diff --git a/.env.example b/.env.example
index 8c49d88cc8..ab1dec0d05 100644
--- a/.env.example
+++ b/.env.example
@@ -91,6 +91,12 @@ OMNIROUTE_USE_TURBOPACK=1
 # Used by: src/lib/runtime/ports.ts — preserves canonical port in Electron.
 # OMNIROUTE_PORT=20128
 
+# Hostname/bind address for the Next.js server.
+# Used by: scripts/run-next.mjs (HOST), Playwright runner (HOSTNAME).
+# Default: 0.0.0.0 (HOST) / 127.0.0.1 (HOSTNAME inside tests).
+#HOST=0.0.0.0
+#HOSTNAME=127.0.0.1
+
 # Environment mode — affects Next.js behavior, logging verbosity, and caching.
 # Values: production | development  |  Default: production
 NODE_ENV=production
@@ -250,6 +256,13 @@ NEXT_PUBLIC_CLOUD_URL=
 # Legacy alias — fallback for NEXT_PUBLIC_BASE_URL in sync schedulers.
 # NEXT_PUBLIC_APP_URL=http://localhost:20128
 
+# Public callback URL for asynchronous image/audio jobs (kie.ai, etc.).
+# Used by: open-sse/utils/kieTask.ts — overrides callbackUrlFromBaseUrl().
+# Honor order: KIE_CALLBACK_URL → OMNIROUTE_KIE_CALLBACK_URL → OMNIROUTE_PUBLIC_URL.
+#KIE_CALLBACK_URL=
+#OMNIROUTE_KIE_CALLBACK_URL=
+#OMNIROUTE_PUBLIC_URL=
+
 
 # ═══════════════════════════════════════════════════════════════════════════════
 # 8. OUTBOUND PROXY (Upstream Provider Calls)
@@ -332,6 +345,17 @@ NEXT_PUBLIC_ENABLE_SOCKS5_PROXY=true
 # Full list: admin, combos, health, models, routing, budget, metrics, pricing, memory, skills
 # OMNIROUTE_MCP_SCOPES=admin,combos,health
 
+# Compress MCP tool descriptions before serializing the manifest.
+# Used by: open-sse/mcp-server/descriptionCompressor.ts — reduces token spend
+# for clients that read the full tool catalog.
+# Accepted disabling values: 0, false, off. Default: enabled.
+# OMNIROUTE_MCP_COMPRESS_DESCRIPTIONS=1
+
+# Algorithm/profile used when description compression is enabled.
+# Used by: open-sse/mcp-server/descriptionCompressor.ts
+# Set to 0/false/off to skip compression entirely. Default: rtk
+# OMNIROUTE_MCP_DESCRIPTION_COMPRESSION=rtk
+
 # Model catalog sync interval in hours.
 # Used by: src/shared/services/modelSyncScheduler.ts — periodic model refresh.
 # Default: 24
@@ -347,6 +371,48 @@ PROVIDER_LIMITS_SYNC_INTERVAL_MINUTES=70
 # Useful for: CI builds, test environments, or resource-constrained containers.
 # OMNIROUTE_DISABLE_BACKGROUND_SERVICES=false
 
+# Force runtime background tasks (healthchecks/sync) even under automated test
+# detection. Used by: src/lib/config/runtimeSettings.ts — overrides the test
+# heuristic in instrumentation-node.ts.  Default: unset (tests skip background).
+#OMNIROUTE_ENABLE_RUNTIME_BACKGROUND_TASKS=1
+
+# Background job interval for budget reset checks (ms).  Default: 600000 (10m).
+# Used by: src/lib/jobs/budgetResetJob.ts.  Floor: 10000.
+#OMNIROUTE_BUDGET_RESET_JOB_INTERVAL_MS=600000
+
+# Reasoning cache cleanup cadence (ms).  Default: 1800000 (30m).  Floor: 60000.
+# Used by: src/lib/jobs/reasoningCacheCleanupJob.ts.
+#OMNIROUTE_REASONING_CACHE_CLEANUP_INTERVAL_MS=1800000
+
+# Spend write batcher cadence (ms) and buffer size before forced flush.
+# Used by: src/lib/spend/batchWriter.ts.  Defaults: 60000 ms / 1000 entries.
+#OMNIROUTE_SPEND_FLUSH_INTERVAL_MS=60000
+#OMNIROUTE_SPEND_MAX_BUFFER_SIZE=1000
+
+# Config hot-reload polling interval (ms).  Default: 5000.
+# Used by: src/lib/config/hotReload.ts.  Lower than 1000ms is rejected.
+#OMNIROUTE_CONFIG_HOT_RELOAD_MS=5000
+
+# Override the migrations directory used by src/lib/db/migrationRunner.ts.
+# Default: <repo>/src/lib/db/migrations.
+#OMNIROUTE_MIGRATIONS_DIR=
+
+# Trust user-managed RTK project filter rules without strict signature checks.
+# Used by: open-sse/services/compression/engines/rtk/filterLoader.ts.  Default: 0.
+#OMNIROUTE_RTK_TRUST_PROJECT_FILTERS=0
+
+# Force a DB healthcheck regardless of cadence.  Default: 0.
+# Used by: src/lib/db/core.ts::shouldRunDbHealthCheck().
+#OMNIROUTE_FORCE_DB_HEALTHCHECK=0
+
+# DB healthcheck cadence override (ms).  Default: 21600000 (6h).
+# Used by: src/lib/db/core.ts::getDbHealthCheckIntervalMs().
+#OMNIROUTE_DB_HEALTHCHECK_INTERVAL_MS=21600000
+
+# Skip the Redis-backed auth cache used by API key lookups (forces DB reads).
+# Used by: src/lib/db/apiKeys.ts.  Set to 1 to disable.  Default: enabled.
+#OMNIROUTE_DISABLE_REDIS_AUTH_CACHE=0
+
 # Flag set by bootstrap script after initial setup is complete.
 # Used by: src/app/(dashboard)/dashboard/page.tsx — shows setup wizard vs. dashboard.
 # OMNIROUTE_BOOTSTRAPPED=false
@@ -355,6 +421,11 @@ PROVIDER_LIMITS_SYNC_INTERVAL_MINUTES=70
 # Used by: open-sse/executors/antigravity.ts — escape hatch for multi-project setups.
 # OMNIROUTE_ALLOW_BODY_PROJECT_OVERRIDE=0
 
+# Adjust how Antigravity advertises remaining credits.  Used by:
+# open-sse/services/antigravityCredits.ts — accepts forced override strings.
+# Default: empty (use upstream-reported credits).
+#ANTIGRAVITY_CREDITS=
+
 
 # ═══════════════════════════════════════════════════════════════════════════════
 # 11. OAUTH PROVIDER CREDENTIALS
@@ -406,6 +477,14 @@ WINDSURF_FIREBASE_API_KEY=AIzaSyBpLTEGSt59AUPKxBb7lIWjSE2ZXQH7mgU
 # Required scopes: api, read_user, openid, profile, email
 # GITLAB_DUO_OAUTH_CLIENT_ID=***
 # GITLAB_DUO_OAUTH_CLIENT_SECRET=***  # optional — PKCE flow does not require a secret
+#
+# Self-managed GitLab Duo instance overrides.
+# Used by: src/lib/oauth/gitlab.ts and src/lib/oauth/constants/oauth.ts —
+# fall back to these when the _DUO_ variants above are unset.
+#GITLAB_DUO_BASE_URL=https://gitlab.com
+#GITLAB_BASE_URL=https://gitlab.com
+#GITLAB_OAUTH_CLIENT_ID=
+#GITLAB_OAUTH_CLIENT_SECRET=
 
 # ── Qoder ──
 QODER_OAUTH_CLIENT_SECRET=4Z3YjXycVsQvyGF1etiNlIBB4RsqSDtW
@@ -500,6 +579,12 @@ GEMINI_CLI_USER_AGENT="google-api-nodejs-client/10.3.0"
 # Or enable for all providers at once:
 # CLI_COMPAT_ALL=1
 
+# ── Kimi Coding CLI identity overrides ──
+# Used by: src/lib/oauth/providers/kimi-coding.ts — sent in OAuth + API headers.
+# Leave unset to use the captured defaults baked into the OmniRoute build.
+#KIMI_CLI_VERSION=1.36.0
+#KIMI_CODING_DEVICE_ID=
+
 
 # ═══════════════════════════════════════════════════════════════════════════════
 # 14. API KEY PROVIDERS
@@ -515,6 +600,10 @@ GEMINI_CLI_USER_AGENT="google-api-nodejs-client/10.3.0"
 # DEEPSEEK_API_KEY=
 # NVIDIA_API_KEY=
 
+# Windsurf / Devin CLI direct API key.
+# Used by: open-sse/executors/devin-cli.ts — bypasses OAuth when set.
+# WINDSURF_API_KEY=
+
 # Embedding Providers (optional — used by /v1/embeddings)
 # OpenAI/Mistral/Together/Fireworks/NVIDIA configured via Dashboard → Providers
 # also work for embeddings.
@@ -772,18 +861,49 @@ APP_LOG_TO_FILE=true
 # Used by: open-sse/services/rateLimitManager.ts
 # RATE_LIMIT_MAX_WAIT_MS=120000
 
+# Force the auto-enable rate limit safety net on/off regardless of the persisted
+# Dashboard setting. Used by: open-sse/services/rateLimitManager.ts.
+# Accepted values: true|1|on (force on), false|0|off (force off), unset (use Dashboard).
+# RATE_LIMIT_AUTO_ENABLE=
+
+# Stagger interval (ms) between provider token healthchecks at startup.
+# Used by: src/lib/tokenHealthCheck.ts.  Default: 3000.
+# HEALTHCHECK_STAGGER_MS=3000
+
 
 # ═══════════════════════════════════════════════════════════════════════════════
 # 22. DEBUGGING
 # ═══════════════════════════════════════════════════════════════════════════════
 # These variables enable verbose debugging output. NEVER enable in production.
 
-# Dump raw Cursor SSE stream data to console.
+# Cursor executor verbose debug (decoded SSE chunks, etc.).
+# CURSOR_STREAM_DEBUG is kept as a backward-compatible alias.
+# Used by: open-sse/executors/cursor.ts
+# CURSOR_DEBUG=1
 # CURSOR_STREAM_DEBUG=1
 
+# When CURSOR_DEBUG=1, also append raw decoded chunks to this file path.
+# CURSOR_DUMP_FILE=/tmp/cursor-stream.log
+
+# Cursor stream idle timeout (ms). Default: 300000 (5 min).
+# Used by: open-sse/executors/cursor.ts.
+# CURSOR_STREAM_TIMEOUT_MS=300000
+
+# Cursor state DB path override (for cursor version detection).
+# Used by: open-sse/utils/cursorVersionDetector.ts. Default: probed automatically.
+# CURSOR_STATE_DB_PATH=
+
+# Direct Cursor bearer token used by scripts/cursor-tap.cjs (developer tooling).
+# CURSOR_TOKEN=
+
 # Log Responses API SSE-to-JSON translation details.
 # DEBUG_RESPONSES_SSE_TO_JSON=true
 
+# Log request shape (content-type + content-length) for large chat payloads.
+# Used by: src/app/api/v1/chat/completions/route.ts. Set to "0" to silence.
+# Default: enabled.
+# OMNIROUTE_LOG_REQUEST_SHAPE=1
+
 # Write raw (untruncated) request/response JSON in call log artifacts.
 # When enabled, serializeArtifactForStorage skips size-based truncation.
 # Also enabled automatically when APP_LOG_LEVEL=debug.
@@ -805,3 +925,128 @@ APP_LOG_TO_FILE=true
 
 # GitHub Personal Access Token with issues:write scope.
 # GITHUB_ISSUES_TOKEN=ghp_xxxx
+
+# Generic GitHub access token consumed by issue triage / agent helpers.
+# Used by: src/app/api/v1/issues/* and src/lib/cloudAgent/* — falls back to
+# GITHUB_ISSUES_TOKEN when unset.
+# GITHUB_TOKEN=
+
+
+# ═══════════════════════════════════════════════════════════════════════════════
+# 24. PROVIDER QUOTAS, TUNNELS & SANDBOXED SKILLS
+# ═══════════════════════════════════════════════════════════════════════════════
+# Provider quota endpoints, network tunnels (Tailscale, Ngrok, MITM debug
+# proxy), 1Proxy egress pool, skills sandbox runtime, and miscellaneous CLI
+# binaries referenced by the executor layer or the dashboard runtime.
+
+# ── Alibaba (Bailian) coding plan quota ──
+# Host/full URL override used by: open-sse/services/bailianQuotaFetcher.ts.
+# When unset the fetcher uses the production Alibaba endpoints.
+# ALIBABA_CODING_PLAN_HOST=
+# ALIBABA_CODING_PLAN_QUOTA_URL=
+
+# ── Context window tuning ──
+# Tokens reserved for completion output when computing prompt budgets.
+# Used by: open-sse/services/contextManager.ts. Default: 1024.
+# CONTEXT_RESERVE_TOKENS=1024
+
+# ── Model alias rewriting (legacy compatibility) ──
+# Toggle the legacy model-alias compatibility layer used by older clients.
+# Used by: open-sse/services/model.ts.  Default: enabled.
+# MODEL_ALIAS_COMPAT_ENABLED=true
+
+# ── Devin CLI binary path ──
+# Used by: open-sse/executors/devin-cli.ts. Default: looked up via PATH.
+# CLI_DEVIN_BIN=devin
+
+# ── Command Code (custom CLI) callback ──
+# Local port used for OAuth-style callbacks from the Command Code CLI helper.
+# Used by: src/app/api/providers/command-code/auth/shared.ts.
+# COMMAND_CODE_CALLBACK_PORT=
+
+# ── MITM debug proxy (development only) ──
+# Used by: src/mitm/server.cjs — captures upstream traffic for inspection.
+# MITM_LOCAL_PORT=443
+# MITM_DISABLE_TLS_VERIFY=0
+
+# ── 1Proxy egress pool ──
+# Used by: src/lib/oneproxySync.ts — fetches proxy nodes from the OmniRoute
+# CrofAI 1Proxy service. Disable, override URL, or tune the import quality.
+# ONEPROXY_ENABLED=true
+# ONEPROXY_API_URL=https://1proxy-api.aitradepulse.com
+# ONEPROXY_MAX_PROXIES=500
+# ONEPROXY_MIN_QUALITY_THRESHOLD=50
+
+# ── Tailscale tunnel binaries ──
+# Optional explicit paths to tailscale/tailscaled binaries used by the
+# dashboard's tunnel manager. Used by: src/lib/tailscaleTunnel.ts.
+# TAILSCALE_BIN=/usr/local/bin/tailscale
+# TAILSCALED_BIN=/usr/local/bin/tailscaled
+
+# ── Ngrok tunnel ──
+# Used by: src/lib/ngrokTunnel.ts — authenticates outbound tunnels.
+# NGROK_AUTHTOKEN=
+
+# ── Database backups ──
+# Used by: src/lib/db/backup.ts.
+# DB_BACKUP_MAX_FILES=20
+# DB_BACKUP_RETENTION_DAYS=0
+
+# ── TLS sidecar override ──
+# Used by: open-sse/services/chatgptTlsClient.ts tests. Production deployments
+# should leave this unset; the sidecar is auto-managed.
+# OMNIROUTE_TLS_PROXY_URL=
+
+# ── Skills sandbox (experimental) ──
+# Used by: src/lib/skills/builtins.ts. All values support comma lists where
+# noted in the source.
+# SKILLS_MAX_FILE_BYTES=1048576
+# SKILLS_MAX_HTTP_RESPONSE_BYTES=256000
+# SKILLS_MAX_SANDBOX_OUTPUT_CHARS=100000
+# SKILLS_SANDBOX_TIMEOUT_MS=10000
+# SKILLS_SANDBOX_NETWORK_ENABLED=0
+# SKILLS_ALLOWED_SANDBOX_IMAGES=
+
+
+# ═══════════════════════════════════════════════════════════════════════════════
+# 25. TEST & E2E
+# ═══════════════════════════════════════════════════════════════════════════════
+# Used by scripts/run-next-playwright.mjs, scripts/smoke-electron-packaged.mjs,
+# scripts/run-ecosystem-tests.mjs and scripts/uninstall.mjs.
+# Production deployments should leave every value below unset.
+
+# E2E bootstrap mode for the Playwright runner. Accepted: auth | fresh | reuse.
+# Default (when unset): auth.
+# OMNIROUTE_E2E_BOOTSTRAP_MODE=auth
+
+# Admin password injected into the Playwright test environment.
+# Falls back to INITIAL_PASSWORD when unset.
+# OMNIROUTE_E2E_PASSWORD=
+
+# Disable the local healthcheck poll during Playwright runs (default: true).
+# OMNIROUTE_DISABLE_LOCAL_HEALTHCHECK=true
+
+# Disable the OAuth token healthcheck loop during tests (default: true).
+# OMNIROUTE_DISABLE_TOKEN_HEALTHCHECK=true
+
+# Silence healthcheck noise in Playwright stdout (default: true).
+# OMNIROUTE_HIDE_HEALTHCHECK_LOGS=true
+
+# Skip the Next.js production build before Playwright starts (CI optimization).
+# OMNIROUTE_PLAYWRIGHT_SKIP_BUILD=0
+
+# Skip the OmniRoute uninstall hook (used by CI to keep node_modules intact).
+# OMNIROUTE_SKIP_UNINSTALL_HOOK=0
+
+# Ecosystem/protocol test orchestrators wait this long (ms) for the server to
+# become healthy. Default: 180000.
+# ECOSYSTEM_SERVER_WAIT_MS=180000
+
+# Electron smoke harness (used by scripts/smoke-electron-packaged.mjs).
+# ELECTRON_SMOKE_URL=http://127.0.0.1:20128/login
+# ELECTRON_SMOKE_TIMEOUT_MS=45000
+# ELECTRON_SMOKE_SETTLE_MS=2000
+# ELECTRON_SMOKE_APP_EXECUTABLE=
+# ELECTRON_SMOKE_DATA_DIR=
+# ELECTRON_SMOKE_KEEP_DATA=0
+# ELECTRON_SMOKE_STREAM_LOGS=0