| CURSOR_USER_AGENT | Cursor/3.3 | When Cursor updates |
[!TIP] You can add User-Agent overrides for any provider using the pattern
{PROVIDER_ID}_USER_AGENT. The executor dynamically constructs the env var name.
When enabled, OmniRoute reorders HTTP headers and JSON body fields to match the exact signature of official CLI tools. This reduces the risk of account flagging while preserving your proxy IP.
Source: open-sse/config/cliFingerprints.ts, open-sse/executors/base.ts
| Variable | Activation | Effect |
|---|---|---|
CLI_COMPAT_CODEX | =1 | Mimics Codex CLI request signature |
CLI_COMPAT_CLAUDE | =1 | Mimics Claude Code request signature |
CLI_COMPAT_GITHUB | =1 | Mimics GitHub Copilot request signature |
CLI_COMPAT_ANTIGRAVITY | =1 | Mimics Antigravity request signature |
CLI_COMPAT_CURSOR | =1 | Mimics Cursor request signature |
CLI_COMPAT_KIMI_CODING | =1 | Mimics Kimi Coding request signature |
CLI_COMPAT_KILOCODE | =1 | Mimics Kilo Code request signature |
CLI_COMPAT_CLINE | =1 | Mimics Cline request signature |
| Variable | Activation | Effect |
|---|---|---|
CLI_COMPAT_ALL | =1 | Enable fingerprint compatibility for all providers at once. |
| Variable | Default | Source File | Description |
|---|---|---|---|
KIMI_CLI_VERSION | 1.36.0 | src/lib/oauth/providers/kimi-coding.ts | Override the Kimi CLI version sent during OAuth/API calls. |
KIMI_CODING_DEVICE_ID | (captured default) | src/lib/oauth/providers/kimi-coding.ts | Override the captured Kimi device ID used in client headers. |
[!NOTE] This feature works alongside the User-Agent overrides (§12). The fingerprint system handles header ordering and body field ordering, while User-Agent overrides handle the specific UA string. Both can be enabled independently.
API keys for providers that use direct authentication. Preferred setup: Dashboard → Providers → Add API Key.
Setting via environment variables is an alternative for Docker or headless deployments.
Recognized pattern: {PROVIDER_ID}_API_KEY
| Variable | Provider |
|---|---|
DEEPSEEK_API_KEY | DeepSeek |
NVIDIA_API_KEY | NVIDIA NIM |
[!NOTE] Static
${PROVIDER}_API_KEYentries for Groq, xAI, Mistral, Perplexity, Together AI, Fireworks, Cerebras, Cohere, Nebius, and Qianfan were removed in v3.8.0 because the runtime no longer reads them — those providers rely exclusively on Dashboard /data/provider-credentials.json/ the encrypted DB. See the Audit: Removed / Dead Variables section at the bottom of this document for the migration path.
[!TIP] Keys set via the Dashboard are stored encrypted in SQLite and take precedence over environment variables.
All values are in milliseconds. Centralized resolution in src/shared/utils/runtimeTimeouts.ts.
REQUEST_TIMEOUT_MS (global override)
├─→ FETCH_TIMEOUT_MS (upstream provider calls, default: 600000)
│ ├─→ FETCH_HEADERS_TIMEOUT_MS (inherits from FETCH_TIMEOUT_MS)
│ ├─→ FETCH_BODY_TIMEOUT_MS (inherits from FETCH_TIMEOUT_MS)
│ ├─→ TLS_CLIENT_TIMEOUT_MS (inherits from FETCH_TIMEOUT_MS)
│ ├── FETCH_CONNECT_TIMEOUT_MS (independent, default: 30000)
│ └── FETCH_KEEPALIVE_TIMEOUT_MS (independent, default: 4000)
├─→ STREAM_IDLE_TIMEOUT_MS (inherits from REQUEST_TIMEOUT_MS, default: 600000)
├─→ STREAM_READINESS_TIMEOUT_MS (inherits from REQUEST_TIMEOUT_MS, default: 80000)
├─→ STREAM_READINESS_MAX_TIMEOUT_MS (caps adaptive readiness extensions, default: 180000)
└─→ API_BRIDGE_PROXY_TIMEOUT_MS (inherits from REQUEST_TIMEOUT_MS, default: 30000)
├─→ API_BRIDGE_SERVER_REQUEST_TIMEOUT_MS (derived, default: 300000)
├── API_BRIDGE_SERVER_HEADERS_TIMEOUT_MS (default: 60000)
├── API_BRIDGE_SERVER_KEEPALIVE_TIMEOUT_MS (default: 5000)
└── API_BRIDGE_SERVER_SOCKET_TIMEOUT_MS (default: 0 = disabled)
| Variable | Default | Description |
|---|---|---|
REQUEST_TIMEOUT_MS | (unset) | Global shortcut — overrides both FETCH_TIMEOUT_MS and STREAM_IDLE_TIMEOUT_MS defaults. |
FETCH_TIMEOUT_MS | 600000 | Total HTTP request timeout for upstream provider calls. |
STREAM_IDLE_TIMEOUT_MS | 600000 | Max silence between SSE chunks before aborting. Extended-thinking models rarely pause >90s. |
OMNIROUTE_SSE_COMMENTS | (enabled) | Whether OmniRoute may emit SSE : comment lines (e.g. the : keepalive heartbeat). Set off to suppress comment-shaped heartbeats (no-op) for strict OpenAI-compatible clients that JSON.parse every SSE line; data: heartbeats are unaffected. Used by open-sse/utils/sseHeartbeat.ts. |
STREAM_READINESS_TIMEOUT_MS | 80000 | Time to receive the first non-ping SSE event. Inherits REQUEST_TIMEOUT_MS when set. |
STREAM_READINESS_MAX_TIMEOUT_MS | 180000 | Maximum adaptive first-event readiness window for large, tool-heavy, or high-reasoning streaming requests. |
OMNIROUTE_AGENT_GOAL_POLICY_ENABLED | true | Kill-switch for the /goal heuristic. Set false/0/off to fully disable detection — readiness timeouts and stream recovery are never elevated by request body/headers, mitigating client-controlled timeout amplification. |
OMNIROUTE_AGENT_GOAL_READINESS_MAX_TIMEOUT_MS | 600000 | Maximum first-event readiness window for detected /goal agent runs or requests forced with x-omniroute-agent-goal. |
OMNIROUTE_AGENT_GOAL_STREAM_RECOVERY | true | Enable early stream recovery automatically for detected /goal agent runs. Set false/0/off to disable the goal-specific opt-in. This can only ADD recovery on top of the operator default — it never overrides an explicit STREAM_RECOVERY_ENABLED/DB settings opt-out. |
OMNIROUTE_CODEX_DROP_NONSTANDARD_EVENTS | (off) | Strip non-standard codex.* SSE events (e.g. codex.rate_limits) that break the OpenAI SDK's responses.stream() with a 502. Set true/1/yes to enable. |
FETCH_HEADERS_TIMEOUT_MS | = FETCH_TIMEOUT_MS | Time to receive response headers. |
FETCH_BODY_TIMEOUT_MS | = FETCH_TIMEOUT_MS | Time to receive the full response body. |
FETCH_CONNECT_TIMEOUT_MS | 30000 | TCP connection establishment timeout. |
FETCH_KEEPALIVE_TIMEOUT_MS | 4000 | Keep-alive socket idle timeout. |
TLS_CLIENT_TIMEOUT_MS | = FETCH_TIMEOUT_MS | TLS fingerprint proxy (wreq-js) timeout. |
API_BRIDGE_PROXY_TIMEOUT_MS | 30000 | Proxy hop timeout for /v1 bridge requests. |
FIRECRAWL_BASE_URL | https://api.firecrawl.dev | Point the Firecrawl web-fetch executor at a self-hosted instance (API key optional off-cloud). |
FIRECRAWL_TIMEOUT_MS | 30000 | Per-request timeout for the Firecrawl web-fetch executor. |
API_BRIDGE_SERVER_REQUEST_TIMEOUT_MS | 300000 | Overall server request timeout for the bridge. |
API_BRIDGE_SERVER_HEADERS_TIMEOUT_MS | 60000 | Time to send response headers via the bridge. |
API_BRIDGE_SERVER_KEEPALIVE_TIMEOUT_MS | 5000 | Bridge keep-alive idle timeout. |
API_BRIDGE_SERVER_SOCKET_TIMEOUT_MS | 0 | Raw socket timeout (0 = disabled). |
SHUTDOWN_TIMEOUT_MS | 30000 | Grace period on SIGTERM/SIGINT before force-exit. |
OMNIROUTE_DEFAULT_FETCH_TIMEOUT_MS | 120000 | Fallback used by src/shared/utils/fetchTimeout.ts when FETCH_TIMEOUT_MS is unset. |
OMNIROUTE_PROVIDER_PROBE_TIMEOUT_MS | 8000 | Timeout (ms) for the validationRead and modelsProbe presets in src/shared/network/safeOutboundFetch.ts. Raise for slow endpoints (Cerebras, Cloudflare AI, Groq) to prevent flapping between active/error in the dashboard. Falls back to 8000ms for invalid (<1000) or non-numeric values. |
OMNIROUTE_RELAY_FETCH_TIMEOUT_MS | 25000 | Relay-specific fetch timeout in open-sse/utils/proxyFetch.ts (#9158). A hung relay must fail before the client/agent timeout (~30s) so callers see a relay-specific failure instead of a generic upstream timeout. Capped at 29000 so it always fires first. |
OMNIROUTE_RETRY_BACKOFF_MS | 10 | Shared retry backoff for the direct/relay/proxy retry-once paths in open-sse/utils/proxyFetch.ts (#9158). 0 = retry immediately. |
OMNIROUTE_CHATGPT_TLS_TIMEOUT_MS | 60000 | Wire-level timeout for the bogdanfinn/tls-client koffi binding (chatgptTlsClient.ts). |
OMNIROUTE_CHATGPT_TLS_GRACE_MS | 10000 | JS-side grace added on top of the wire timeout when the native binding is wedged. |
OMNIROUTE_CHATGPT_STREAM_FIRST_BYTE_TIMEOUT_MS | 30000 (30s) | Max wait for the first streamed byte from the ChatGPT TLS sidecar (chatgptTlsClient.ts) before aborting a dead stream. Raise if upstream cold-starts exceed the window. |
OMNIROUTE_CLAUDE_TLS_TIMEOUT_MS | 60000 | Wire-level timeout for the bogdanfinn/tls-client koffi binding (claudeTlsClient.ts). |
OMNIROUTE_CLAUDE_TLS_GRACE_MS | 10000 | JS-side grace added on top of the wire timeout when the native binding is wedged. |
OMNIROUTE_PPLX_TLS_TIMEOUT_MS | 30000 | Wire-level timeout for the bogdanfinn/tls-client koffi binding (perplexityTlsClient.ts). |
OMNIROUTE_PPLX_TLS_GRACE_MS | 10000 | JS-side grace added on top of the wire timeout when the native binding is wedged. |
OMNIROUTE_GROK_TLS_TIMEOUT_MS | 60000 | Wire-level timeout for the bogdanfinn/tls-client koffi binding (grokTlsClient.ts). |
OMNIROUTE_GROK_TLS_GRACE_MS | 10000 | JS-side grace added on top of the wire timeout when the native binding is wedged. |
OMNIROUTE_NOTION_TLS_TIMEOUT_MS | 30000 | Wire-level timeout for the bogdanfinn/tls-client koffi binding (notionTlsClient.ts); the notion-web executor raises it per-request to 180000 for long generations. |
OMNIROUTE_NOTION_TLS_GRACE_MS | 10000 | JS-side grace added on top of the wire timeout when the native binding is wedged. |
OMNIROUTE_BROWSER_POOL | on | Shared Playwright browser pool for browser-backed web-cookie chat (browserPool.ts); set off to disable. |
WEB_COOKIE_USE_BROWSER | 0 | Opt a web-cookie chat request into the browser-backed path (browserBackedChat.ts); 1 to enable. |
OMNIROUTE_LOGIN_BROWSER_PATH | (auto-detected) | Path to a system Chrome/Edge executable for the Adobe Firefly interactive browser sign-in (adobeFireflyBrowserLogin.ts); overrides per-OS auto-detection. |
Combo target attempts inherit the resolved upstream request timeout (FETCH_TIMEOUT_MS, or
REQUEST_TIMEOUT_MS when it supplies the fetch default). Set targetTimeoutMs in a combo,
combo defaults, or provider override only to make combo fallback faster; values above the
current upstream timeout are capped to the upstream timeout.
Provider-level circuit breaker tuning. Defaults reflect the scaled values used since v3.6 for 500+ connections.
| Variable | Default | Source File | Description |
|---|---|---|---|
OMNIROUTE_CIRCUIT_BREAKER_OAUTH_THRESHOLD | 8 | open-sse/config/constants.ts | Consecutive failure threshold for OAuth providers before the breaker trips. |
OMNIROUTE_CIRCUIT_BREAKER_OAUTH_RESET_MS | 60000 | open-sse/config/constants.ts | Reset window (ms) for OAuth provider breaker. |
OMNIROUTE_CIRCUIT_BREAKER_API_KEY_THRESHOLD | 12 | open-sse/config/constants.ts | Consecutive failure threshold for API-key providers. |
OMNIROUTE_CIRCUIT_BREAKER_API_KEY_RESET_MS | 30000 | open-sse/config/constants.ts | Reset window (ms) for API-key provider breaker. |
OMNIROUTE_CIRCUIT_BREAKER_LOCAL_THRESHOLD | 2 | open-sse/config/constants.ts | Consecutive failure threshold for local providers (Ollama, LM Studio, ...). |
OMNIROUTE_CIRCUIT_BREAKER_LOCAL_RESET_MS | 15000 | open-sse/config/constants.ts | Reset window (ms) for local provider breaker. |
OMNIROUTE_PROVIDER_BREAKER_OAUTH_FAILURE_THRESHOLD | 10 | open-sse/config/constants.ts | Provider-level breaker: failures within the window before the entire OAuth provider enters cooldown. |
OMNIROUTE_PROVIDER_BREAKER_OAUTH_FAILURE_WINDOW_MS | 900000 | open-sse/config/constants.ts | Provider-level breaker: rolling failure-count window (ms) for OAuth providers. |
OMNIROUTE_PROVIDER_BREAKER_OAUTH_COOLDOWN_MS | 300000 | open-sse/config/constants.ts | Provider-level breaker: cooldown (ms) once the OAuth provider threshold is reached. |
OMNIROUTE_PROVIDER_BREAKER_OAUTH_DEGRADATION_THRESHOLD | 5 | open-sse/config/constants.ts | OAuth provider enters DEGRADED at this many failures. |
OMNIROUTE_PROVIDER_BREAKER_OAUTH_MAX_BACKOFF_MULTIPLIER | 8 | open-sse/config/constants.ts | OAuth provider max resetTimeout escalation multiplier. |
OMNIROUTE_PROVIDER_BREAKER_OAUTH_BACKOFF_ESCALATION_COUNT | 2 | open-sse/config/constants.ts | OAuth provider escalates after this many open cycles. |
OMNIROUTE_PROVIDER_BREAKER_API_KEY_FAILURE_THRESHOLD | 15 | open-sse/config/constants.ts | Provider-level breaker: failures within the window before the entire API-key provider enters cooldown. |
OMNIROUTE_PROVIDER_BREAKER_API_KEY_FAILURE_WINDOW_MS | 1800000 | open-sse/config/constants.ts | Provider-level breaker: rolling failure-count window (ms) for API-key providers. |
OMNIROUTE_PROVIDER_BREAKER_API_KEY_COOLDOWN_MS | 600000 | open-sse/config/constants.ts | Provider-level breaker: cooldown (ms) once the API-key provider threshold is reached. |
OMNIROUTE_PROVIDER_BREAKER_API_KEY_DEGRADATION_THRESHOLD | 7 | open-sse/config/constants.ts | API-key provider enters DEGRADED at this many failures. |
OMNIROUTE_PROVIDER_BREAKER_API_KEY_MAX_BACKOFF_MULTIPLIER | 4 | open-sse/config/constants.ts | API-key provider max resetTimeout escalation multiplier. |
OMNIROUTE_PROVIDER_BREAKER_API_KEY_BACKOFF_ESCALATION_COUNT | 3 | open-sse/config/constants.ts | API-key provider escalates after this many open cycles. |
OMNIROUTE_PROVIDER_BREAKER_LOCAL_FAILURE_THRESHOLD | 2 | open-sse/config/constants.ts | Provider-level breaker: failures before the entire local provider enters cooldown. |
OMNIROUTE_PROVIDER_BREAKER_LOCAL_FAILURE_WINDOW_MS | 300000 | open-sse/config/constants.ts | Provider-level breaker: rolling failure-count window (ms) for local providers. |
OMNIROUTE_PROVIDER_BREAKER_LOCAL_COOLDOWN_MS | 60000 | open-sse/config/constants.ts | Provider-level breaker: cooldown (ms) once the local provider threshold is reached. |
PIN_DROP_BACKOFF_LEVEL | 2 | open-sse/services/combo.ts | Backoff depth at which a context-cache pin's provider is deemed durably unhealthy and the pin is dropped for failover. |
PIN_DROP_GRACE_MS | 20000 | open-sse/services/combo.ts | Anti-flap window (ms) tolerating brief transient cooldowns before dropping a context-cache pin. |
| Scenario | Configuration |
|---|---|
| Long-running code generation | REQUEST_TIMEOUT_MS=900000 (15 min) |
| Fast-fail for production API | API_BRIDGE_PROXY_TIMEOUT_MS=10000 |
| Extended thinking models | STREAM_IDLE_TIMEOUT_MS=300000 (5 min between chunks) |
The logging system writes to both stdout and rotated log files. All configuration is read by src/lib/logEnv.ts.
| Variable | Default | Description |
|---|---|---|
APP_LOG_LEVEL | info | Minimum log level: debug, info, warn, error. |
APP_LOG_FORMAT | text | Output format: text (human-readable) or json (structured). |
APP_LOG_TO_FILE | true | Write logs to file alongside stdout. |
APP_LOG_FILE_PATH | logs/application/app.log | Log file path (relative to project root or DATA_DIR). |
APP_LOG_MAX_FILE_SIZE | 50M | Max file size before rotation. Accepts: 50M, 1G, 512K, or plain bytes. |
APP_LOG_RETENTION_DAYS | 7 | Days to keep rotated application log files. |
APP_LOG_MAX_FILES | 20 | Maximum rotated log file backups. |
CALL_LOG_RETENTION_DAYS | 7 | Days to keep request/call log entries in the database. |
CALL_LOG_MAX_ENTRIES | 10000 | Max call log entries in the in-memory buffer. |
CALL_LOGS_TABLE_MAX_ROWS | 100000 | Max rows in the call_logs SQLite table before pruning. |
ENABLE_REQUEST_LOGS | (unset) | Force detailed request logging on or off, overriding the dashboard setting. |
MAX_PENDING_REQUEST_AGE_MS | 3600000 (1 hour) | Max age for orphaned active request log entries before in-memory cleanup. |
CALL_LOG_PIPELINE_CAPTURE_STREAM_CHUNKS | false | Store stream chunks in pipeline artifacts when call_log_pipeline_enabled=true. Opt-in (true) — off by default to save disk. |
CALL_LOG_PIPELINE_MAX_SIZE_KB | 512 | Max pipeline call log artifact size in KB when call_log_pipeline_enabled=true. |
PROXY_LOGS_TABLE_MAX_ROWS | 100000 | Max rows in the proxy_logs SQLite table before pruning. |
APP_LOG_ROTATION_CHECK_INTERVAL_MS | 60000 (1 min) | How often src/lib/logRotation.ts re-checks the active log file size. |
CHAT_LOG_TEXT_LIMIT | 65536 | Max string length retained in chat log artifacts (default 64 KB). |
CHAT_LOG_ARRAY_TAIL_ITEMS | 128 | Number of array items retained from the tail when truncating chat log payloads. |
CHAT_LOG_MAX_DEPTH | 6 | Max nesting depth before chat log payloads are truncated. |
CHAT_LOG_MAX_OBJECT_KEYS | 80 | Max object keys retained in chat log payloads (0 = unlimited). |
CHAT_LOG_MAX_BODY_KB | 1024 | Whole request/response body size (KB) before it's replaced by a bare summary instead of the full clone. Raise this if long agentic conversations show a placeholder instead of the real messages in the dashboard. |
CHAT_DEBUG_FILE | false | When true, serializeArtifactForStorage skips size-based truncation. Debug only. |
| Variable | Default | Description |
|---|---|---|
OMNIROUTE_MEMORY_MB | auto | Runtime V8 heap limit (MB). When unset, calibrated dynamically (~35% of system RAM, clamped to [512, 4096]); 512 is only the floor when total memory can't be read. Set explicitly to override. Docker standalone and omniroute serve use it to set --max-old-space-size. |
PROMPT_CACHE_MAX_SIZE | 50 | Max cached system prompt entries. |
PROMPT_CACHE_MAX_BYTES | 2097152 (2 MB) | Max total prompt cache size. |
PROMPT_CACHE_TTL_MS | 300000 (5 min) | Prompt cache entry TTL. |
SEMANTIC_CACHE_MAX_SIZE | 100 | Max cached temperature=0 responses. |
SEMANTIC_CACHE_MAX_BYTES | 4194304 (4 MB) | Max total semantic cache size. |
SEMANTIC_CACHE_TTL_MS | 1800000 (30 min) | Semantic cache entry TTL. |
STREAM_HISTORY_MAX | 50 | Max recent stream events in the Dashboard live view buffer. |
CONTEXT_LENGTH_DEFAULT | 128000 | Global fallback max context length for models without explicit config. |
USAGE_TOKEN_BUFFER | 100 | Extra token headroom reserved when tracking usage quotas. |
| Variable | Default | Description |
|---|---|---|
OMNIROUTE_RTK_TRUST_PROJECT_FILTERS | unset | Trust project .rtk/filters.json without a .rtk/trust.json hash. Use only in controlled local development. |
Embedding layer, vector store and reranking knobs for the persistent memory subsystem (src/lib/memory/).
| Variable | Default | Description |
|---|---|---|
MEMORY_EMBEDDING_CACHE_TTL_MS | 300000 (5 min) | TTL for the in-memory embedding cache (per source/model/dim signature). |
MEMORY_EMBEDDING_CACHE_MAX | 1000 | Max LRU entries kept in the embedding cache. |
MEMORY_TRANSFORMERS_MODEL | Xenova/all-MiniLM-L6-v2 | HF repo id for the opt-in @huggingface/transformers local MiniLM pipeline (~23 MB int8, ~400 MB RAM). |
MEMORY_STATIC_MODEL | minishlab/potion-base-8M | HF repo id for the static potion/Model2Vec lookup-table embedder. Downloaded lazily into the cache dir. |
MEMORY_STATIC_CACHE_DIR | <DATA_DIR>/embeddings | Directory used to cache the static potion model files. Defaults under DATA_DIR when unset. |
HF_HUB_ENDPOINT | https://huggingface.co | Override Hugging Face Hub base URL used by staticPotion.ts (e.g. mirror endpoint for air-gapped setups). |
MEMORY_VEC_TOP_K | 20 | Default top-K used by the sqlite-vec brute-force vector search inside src/lib/memory/vectorStore.ts. |
MEMORY_RRF_K | 60 | Reciprocal Rank Fusion constant k for hybrid FTS5 + vector retrieval (sqlite-vec recipe). |
NOTION_API_KEY | (unset) | API key for Notion backend (used by genericBackend.ts known backend preset). |
NOTION_API_URL | https://api.notion.com/v1 | Base URL for Notion API (can override for self-hosted Notion alternatives). |
OBSIDIAN_API_KEY | (unset) | API key for Obsidian Vault backend (used by genericBackend.ts known backend preset). |
OBSIDIAN_API_URL | http://localhost:27123 | Base URL for Obsidian Vault API (can override for remote vault). |
MEMORY_TYPED_DECAY_ENABLED | false | TV6 typed memory decay master switch. Opt-in (default off) — the sweep deletes decayed memories. With it off, access_count/last_accessed_at are pure telemetry and nothing is ever deleted. |
MEMORY_TYPED_DECAY_EPISODIC_DAYS | 30 | TTL (days) after which an unused episodic memory decays. 0 makes episodic immune too. Durable types (factual/procedural/semantic) are always immune. The decay clock re-bases on last_accessed_at. |
MEMORY_TYPED_DECAY_ACCESS_IMMUNITY | 3 | A memory injected >= this many times becomes immune to decay regardless of type. 0 disables access immunity. |
MEMORY_TYPED_DECAY_SWEEP_INTERVAL | 0 (disabled) | Interval (seconds) for the optional periodic decay sweep in src/lib/memory/typedDecay.ts. 0/unset = no periodic sweep. Doubly opt-in: also requires MEMORY_TYPED_DECAY_ENABLED=true. |
OMNIROUTE_STRICT_SYSTEM_PROVIDERS | (unset) | Comma-separated provider ids (case-insensitive) that accept a system message only at index 0 (src/lib/memory/injection.ts). For these, the cache-safe mid-array memory splice is unsafe in multi-turn conversations, so memory is merged/prepended as the leading system message instead. Defaults to only xiaomi-mimo/mimo; extend for self-hosted OpenAI-compatible endpoints (e.g. Qwen3.5+/3.6) whose chat template enforces the same single-leading-system-message constraint. |
OMNIROUTE_MEMORY_MB=128
PROMPT_CACHE_MAX_SIZE=20
PROMPT_CACHE_MAX_BYTES=524288 # 512 KB
SEMANTIC_CACHE_MAX_SIZE=25
SEMANTIC_CACHE_MAX_BYTES=1048576 # 1 MB
STREAM_HISTORY_MAX=10
Automatic model pricing data synchronization from external sources.
| Variable | Default | Source File | Description |
|---|---|---|---|
PRICING_SYNC_ENABLED | false | src/lib/pricingSync.ts | Opt-in periodic pricing sync. |
PRICING_SYNC_INTERVAL | 86400 (24h) | src/lib/pricingSync.ts | Sync interval in seconds. |
PRICING_SYNC_SOURCES | litellm | src/lib/pricingSync.ts | Comma-separated data sources. |
| Variable | Default | Source File | Description |
|---|---|---|---|
ARENA_ELO_SYNC_ENABLED | true | src/shared/constants/featureFlagDefinitions.ts | Periodic Arena AI leaderboard ELO sync, configurable from Dashboard Feature Flags or with false to opt out. |
ARENA_ELO_SYNC_INTERVAL | 86400 (24h) | src/lib/arenaEloSync.ts | Sync interval in seconds. |
Reverse-engineered GraphQL session bridge for prompt.ql.app (src/shared/constants/providers/web-cookie.ts). All optional — defaults point at the public playground endpoints; override only for a self-hosted/alternate PromptQL deployment.
| Variable | Default | Source File | Description |
|---|---|---|---|
PROMPTQL_GRAPHQL_ENDPOINT | https://data.prompt.ql.app/promptql/playground-v2-hge/v1/graphql | open-sse/executors/promptql.ts | GraphQL endpoint used for chat/session operations. |
PROMPTQL_CREDITS_ENDPOINT | https://data.pro.ql.app/v1/graphql | open-sse/executors/promptql.ts, open-sse/services/usage/promptql.ts | GraphQL endpoint used to query credit balance/usage. |
PROMPTQL_TOKEN_REFRESH_URL | https://auth.pro.ql.app/ddn/project/token | open-sse/executors/promptql.ts | Endpoint used for best-effort token refresh. |
PROMPTQL_POLL_TIMEOUT_MS | 180000 | open-sse/executors/promptql.ts | Max time (ms) to poll thread_events before timing out. |
Reverse-engineered session bridge for hyperagent.com (src/shared/constants/providers/web-cookie.ts). Optional — the default points at the public billing/usage endpoint; override only for a self-hosted/alternate HyperAgent deployment.
| Variable | Default | Source File | Description |
|---|---|---|---|
HYPERAGENT_USAGE_URL | https://hyperagent.com/api/settings/billing/usage | open-sse/services/usage/hyperagent.ts | Endpoint used to fetch billing/usage credit blocks. |
Chrome-driven session refresh (ARP) for the Adobe Firefly web provider (open-sse/services/adobeFireflyChromeRuntime.ts, open-sse/services/adobeFireflySession.ts, open-sse/services/adobeFireflyClient.ts). Optional — all defaults are tuned for a normal desktop Chrome install.
| Variable | Default | Source File | Description |
|---|---|---|---|
CHROME_PATH | (auto-detect) | open-sse/services/adobeFireflyChromeRuntime.ts | Override path to the local Google Chrome binary used to drive the session refresh. |
ADOBE_FIREFLY_CHROME_CDP_PORT | 9334 | open-sse/services/adobeFireflyChromeRuntime.ts | Chrome DevTools Protocol port used to attach to the managed Chrome instance. |
ADOBE_FIREFLY_CHROME_HEADLESS | 0 | open-sse/services/adobeFireflyChromeRuntime.ts | Set to 1 for true headless Chrome (known-broken for generate; debug only). |
ADOBE_FIREFLY_CHROME_VISIBLE | 0 | open-sse/services/adobeFireflyChromeRuntime.ts | Set to 1 to show the Chrome window on-screen for debugging. |
ADOBE_FIREFLY_CHROME_HEADED | 0 | open-sse/services/adobeFireflyChromeRuntime.ts | Legacy alias for ADOBE_FIREFLY_CHROME_VISIBLE=1. |
ADOBE_FIREFLY_CHROME_PING | 0 | open-sse/services/adobeFireflyChromeRuntime.ts | Set to 1 to prove ARP with an in-page generate-async ping after warm. |
ADOBE_FIREFLY_CHROME_FORCE_RESTART | 0 | open-sse/services/adobeFireflyChromeRuntime.ts | Set to 1 to force-restart the managed Chrome instance instead of reusing it. |
ADOBE_FIREFLY_BROWSER_REFRESH | 1 | open-sse/services/adobeFireflySession.ts | Proactive browser warm opt-in/out. 0 disables proactive warm (mid-batch 408 recovery still applies). |
ADOBE_FIREFLY_SESSION_DISK | 1 | open-sse/services/adobeFireflySession.ts | Set to 0 to disable persisting the Adobe Firefly session to disk. |
ADOBE_FIREFLY_LOGIN_WAIT_MS | 300000 | open-sse/services/adobeFireflyChromeRuntime.ts | Max wait (ms) for interactive Adobe login to complete during a browser warm. |
ADOBE_FIREFLY_FORTER_WAIT_MS | 45000 | open-sse/services/adobeFireflyChromeRuntime.ts | Max wait (ms) for Forter anti-bot tokens to settle before continuing. |
ADOBE_FIREFLY_MIN_SUBMIT_GAP_MS | (unset) | open-sse/services/adobeFireflySession.ts | Minimum gap (ms) enforced between successive submits, overriding the built-in default. |
ADOBE_FIREFLY_BATCH_EXTRA_GAP_MS | (unset) | open-sse/services/adobeFireflySession.ts | Extra gap (ms) added after a successful batch, overriding the built-in default. |
ADOBE_FIREFLY_SUBMIT_BASE_DELAY_MS | (unset) | open-sse/services/adobeFireflyClient.ts | Base delay (ms) before submitting a generation request, overriding the built-in default. |
| Variable | Default | Source File | Description |
|---|---|---|---|
MODELS_DEV_SYNC_ENABLED | false | src/lib/modelsDevSync.ts | Opt-in switch for the models.dev capability sync. Set to anything non-empty it wins over the modelsDevSyncEnabled setting (Dashboard > Settings > AI) in either direction, so a deployment can pin the sync on or off without depending on database state surviving a rebuild; unset, it defers to that setting. On for 1, true, yes or on in any casing; any other value is off. |
MODELS_DEV_SYNC_INTERVAL | 86400 (24h) | src/lib/modelsDevSync.ts | Development-time model catalog sync interval in seconds. |
CONTEXT_WINDOW_RECONCILE_INTERVAL | 86400 (24h) | src/lib/contextWindowResolver.ts | Interval (seconds) for the self-correcting context-window reconciler (5004): pins provider-declared windows from /models discovery as auto:discovery overrides when they diverge from the catalog. Set to 0 to disable. Reuses already-synced data (no new fetch); never overwrites manual overrides. |
| Variable | Default | Source File | Description |
|---|---|---|---|
OPENROUTER_CATALOG_TTL_MS | 86400000 (24h) | src/lib/catalog/openrouterCatalog.ts | OpenRouter model catalog cache TTL. |
MODEL_CATALOG_INCLUDE_NAMES | true | src/shared/constants/featureFlagDefinitions.ts | Include display-friendly name fields in /v1/models responses. Disable for clients that expect IDs only. |
NANOBANANA_POLL_TIMEOUT_MS | 120000 | open-sse/handlers/imageGeneration.ts | Max wait for NanoBanana image generation jobs. |
NANOBANANA_POLL_INTERVAL_MS | 2500 | open-sse/handlers/imageGeneration.ts | NanoBanana job polling frequency. |
DESIGNER_WEB_POLL_TIMEOUT_MS | 60000 | open-sse/handlers/imageGeneration/providers/designerWeb.ts | Max wait for microsoft-designer-web image generation jobs. |
DESIGNER_WEB_POLL_INTERVAL_MS | 2000 | open-sse/handlers/imageGeneration/providers/designerWeb.ts | microsoft-designer-web job polling frequency. |
ADOBE_FIREFLY_SUBMIT_BASE_DELAY_MS | 8000 | open-sse/services/adobeFireflyUpscale.ts | Base delay for the Adobe Firefly upscale submit-retry exponential backoff. |
AWS_REGION | (unset) | src/lib/providers/validation.ts, open-sse/handlers/audioSpeech.ts | Region used to construct AWS Bedrock endpoints (Kiro, audio). |
AWS_DEFAULT_REGION | (unset) | src/lib/providers/validation.ts, open-sse/handlers/audioSpeech.ts | Fallback when AWS_REGION is not set. |
CLOUDFLARE_ACCOUNT_ID | (unset) | open-sse/executors/cloudflare-ai.ts | Account ID for Cloudflare Workers AI. |
CLOUDFLARE_API_BASE | https://api.cloudflare.com/client/v4 | src/app/api/settings/proxy/cloudflare-deploy/route.ts | Override the Cloudflare REST API base used by the proxy-pool Workers relay deployer (#4640 / 9router#1360). |
NEXT_PUBLIC_CLOUDFLARE_RELAY_DEFAULT_PROJECT | omniroute-relay | src/app/(dashboard)/dashboard/settings/components/proxy/CloudflareRelayModal.tsx | Default worker project name suggested in the proxy-pool "Deploy Relay" modal. |
NEXT_PUBLIC_CLOUDFLARE_RELAY_ENABLED | true | src/app/(dashboard)/dashboard/settings/components/proxy/ProxyPoolTab.tsx | Set to false to hide the Cloudflare Workers relay option from the Proxy Pool tab. |
CLOUDFLARED_BIN | auto-detect | src/lib/cloudflaredTunnel.ts | Custom path to cloudflared binary. |
DENO_DEPLOY_API_BASE | https://api.deno.com/v2 | src/app/api/settings/proxy/deno-deploy/route.ts | Override the Deno Deploy REST API base used by the proxy-pool relay deployer (#4643 / 9router#1437). |
NEXT_PUBLIC_DENO_RELAY_DEFAULT_PROJECT | omniroute-deno-relay | src/app/(dashboard)/dashboard/settings/components/proxy/DenoRelayModal.tsx | Default Deno Deploy app name suggested in the proxy-pool "Deploy Relay" modal. |
NEXT_PUBLIC_DENO_RELAY_ENABLED | true | src/app/(dashboard)/dashboard/settings/components/proxy/ProxyPoolTab.tsx | Set to false to hide the Deno Deploy relay option from the Proxy Pool tab. |
SEARCH_CACHE_TTL_MS | 300000 (5 min) | open-sse/services/searchCache.ts | TTL for search API (Perplexity, Brave, etc.) response caching. |
ALLOW_MULTI_CONNECTIONS_PER_COMPAT_NODE | false | src/app/api/providers/route.ts | Allow multiple simultaneous connections per OpenAI-compatible provider. |
ENABLE_CC_COMPATIBLE_PROVIDER | false | src/shared/utils/featureFlags.ts | Reveal the experimental CC-compatible provider UI for Claude Code-only relays. |
NINEROUTER_HOST | 127.0.0.1 | open-sse/executors/ninerouter.ts | Override the host where the embedded 9router instance listens. |
NINEROUTER_PORT | 20130 | open-sse/executors/ninerouter.ts | Override the port where the embedded 9router instance listens. |
EMBED_WS_PROXY_HOST | 127.0.0.1 | src/lib/services/embedWsProxy.ts | Bind host for the embedded-service WebSocket proxy (loopback only by default). |
EMBED_WS_PROXY_PORT | 20131 | src/lib/services/embedWsProxy.ts | Port for the embedded-service WebSocket proxy server. |
CLIPROXYAPI_HOST | 127.0.0.1 | open-sse/executors/cliproxyapi.ts | CLIProxyAPI bridge host (legacy integration). |
CLIPROXYAPI_PORT | 5544 | open-sse/executors/cliproxyapi.ts | CLIProxyAPI bridge port. |
CLIPROXYAPI_CONFIG_DIR | ~/.cli-proxy-api | src/lib/versionManager/processManager.ts | CLIProxyAPI config directory. |
MUX_SERVICE_PORT | 8322 | src/lib/services/bootstrap.ts | Override the port where the embedded Mux (coder/mux) agent-orchestration daemon listens (always 127.0.0.1). |
DARIO_HOST | 127.0.0.1 | open-sse/executors/dario.ts | Dario embedded-service bind/connect host (loopback only by default). |
DARIO_PORT | 3456 | open-sse/executors/dario.ts | Dario embedded-service port. |
DARIO_HOST | 127.0.0.1 | open-sse/executors/dario.ts | Dario embedded-service bind/connect host (loopback only by default). |
DARIO_PORT | 3456 | open-sse/executors/dario.ts | Dario embedded-service port. |
LOCAL_HOSTNAMES | (empty) | open-sse/config/providerRegistry.ts | Comma-separated additional hostnames treated as "local" (Docker service names, etc.). |
ENABLE_CC_COMPATIBLE_PROVIDER is only for third-party relays that accept Claude Code clients
exclusively. OmniRoute rewrites requests so those relays accept them. If you only want to use
Claude Code CLI, or you are not sure what these relays are, keep this disabled and add a regular
Anthropic-compatible provider instead.
| Variable | Default | Source File | Description |
|---|---|---|---|
PROXY_FAST_FAIL_TIMEOUT_MS | 2000 | src/lib/proxyHealth.ts | Fast-fail health check timeout. |
PROXY_LATENCY_WINDOW_HOURS | 3 | src/lib/db/proxies.ts | Time window (hours) for calculating the average latency of candidate proxies in the latency-optimized pool strategy. |
PROXY_HEALTH_CACHE_TTL_MS | 30000 | src/lib/proxyHealth.ts | Health check result cache TTL. |
PROXY_HEALTH_UNHEALTHY_CACHE_TTL_MS | 2000 | src/lib/proxyHealth.ts | Cache TTL for failed proxy health probes. Keep this shorter than PROXY_HEALTH_CACHE_TTL_MS so transient proxy timeouts under high concurrency retry quickly without disabling fast-fail for truly dead proxies. |
PROXY_HEALTH_ENABLED | true | src/lib/proxyHealth/scheduler.ts | Set false to disable the background proxy health scheduler that periodically probes registered proxies. |
PROXY_HEALTH_INTERVAL_MS | 600000 | src/lib/proxyHealth/scheduler.ts | Background health-scheduler sweep interval in ms (minimum 60000). |
PROXY_HEALTH_TEST_URL | https://httpbin.org/ip | src/lib/proxyHealth/scheduler.ts | Reachability probe target used by the scheduler and the /api/settings/proxies/auto-test endpoint. Point it at an internal/self-hosted URL to avoid the public default. |
PROXY_HEALTH_AUTO_DEACTIVATE | false | src/lib/proxyHealth/statusPolicy.ts | When false (default), automated reachability probes (the scheduler + the /api/settings/proxies/auto-test "Test All" button) are read-only and never write a proxy's status — only the operator sets active/inactive, so a flaky probe can't strand an assigned proxy (#6246). Set true to restore the legacy test-and-set behaviour. |
PROXY_AUTO_REMOVE | false | src/lib/proxyHealth/scheduler.ts | Set true to let the scheduler auto-remove proxies after repeated consecutive failures. |
PROXY_AUTO_REMOVE_AFTER | 3 | src/lib/proxyHealth/scheduler.ts | Consecutive failures before the scheduler auto-removes a proxy (when PROXY_AUTO_REMOVE=true). |
OMNIROUTE_CONTROL_PLANE_PROXY_DIRECT_FALLBACK | false | src/shared/constants/featureFlagDefinitions.ts | Allow OAuth and provider validation flows to bypass a pinned proxy and connect directly when proxy reachability pre-checks fail. Effective precedence is Feature Flags DB override > env var > default. |
RATE_LIMIT_MAX_WAIT_MS | 15000 (15s) | open-sse/services/rateLimitManager.ts | Max time to wait on a 429 before failing the request. |
RATE_LIMIT_MAX_QUEUE_DEPTH | 0 (disabled) | open-sse/services/rateLimitManager.ts | Queue admission cap: reject with a 429 queue_full once this many requests are already queued. 0 = unbounded (default). |
RATE_LIMIT_AUTO_ENABLE | (unset) | open-sse/services/rateLimitManager.ts | Force the auto-enable rate limit safety net on/off regardless of the persisted Dashboard setting. Accepts true/1/on to force on, false/0/off to force off. |
PROVIDER_COOLDOWN_ENABLED | (unset → off) | open-sse/services/providerCooldownTracker.ts | Opt-in global cross-request provider/connection cooldown tracking. OFF by default (overlaps Connection Cooldown / Provider Circuit Breaker). Accepts true/1/on to enable. |
PROVIDER_COOLDOWN_MIN_MS | 5000 | open-sse/services/providerCooldownTracker.ts | Minimum cooldown (ms) before a failed provider/connection is retried. Scaled exponentially with consecutive failures. Only used when PROVIDER_COOLDOWN_ENABLED. |
PROVIDER_COOLDOWN_MAX_MS | 300000 (5 min) | open-sse/services/providerCooldownTracker.ts | Maximum cooldown (ms) cap before a failed provider/connection is retried regardless. Only used when PROVIDER_COOLDOWN_ENABLED. |
STREAM_RECOVERY_ENABLED | (unset → off) | src/lib/resilience/settings.ts (seed) → open-sse/services/streamRecovery.ts (logic) | What: transparent recovery of truncated upstream streams (free-claude-code port). Holds the opening SSE window up to STREAM_RECOVERY.HOLDBACK_MS (750 ms) so a pre-commit cutoff — one that happens before any byte reaches the client — is re-opened and retried invisibly. When to enable: flaky/upstreams that frequently 0-byte-truncate at stream start; leave OFF if you cannot afford up to 750 ms of added time-to-first-token on every stream. Accepts true/1/on. Seeds the persisted Resilience setting; the Dashboard setting wins once set. |
STREAM_RECOVERY_MIDSTREAM_ENABLED | (unset → off) | src/lib/resilience/settings.ts (seed) → open-sse/services/streamRecovery.ts (logic) | What: mid-stream continuation (Fase 4.4) — after a post-commit truncation (bytes already reached the client), re-request with the partial text as an assistant prefill and stitch the missing suffix. Plain-text OpenAI-compatible streams only; never fires with a tool call in flight. When to enable: long generations that get cut mid-answer and you accept the recovered tail arriving as one burst rather than token-by-token. Independent of STREAM_RECOVERY_ENABLED (different risk profile). Accepts true/1/on. |
STREAM_THROUGHPUT_WATCHDOG_ENABLED | (unset → off) | src/lib/resilience/settings.ts → open-sse/services/throughputWatchdog.ts | Opt-in active-stream useful-output watchdog. Detects streams that keep sending chunks but remain below the configured assistant-output rate; heartbeats, usage events, empty deltas, and tool/reasoning phases do not masquerade as progress. Separate from idle and hard-deadline timeouts. |
STREAM_THROUGHPUT_WATCHDOG_WARMUP_MS | 30000 | src/lib/resilience/settings/normalize.ts | Grace period before throughput evaluation, bounded to 0–600000 ms. |
STREAM_THROUGHPUT_WATCHDOG_WINDOW_MS | 30000 | src/lib/resilience/settings/normalize.ts | Rolling useful-output window, bounded to 1000–600000 ms; one complete window is required before abort. |
STREAM_THROUGHPUT_WATCHDOG_MIN_BYTES_PER_SECOND | 4 | src/lib/resilience/settings/normalize.ts | Minimum UTF-8 assistant-output byte rate (conservative token proxy), bounded to 1–1000000. |
STREAM_THROUGHPUT_WATCHDOG_MIN_USEFUL_BYTES | 1 | src/lib/resilience/settings/normalize.ts | Minimum non-zero useful-output sample considered measurable, bounded to 1–1000000 bytes. |
HEALTHCHECK_STAGGER_MS | 3000 | src/lib/tokenHealthCheck.ts | Stagger interval (ms) between provider token healthchecks at startup. |
HEALTHCHECK_JITTER_MIN_MS | 500 | src/lib/tokenHealthCheck.ts | Minimum randomized jitter (ms) added on top of HEALTHCHECK_STAGGER_MS between provider token healthchecks, to prevent bursting (Issue #1220). |
HEALTHCHECK_JITTER_MAX_MS | 5000 | src/lib/tokenHealthCheck.ts | Maximum randomized jitter (ms) added on top of HEALTHCHECK_STAGGER_MS between provider token healthchecks, to prevent bursting (Issue #1220). |
HEALTHCHECK_BATCH_SIZE | 20 | src/lib/tokenHealthCheck.ts | Concurrent-check batch size for the startup token-healthcheck sweep; larger values check more connections in parallel, smaller values reduce burst load (Issue #7875, regression of #7719). |
REQUEST_RETRY | 2 | src/sse/services/cooldownAwareRetry.ts | Number of automatic retries on model-scoped cooldown responses before returning error to client. |
MAX_RETRY_INTERVAL_SEC | 30 | src/sse/services/cooldownAwareRetry.ts | Max backoff interval (seconds) between cooldown retries. Capped by this value regardless of upstream Retry-After. |
HEADROOM_URL | http://localhost:8787 | src/lib/headroom/detect.ts | Headroom token-saver proxy URL. The dashboard lifecycle (api/headroom/*) spawns a local headroom-ai CLI on loopback by default; override only to point at an external Docker sidecar proxy. |
The recovery holdback behavior is tuned by hardcoded constants in
open-sse/config/constants.ts (STREAM_RECOVERY), shown here for reference —
changing them requires a code edit, not an env var:
STREAM_RECOVERY.HOLDBACK_MS = 750 — how long the opening SSE window is held
so an early truncation can be retried before any byte is committed to the client.STREAM_RECOVERY.BUFFER_MAX_BYTES = 65536 — hard cap on the held window; commit
(flush + passthrough) as soon as this many bytes accumulate, regardless of the timer.STREAM_RECOVERY.EARLY_RETRY_MAX = 4 — max transparent re-opens of the upstream
stream while the holdback is still uncommitted.Per-provider sliding-window rate limit (no env var): the FCC-ported per-provider sliding-window rate-limit fallback exists in code (
open-sse/services/providerDefaultRateLimit.ts, wired throughopen-sse/services/rateLimitManager.ts) but ships with an empty default map and has no operator env var today — it is enabled only via a test hook / code edit. It is intentionally not listed in the table above. The per-(token, IP)relay limiter that does have a knob isRELAY_IP_PER_MINUTE(§3 Network & Ports).
[!CAUTION] These variables produce verbose output and may leak sensitive data. Never enable in production.
| Variable | Default | Source File | Description |
|---|---|---|---|
CURSOR_DEBUG | (unset) | open-sse/executors/cursor.ts | Set 1 to enable verbose Cursor executor logs (decoded SSE chunks, etc.). |
CURSOR_STREAM_DEBUG | (unset) | open-sse/executors/cursor.ts | Backward-compatible alias of CURSOR_DEBUG. |
CURSOR_DUMP_FILE | (unset) | open-sse/executors/cursor.ts | Optional file path that receives raw decoded Cursor chunks when CURSOR_DEBUG=1. |
CURSOR_STREAM_TIMEOUT_MS | 300000 | open-sse/executors/cursor.ts | Stream idle timeout (ms) for the Cursor executor. |
CURSOR_TOOL_DIRECTIVE | enabled (!== "0") | open-sse/executors/cursor.ts | Tool-commit directive that makes composer-2.5 reliably issue tool calls. Set 0 to disable. |
CURSOR_IMAGE_FETCH_TIMEOUT_MS | 15000 | open-sse/utils/cursorImages.ts | Per-image fetch timeout (ms) for remote image_url vision input. |
CURSOR_STATE_DB_PATH | (probed) | open-sse/utils/cursorVersionDetector.ts | Override the Cursor IDE state DB lookup used for IDE version detection. |
CURSOR_AGENT_CLI_VERSION | (detect / pin) | open-sse/utils/cursorAgentCliVersion.ts | Agent CLI build id (YYYY.MM.DD-<hash>) for x-cursor-client-version: cli-… on Agent Run. |
CURSOR_DATA_DIR | (probed) | open-sse/utils/cursorAgentCliVersion.ts | Override Cursor Agent CLI data dir (…/versions/<id>); same var the official agent uses. |
CURSOR_TOKEN | (unset) | scripts/ad-hoc/cursor-tap.cjs | Direct Cursor bearer token used by developer tooling. |
OMNIROUTE_LOG_REQUEST_SHAPE | disabled (opt-in via "1") | src/app/api/v1/chat/completions/route.ts | Log content-type/length markers for large chat payloads when "1" is set. Off by default to reduce log noise. |
DEBUG_RESPONSES_SSE_TO_JSON | (unset) | open-sse/handlers/responseTranslator.ts | Set true to log Responses API SSE→JSON translation details. |
DEBUG_CLAUDE_NONSTREAM | (unset) | open-sse/handlers/responseTranslator.ts | Set true to surface empty textContent chunks in the Claude response translation path (debug only). |
NEXT_PUBLIC_OMNIROUTE_E2E_MODE | (unset) | E2E test harness | Set true to enable E2E test mode (relaxed auth, test hooks). |
Allow users to report issues directly from the Dashboard.
| Variable | Default | Source File | Description |
|---|---|---|---|
GITHUB_ISSUES_REPO | (unset) | src/app/api/v1/issues/report/route.ts | Repository in owner/repo format. |
GITHUB_ISSUES_TOKEN | (unset) | src/app/api/v1/issues/report/route.ts | GitHub Personal Access Token with issues:write scope. |
GITHUB_TOKEN | (unset) | issue triage / cloud agent helpers | Generic GitHub access token used as fallback for GITHUB_ISSUES_TOKEN and consumed by cloud agent helpers in src/lib/cloudAgent/*. |
For relay backend SRE guidance (ts/bifrost/auto behavior, 9router vs CLIProxyAPI placement, and high-throughput fallback strategy), see Relay Backend Strategy.
JWT_SECRET=$(openssl rand -base64 48)
API_KEY_SECRET=$(openssl rand -hex 32)
INITIAL_PASSWORD=dev123
PORT=20128
NODE_ENV=development
JWT_SECRET=<generated>
API_KEY_SECRET=<generated>
INITIAL_PASSWORD=<generated>
STORAGE_ENCRYPTION_KEY=<generated>
DATA_DIR=/data
PORT=20128
API_PORT=20129
NODE_ENV=production
AUTH_COOKIE_SECURE=true
REQUIRE_API_KEY=true
NEXT_PUBLIC_BASE_URL=https://omniroute.example.com
BASE_URL=http://localhost:20128
OMNIROUTE_MEMORY_MB=512
CORS_ORIGIN=https://your-frontend.example.com
JWT_SECRET=test-jwt-secret-for-ci
API_KEY_SECRET=test-api-key-secret-for-ci
INITIAL_PASSWORD=testpass
NODE_ENV=production
OMNIROUTE_DISABLE_BACKGROUND_SERVICES=true
APP_LOG_TO_FILE=false
JWT_SECRET=<generated>
API_KEY_SECRET=<generated>
STORAGE_ENCRYPTION_KEY=<generated>
PORT=20128
AUTH_COOKIE_SECURE=true
REQUIRE_API_KEY=true
NEXT_PUBLIC_BASE_URL=https://omniroute.example.com
BASE_URL=http://127.0.0.1:20128
CORS_ORIGIN=https://omniroute.example.com
ENABLE_TLS_FINGERPRINT=true
CLI_COMPAT_ALL=1
Limits and safety knobs applied when the Skills framework (src/lib/skills/) executes user-defined automations in a sandboxed environment.
| Variable | Default | Source File | Description |
|---|---|---|---|
SKILLS_SANDBOX_TIMEOUT_MS | 10000 (10 s) | src/lib/skills/builtins.ts | Per-execution wall-clock timeout for sandboxed skill code. Hard cap; anything longer is killed. |
SKILLS_EXECUTION_TIMEOUT_MS | (falls back to SKILLS_SANDBOX_TIMEOUT_MS) | src/lib/skills/ | High-level skill orchestration timeout. Set higher than SKILLS_SANDBOX_TIMEOUT_MS to allow multi-step workflows. |
SKILLS_MAX_FILE_BYTES | 1048576 (1 MB) | src/lib/skills/builtins.ts | Max bytes a skill may read from any single sandboxed file. |
SKILLS_MAX_HTTP_RESPONSE_BYTES | 256000 (250 KB) | src/lib/skills/builtins.ts | Max bytes captured from any single HTTP response inside a skill. |
SKILLS_MAX_SANDBOX_OUTPUT_CHARS | 100000 | src/lib/skills/builtins.ts | Hard cap on stdout/stderr characters returned from a sandbox invocation. |
SKILLS_SANDBOX_NETWORK_ENABLED | false | src/lib/skills/builtins.ts | Set 1/true to allow outbound network from inside the sandbox. Defaults to isolated for safety. |
SKILLS_ALLOWED_SANDBOX_IMAGES | (empty) | src/lib/skills/builtins.ts | Comma-separated allowlist of container images permitted for sandbox execution. Empty means built-in default only. |
SKILLS_SANDBOX_DOCKER_IMAGE | (built-in default) | src/lib/skills/ | Container image used when spawning a Docker-backed sandbox. Override to pin a custom hardened base image. |
SKILLS_SANDBOX_RUNTIME | auto | src/lib/skills/sandbox.ts, src/lib/skills/containerProvider.ts | Container runtime for skill sandboxing: auto | docker | apple | wsl | orbstack | podman. auto picks the best installed runtime per host OS (Apple Container/OrbStack on macOS, WSL Container on Windows, Podman on Linux), falling back to Docker. |
[!CAUTION] Enabling
SKILLS_SANDBOX_NETWORK_ENABLED=trueopens an egress path from arbitrary skill code. Pair withOUTBOUND_SSRF_GUARD_ENABLED=trueand a strictCORS_ORIGIN/proxy policy in shared deployments.
Provider quota endpoints, network tunnels (Tailscale, Ngrok, MITM debug proxy), the 1Proxy egress pool, database backups and small per-feature overrides referenced by the executor layer or scripts.
| Variable | Default | Source File | Description |
|---|---|---|---|
REDIS_URL | redis://localhost:6379 | src/shared/utils/rateLimiter.ts | Redis connection string for the rate limiter backend. |
ALIBABA_CODING_PLAN_HOST | (production host) | open-sse/services/bailianQuotaFetcher.ts | Override the host used to fetch Alibaba Bailian coding-plan quotas. |
ALIBABA_CODING_PLAN_QUOTA_URL | derived from host | open-sse/services/bailianQuotaFetcher.ts | Full quota URL override for Alibaba Bailian. |
ALIBABA_FREE_TIER_VISION_FE_PATH | /costing-balance/free-quota-image-video | open-sse/services/alibabaFreeTierQuotaFetcher.ts | Console front-end path override for fetching Alibaba Model Studio free-tier vision/media quota. |
ALIBABA_FREE_TIER_MULTIMODAL_FE_PATH | /costing-balance/free-quota-multimodal | open-sse/services/alibabaFreeTierQuotaFetcher.ts | Console front-end path override for fetching Alibaba Model Studio free-tier multimodal quota. |
ALIBABA_FREE_TIER_AUDIO_FE_PATH | /costing-balance/free-quota-audio | open-sse/services/alibabaFreeTierQuotaFetcher.ts | Console front-end path override for fetching Alibaba Model Studio free-tier audio quota. |
ALIBABA_FREE_TIER_ALLOWLIST_PATH | (unset) | open-sse/services/alibabaFreeTierAllowlist.ts | Optional path to a local JSON override for the built-in Alibaba free-tier text-model allowlist. Falls back to $DATA_DIR/alibaba-free-tier-allowlist.json, then config/alibaba-free-tier-allowlist.json. |
CONTEXT_RESERVE_TOKENS | 1024 | open-sse/services/contextManager.ts | Tokens reserved for completion output when computing prompt budgets. |
CONTEXT_KEEP_LATEST_IMAGES | 2 | open-sse/services/contextManager.ts | How many of the newest inline images to keep when pruning older ones to fit the context window (#8560). |
MODEL_ALIAS_COMPAT_ENABLED | enabled | open-sse/services/model.ts | Toggle the legacy model-alias compatibility layer used by older clients. |
OMNIROUTE_EMERGENCY_FALLBACK | enabled | open-sse/services/emergencyFallback.ts | Set false (or 0) to disable the emergency budget-exhaustion fallback that reroutes failed requests to the free nvidia/openai/gpt-oss-120b model. Effective precedence is Feature Flags DB override > env var > default; if unavailable, the service falls back to the raw env value. |
COMMAND_CODE_CALLBACK_PORT | (unset) | src/app/api/providers/command-code/auth/shared.ts | Local port used for OAuth-style callbacks from the Command Code CLI helper. |
COMMAND_CODE_VERSION | 0.33.2 | open-sse/executors/commandCode.ts | Value sent as the x-command-code-version header to the Command Code upstream. Override to bump the CLI version. |
COMMANDCODE_API_URL | https://api.commandcode.ai | open-sse/services/usage/command-code.ts | Base URL for the Command Code usage/quota upstream used by the smartphone quota-fetcher telemetry. Override for a self-hosted/alternative Command Code API. |
MITM_LOCAL_PORT | 443 | src/mitm/server.cjs | Local bind port for the MITM debug proxy. |
MITM_DISABLE_TLS_VERIFY | 0 | src/mitm/server.cjs | Set 1 to disable upstream TLS verification (development only). |
MITM_IDLE_TIMEOUT_MS | 60000 | src/mitm/socketTimeouts.ts, src/mitm/server.cjs | Idle socket timeout (ms) for proxied connections; idle sockets past this are torn down to avoid leaking half-open tunnels. |
MITM_VERBOSE | 1 | src/mitm/server.cjs, src/mitm/_internal/bypass.cjs | Routing-decision log verbosity: 0 silences, higher values log more bypass/route decisions. |
MITM_ROOT_CA_ENABLED | false | src/mitm/manager.ts | Set true to opt in to the root-CA + per-host-leaf cert model (#6684). Fresh installs get it automatically; installs with a pre-existing trusted legacy leaf keep the legacy fixed-SAN cert unless opted in. |
MITM_CERT_MODE | legacy | src/mitm/manager.ts, src/mitm/server.cjs | Set BY the MITM manager for the spawned proxy process (root-ca | legacy) — reflects the cert-migration decision; not meant to be set manually. |
OMNIROUTE_NO_SUDO | 0 | src/mitm/systemCommands.ts | Set 1 (truthy) to strip the leading sudo from MITM cert-trust commands — for root-less / user-namespaced deployments where the operator trusts the CA manually (e.g. via Node's extra-CA-certs mechanism). |
SKIP_ANTIGRAVITY_DNS | (unset) | src/mitm/dns/provision.ts | Set true to skip provisioning /etc/hosts DNS entries for the Antigravity proxy hostnames entirely — for containers with no sudo/root available. |
OMNIROUTE_SKIP_DNS_WRITE | (unset) | src/mitm/dns/dnsConfig.ts | Set 1 to skip writing to the hosts file when adding/removing DNS entries — for sandboxed or read-only test environments. |
OMNIROUTE_SKIP_SYSTEM_TRUST | 0 | src/mitm/cert/install.ts, src/mitm/tproxy/caTrust.ts | Test/CI-only guard: set 1 to make cert trust install/uninstall a no-op so the suite never mutates the OS trust store. Set automatically by the test setup and CI workflows. |
CHANGELOG_BASE_REF | (auto) | scripts/check/check-changelog-integrity.mjs | Explicit base ref for the anti CHANGELOG-eat gate (defaults to the PR base branch in CI, or the highest release/v*). |
ALLOW_CHANGELOG_REMOVALS | 0 | scripts/check/check-changelog-integrity.mjs | Set 1 to turn intentional CHANGELOG bullet removals into a report instead of a failure (justify in the PR body). |
ONEPROXY_ENABLED | true | src/lib/oneproxySync.ts | Enable the 1Proxy egress pool sync. |
ONEPROXY_API_URL | https://1proxy-api.aitradepulse.com | src/lib/oneproxySync.ts | 1Proxy service API URL override. |
ONEPROXY_MAX_PROXIES | 500 | src/lib/oneproxySync.ts | Maximum proxies imported per sync. |
ONEPROXY_MIN_QUALITY_THRESHOLD | 50 | src/lib/oneproxySync.ts | Minimum quality score for imported proxies. |
FREE_PROXY_AUTO_SYNC_ENABLED | false | src/lib/freeProxyProviders/scheduler.ts | Set true to enable the background free-proxy pool auto-sync scheduler. Opt-in, off by default. |
FREE_PROXY_AUTO_SYNC_INTERVAL_MS | 1800000 | src/lib/freeProxyProviders/scheduler.ts | Auto-sync interval in milliseconds (default 30 min). |
FREE_PROXY_1PROXY_ENABLED | true | src/lib/freeProxyProviders/oneproxy.ts | Enable the 1proxy free proxy source. Set to false to disable. |
FREE_PROXY_1PROXY_API_URL | (see oneproxy.ts) | src/lib/freeProxyProviders/oneproxy.ts | 1proxy API URL override. |
FREE_PROXY_1PROXY_MAX | 500 | src/lib/freeProxyProviders/oneproxy.ts | Maximum proxies fetched per sync from 1proxy. |
FREE_PROXY_1PROXY_MIN_QUALITY | 50 | src/lib/freeProxyProviders/oneproxy.ts | Minimum quality score threshold for 1proxy imports. |
FREE_PROXY_PROXIFLY_ENABLED | true | src/lib/freeProxyProviders/proxifly.ts | Enable the Proxifly free proxy source. Set to false to disable. |
FREE_PROXY_PROXIFLY_QUANTITY | 100 | src/lib/freeProxyProviders/proxifly.ts | Number of proxies to fetch per Proxifly sync. |
FREE_PROXY_PROXIFLY_ANONYMITY | elite | src/lib/freeProxyProviders/proxifly.ts | Anonymity level filter for Proxifly (elite, anonymous, transparent). |
FREE_PROXY_IPLOCATE_ENABLED | false | src/lib/freeProxyProviders/iplocate.ts | Enable the IPLocate free proxy source. Opt-in only. |
FREE_PROXY_IPLOCATE_BASE_URL | https://raw.githubusercontent.com/iplocate/free-proxy-list/main/protocols | src/lib/freeProxyProviders/iplocate.ts | IPLocate proxy list base URL override. |
FREE_PROXY_WEBSHARE_ENABLED | true | src/lib/freeProxyProviders/webshare.ts | Enable the Webshare proxy pool source. Set to false to disable; also requires FREE_PROXY_WEBSHARE_API_KEY to be set. |
FREE_PROXY_WEBSHARE_API_KEY | (none) | src/lib/freeProxyProviders/webshare.ts | Webshare account API token (Authorization: Token <key>). Required — the provider stays disabled without it. |
FREE_PROXY_WEBSHARE_API_URL | https://proxy.webshare.io/api/v2/proxy/list/ | src/lib/freeProxyProviders/webshare.ts | Webshare proxy list API URL override. |
FREE_PROXY_WEBSHARE_MAX | 500 | src/lib/freeProxyProviders/webshare.ts | Maximum proxies imported per Webshare sync. |
NEXT_PUBLIC_VERCEL_RELAY_ENABLED | true | src/app/(dashboard)/…/ProxyPoolTab.tsx | Show/hide the Deploy Vercel Relay button in the Proxy Pool tab. |
VERCEL_API_BASE | https://api.vercel.com | src/app/api/settings/proxy/vercel-deploy/route.ts | Vercel API base URL override (for testing). |
NEXT_PUBLIC_VERCEL_RELAY_DEFAULT_PROJECT | omniroute-relay | src/app/(dashboard)/…/VercelRelayModal.tsx | Default project name pre-filled in the Vercel Relay deploy modal. |
TAILSCALE_BIN | (auto-detect) | src/lib/tailscaleTunnel.ts | Explicit path to the tailscale binary. |
TAILSCALED_BIN | (auto-detect) | src/lib/tailscaleTunnel.ts | Explicit path to the tailscaled daemon binary. |
TAILSCALE_AUTHKEY | (unset) | src/lib/tailscaleTunnel.ts | Pre-shared Tailscale auth key for non-interactive / headless tailscale up (passed via --auth-key=). When unset, login falls back to the interactive browser auth URL. |
NGROK_AUTHTOKEN | (unset) | src/lib/ngrokTunnel.ts | Authenticates outbound ngrok tunnels. |
DB_BACKUP_MAX_FILES | 20 | src/lib/db/backup.ts | Maximum SQLite backup files retained on disk. Overrides the value saved from Settings → Database backup retention. |
DB_BACKUP_RETENTION_DAYS | 0 | src/lib/db/backup.ts | Maximum age (days) of retained backups. 0 disables age-based pruning. Overrides the value saved from Settings → Database backup retention. |
OMNIROUTE_BACKUP_SCHEDULE_JOB_INTERVAL_MS | 30000 | src/lib/jobs/backupScheduleJob.ts | Tick interval (ms) of the server-side job that executes backup-schedule.json. Must stay well under the 1-minute cron granularity; values below 5000 or unparseable fall back to 30000. |
OMNIROUTE_TLS_PROXY_URL | (unset) | open-sse/services/chatgptTlsClient.ts | Override the TLS sidecar URL for tests. Production should leave unset. |
CONTAINER_HOST | docker | scripts/check-permissions.sh | Container runtime hint for the entrypoint permission check. Set to podman for any Podman topology. Because the container cannot determine whether the engine is local or reached through Podman Machine, the warning stays topology-neutral and points to contrib/podman/README.md. |
QUOTA_STORE_DRIVER | sqlite | src/lib/quota/storeFactory.ts | Quota-share consumption store backend: sqlite (default) or redis. |
QUOTA_STORE_REDIS_URL | (unset) | src/lib/quota/storeFactory.ts | Redis connection string used when QUOTA_STORE_DRIVER=redis (e.g. redis://localhost:6379). |
QUOTA_SATURATION_THRESHOLD | 0.5 | src/lib/quota/enforce.ts | Pool saturation ratio (0..1); at/above it the pool enters strict mode (no borrowing). |
QUOTA_SOFT_DEPRIORITIZE_FACTOR | 0.7 | open-sse/services/combo.ts | Score multiplier (0..1) applied to a target when the soft quota policy deprioritizes it. |
STATUS_SOFT_DEPRIORITIZE_FACTOR | 0.5 | open-sse/services/combo/autoStrategy.ts | Score multiplier (0..1) applied to an exhausted provider (credits_exhausted/rate_limited) in auto-combo scoring when the preflight quota cutoff is OFF (#4540). |
QUOTA_CONSUMPTION_RETENTION_DAYS | 14 | src/lib/db/quotaConsumption.ts | Retention window (days) for quota_consumption buckets before GC (gcQuotaConsumption). |
QUOTA_PREFLIGHT_CUTOFF_ENABLED | false | src/lib/resilience/settings.ts | Opt-in (default OFF): enables the auto-routing hard quota cutoff that drops low-quota candidates before scoring. |
OMNIROUTE_AUTO_FREE_FALLBACK_TO_FULL_POOL | false | open-sse/services/autoCombo/virtualFactory.ts | Opt-in (default OFF): when an auto/<category>:<tier> filter matches no connected candidates, restore the legacy behavior of falling back to the full (unfiltered) pool instead of returning an empty pool. Default OFF makes :free mean "free tier only". |
OMNIROUTE_CHAOS_MAX_PANEL | 5 | open-sse/services/autoCombo/virtualFactory.ts | Panel-size cap (clamped 1–10) for the auto/*:chaos broadcast variant — one request fans out to at most this many provider-diverse models. |
OMNIROUTE_CHAOS_MIN_PANEL | (engine default) | open-sse/services/autoCombo/virtualFactory.ts | Minimum panel-size tuning forwarded to the chaos broadcast handler; unset keeps the engine default. |
OMNIROUTE_CHAOS_PANEL_TIMEOUT_MS | (engine default) | open-sse/services/autoCombo/virtualFactory.ts | Hard timeout (ms) for the whole chaos panel fan-out; unset keeps the engine default. |
GROK_AUTH_PATH | ~/.grok/auth.json | open-sse/services/grokQuotaFetcher.ts | Path of the Grok CLI auth.json used to fetch the grok-web weekly quota; override for tests or a non-standard CLI install. |
AGENTBRIDGE_UPSTREAM_CA_CERT | (unset) | src/mitm/manager.ts | Extra CA certificate (PEM) trusted for AgentBridge upstream TLS connections. |
INSPECTOR_BUFFER_SIZE | 1000 | src/mitm/inspector/buffer.ts | Max captured requests held in the Traffic Inspector ring buffer. |
INSPECTOR_MAX_BODY_KB | 1024 | src/mitm/inspector/buffer.ts | Max captured request/response body size (KB) before truncation. |
INSPECTOR_HTTP_PROXY_PORT | 8080 | src/mitm/inspector/httpProxyServer.ts | Local port for the Traffic Inspector HTTP proxy. |
INSPECTOR_HTTP_PROXY_AUTOSTART | false | src/mitm/inspector/httpProxyServer.ts | Auto-start the inspector HTTP proxy on boot. |
INSPECTOR_TLS_INTERCEPT | false | src/lib/inspector/captureState.ts | Enable TLS interception (MITM) for captured HTTPS traffic. |
INSPECTOR_LLM_HOSTS_EXTRA | (unset) | src/lib/inspector/captureState.ts | Extra hostnames (comma-separated) treated as LLM endpoints for capture. |
INSPECTOR_MASK_SECRETS | true | src/mitm/inspector/buffer.ts | Mask secrets (auth headers / API keys) in captured traffic. |
INSPECTOR_SYSTEM_PROXY_GUARD_MINUTES | 30 | src/app/api/tools/traffic-inspector/capture-modes/system-proxy/route.ts | Minutes before the system-proxy guard auto-reverts OS proxy settings. |
INSPECTOR_INTERNAL_INGEST_TOKEN | (auto) | src/app/api/tools/traffic-inspector/internal/ingest/route.ts | Token authenticating internal capture ingest into the inspector. |
PLAYGROUND_COMPARE_MAX_COLUMNS | 4 | src/app/(dashboard)/dashboard/playground/ | Max number of side-by-side columns in the Playground compare mode. |
PLAYGROUND_IMPROVE_PROMPT_DEFAULT_MODEL | (unset) | src/app/(dashboard)/dashboard/playground/ | Default model for the Playground 'improve prompt' action (falls back to the active model when unset). |
BIFROST_ENABLED | 1 | src/app/api/v1/relay/chat/completions/bifrost/route.ts | Master kill switch for the bifrost sidecar proxy. When set to 0, the route returns 503 with the X-Bifrost-Killswitch header and the operator is bounced to the TS path. Use to disable the sidecar without redeploying (tier-1 router incident, key rotation). |
BIFROST_BASE_URL | (unset) | src/app/api/v1/relay/chat/completions/bifrost/route.ts | When set, the Bifrost sidecar proxy route forwards /v1/chat/completions traffic to this Go gateway instead of the TS relay handler. Unset → 503-with-fallback. Trailing slash is stripped. |
BIFROST_PORT | 8080 | src/lib/services/bootstrap.ts | Port the supervised Bifrost embedded service binds to (127.0.0.1:<port>) when OmniRoute manages the Bifrost sidecar lifecycle. Defaults to 8080. |
BIFROST_API_KEY | (unset) | src/app/api/v1/relay/chat/completions/bifrost/route.ts | API key for the Bifrost gateway (sent as Authorization: Bearer ...). If unset, the route expects the request to carry a valid OmniRoute API key; this key is for gateway-side auth only. |
BIFROST_STREAMING_ENABLED | true | src/app/api/v1/relay/chat/completions/bifrost/route.ts | When true, the Bifrost sidecar route streams responses back via SSE through the gateway rather than the TS streaming executor. Set to 0 to force non-streaming JSON responses through the gateway. |
BIFROST_TIMEOUT_MS | 30000 | src/app/api/v1/relay/chat/completions/bifrost/route.ts | Per-request timeout when proxying to the Bifrost gateway (ms). On timeout the route returns the TS relay path via the X-Bifrost-Fallback header. |
OMNIROUTE_BIFROST_KEY | (unset) | src/app/api/v1/relay/chat/completions/bifrost/route.ts | Alias for BIFROST_API_KEY (used by scripts that read the env via OMNIROUTE_*). BIFROST_API_KEY takes precedence when both are set. |
OMNIROUTE_RELAY_BACKEND | ts / auto | src/app/api/v1/relay/chat/completions/routingBackend.ts | Relay backend for /api/v1/relay/chat/completions: ts | bifrost | auto. ts = TypeScript relay (default when Bifrost unconfigured); auto selects Bifrost when BIFROST_BASE_URL is set and BIFROST_ENABLED ≠ 0, with automatic TS fallback if the sidecar is unreachable; bifrost forces Bifrost (strict, no fallback). Auth/rate-limit/injection-guard/allowlist always run in the Next route first. Responses carry X-Routing-Backend / X-Routing-Fallback / X-Routing-Fallback-Reason. |
RELAY_ROUTING_BACKEND | (unset) | src/app/api/v1/relay/chat/completions/routingBackend.ts | Accepted alias for OMNIROUTE_RELAY_BACKEND (same ts | bifrost | auto values). OMNIROUTE_RELAY_BACKEND takes precedence when both are set. |
OMNIROUTE_BIFROST_FAILURE_COOLDOWN_MS | 5000 | src/app/api/v1/relay/chat/completions/bifrostCooldown.ts | Cooldown (ms) after a Bifrost sidecar hop fails in auto mode before the relay re-attempts the sidecar; it routes straight to the TS path while the cooldown lasts, then probes again. 0 disables. Only applies when OMNIROUTE_RELAY_BACKEND=auto. |
OMNIROUTE_TLS_CERT | (unset) | bin/cli/commands/serve.mjs | Path to a PEM TLS certificate to serve omniroute serve over HTTPS (equivalent to --tls-cert). Must be paired with OMNIROUTE_TLS_KEY; the standalone server then terminates TLS on the same listener (wss:// works unchanged). Unset → plain HTTP. Providing only one of cert/key, or an unreadable path, logs a warning and stays HTTP. |
OMNIROUTE_TLS_KEY | (unset) | bin/cli/commands/serve.mjs | Path to the PEM TLS private key for omniroute serve HTTPS (equivalent to --tls-key). Must be paired with OMNIROUTE_TLS_CERT. See OMNIROUTE_TLS_CERT. |
OMNIROUTE_LOCAL_ENDPOINTS_ENABLED | 0 | src/lib/security/localEndpoints.ts | Master switch for /api/local/* routes. When unset or 0, all /api/local/* routes return 503 in production. Must be 1 in non-loopback deploys to enable the Redis launcher and similar 1-click local service starters. Belt-and-suspenders with isLocalOnlyPath() route-guard classification (LOCAL_ONLY_API_PREFIXES in src/server/authz/routeGuard.ts). |
OMNIROUTE_LOCAL_ENDPOINTS_TOKEN | (unset) | src/lib/security/localEndpoints.ts | Bearer token for /api/local/* callers that aren't on loopback (e.g. the desktop app). When set, requests from non-loopback IPs must carry Authorization: Bearer <token>. Required when OMNIROUTE_LOCAL_ENDPOINTS_ENABLED=1 in non-loopback deployments. |
OMNIROUTE_REDIS_CONTAINER_NAME | omniroute-redis | bin/cli/commands/redis.mjs | Container name for the 1-click Redis launcher (omniroute redis up). Used by both the CLI and the RedisLauncherPanel GUI. |
OMNIROUTE_REDIS_HOST_PORT | 6379 | bin/cli/commands/redis.mjs | Host port for the 1-click Redis launcher. Bump if the host already binds 6379. The container's internal port stays 6379. |
OMNIROUTE_REDIS_BIND_HOST | 127.0.0.1 | bin/cli/commands/redis.mjs | Host interface the 1-click Redis launcher publishes on. The launcher starts Redis WITHOUT a password, so binding 0.0.0.0 hands every host on your LAN an unauthenticated Redis — only widen this if you also set a password on the instance yourself. |
REDIS_BIND_HOST | 127.0.0.1 | docker-compose.yml | Host interface docker-compose publishes the Redis sidecar on (#9286). The compose Redis runs without requirepass; app containers reach it over the compose network (redis:6379) — the published port exists only for host-side tooling. 0.0.0.0 exposes an unauthenticated Redis to the whole LAN. |
REDIS_PORT | 6379 | docker-compose.yml | Host port for the compose Redis sidecar. |
OMNIROUTE_INTERNAL_SERVICE_TOKEN | (unset — mechanism disabled) | src/lib/api/internalServiceAuth.ts | Shared secret for identity-preserving internal REST hops (#9260): OmniRoute components calling other local OmniRoute routes send it as x-omniroute-internal-service-token so the original caller identity is preserved. Compared with timingSafeEqual. |
OMNIROUTE_INTERNAL_SERVICE_TOKEN_FILE | (unset) | src/lib/api/internalServiceAuth.ts | Secret-file variant of the internal service token: path to a file whose trimmed content is the token. Only consulted when the inline var is unset. |
OPENROUTER_PROVIDER_STATS_ENABLED | true | src/lib/catalog/openrouterProviderStats.ts | Enrich the dashboard providers list with OpenRouter weekly ranking stats (#9324). On by default; set false to skip the background fetch entirely (non-blocking, never fatal). |
OPENROUTER_PROVIDER_STATS_TTL_MS | 86400000 (24h) | src/lib/catalog/openrouterProviderStats.ts | Cache TTL for the OpenRouter provider-stats snapshot, in milliseconds. |
OMNIROUTE_REDIS_IMAGE | redis:7-alpine | bin/cli/commands/redis.mjs | Redis image used by the 1-click Redis launcher. Override to redis:8-alpine or a private registry mirror as needed. |
QDRANT_HOST | qdrant | (opt-in cluster profile) | Hostname of the Qdrant sidecar when --profile memory is active. Default points to the in-network qdrant service name; override for an external deployment. Only consumed when qdrantEnabled is true in code (src/lib/memory/vectorStore.ts:108). |
QDRANT_PORT | 6333 | (opt-in cluster profile) | REST port of the Qdrant sidecar. |
QDRANT_GRPC_PORT | 6334 | (opt-in cluster profile) | gRPC port of the Qdrant sidecar. Used by client libraries that prefer gRPC over REST for streaming ops. |
QDRANT_API_KEY | (unset) | (opt-in cluster profile) | Optional API key for Qdrant Cloud or an authenticated on-prem instance. Empty → no api-key header sent. |
QDRANT_COLLECTION | omniroute-memory | (opt-in cluster profile) | Collection name for OmniRoute's conversation memory embeddings. Created on first run with QDRANT_VECTOR_SIZE dimensions. |
QDRANT_EMBEDDING_MODEL | text-embedding-3-small | (opt-in cluster profile) | Default embedding model name recorded in the Qdrant collection metadata. Actual embeddings are generated by whatever provider the embeddingModel field in OmniRoute's settings points to. |
QDRANT_VECTOR_SIZE | 1536 | (opt-in cluster profile) | Embedding vector dimension. Must match the model you embed with (text-embedding-3-small → 1536; ada-002 → 1536; nomic-embed-text → 768). |
QDRANT_HNSW_EF_CONSTRUCT | 128 | (opt-in cluster profile) | HNSW index construction-time accuracy. Higher = slower build, faster search. |
OMNIROUTE_ROTATION_ENABLED | true | open-sse/services/rotationConfig.ts | Master switch for operator-configurable account rotation. When false, none of the OMNIROUTE_ROTATE_* classes below trigger account fallback (the master-off state also blocks the default-enabled 429/500/502 classes). Lets a supervising front-end (e.g. the VibeProxy desktop app) mirror its own rotation rules onto the backend's account-fallback engine. |
OMNIROUTE_ROTATION_RATE_LIMIT_RESET_SECONDS | 0 | open-sse/services/rotationConfig.ts | Cooldown (seconds) applied to a rate-limited account when the upstream gives no explicit reset hint. 0 = use the engine default cooldown instead of a fixed override. |
OMNIROUTE_ROTATION_DISABLE_TAG_WITHOUT_RESET | true | open-sse/services/rotationConfig.ts | Mirror of the front-end "don't tag as rate-limited without a reset time" preference. |
OMNIROUTE_ROTATE_ON_429 | true | open-sse/services/rotationConfig.ts | Per-status fallback enable for 429 errors. When false (and OMNIROUTE_ROTATION_ENABLED=true), a 429 no longer triggers account rotation and is returned to the client instead. |
OMNIROUTE_ROTATE_429_THRESHOLD | 1 | open-sse/services/rotationConfig.ts | Number of 429 errors within OMNIROUTE_ROTATE_429_WINDOW_SECONDS required before the account is rotated. 1 (default) rotates immediately, preserving historical behavior. |
OMNIROUTE_ROTATE_429_WINDOW_SECONDS | 120 | open-sse/services/rotationConfig.ts | Sliding window (seconds) over which 429 errors are counted toward OMNIROUTE_ROTATE_429_THRESHOLD. |
OMNIROUTE_ROTATE_ON_500 | true | open-sse/services/rotationConfig.ts | Per-status fallback enable for 5xx server errors (excluding 502, which has its own class). When false, these errors no longer trigger account rotation. |
OMNIROUTE_ROTATE_500_THRESHOLD | 1 | open-sse/services/rotationConfig.ts | Number of 5xx errors within OMNIROUTE_ROTATE_500_WINDOW_SECONDS required before the account is rotated. 1 (default) rotates immediately. |
OMNIROUTE_ROTATE_500_WINDOW_SECONDS | 120 | open-sse/services/rotationConfig.ts | Sliding window (seconds) over which 5xx errors are counted toward OMNIROUTE_ROTATE_500_THRESHOLD. |
OMNIROUTE_ROTATE_ON_502 | true | open-sse/services/rotationConfig.ts | Per-status fallback enable for 502 (bad gateway) errors. When false, 502s no longer trigger account rotation. |
OMNIROUTE_ROTATE_502_THRESHOLD | 1 | open-sse/services/rotationConfig.ts | Number of 502 errors within OMNIROUTE_ROTATE_502_WINDOW_SECONDS required before the account is rotated. 1 (default) rotates immediately. |
OMNIROUTE_ROTATE_502_WINDOW_SECONDS | 120 | open-sse/services/rotationConfig.ts | Sliding window (seconds) over which 502 errors are counted toward OMNIROUTE_ROTATE_502_THRESHOLD. |
OMNIROUTE_ROTATE_ON_400 | false | open-sse/services/rotationConfig.ts | Opt-in (default OFF): when true, a plain 400 (bad request) also triggers account rotation. This is additive only — it never blocks the engine's existing behavior where a 400 carrying rate-limit/quota text still falls over regardless of this flag. |
OMNIROUTE_ROTATE_400_THRESHOLD | 1 | open-sse/services/rotationConfig.ts | Number of 400 errors within OMNIROUTE_ROTATE_400_WINDOW_SECONDS required before the account is rotated (only consulted when OMNIROUTE_ROTATE_ON_400=true). |
OMNIROUTE_ROTATE_400_WINDOW_SECONDS | 120 | open-sse/services/rotationConfig.ts | Sliding window (seconds) over which 400 errors are counted toward OMNIROUTE_ROTATE_400_THRESHOLD. |
Cron-driven warmup for opted-in Anthropic OAuth connections, so the 5-hour rate-limit window is opened by a trivial scheduled request instead of by the first real one (#8848). The scheduler is off unless OMNIROUTE_WARMUP_ENABLED is truthy and the connection is flagged in settings.claudeWarmup.connections; an empty connection list means nothing is warmed even with the env var on.
| Variable | Default | Source File | Description |
|---|---|---|---|
OMNIROUTE_WARMUP_ENABLED | (unset → off) | src/lib/warmupScheduler.ts | Master switch for the warmup scheduler. Accepts 1/true/yes/on (case-insensitive, trimmed). Any other value, or unset, leaves the scheduler off. |
OMNIROUTE_WARMUP_CRON | 0 7 * * * | src/lib/warmupScheduler.ts | Five-field cron expression for the warmup tick, evaluated in America/Los_Angeles (Anthropic's reset timezone) regardless of the host clock. |
OMNIROUTE_WARMUP_CONCURRENCY | 3 | src/lib/warmupScheduler.ts | How many connections are warmed in parallel per tick. Clamped to 1-10; a non-numeric value falls back to 3. |
OMNIROUTE_WARMUP_MODEL | claude-3-5-haiku-20241022 | src/lib/warmupScheduler.ts | Model used for the warmup request. Override only if the default is unavailable on your plan; pick the cheapest model that still opens the window. |
Containerized Chromium+VNC used for interactive browser-login credential capture (/api/vnc-session), plus a legacy DATA_DIR alias. All optional — the VNC defaults target the bundled omniroute-vnc-chromium:local image and are only overridden for a custom container image, ports, or lifecycle tuning.
| Variable | Default | Source File | Description |
|---|---|---|---|
OMNIROUTE_VNC_IMAGE | omniroute-vnc-chromium:local | src/lib/vncSession/manifest.ts | Docker image tag for the Chromium+VNC login container. Build docker/vnc-browser/chromium or point this at a custom image. |
OMNIROUTE_DOCKER_BIN | docker | src/lib/vncSession/manifest.ts | Container runtime binary used to launch the VNC container (e.g. set to podman). |
OMNIROUTE_VNC_CONTAINER_VNC_PORT | 3000 | src/lib/vncSession/manifest.ts | VNC/noVNC port exposed inside the container. |
OMNIROUTE_VNC_CONTAINER_CDP_PORT | 9223 | src/lib/vncSession/manifest.ts | Chrome DevTools Protocol port inside the container. |
OMNIROUTE_VNC_CONTAINER_PROFILE_DIR | /config | src/lib/vncSession/manifest.ts | Chromium profile directory path inside the container. |
OMNIROUTE_VNC_PROFILE_DIR | $HOME/.omniroute/browser-login-profiles | src/lib/vncSession/manifest.ts | Host directory holding persisted browser-login profiles. |
OMNIROUTE_VNC_IDLE_MS | 600000 (10 min) | src/lib/vncSession/manifest.ts | Idle timeout (ms) before an inactive VNC session is reaped. |
OMNIROUTE_VNC_MAX_MS | 1800000 (30 min) | src/lib/vncSession/manifest.ts | Hard cap (ms) on a single VNC session's lifetime. |
OMNIROUTE_VNC_MAX_SESSIONS | 4 | src/lib/vncSession/manifest.ts | Maximum number of concurrent VNC sessions. |
OMNIROUTE_VNC_READY_MS | 45000 | src/lib/vncSession/manifest.ts | Timeout (ms) waiting for the containerized browser to become CDP-ready. |
OMNIROUTE_VNC_HARVEST_MS | 20000 | src/lib/vncSession/manifest.ts | Timeout (ms) for harvesting the captured session/cookies after login completes. |
OMNIROUTE_VNC_CHROMIUM_ARGS | --remote-debugging-port=9222 --no-first-run --no-default-browser-check | src/lib/vncSession/manifest.ts | Extra command-line flags passed to the containerized Chromium. |
VIBEPROXY_DATA_DIR | (unset) | open-sse/services/notionThreadSessions.ts | Legacy alias for DATA_DIR, checked only after both DATA_DIR and OMNIROUTE_DATA_DIR are unset. Locates the Notion web-thread session cache (<dir>/notion-web-thread-sessions.json). |
Used by scripts/dev/run-next-playwright.mjs, scripts/dev/smoke-electron-packaged.mjs,
scripts/dev/run-ecosystem-tests.mjs, and scripts/build/uninstall.mjs. Leave every
value below unset in production deployments.
| Variable | Default | Source File | Description |
|---|---|---|---|
OMNIROUTE_E2E_BOOTSTRAP_MODE | auth | scripts/dev/run-next-playwright.mjs | E2E bootstrap mode (auth, fresh, reuse) for the Playwright runner. |
OMNIROUTE_E2E_PASSWORD | falls back to INITIAL_PASSWORD | scripts/dev/run-next-playwright.mjs | Admin password injected into the Playwright environment. |
OMNIROUTE_DISABLE_LOCAL_HEALTHCHECK | true | scripts/dev/run-next-playwright.mjs | Disable the local healthcheck poll during Playwright runs. |
OMNIROUTE_DISABLE_TOKEN_HEALTHCHECK | true | scripts/dev/run-next-playwright.mjs | Disable the OAuth token healthcheck loop during tests. |
OMNIROUTE_HEALTHCHECK_SKIP_PROVIDERS | (unset) | src/lib/tokenHealthCheck.ts | Comma-separated providers excluded from the proactive token-refresh sweep (e.g. codex,openai). Targeted alternative to fully disabling the healthcheck — short-TTL providers keep refreshing while cascade providers stay reactive-only. |
OMNIROUTE_HIDE_HEALTHCHECK_LOGS | true | scripts/dev/run-next-playwright.mjs | Silence healthcheck noise in Playwright stdout. |
OMNIROUTE_PLAYWRIGHT_SKIP_BUILD | 0 | scripts/dev/run-next-playwright.mjs | Skip the Next.js production build before Playwright starts (CI optimization). |
OMNIROUTE_SKIP_UNINSTALL_HOOK | 0 | scripts/build/uninstall.mjs | Skip the OmniRoute uninstall hook (used by CI to keep node_modules intact). |
ECOSYSTEM_SERVER_WAIT_MS | 180000 | scripts/dev/run-ecosystem-tests.mjs | Wait time (ms) for the server to become healthy before running ecosystem/protocol tests. |
ELECTRON_SMOKE_URL | http://127.0.0.1:20128/login | scripts/dev/smoke-electron-packaged.mjs | URL the Electron smoke harness expects the packaged app to serve. |
ELECTRON_SMOKE_TIMEOUT_MS | 45000 | scripts/dev/smoke-electron-packaged.mjs | Total timeout (ms) before the smoke harness gives up. |
ELECTRON_SMOKE_SETTLE_MS | 2000 | scripts/dev/smoke-electron-packaged.mjs | Settle window (ms) after the page loads. |
ELECTRON_SMOKE_APP_EXECUTABLE | (auto) | scripts/dev/smoke-electron-packaged.mjs | Explicit path to the packaged Electron executable. |
ELECTRON_SMOKE_DATA_DIR | (tmpdir) | scripts/dev/smoke-electron-packaged.mjs | Data directory for the Electron smoke run. |
ELECTRON_SMOKE_KEEP_DATA | 0 | scripts/dev/smoke-electron-packaged.mjs | Set 1 to preserve the smoke data directory after the run. |
ELECTRON_SMOKE_STREAM_LOGS | 0 | scripts/dev/smoke-electron-packaged.mjs | Set 1 to stream Electron logs to stdout during the run. |
CLI_DEVIN_BIN | (PATH lookup) | open-sse/executors/devin-cli.ts | Override the Devin CLI binary path. |
Used by scripts/i18n/run-translation.mjs (the npm run i18n:run command).
All five variables are unset by default — set them in .env only on machines
that should be able to run the docs translator.
| Variable | Default | Source File | Description |
|---|---|---|---|
OMNIROUTE_TRANSLATION_API_URL | (unset) | scripts/i18n/run-translation.mjs | OpenAI-compatible base URL for the translation backend. |
OMNIROUTE_TRANSLATION_API_KEY | (unset) | scripts/i18n/run-translation.mjs | Bearer token for the translation backend (never logged). |
OMNIROUTE_TRANSLATION_MODEL | (unset) | scripts/i18n/run-translation.mjs | Model id, e.g. gpt-4o-mini or cx/gpt-5.4-mini. |
OMNIROUTE_TRANSLATION_TIMEOUT_MS | 60000 | scripts/i18n/run-translation.mjs | Per-request timeout in milliseconds. |
OMNIROUTE_TRANSLATION_CONCURRENCY | 4 | scripts/i18n/run-translation.mjs | Parallel translation requests when running over multiple files / locales. |
Optional add-on gated by the RADAR_ENABLED feature flag (default off — a feature flag toggled via Settings/DB, not an env var; see docs/frameworks/RADAR.md). The four variables below are optional overrides used only to point the client at a self-hosted or forked feed / supporter-key flow instead of the default OmniRoute Radar service. See docs/frameworks/RADAR.md for the full module doc.
| Variable | Default | Source File | Description |
|---|---|---|---|
RADAR_FEED_URL | https://radar.omniroute.online | src/lib/radar/sync.ts | Base URL of the Radar feed service. Override to point at a self-hosted or forked feed. |
RADAR_FEED_PUBKEY | (pinned default key) | src/lib/radar/pinnedKeys.ts | Ed25519 public key (base64-DER SPKI or PEM) used to verify feed signatures from a custom feed. |
RADAR_CONTRIBUTOR_CLAIM_URL | https://radar.omniroute.online/auth/github | src/lib/radar/links.ts | URL the "I'm a contributor" dashboard button opens (GitHub OAuth supporter-key claim flow). |
RADAR_SUPPORTER_PLANS_URL | https://radar.omniroute.online/planos | src/lib/radar/links.ts | URL the "Support the project" dashboard button opens (payment/plans page). |
The following variables appeared in previous versions of .env.example but have no runtime references in the current codebase. They have been removed:
| Variable | Reason |
|---|---|
STORAGE_DRIVER=sqlite | Never read by any source file. SQLite is the only supported driver — no selection needed. |
INSTANCE_NAME=omniroute | Present in old docs/env templates but unused at runtime. May return in a future multi-instance feature. |
SQLITE_MAX_SIZE_MB=2048 | Not referenced in source code. Database size is not artificially limited. |
SQLITE_CLEAN_LEGACY_FILES=true | Not referenced in source code. Legacy cleanup was likely removed. |
CLI_ROO_BIN | Not registered in src/shared/services/cliRuntime.ts. |
CLI_KIMI_CODING_BIN | Not registered in src/shared/services/cliRuntime.ts (Kimi Coding uses OAuth, not a CLI binary). |
IFLOW_OAUTH_CLIENT_ID / IFLOW_OAUTH_CLIENT_SECRET | Not referenced anywhere in source code. |
CEREBRAS_API_KEY / COHERE_API_KEY / FIREWORKS_API_KEY / GROQ_API_KEY / MISTRAL_API_KEY / NEBIUS_API_KEY / PERPLEXITY_API_KEY / TOGETHER_API_KEY / XAI_API_KEY | Removed in v3.8.0. The runtime no longer reads these env vars — credentials come from Dashboard / data/provider-credentials.json / encrypted DB. |
CURSOR_PROTOBUF_DEBUG | Removed in v3.8.0. Cursor executor uses CURSOR_DEBUG / CURSOR_STREAM_DEBUG (see §22). |
CLI_COMPAT_KIRO | Removed in v3.8.0. Kiro is in CLI_COMPAT_OMITTED_PROVIDER_IDS — its toggle has no effect. |
QIANFAN_API_KEY | Removed alongside other unused provider API key stubs in v3.8.0. |
| Variable | Old .env.example Value | Actual Code Default | Fixed |
|---|---|---|---|
APP_LOG_RETENTION_DAYS | 90 | 7 | ✅ Removed misleading value; documented 7 as default |
CALL_LOG_RETENTION_DAYS | 90 | 7 | ✅ Removed misleading value; documented 7 as default |
Used by scripts/ad-hoc/regen-opencode-config.ts to regenerate an opencode.json
with accurate limit.context and limit.output values pulled from the running
OmniRoute instance. None of these are required for normal operation — the script
is developer tooling only.
| Variable | Default | Source File | Description |
|---|---|---|---|
OMNIROUTE_URL | http://localhost:20128 | scripts/ad-hoc/regen-opencode-config.ts | Base URL of the OmniRoute instance to query for /v1/models. |
OMNIROUTE_KEY | (unset) | scripts/ad-hoc/regen-opencode-config.ts | API key to authenticate against the OmniRoute /v1/models endpoint. Falls back to OPENCODE_API_KEY when unset. |
OPENCODE_API_KEY | (unset) | scripts/ad-hoc/regen-opencode-config.ts | OpenCode-style API key (sk-...) written into the regenerated opencode.json. Falls back to OMNIROUTE_KEY when unset. |
Used by scripts/compression-eval/index.ts, the offline compression evaluation CLI.
Not required for normal operation — developer tooling only.
| Variable | Default | Source File | Description |
|---|---|---|---|
OMNIROUTE_EVAL_CREDENTIALS | {} (empty) | scripts/compression-eval/index.ts | Operator-supplied JSON credentials for the provider exercised by the offline compression-eval CLI (parsed with JSON.parse). Leave unset for a dry run. |
Used by src/lib/vncSession/manifest.ts to configure Docker-based headless Chromium sessions for browser-automation providers. All optional — defaults shown below.
| Variable | Default | Source File | Description |
|---|---|---|---|
OMNIROUTE_DOCKER_BIN | docker | src/lib/vncSession/manifest.ts | Path to the Docker binary used to spawn VNC containers. |
OMNIROUTE_VNC_IMAGE | omniroute-vnc-chromium:local | src/lib/vncSession/manifest.ts | Docker image for the VNC Chromium container. |
OMNIROUTE_VNC_CHROMIUM_ARGS | (built-in flags) | src/lib/vncSession/manifest.ts | Extra Chromium CLI args passed to the browser inside the container. |
OMNIROUTE_VNC_CONTAINER_VNC_PORT | 3000 | src/lib/vncSession/manifest.ts | VNC port inside the container. |
OMNIROUTE_VNC_CONTAINER_CDP_PORT | 9223 | src/lib/vncSession/manifest.ts | Chrome DevTools Protocol port inside the container. |
OMNIROUTE_VNC_CONTAINER_PROFILE_DIR | /config | src/lib/vncSession/manifest.ts | Profile directory inside the container. |
OMNIROUTE_VNC_PROFILE_DIR | (unset) | src/lib/vncSession/manifest.ts | Host-side directory for persistent browser profiles. |
OMNIROUTE_VNC_IDLE_MS | 600000 | src/lib/vncSession/manifest.ts | Idle timeout (ms) before a VNC session is harvested. |
OMNIROUTE_VNC_MAX_MS | 1800000 | src/lib/vncSession/manifest.ts | Maximum session duration (ms). |
OMNIROUTE_VNC_MAX_SESSIONS | 4 | src/lib/vncSession/manifest.ts | Maximum concurrent VNC sessions. |
OMNIROUTE_VNC_READY_MS | 45000 | src/lib/vncSession/manifest.ts | Browser readiness timeout (ms). |
OMNIROUTE_VNC_HARVEST_MS | 20000 | src/lib/vncSession/manifest.ts | Harvest/cleanup timeout (ms). |
VIBEPROXY_DATA_DIR | (unset) | open-sse/services/notionThreadSessions.ts | Directory for Notion thread session persistence. |
| Variable | Default | Description |
|---|---|---|
OMNIROUTE_INTERNAL_SERVICE_TOKEN | – | Inline token for management-plane service-to-service authentication. |
OMNIROUTE_INTERNAL_SERVICE_TOKEN_FILE | – | Path to a file containing the internal service token (preferred in containers; overrides the inline variable). |
| Variable | Default | Description |
|---|---|---|
OPENROUTER_PROVIDER_STATS_ENABLED | true | Set to false to skip fetching OpenRouter per-provider stats for catalog enrichment. |
OPENROUTER_PROVIDER_STATS_TTL_MS | 3600000 | Cache TTL (ms) for the fetched OpenRouter provider stats. |
| Variable | Default | Description |
|---|---|---|
REDIS_BIND_HOST | 127.0.0.1 | Bind address for the embedded Redis service. |
REDIS_PORT | 6379 | Port for the embedded Redis service. |
OMNIROUTE_REDIS_BIND_HOST | – | OmniRoute-scoped override for the embedded Redis bind address. |
These settings were introduced after the previous environment-contract snapshot.
| Variable | Default | Source File | Description |
|---|---|---|---|
OMNIROUTE_CHAT_ADMISSION_QUEUE_MS | 2000 | src/shared/middleware/chatBodyAdmission.ts | Maximum wait for a heavyweight chat admission slot before a retryable 503; a short bounded wait serializes agent bursts instead of an instant 503. 0 restores immediate rejection. |
OMNIROUTE_CHAT_ADMISSION_MAX_QUEUED_BYTES | 4194304 (4 MB) | src/shared/middleware/chatBodyAdmission.ts | Queued-bytes budget for the admission wait (#9654): bounds total buffered body bytes parked per lane so the wait cannot amplify the heap (#4380). Over-budget waits receive a retryable 503 immediately. |
OMNIROUTE_CHAT_VIRTUAL_TTL_MS | 60000 (60 s) | src/shared/middleware/chatBodyAdmission.ts | Per-connection virtual admission lanes (#9654): idle-lane eviction TTL. |
OMNIROUTE_CHAT_VIRTUAL_MAX_SESSIONS | 64 | src/shared/middleware/chatBodyAdmission.ts | Per-connection virtual admission lanes (#9654): max concurrent sessions (lanes). |
OMNIROUTE_RUNNOW_TIMEOUT_MS | 30000 | src/app/api/jobs/[id]/run-now/route.ts | Bounds how long a run-now call waits for an in-flight job before starting the queued run. |
ADOBE_FIREFLY_BROWSER_REFRESH | enabled | open-sse/services/adobeFireflySession.ts | Keeps IMS and browser-risk state fresh through account-scoped Chrome CDP sessions; set 0 to disable. |
ADOBE_FIREFLY_SESSION_DISK | enabled | open-sse/services/adobeFireflySession.ts | Persists repaired Adobe sessions under DATA_DIR; set 0 for memory-only state. |
ADOBE_FIREFLY_MIN_SUBMIT_GAP_MS | 12000 | open-sse/services/adobeFireflySession.ts | Minimum spacing between Adobe Firefly generate submissions. |
ADOBE_FIREFLY_BATCH_EXTRA_GAP_MS | 15000 | open-sse/services/adobeFireflySession.ts | Extra quiet period after every third successful Adobe submission. |
ADOBE_FIREFLY_CHROME_CDP_PORT | 9334 | open-sse/services/adobeFireflyChromeRuntime.ts | CDP port for the account-scoped Chrome runtime. |
ADOBE_FIREFLY_CHROME_VISIBLE | 0 | open-sse/services/adobeFireflyChromeRuntime.ts | Set 1 to keep the Adobe renewal browser visible; the default parks a headed window off-screen. |
ADOBE_FIREFLY_CHROME_HEADLESS | 0 | open-sse/services/adobeFireflyChromeRuntime.ts | Debug-only true-headless mode; Adobe colligo normally rejects the resulting risk session. |
ADOBE_FIREFLY_CHROME_FORCE_RESTART | 0 | open-sse/services/adobeFireflyChromeRuntime.ts | Set 1 to restart the account-scoped Chrome runtime before renewal. |
ADOBE_FIREFLY_CHROME_PING | automatic | open-sse/services/adobeFireflyChromeRuntime.ts | 1 forces, and 0 disables, the in-page generate probe used to prove the renewed ARP session. |
ADOBE_FIREFLY_LOGIN_WAIT_MS | context-dependent | open-sse/services/adobeFireflyChromeRuntime.ts | Interactive-login wait budget: 0 on background renewal and 300000 on the explicit login flow unless overridden. |
ADOBE_FIREFLY_FORTER_WAIT_MS | 45000 | open-sse/services/adobeFireflyChromeRuntime.ts | Maximum wait for a fresh Forter token during session renewal. |
CHROME_PATH | auto-detect | open-sse/services/adobeFireflyChromeRuntime.ts | Optional absolute Chrome executable used when platform auto-detection is insufficient. |
TELEGRAM_BOT_TOKEN | (unset) | src/lib/telegram/config.ts | BotFather token that enables the inbound webhook and signs Mini App initData. |
TELEGRAM_DEFAULT_MODEL | auto/chat | src/lib/telegram/chatProxy.ts | Model used for Telegram chat replies. |
TELEGRAM_BOT_API_BASE | https://api.telegram.org | src/lib/telegram/config.ts | Bot API base URL override for proxies or self-hosted Bot API servers. |
TELEGRAM_WEBHOOK_TIMEOUT_MS | 60000 | src/lib/telegram/config.ts | Timeout in milliseconds for outbound Bot API calls. |
Globale Defaults für den headless Browser und den ausgehenden Tool-Tunnel. Im Dashboard gesetzte Connection-Werte haben Vorrang.
| Variable | Default | Source File | Description |
|---|---|---|---|
CHATGPT_WEB_CODEX_CHROME_PATH | (auto-detect) | open-sse/executors/chatgpt-web-codex.ts | Expliziter Chrome-/Chromium-Pfad für npm-, systemd- und PM2-Betrieb. |
CHROME_PATH | (auto-detect) | open-sse/executors/chatgpt-web-codex.ts | Gemeinsamer Fallback für einen expliziten Chrome-/Chromium-Pfad. |
CHATGPT_WEB_CODEX_CDP_URL | (unset) | open-sse/executors/chatgpt-web-codex.ts | Interner CDP-Endpunkt; Docker verwendet den Sidecar auf Port 9223. |
CHATGPT_WEB_CODEX_TUNNEL_ID | (unset) | open-sse/executors/chatgpt-web-codex.ts | Globale OpenAI-Tunnel-ID für lokale Codex-Tool-Runden. |
CHATGPT_WEB_CODEX_RUNTIME_KEY | (unset) | open-sse/executors/chatgpt-web-codex.ts | Globaler Tunnel Runtime-Key; niemals in Logs ausgeben. |
CHATGPT_WEB_CODEX_CONNECTOR_NAME | (unset) | open-sse/executors/chatgpt-web-codex.ts | Name des ChatGPT-Custom-Connectors für die MCP-Brücke. |
Long-lived SSE consumer that mirrors OmniConductor hub tasks into the local A2A TaskManager (src/lib/conductor/). Opt-in — the bridge only starts when CONDUCTOR_HUB_URL is set. Server-side only: the hub token must never reach the browser.
| Variable | Default | Source File | Description |
|---|---|---|---|
CONDUCTOR_HUB_URL | (empty) | src/lib/conductor/boot.ts | Base URL of the OmniConductor hub (e.g. http://127.0.0.1:7910). Unset = bridge disabled. |
CONDUCTOR_HUB_TOKEN | (empty) | src/lib/conductor/boot.ts | Hub credential for the SSE feed — emit a spokesperson-kind peer on the hub (POST /v1/peers, admin). |
CONDUCTOR_ORCHESTRATOR_TOKEN | (empty) | src/lib/conductor/hubProxy.ts | Credential for inbound A2A→hub task delegation (POST /v1/tasks); falls back to CONDUCTOR_HUB_TOKEN when unset. |
CONDUCTOR_SPOKESPERSON_URL | http://127.0.0.1:7920 | src/lib/conductor/faroProxy.ts | Base URL of the spokesperson (Faro) service behind the dashboard chat proxy (/api/conductor/ask). |