hack/tools/scripts/llm-key-hunter/results/_cache/content/agniwen_ai-interview.json

{"repo": "agniwen/ai-interview", "files": {"apps/ai-recruitment-copilot/.env.example": {"ee897c2801eb13b52f88fb7f57acbf1a0be32f6b": {"t": 1785746754.561277, "n": 6521, "h": "10c399f7ba75af61", "c": "# =====================================================================\n# Core database / app URLs\n# =====================================================================\n\n# Postgres connection string shared by Drizzle ORM and Better Auth.\nDATABASE_URL=\n\n# Redis connection string for queues/cache. For password-only Redis:\n# redis://:password@host:6379/0\nREDIS_URL=redis://:password@host:6379/0\n\n# Workflow target must be explicit; it does not fall back to DATABASE_URL.\nWORKFLOW_TARGET_WORLD=\n\n# Public application URLs. Keep BETTER_AUTH_URL and NEXT_PUBLIC_BASE_URL in sync.\nBETTER_AUTH_URL=\nNEXT_PUBLIC_BASE_URL=\nNEXT_PUBLIC_PUBLIC_URL=\n\n# Browser-side Better Auth API origin. Keep it explicit; no runtime fallback.\nNEXT_PUBLIC_BETTER_AUTH_URL=\n\n# Postgres.js pool and connection lifetime settings.\nPOSTGRES_POOL_MAX=\nPOSTGRES_CONNECT_TIMEOUT_SECONDS=10\nPOSTGRES_IDLE_TIMEOUT_SECONDS=60\nPOSTGRES_MAX_LIFETIME_SECONDS=1200\n\n# =====================================================================\n# Core secrets\n# =====================================================================\n\n# Generate a fresh production value, e.g. `openssl rand -base64 32`.\nBETTER_AUTH_SECRET=\n\n# Optional platform admin organization id.\nADMIN_ORGANIZATION_ID=\n\n# =====================================================================\n# Google OAuth / Google AI\n# =====================================================================\n\n# Google OAuth credentials from Google Cloud Console.\nGOOGLE_CLIENT_ID=\nGOOGLE_CLIENT_SECRET=\n\n# Explicit boolean string. Use true to show Google login and hide Feishu login.\nNEXT_PUBLIC_ENABLE_GOOGLE_LOGIN=false\n\n# AI interview candidate-specific question generation. Defaults to true when unset.\nNEXT_PUBLIC_ENABLE_CANDIDATE_SPECIFIC_INTERVIEW_QUESTIONS=true\n\n# Global user watermark overlay. Defaults to true when unset.\nNEXT_PUBLIC_ENABLE_WATERMARK=true\n\n# Google AI provider key, if enabled by the deployment.\nGOOGLE_GENERATIVE_AI_API_KEY=\n\n# =====================================================================\n# Alibaba DashScope / Qwen\n# =====================================================================\n\n# DashScope OpenAI-compatible endpoint and key.\nALIBABA_BASE_URL=https://dashscope.aliyuncs.com/compatible-mode/v1\nALIBABA_API_KEY=\n\n# Alibaba OpenAI-compatible model ids. Business code does not hard-code fallbacks.\nALIBABA_MODEL=deepseek-v4-pro\nALIBABA_FAST_MODEL=deepseek-v4-flash\nALIBABA_STRUCTURED_MODEL=deepseek-v4-pro\nALIBABA_VISION_MODEL=\n\n# Qwen-VL OCR endpoint and model id.\nQWEN_OCR_BASE_URL=https://dashscope.aliyuncs.com/compatible-mode/v1\nQWEN_OCR_MODEL=qwen-vl-ocr-latest\n\n# =====================================================================\n# Vercel AI Gateway\n# =====================================================================\n\n# Read implicitly by AI SDK gateway() for interview evaluation.\nAI_GATEWAY_API_KEY=\nINTERVIEW_EVALUATION_MODEL=google/gemini-2.5-flash\n\n# =====================================================================\n# Zhipu\n# =====================================================================\n\nZHIPU_API_KEY=\nZHIPU_MODEL=\n\n# =====================================================================\n# LiveKit / agent callback\n# =====================================================================\n\n# LiveKit Cloud project URL and credentials. LIVEKIT_URL is a wss:// endpoint.\nLIVEKIT_URL=\nLIVEKIT_API_KEY=\nLIVEKIT_API_SECRET=\n\n# Must match the agent_name registered by the Python worker.\nAGENT_NAME=giaogiao\nNEXT_PUBLIC_AGENT_NAME=giaogiao\n\n# Web service public base URL for agent callbacks.\nCALLBACK_BASE_URL=\n\n# Shared secret for agent -> web callbacks. Both sides must match.\nAGENT_CALLBACK_SECRET=\n\n# =====================================================================\n# ElevenLabs\n# =====================================================================\n\nELEVENLABS_API_KEY=\nELEVENLABS_AGENT_ID=\nELEVENLABS_WEBHOOK_SECRET=\n\n# =====================================================================\n# MiniMax\n# =====================================================================\n\nMINIMAX_TTS_BASE_URL=https://api.minimax.chat\nMINIMAX_API_KEY=\n\n# =====================================================================\n# Feishu\n# =====================================================================\n\n# Primary Feishu app credentials.\nFEISHU_APP_ID=\nFEISHU_APP_SECRET=\n\n# Optional secondary Feishu app credentials.\nFEISHU_APP_ID2=\nFEISHU_APP_SECRET2=\n\n# Set true only in the long-running backend process that should maintain\n# official Chat SDK Lark/Feishu websocket bot connections.\nFEISHU_BOT_ENABLED=false\n\n# =====================================================================\n# S3-compatible storage\n# =====================================================================\n\n# Leave S3_ENDPOINT blank for AWS S3; set it for S3-compatible providers.\nS3_ENDPOINT=\nS3_BUCKET_NAME=\nS3_REGION=\nS3_ACCESS_KEY_ID=\nS3_SECRET_ACCESS_KEY=\nS3_KEY_PREFIX=uploads\nS3_FORCE_PATH_STYLE=false\n\n# =====================================================================\n# Recording R2 storage\n# =====================================================================\n\n# Endpoint format: https://<account_id>.r2.cloudflarestorage.com\nRECORDING_R2_ENDPOINT=\nRECORDING_R2_BUCKET_NAME=\nRECORDING_R2_REGION=auto\nRECORDING_R2_ACCESS_KEY_ID=\nRECORDING_R2_SECRET_ACCESS_KEY=\nRECORDING_R2_KEY_PREFIX=recordings\nRECORDING_R2_FORCE_PATH_STYLE=true\n\n# AI interview recording feature flag. Defaults to true when unset.\nNEXT_PUBLIC_ENABLE_INTERVIEW_RECORDING=true\n\n# =====================================================================\n# Resume parse queue\n# =====================================================================\n\nRESUME_PARSE_QUEUE_ATTEMPTS=3\nRESUME_PARSE_QUEUE_BACKOFF_MS=30000\nRESUME_PARSE_STALE_PROCESSING_SECONDS=900\nRESUME_PARSE_OCR_PAGE_CONCURRENCY=1\nRESUME_PARSE_OCR_ATTEMPTS=3\nRESUME_PARSE_OCR_RETRY_DELAY_MS=1000\nRESUME_PARSE_DISABLE_CACHE=false\n\n# =====================================================================\n# Resend email\n# =====================================================================\n\n# Use a bare email address. The display name is built dynamically at runtime.\nRESEND_API_KEY=\nRESEND_FROM=noreply@yourdomain.com\n\n# =====================================================================\n# PostHog\n# =====================================================================\n\nNEXT_PUBLIC_ENABLE_POSTHOG=\nNEXT_PUBLIC_POSTHOG_HOST=\nNEXT_PUBLIC_POSTHOG_PROJECT_TOKEN=\nPOSTHOG_API_HOST=\nPOSTHOG_PERSONAL_API_KEY=\nPOSTHOG_PROJECT_ID=\n"}, "7c61aa818c1ce6d4ebe1efd181944c801ffd235c": {"t": 1785767480.1197052, "n": 6521, "h": "10c399f7ba75af61", "c": "# =====================================================================\n# Core database / app URLs\n# =====================================================================\n\n# Postgres connection string shared by Drizzle ORM and Better Auth.\nDATABASE_URL=\n\n# Redis connection string for queues/cache. For password-only Redis:\n# redis://:password@host:6379/0\nREDIS_URL=redis://:password@host:6379/0\n\n# Workflow target must be explicit; it does not fall back to DATABASE_URL.\nWORKFLOW_TARGET_WORLD=\n\n# Public application URLs. Keep BETTER_AUTH_URL and NEXT_PUBLIC_BASE_URL in sync.\nBETTER_AUTH_URL=\nNEXT_PUBLIC_BASE_URL=\nNEXT_PUBLIC_PUBLIC_URL=\n\n# Browser-side Better Auth API origin. Keep it explicit; no runtime fallback.\nNEXT_PUBLIC_BETTER_AUTH_URL=\n\n# Postgres.js pool and connection lifetime settings.\nPOSTGRES_POOL_MAX=\nPOSTGRES_CONNECT_TIMEOUT_SECONDS=10\nPOSTGRES_IDLE_TIMEOUT_SECONDS=60\nPOSTGRES_MAX_LIFETIME_SECONDS=1200\n\n# =====================================================================\n# Core secrets\n# =====================================================================\n\n# Generate a fresh production value, e.g. `openssl rand -base64 32`.\nBETTER_AUTH_SECRET=\n\n# Optional platform admin organization id.\nADMIN_ORGANIZATION_ID=\n\n# =====================================================================\n# Google OAuth / Google AI\n# =====================================================================\n\n# Google OAuth credentials from Google Cloud Console.\nGOOGLE_CLIENT_ID=\nGOOGLE_CLIENT_SECRET=\n\n# Explicit boolean string. Use true to show Google login and hide Feishu login.\nNEXT_PUBLIC_ENABLE_GOOGLE_LOGIN=false\n\n# AI interview candidate-specific question generation. Defaults to true when unset.\nNEXT_PUBLIC_ENABLE_CANDIDATE_SPECIFIC_INTERVIEW_QUESTIONS=true\n\n# Global user watermark overlay. Defaults to true when unset.\nNEXT_PUBLIC_ENABLE_WATERMARK=true\n\n# Google AI provider key, if enabled by the deployment.\nGOOGLE_GENERATIVE_AI_API_KEY=\n\n# =====================================================================\n# Alibaba DashScope / Qwen\n# =====================================================================\n\n# DashScope OpenAI-compatible endpoint and key.\nALIBABA_BASE_URL=https://dashscope.aliyuncs.com/compatible-mode/v1\nALIBABA_API_KEY=\n\n# Alibaba OpenAI-compatible model ids. Business code does not hard-code fallbacks.\nALIBABA_MODEL=deepseek-v4-pro\nALIBABA_FAST_MODEL=deepseek-v4-flash\nALIBABA_STRUCTURED_MODEL=deepseek-v4-pro\nALIBABA_VISION_MODEL=\n\n# Qwen-VL OCR endpoint and model id.\nQWEN_OCR_BASE_URL=https://dashscope.aliyuncs.com/compatible-mode/v1\nQWEN_OCR_MODEL=qwen-vl-ocr-latest\n\n# =====================================================================\n# Vercel AI Gateway\n# =====================================================================\n\n# Read implicitly by AI SDK gateway() for interview evaluation.\nAI_GATEWAY_API_KEY=\nINTERVIEW_EVALUATION_MODEL=google/gemini-2.5-flash\n\n# =====================================================================\n# Zhipu\n# =====================================================================\n\nZHIPU_API_KEY=\nZHIPU_MODEL=\n\n# =====================================================================\n# LiveKit / agent callback\n# =====================================================================\n\n# LiveKit Cloud project URL and credentials. LIVEKIT_URL is a wss:// endpoint.\nLIVEKIT_URL=\nLIVEKIT_API_KEY=\nLIVEKIT_API_SECRET=\n\n# Must match the agent_name registered by the Python worker.\nAGENT_NAME=giaogiao\nNEXT_PUBLIC_AGENT_NAME=giaogiao\n\n# Web service public base URL for agent callbacks.\nCALLBACK_BASE_URL=\n\n# Shared secret for agent -> web callbacks. Both sides must match.\nAGENT_CALLBACK_SECRET=\n\n# =====================================================================\n# ElevenLabs\n# =====================================================================\n\nELEVENLABS_API_KEY=\nELEVENLABS_AGENT_ID=\nELEVENLABS_WEBHOOK_SECRET=\n\n# =====================================================================\n# MiniMax\n# =====================================================================\n\nMINIMAX_TTS_BASE_URL=https://api.minimax.chat\nMINIMAX_API_KEY=\n\n# =====================================================================\n# Feishu\n# =====================================================================\n\n# Primary Feishu app credentials.\nFEISHU_APP_ID=\nFEISHU_APP_SECRET=\n\n# Optional secondary Feishu app credentials.\nFEISHU_APP_ID2=\nFEISHU_APP_SECRET2=\n\n# Set true only in the long-running backend process that should maintain\n# official Chat SDK Lark/Feishu websocket bot connections.\nFEISHU_BOT_ENABLED=false\n\n# =====================================================================\n# S3-compatible storage\n# =====================================================================\n\n# Leave S3_ENDPOINT blank for AWS S3; set it for S3-compatible providers.\nS3_ENDPOINT=\nS3_BUCKET_NAME=\nS3_REGION=\nS3_ACCESS_KEY_ID=\nS3_SECRET_ACCESS_KEY=\nS3_KEY_PREFIX=uploads\nS3_FORCE_PATH_STYLE=false\n\n# =====================================================================\n# Recording R2 storage\n# =====================================================================\n\n# Endpoint format: https://<account_id>.r2.cloudflarestorage.com\nRECORDING_R2_ENDPOINT=\nRECORDING_R2_BUCKET_NAME=\nRECORDING_R2_REGION=auto\nRECORDING_R2_ACCESS_KEY_ID=\nRECORDING_R2_SECRET_ACCESS_KEY=\nRECORDING_R2_KEY_PREFIX=recordings\nRECORDING_R2_FORCE_PATH_STYLE=true\n\n# AI interview recording feature flag. Defaults to true when unset.\nNEXT_PUBLIC_ENABLE_INTERVIEW_RECORDING=true\n\n# =====================================================================\n# Resume parse queue\n# =====================================================================\n\nRESUME_PARSE_QUEUE_ATTEMPTS=3\nRESUME_PARSE_QUEUE_BACKOFF_MS=30000\nRESUME_PARSE_STALE_PROCESSING_SECONDS=900\nRESUME_PARSE_OCR_PAGE_CONCURRENCY=1\nRESUME_PARSE_OCR_ATTEMPTS=3\nRESUME_PARSE_OCR_RETRY_DELAY_MS=1000\nRESUME_PARSE_DISABLE_CACHE=false\n\n# =====================================================================\n# Resend email\n# =====================================================================\n\n# Use a bare email address. The display name is built dynamically at runtime.\nRESEND_API_KEY=\nRESEND_FROM=noreply@yourdomain.com\n\n# =====================================================================\n# PostHog\n# =====================================================================\n\nNEXT_PUBLIC_ENABLE_POSTHOG=\nNEXT_PUBLIC_POSTHOG_HOST=\nNEXT_PUBLIC_POSTHOG_PROJECT_TOKEN=\nPOSTHOG_API_HOST=\nPOSTHOG_PERSONAL_API_KEY=\nPOSTHOG_PROJECT_ID=\n"}, "fd7dc7b69ed56464376a3d551ab0080396d55b1d": {"t": 1785767481.4395723, "n": 6505, "h": "0399dd0631e9bc16", "c": "# =====================================================================\n# Core database / app URLs\n# =====================================================================\n\n# Postgres connection string shared by Drizzle ORM and Better Auth.\nDATABASE_URL=\n\n# Redis connection string for queues/cache. For password-only Redis:\n# redis://:password@host:6379/0\nREDIS_URL=redis://:password@host:6379/0\n\n# Workflow target must be explicit; it does not fall back to DATABASE_URL.\nWORKFLOW_TARGET_WORLD=\n\n# Public application URLs. Keep BETTER_AUTH_URL and NEXT_PUBLIC_BASE_URL in sync.\nBETTER_AUTH_URL=\nNEXT_PUBLIC_BASE_URL=\nNEXT_PUBLIC_PUBLIC_URL=\n\n# Browser-side Better Auth API origin. Keep it explicit; no runtime fallback.\nNEXT_PUBLIC_BETTER_AUTH_URL=\n\n# Postgres.js pool and connection lifetime settings.\nPOSTGRES_POOL_MAX=\nPOSTGRES_CONNECT_TIMEOUT_SECONDS=10\nPOSTGRES_IDLE_TIMEOUT_SECONDS=60\nPOSTGRES_MAX_LIFETIME_SECONDS=1200\n\n# =====================================================================\n# Core secrets\n# =====================================================================\n\n# Generate a fresh production value, e.g. `openssl rand -base64 32`.\nBETTER_AUTH_SECRET=\n\n# Optional platform admin organization id.\nADMIN_ORGANIZATION_ID=\n\n# =====================================================================\n# Google OAuth / Google AI\n# =====================================================================\n\n# Google OAuth credentials from Google Cloud Console.\nGOOGLE_CLIENT_ID=\nGOOGLE_CLIENT_SECRET=\n\n# Explicit boolean string. Use true to show Google login and hide Feishu login.\nNEXT_PUBLIC_ENABLE_GOOGLE_LOGIN=false\n\n# AI interview candidate-specific question generation. Defaults to true when unset.\nNEXT_PUBLIC_ENABLE_CANDIDATE_SPECIFIC_INTERVIEW_QUESTIONS=true\n\n# Global user watermark overlay. Defaults to true when unset.\nNEXT_PUBLIC_ENABLE_WATERMARK=true\n\n# Google AI provider key, if enabled by the deployment.\nGOOGLE_GENERATIVE_AI_API_KEY=\n\n# =====================================================================\n# Alibaba DashScope / Qwen\n# =====================================================================\n\n# DashScope OpenAI-compatible endpoint and key.\nALIBABA_BASE_URL=https://dashscope.aliyuncs.com/compatible-mode/v1\nALIBABA_API_KEY=\n\n# Alibaba OpenAI-compatible model ids. Business code does not hard-code fallbacks.\nALIBABA_MODEL=deepseek-v4-pro\nALIBABA_FAST_MODEL=deepseek-v4-flash\nALIBABA_STRUCTURED_MODEL=deepseek-v4-pro\nALIBABA_VISION_MODEL=\n\n# Qwen-VL OCR endpoint and model id.\nQWEN_OCR_BASE_URL=https://dashscope.aliyuncs.com/compatible-mode/v1\nQWEN_OCR_MODEL=qwen-vl-ocr-latest\n\n# =====================================================================\n# Vercel AI Gateway\n# =====================================================================\n\n# Read implicitly by AI SDK gateway() for interview evaluation.\nAI_GATEWAY_API_KEY=\nINTERVIEW_EVALUATION_MODEL=google/gemini-2.5-flash\n\n# =====================================================================\n# Zhipu\n# =====================================================================\n\nZHIPU_API_KEY=\nZHIPU_MODEL=\n\n# =====================================================================\n# LiveKit / agent callback\n# =====================================================================\n\n# LiveKit Cloud project URL and credentials. LIVEKIT_URL is a wss:// endpoint.\nLIVEKIT_URL=\nLIVEKIT_API_KEY=\nLIVEKIT_API_SECRET=\n\n# Must match the agent_name registered by the Python worker.\nAGENT_NAME=\nNEXT_PUBLIC_AGENT_NAME=\n\n# Web service public base URL for agent callbacks.\nCALLBACK_BASE_URL=\n\n# Shared secret for agent -> web callbacks. Both sides must match.\nAGENT_CALLBACK_SECRET=\n\n# =====================================================================\n# ElevenLabs\n# =====================================================================\n\nELEVENLABS_API_KEY=\nELEVENLABS_AGENT_ID=\nELEVENLABS_WEBHOOK_SECRET=\n\n# =====================================================================\n# MiniMax\n# =====================================================================\n\nMINIMAX_TTS_BASE_URL=https://api.minimax.chat\nMINIMAX_API_KEY=\n\n# =====================================================================\n# Feishu\n# =====================================================================\n\n# Primary Feishu app credentials.\nFEISHU_APP_ID=\nFEISHU_APP_SECRET=\n\n# Optional secondary Feishu app credentials.\nFEISHU_APP_ID2=\nFEISHU_APP_SECRET2=\n\n# Set true only in the long-running backend process that should maintain\n# official Chat SDK Lark/Feishu websocket bot connections.\nFEISHU_BOT_ENABLED=false\n\n# =====================================================================\n# S3-compatible storage\n# =====================================================================\n\n# Leave S3_ENDPOINT blank for AWS S3; set it for S3-compatible providers.\nS3_ENDPOINT=\nS3_BUCKET_NAME=\nS3_REGION=\nS3_ACCESS_KEY_ID=\nS3_SECRET_ACCESS_KEY=\nS3_KEY_PREFIX=uploads\nS3_FORCE_PATH_STYLE=false\n\n# =====================================================================\n# Recording R2 storage\n# =====================================================================\n\n# Endpoint format: https://<account_id>.r2.cloudflarestorage.com\nRECORDING_R2_ENDPOINT=\nRECORDING_R2_BUCKET_NAME=\nRECORDING_R2_REGION=auto\nRECORDING_R2_ACCESS_KEY_ID=\nRECORDING_R2_SECRET_ACCESS_KEY=\nRECORDING_R2_KEY_PREFIX=recordings\nRECORDING_R2_FORCE_PATH_STYLE=true\n\n# AI interview recording feature flag. Defaults to true when unset.\nNEXT_PUBLIC_ENABLE_INTERVIEW_RECORDING=true\n\n# =====================================================================\n# Resume parse queue\n# =====================================================================\n\nRESUME_PARSE_QUEUE_ATTEMPTS=3\nRESUME_PARSE_QUEUE_BACKOFF_MS=30000\nRESUME_PARSE_STALE_PROCESSING_SECONDS=900\nRESUME_PARSE_OCR_PAGE_CONCURRENCY=1\nRESUME_PARSE_OCR_ATTEMPTS=3\nRESUME_PARSE_OCR_RETRY_DELAY_MS=1000\nRESUME_PARSE_DISABLE_CACHE=false\n\n# =====================================================================\n# Resend email\n# =====================================================================\n\n# Use a bare email address. The display name is built dynamically at runtime.\nRESEND_API_KEY=\nRESEND_FROM=noreply@yourdomain.com\n\n# =====================================================================\n# PostHog\n# =====================================================================\n\nNEXT_PUBLIC_ENABLE_POSTHOG=\nNEXT_PUBLIC_POSTHOG_HOST=\nNEXT_PUBLIC_POSTHOG_PROJECT_TOKEN=\nPOSTHOG_API_HOST=\nPOSTHOG_PERSONAL_API_KEY=\nPOSTHOG_PROJECT_ID=\n"}, "780989f52d6e824c3a5b878617e234422db4f803": {"t": 1785767482.7530951, "n": 6452, "h": "ab0b2229c08063b4", "c": "# =====================================================================\n# Core database / app URLs\n# =====================================================================\n\n# Postgres connection string shared by Drizzle ORM and Better Auth.\nDATABASE_URL=\n\n# Redis connection string for queues/cache. For password-only Redis:\n# redis://:password@host:6379/0\nREDIS_URL=redis://:password@host:6379/0\n\n# Workflow target must be explicit; it does not fall back to DATABASE_URL.\nWORKFLOW_TARGET_WORLD=\n\n# Public application URLs. Keep BETTER_AUTH_URL and NEXT_PUBLIC_BASE_URL in sync.\nBETTER_AUTH_URL=\nNEXT_PUBLIC_BASE_URL=\nNEXT_PUBLIC_PUBLIC_URL=\n\n# Browser-side Better Auth API origin. Keep it explicit; no runtime fallback.\nNEXT_PUBLIC_BETTER_AUTH_URL=\n\n# Postgres.js pool and connection lifetime settings.\nPOSTGRES_POOL_MAX=\nPOSTGRES_CONNECT_TIMEOUT_SECONDS=10\nPOSTGRES_IDLE_TIMEOUT_SECONDS=60\nPOSTGRES_MAX_LIFETIME_SECONDS=1200\n\n# =====================================================================\n# Core secrets\n# =====================================================================\n\n# Generate a fresh production value, e.g. `openssl rand -base64 32`.\nBETTER_AUTH_SECRET=\n\n# Optional platform admin organization id.\nADMIN_ORGANIZATION_ID=\n\n# =====================================================================\n# Google OAuth / Google AI\n# =====================================================================\n\n# Google OAuth credentials from Google Cloud Console.\nGOOGLE_CLIENT_ID=\nGOOGLE_CLIENT_SECRET=\n\n# Explicit boolean string. Use true to show Google login and hide Feishu login.\nNEXT_PUBLIC_ENABLE_GOOGLE_LOGIN=false\n\n# AI interview candidate-specific question generation. Defaults to true when unset.\nNEXT_PUBLIC_ENABLE_CANDIDATE_SPECIFIC_INTERVIEW_QUESTIONS=true\n\n# Global user watermark overlay. Defaults to true when unset.\nNEXT_PUBLIC_ENABLE_WATERMARK=true\n\n# Google AI provider key, if enabled by the deployment.\nGOOGLE_GENERATIVE_AI_API_KEY=\n\n# =====================================================================\n# Alibaba DashScope / Qwen\n# =====================================================================\n\n# DashScope OpenAI-compatible endpoint and key.\nALIBABA_BASE_URL=https://dashscope.aliyuncs.com/compatible-mode/v1\nALIBABA_API_KEY=\n\n# Alibaba OpenAI-compatible model ids. Business code does not hard-code fallbacks.\nALIBABA_MODEL=deepseek-v4-pro\nALIBABA_FAST_MODEL=deepseek-v4-flash\nALIBABA_STRUCTURED_MODEL=deepseek-v4-pro\nALIBABA_VISION_MODEL=\n\n# Qwen-VL OCR endpoint and model id.\nQWEN_OCR_BASE_URL=https://dashscope.aliyuncs.com/compatible-mode/v1\nQWEN_OCR_MODEL=qwen-vl-ocr-latest\n\n# =====================================================================\n# Vercel AI Gateway\n# =====================================================================\n\n# Read implicitly by AI SDK gateway() for interview evaluation.\nAI_GATEWAY_API_KEY=\nINTERVIEW_EVALUATION_MODEL=google/gemini-2.5-flash\n\n# =====================================================================\n# Zhipu\n# =====================================================================\n\nZHIPU_API_KEY=\nZHIPU_MODEL=\n\n# =====================================================================\n# LiveKit / agent callback\n# =====================================================================\n\n# LiveKit Cloud project URL and credentials. LIVEKIT_URL is a wss:// endpoint.\nLIVEKIT_URL=\nLIVEKIT_API_KEY=\nLIVEKIT_API_SECRET=\n\n# Must match the agent_name registered by the Python worker.\nAGENT_NAME=\nNEXT_PUBLIC_AGENT_NAME=\n\n# Web service public base URL for agent callbacks.\nCALLBACK_BASE_URL=\n\n# Shared secret for agent -> web callbacks. Both sides must match.\nAGENT_CALLBACK_SECRET=\n\n# =====================================================================\n# ElevenLabs\n# =====================================================================\n\nELEVENLABS_API_KEY=\nELEVENLABS_AGENT_ID=\nELEVENLABS_WEBHOOK_SECRET=\n\n# =====================================================================\n# MiniMax\n# =====================================================================\n\nMINIMAX_TTS_BASE_URL=https://api.minimax.chat\nMINIMAX_API_KEY=\n\n# =====================================================================\n# Feishu\n# =====================================================================\n\n# Primary Feishu app credentials.\nFEISHU_APP_ID=\nFEISHU_APP_SECRET=\n\n# Optional secondary Feishu app credentials.\nFEISHU_APP_ID2=\nFEISHU_APP_SECRET2=\n\n# Feishu event subscription encryption and verification.\nFEISHU_ENCRYPT_KEY=\nFEISHU_VERIFICATION_TOKEN=\n\n# =====================================================================\n# S3-compatible storage\n# =====================================================================\n\n# Leave S3_ENDPOINT blank for AWS S3; set it for S3-compatible providers.\nS3_ENDPOINT=\nS3_BUCKET_NAME=\nS3_REGION=\nS3_ACCESS_KEY_ID=\nS3_SECRET_ACCESS_KEY=\nS3_KEY_PREFIX=uploads\nS3_FORCE_PATH_STYLE=false\n\n# =====================================================================\n# Recording R2 storage\n# =====================================================================\n\n# Endpoint format: https://<account_id>.r2.cloudflarestorage.com\nRECORDING_R2_ENDPOINT=\nRECORDING_R2_BUCKET_NAME=\nRECORDING_R2_REGION=auto\nRECORDING_R2_ACCESS_KEY_ID=\nRECORDING_R2_SECRET_ACCESS_KEY=\nRECORDING_R2_KEY_PREFIX=recordings\nRECORDING_R2_FORCE_PATH_STYLE=true\n\n# AI interview recording feature flag. Defaults to true when unset.\nNEXT_PUBLIC_ENABLE_INTERVIEW_RECORDING=true\n\n# =====================================================================\n# Resume parse queue\n# =====================================================================\n\nRESUME_PARSE_QUEUE_ATTEMPTS=3\nRESUME_PARSE_QUEUE_BACKOFF_MS=30000\nRESUME_PARSE_STALE_PROCESSING_SECONDS=900\nRESUME_PARSE_OCR_PAGE_CONCURRENCY=1\nRESUME_PARSE_OCR_ATTEMPTS=3\nRESUME_PARSE_OCR_RETRY_DELAY_MS=1000\nRESUME_PARSE_DISABLE_CACHE=false\n\n# =====================================================================\n# Resend email\n# =====================================================================\n\n# Use a bare email address. The display name is built dynamically at runtime.\nRESEND_API_KEY=\nRESEND_FROM=noreply@yourdomain.com\n\n# =====================================================================\n# PostHog\n# =====================================================================\n\nNEXT_PUBLIC_ENABLE_POSTHOG=\nNEXT_PUBLIC_POSTHOG_HOST=\nNEXT_PUBLIC_POSTHOG_PROJECT_TOKEN=\nPOSTHOG_API_HOST=\nPOSTHOG_PERSONAL_API_KEY=\nPOSTHOG_PROJECT_ID=\n"}, "4ad5321f74cd9ccf8ff43896f3569ad995073672": {"t": 1785767483.9936616, "n": 6355, "h": "9c92f03bc6a2b95d", "c": "# =====================================================================\n# Core database / app URLs\n# =====================================================================\n\n# Postgres connection string shared by Drizzle ORM and Better Auth.\nDATABASE_URL=\n\n# Redis connection string for queues/cache. For password-only Redis:\n# redis://:password@host:6379/0\nREDIS_URL=redis://:password@host:6379/0\n\n# Workflow target must be explicit; it does not fall back to DATABASE_URL.\nWORKFLOW_TARGET_WORLD=\n\n# Public application URLs. Keep BETTER_AUTH_URL and NEXT_PUBLIC_BASE_URL in sync.\nBETTER_AUTH_URL=\nNEXT_PUBLIC_BASE_URL=\nNEXT_PUBLIC_PUBLIC_URL=\n\n# Browser-side Better Auth API origin. Keep it explicit; no runtime fallback.\nNEXT_PUBLIC_BETTER_AUTH_URL=\n\n# Postgres.js pool and connection lifetime settings.\nPOSTGRES_POOL_MAX=\nPOSTGRES_CONNECT_TIMEOUT_SECONDS=10\nPOSTGRES_IDLE_TIMEOUT_SECONDS=60\nPOSTGRES_MAX_LIFETIME_SECONDS=1200\n\n# =====================================================================\n# Core secrets\n# =====================================================================\n\n# Generate a fresh production value, e.g. `openssl rand -base64 32`.\nBETTER_AUTH_SECRET=\n\n# Optional platform admin organization id.\nADMIN_ORGANIZATION_ID=\n\n# =====================================================================\n# Google OAuth / Google AI\n# =====================================================================\n\n# Google OAuth credentials from Google Cloud Console.\nGOOGLE_CLIENT_ID=\nGOOGLE_CLIENT_SECRET=\n\n# Explicit boolean string. Use true to show Google login and hide Feishu login.\nNEXT_PUBLIC_ENABLE_GOOGLE_LOGIN=false\n\n# AI interview candidate-specific question generation. Defaults to true when unset.\nNEXT_PUBLIC_ENABLE_CANDIDATE_SPECIFIC_INTERVIEW_QUESTIONS=true\n\n# Google AI provider key, if enabled by the deployment.\nGOOGLE_GENERATIVE_AI_API_KEY=\n\n# =====================================================================\n# Alibaba DashScope / Qwen\n# =====================================================================\n\n# DashScope OpenAI-compatible endpoint and key.\nALIBABA_BASE_URL=https://dashscope.aliyuncs.com/compatible-mode/v1\nALIBABA_API_KEY=\n\n# Alibaba OpenAI-compatible model ids. Business code does not hard-code fallbacks.\nALIBABA_MODEL=deepseek-v4-pro\nALIBABA_FAST_MODEL=deepseek-v4-flash\nALIBABA_STRUCTURED_MODEL=deepseek-v4-pro\nALIBABA_VISION_MODEL=\n\n# Qwen-VL OCR endpoint and model id.\nQWEN_OCR_BASE_URL=https://dashscope.aliyuncs.com/compatible-mode/v1\nQWEN_OCR_MODEL=qwen-vl-ocr-latest\n\n# =====================================================================\n# Vercel AI Gateway\n# =====================================================================\n\n# Read implicitly by AI SDK gateway() for interview evaluation.\nAI_GATEWAY_API_KEY=\nINTERVIEW_EVALUATION_MODEL=google/gemini-2.5-flash\n\n# =====================================================================\n# Zhipu\n# =====================================================================\n\nZHIPU_API_KEY=\nZHIPU_MODEL=\n\n# =====================================================================\n# LiveKit / agent callback\n# =====================================================================\n\n# LiveKit Cloud project URL and credentials. LIVEKIT_URL is a wss:// endpoint.\nLIVEKIT_URL=\nLIVEKIT_API_KEY=\nLIVEKIT_API_SECRET=\n\n# Must match the agent_name registered by the Python worker.\nAGENT_NAME=\nNEXT_PUBLIC_AGENT_NAME=\n\n# Web service public base URL for agent callbacks.\nCALLBACK_BASE_URL=\n\n# Shared secret for agent -> web callbacks. Both sides must match.\nAGENT_CALLBACK_SECRET=\n\n# =====================================================================\n# ElevenLabs\n# =====================================================================\n\nELEVENLABS_API_KEY=\nELEVENLABS_AGENT_ID=\nELEVENLABS_WEBHOOK_SECRET=\n\n# =====================================================================\n# MiniMax\n# =====================================================================\n\nMINIMAX_TTS_BASE_URL=https://api.minimax.chat\nMINIMAX_API_KEY=\n\n# =====================================================================\n# Feishu\n# =====================================================================\n\n# Primary Feishu app credentials.\nFEISHU_APP_ID=\nFEISHU_APP_SECRET=\n\n# Optional secondary Feishu app credentials.\nFEISHU_APP_ID2=\nFEISHU_APP_SECRET2=\n\n# Feishu event subscription encryption and verification.\nFEISHU_ENCRYPT_KEY=\nFEISHU_VERIFICATION_TOKEN=\n\n# =====================================================================\n# S3-compatible storage\n# =====================================================================\n\n# Leave S3_ENDPOINT blank for AWS S3; set it for S3-compatible providers.\nS3_ENDPOINT=\nS3_BUCKET_NAME=\nS3_REGION=\nS3_ACCESS_KEY_ID=\nS3_SECRET_ACCESS_KEY=\nS3_KEY_PREFIX=uploads\nS3_FORCE_PATH_STYLE=false\n\n# =====================================================================\n# Recording R2 storage\n# =====================================================================\n\n# Endpoint format: https://<account_id>.r2.cloudflarestorage.com\nRECORDING_R2_ENDPOINT=\nRECORDING_R2_BUCKET_NAME=\nRECORDING_R2_REGION=auto\nRECORDING_R2_ACCESS_KEY_ID=\nRECORDING_R2_SECRET_ACCESS_KEY=\nRECORDING_R2_KEY_PREFIX=recordings\nRECORDING_R2_FORCE_PATH_STYLE=true\n\n# AI interview recording feature flag. Defaults to true when unset.\nNEXT_PUBLIC_ENABLE_INTERVIEW_RECORDING=true\n\n# =====================================================================\n# Resume parse queue\n# =====================================================================\n\nRESUME_PARSE_QUEUE_ATTEMPTS=3\nRESUME_PARSE_QUEUE_BACKOFF_MS=30000\nRESUME_PARSE_STALE_PROCESSING_SECONDS=900\nRESUME_PARSE_OCR_PAGE_CONCURRENCY=1\nRESUME_PARSE_OCR_ATTEMPTS=3\nRESUME_PARSE_OCR_RETRY_DELAY_MS=1000\nRESUME_PARSE_DISABLE_CACHE=false\n\n# =====================================================================\n# Resend email\n# =====================================================================\n\n# Use a bare email address. The display name is built dynamically at runtime.\nRESEND_API_KEY=\nRESEND_FROM=noreply@yourdomain.com\n\n# =====================================================================\n# PostHog\n# =====================================================================\n\nNEXT_PUBLIC_ENABLE_POSTHOG=\nNEXT_PUBLIC_POSTHOG_HOST=\nNEXT_PUBLIC_POSTHOG_PROJECT_TOKEN=\nPOSTHOG_API_HOST=\nPOSTHOG_PERSONAL_API_KEY=\nPOSTHOG_PROJECT_ID=\n"}, "ad2e011ae6474d76f4da76dbe92bc9c98411144c": {"t": 1785767485.2394652, "n": 6094, "h": "c7471f0b8dea5489", "c": "# =====================================================================\n# Core database / app URLs\n# =====================================================================\n\n# Postgres connection string shared by Drizzle ORM and Better Auth.\nDATABASE_URL=\n\n# Redis connection string for queues/cache. For password-only Redis:\n# redis://:password@host:6379/0\nREDIS_URL=redis://:password@host:6379/0\n\n# Workflow target must be explicit; it does not fall back to DATABASE_URL.\nWORKFLOW_TARGET_WORLD=\n\n# Public application URLs. Keep BETTER_AUTH_URL and NEXT_PUBLIC_BASE_URL in sync.\nBETTER_AUTH_URL=\nNEXT_PUBLIC_BASE_URL=\nNEXT_PUBLIC_PUBLIC_URL=\n\n# Browser-side Better Auth API origin. Keep it explicit; no runtime fallback.\nNEXT_PUBLIC_BETTER_AUTH_URL=\n\n# Postgres.js pool and connection lifetime settings.\nPOSTGRES_POOL_MAX=\nPOSTGRES_CONNECT_TIMEOUT_SECONDS=10\nPOSTGRES_IDLE_TIMEOUT_SECONDS=60\nPOSTGRES_MAX_LIFETIME_SECONDS=1200\n\n# =====================================================================\n# Core secrets\n# =====================================================================\n\n# Generate a fresh production value, e.g. `openssl rand -base64 32`.\nBETTER_AUTH_SECRET=\n\n# Optional platform admin organization id.\nADMIN_ORGANIZATION_ID=\n\n# =====================================================================\n# Google OAuth / Google AI\n# =====================================================================\n\n# Google OAuth credentials from Google Cloud Console.\nGOOGLE_CLIENT_ID=\nGOOGLE_CLIENT_SECRET=\n\n# Explicit boolean string. Use true to show Google login and hide Feishu login.\nNEXT_PUBLIC_ENABLE_GOOGLE_LOGIN=false\n\n# Google AI provider key, if enabled by the deployment.\nGOOGLE_GENERATIVE_AI_API_KEY=\n\n# =====================================================================\n# Alibaba DashScope / Qwen\n# =====================================================================\n\n# DashScope OpenAI-compatible endpoint and key.\nALIBABA_BASE_URL=https://dashscope.aliyuncs.com/compatible-mode/v1\nALIBABA_API_KEY=\n\n# Alibaba OpenAI-compatible model ids. Business code does not hard-code fallbacks.\nALIBABA_MODEL=deepseek-v4-pro\nALIBABA_FAST_MODEL=deepseek-v4-flash\nALIBABA_STRUCTURED_MODEL=deepseek-v4-pro\nALIBABA_VISION_MODEL=\n\n# Qwen-VL OCR endpoint and model id.\nQWEN_OCR_BASE_URL=https://dashscope.aliyuncs.com/compatible-mode/v1\nQWEN_OCR_MODEL=qwen-vl-ocr-latest\n\n# =====================================================================\n# Vercel AI Gateway\n# =====================================================================\n\n# Read implicitly by AI SDK gateway() for interview evaluation.\nAI_GATEWAY_API_KEY=\nINTERVIEW_EVALUATION_MODEL=google/gemini-2.5-flash\n\n# =====================================================================\n# Zhipu\n# =====================================================================\n\nZHIPU_API_KEY=\nZHIPU_MODEL=\n\n# =====================================================================\n# LiveKit / agent callback\n# =====================================================================\n\n# LiveKit Cloud project URL and credentials. LIVEKIT_URL is a wss:// endpoint.\nLIVEKIT_URL=\nLIVEKIT_API_KEY=\nLIVEKIT_API_SECRET=\n\n# Must match the agent_name registered by the Python worker.\nAGENT_NAME=\nNEXT_PUBLIC_AGENT_NAME=\n\n# Web service public base URL for agent callbacks.\nCALLBACK_BASE_URL=\n\n# Shared secret for agent -> web callbacks. Both sides must match.\nAGENT_CALLBACK_SECRET=\n\n# =====================================================================\n# ElevenLabs\n# =====================================================================\n\nELEVENLABS_API_KEY=\nELEVENLABS_AGENT_ID=\nELEVENLABS_WEBHOOK_SECRET=\n\n# =====================================================================\n# MiniMax\n# =====================================================================\n\nMINIMAX_TTS_BASE_URL=https://api.minimax.chat\nMINIMAX_API_KEY=\n\n# =====================================================================\n# Feishu\n# =====================================================================\n\n# Primary Feishu app credentials.\nFEISHU_APP_ID=\nFEISHU_APP_SECRET=\n\n# Optional secondary Feishu app credentials.\nFEISHU_APP_ID2=\nFEISHU_APP_SECRET2=\n\n# Feishu event subscription encryption and verification.\nFEISHU_ENCRYPT_KEY=\nFEISHU_VERIFICATION_TOKEN=\n\n# =====================================================================\n# S3-compatible storage\n# =====================================================================\n\n# Leave S3_ENDPOINT blank for AWS S3; set it for S3-compatible providers.\nS3_ENDPOINT=\nS3_BUCKET_NAME=\nS3_REGION=\nS3_ACCESS_KEY_ID=\nS3_SECRET_ACCESS_KEY=\nS3_KEY_PREFIX=uploads\nS3_FORCE_PATH_STYLE=false\n\n# =====================================================================\n# Recording R2 storage\n# =====================================================================\n\n# Endpoint format: https://<account_id>.r2.cloudflarestorage.com\nRECORDING_R2_ENDPOINT=\nRECORDING_R2_BUCKET_NAME=\nRECORDING_R2_REGION=auto\nRECORDING_R2_ACCESS_KEY_ID=\nRECORDING_R2_SECRET_ACCESS_KEY=\nRECORDING_R2_KEY_PREFIX=recordings\nRECORDING_R2_FORCE_PATH_STYLE=true\n\n# =====================================================================\n# Resume parse queue\n# =====================================================================\n\nRESUME_PARSE_QUEUE_ATTEMPTS=3\nRESUME_PARSE_QUEUE_BACKOFF_MS=30000\nRESUME_PARSE_STALE_PROCESSING_SECONDS=900\nRESUME_PARSE_OCR_PAGE_CONCURRENCY=1\nRESUME_PARSE_OCR_ATTEMPTS=3\nRESUME_PARSE_OCR_RETRY_DELAY_MS=1000\nRESUME_PARSE_DISABLE_CACHE=false\n\n# =====================================================================\n# Resend email\n# =====================================================================\n\n# Use a bare email address. The display name is built dynamically at runtime.\nRESEND_API_KEY=\nRESEND_FROM=noreply@yourdomain.com\n\n# =====================================================================\n# PostHog\n# =====================================================================\n\nNEXT_PUBLIC_ENABLE_POSTHOG=\nNEXT_PUBLIC_POSTHOG_HOST=\nNEXT_PUBLIC_POSTHOG_PROJECT_TOKEN=\nPOSTHOG_API_HOST=\nPOSTHOG_PERSONAL_API_KEY=\nPOSTHOG_PROJECT_ID=\n"}, "0f9db2b16511a1dddd1a91b70f0637ba2b9e3536": {"t": 1785767486.5509942, "n": 10893, "h": "2ca4fb210685c853", "c": "# =====================================================================\n# Database\n# =====================================================================\n\n# Postgres 连接串，Drizzle ORM 和 Better Auth 共用。\n# Postgres connection string — shared by Drizzle ORM and Better Auth.\nDATABASE_URL=\n\n# Postgres.js 连接池与连接生命周期设置。公网/跨机房数据库建议保留较短 idle timeout，\n# 避免中间网络设备回收空闲 TCP 后，下次 Better Auth session 查询踩到半开连接。\n# Postgres.js pool and connection lifetime settings. Keep idle timeout short for\n# public/cross-IDC databases to avoid reusing half-open TCP connections.\nPOSTGRES_POOL_MAX=\nPOSTGRES_CONNECT_TIMEOUT_SECONDS=10\nPOSTGRES_IDLE_TIMEOUT_SECONDS=60\nPOSTGRES_MAX_LIFETIME_SECONDS=1200\n\n# =====================================================================\n# Better Auth\n# =====================================================================\n\n# Better Auth 用来签名 / 加密 session、CSRF token 等的随机密钥；\n# 生产环境必须独立设置（建议 `openssl rand -base64 32`），切勿提交到仓库。\n# Random secret Better Auth uses to sign/encrypt sessions, CSRF tokens, etc.\n# Generate a fresh value in production (e.g. `openssl rand -base64 32`); never commit.\nBETTER_AUTH_SECRET=\n\n# 生产环境必须设为真实域名（不带尾斜杠），如 https://app.example.com。\n# Google Cloud Console「已获授权的重定向 URI」需要登记\n# `${BETTER_AUTH_URL}/api/auth/callback/google`，否则会触发 redirect_uri_mismatch。\n# Production must be the real domain (no trailing slash), e.g. https://app.example.com.\n# Register `${BETTER_AUTH_URL}/api/auth/callback/google` in Google Cloud Console\n# under \"Authorised redirect URIs\" — mismatch causes redirect_uri_mismatch.\nBETTER_AUTH_URL=\n\n# 浏览器侧拼绝对 callbackURL 用，跟 BETTER_AUTH_URL 保持一致。\n# Used in the browser to build an absolute callbackURL; keep in sync with BETTER_AUTH_URL.\nNEXT_PUBLIC_BASE_URL=\n\n# 可选：浏览器侧 Better Auth API origin。留空时使用当前站点 origin；\n# 当前端和 Hono 后端分域/分端口部署时，填 Hono 后端公开地址，如 http://localhost:8787。\n# Optional browser-side Better Auth API origin. Empty means current site origin;\n# set it when the frontend and Hono backend are on different domains/ports.\nVITE_BETTER_AUTH_URL=\n\n# Google OAuth 凭据（来自 Google Cloud Console -> Credentials -> OAuth 2.0 Client）。\n# Google OAuth credentials (Google Cloud Console -> Credentials -> OAuth 2.0 Client).\nGOOGLE_CLIENT_ID=\nGOOGLE_CLIENT_SECRET=\n\n# 登录入口开关：设置任意非空值后，登录页会显示 Google 登录并隐藏飞书登录；\n# 留空则保持默认（飞书登录）。生产国内 IDC 无法连通 oauth2.googleapis.com，\n# 应当留空；本地 dev 或有海外出口的部署可设为 `1` 开启。Vite 已配置\n# envPrefix 暴露 NEXT_PUBLIC_*，客户端通过 import.meta.env 读取。\n# Login entry toggle: set to any non-empty value to show Google sign-in and\n# hide Feishu on the login page; leave blank for the default (Feishu).\n# Production runs from a domestic IDC that can't reach oauth2.googleapis.com,\n# so keep it blank there; local dev or overseas-egress deployments can set it\n# to `1`. Vite is configured with envPrefix for NEXT_PUBLIC_*, and client code\n# reads these values from import.meta.env.\nNEXT_PUBLIC_ENABLE_GOOGLE_LOGIN=\n\n# =====================================================================\n# 主 LLM 提供方：阿里云 DashScope（Qwen 系列 + DeepSeek 兼容模式）\n# Primary LLM provider: Aliyun DashScope (Qwen + DeepSeek compat endpoint)\n# =====================================================================\n\n# DashScope API key，用于简历筛选 chat / 标题生成 / Qwen-VL OCR / JD ranker。\n# DashScope API key — powers screening chat, title generation, Qwen-VL OCR, JD ranker.\nALIBABA_API_KEY=\n\n# DashScope base URL。留空走默认值 https://dashscope.aliyuncs.com/compatible-mode/v1，\n# 私有部署或代理时填入对应地址。\n# DashScope base URL. Leave blank to use the default\n# https://dashscope.aliyuncs.com/compatible-mode/v1; override for private / proxied deploys.\nALIBABA_BASE_URL=\n\n# =====================================================================\n# Voice agent / 语音相关\n# =====================================================================\n\n# ElevenLabs API key，被 LiveKit Python agent 通过 livekit-plugins-elevenlabs 隐式读取\n# （TTS / STT）。在 web 侧的 .env 里写一份，agent 启动时也能拿到。\n# ElevenLabs API key — implicitly read by the LiveKit Python agent\n# (livekit-plugins-elevenlabs) for TTS / STT. Defined here so the agent picks it up too.\nELEVENLABS_API_KEY=\n\n# MiniMax API key。Python agent 用它做正式面试 TTS；web 后端也用它为面试官音色生成\n# 公共试听音频（首次试听生成并上传，后续复用缓存）。\n# MiniMax API key. The Python agent uses it for interview TTS; the web server\n# also uses it to generate public interviewer-voice preview audio on cache miss.\nMINIMAX_API_KEY=\n\n# 可选。MiniMax TTS HTTP base URL，留空默认 https://api.minimax.chat。\n# Optional. MiniMax TTS HTTP base URL. Defaults to https://api.minimax.chat.\nMINIMAX_TTS_BASE_URL=\n\n# =====================================================================\n# Vercel AI Gateway\n# =====================================================================\n\n# Vercel AI Gateway key（用于面试结束后的评估，模型走 google/gemini-2.5-flash 等）。\n# 由 `ai` SDK 的 gateway provider 隐式读取，无需手动 import。\n# Vercel AI Gateway key — used for post-interview evaluation\n# (default model google/gemini-2.5-flash). Read implicitly by the `ai` SDK gateway provider.\nAI_GATEWAY_API_KEY=\n\n# =====================================================================\n# LiveKit Cloud — 语音 agent 运行时\n# LiveKit Cloud — voice agent runtime\n# =====================================================================\n\n# LiveKit Cloud 项目地址 / API 凭据。LIVEKIT_URL 为 wss:// 形式。\n# LiveKit Cloud project URL / API credentials. LIVEKIT_URL is a wss:// endpoint.\n# LIVEKIT_URL=wss://ai-interview-livekit.guadd.fun\n# LIVEKIT_API_KEY=livekit\n# LIVEKIT_API_SECRET=ai-interview\nLIVEKIT_URL=\nLIVEKIT_API_KEY=\nLIVEKIT_API_SECRET=\n\n# 必须与 Python worker 注册的 agent_name 一致（见 agent/src/agent.py）。\n# 服务端用它在 dispatch interview 时定向唤起对应 worker。\n# Must match the agent_name registered by the Python worker (agent/src/agent.py).\n# Used server-side to dispatch interview sessions to the correct worker.\nAGENT_NAME=\n\n# 浏览器侧 AgentDispatch 也需要知道 agent_name，因此暴露一份 NEXT_PUBLIC_ 版本，\n# 保持与 AGENT_NAME 同步。\n# Browser-side AgentDispatch also needs the agent_name; expose a NEXT_PUBLIC_ mirror\n# kept in lock-step with AGENT_NAME.\nNEXT_PUBLIC_AGENT_NAME=\n\n\n# Agent → web 回调的共享密钥，web 端 `/api/agent/*` 路由用它做 HMAC / bearer 校验，\n# 防止任何第三方伪造面试事件。两端值必须一致。\n# Shared secret for agent → web callbacks. The web `/api/agent/*` routes validate it\n# (HMAC / bearer) to reject forged interview events. Both sides must match.\nAGENT_CALLBACK_SECRET=\n\n# =====================================================================\n# Feishu 集成（可选，用于飞书机器人 / 多租户）\n# Feishu integration (optional — Feishu bot / multi-tenant)\n# =====================================================================\n\n# Feishu 应用凭据（来自飞书开放平台 -> 应用 -> 凭证与基础信息）。\n# 支持配置两个独立应用：默认应用走 *_APP_ID / *_APP_SECRET，副应用走带 2 的变量。\n# Feishu app credentials (Feishu Open Platform -> App -> Credentials).\n# Two independent apps are supported: primary uses *_APP_ID / *_APP_SECRET,\n# secondary uses the variables suffixed with 2.\nFEISHU_APP_ID=\nFEISHU_APP_SECRET=\nFEISHU_APP_ID2=\nFEISHU_APP_SECRET2=\n\n# 飞书事件订阅的加密 key 与校验 token，用于解密 / 校验回调消息。\n# Encryption key + verification token for Feishu event subscriptions\n# (decrypt / verify incoming callbacks).\nFEISHU_ENCRYPT_KEY=\nFEISHU_VERIFICATION_TOKEN=\n\n# =====================================================================\n# S3-compatible object storage（简历 PDF、附件上传）\n# S3-compatible object storage (resume PDFs, general attachments)\n# =====================================================================\n\n# S3 / 兼容服务端点。如使用 AWS S3 可留空（SDK 默认走 AWS）。\n# S3 / S3-compatible endpoint. Leave blank for AWS S3 (SDK default).\nS3_ENDPOINT=\nS3_BUCKET_NAME=\nS3_REGION=\nS3_ACCESS_KEY_ID=\nS3_SECRET_ACCESS_KEY=\n\n# 对象 key 前缀，便于把上传和录制隔离到不同子目录（可留空）。\n# Optional key prefix used to namespace uploaded objects (may be empty).\nS3_KEY_PREFIX=\n\n# 是否强制 path-style 访问（MinIO / 部分私有 S3 必须为 true）。\n# Force path-style addressing (required by MinIO / some self-hosted S3). Default false.\nS3_FORCE_PATH_STYLE=\n\n# =====================================================================\n# Redis / resume parse queue（批量简历异步解析）\n# Redis / resume parse queue (async bulk resume parsing)\n# =====================================================================\n\n# Redis 连接串。无用户名但有密码时写作 redis://:password@host:6379/0\n# Redis connection string. For password-only Redis, use redis://:password@host:6379/0\nREDIS_URL=redis://:de893df257e31c51873583cb292a8b24@10.210.16.3:6379/2\n\n# 批量简历解析任务重试次数与指数退避基准时间。\n# Queue retry attempts and exponential-backoff base delay for bulk resume parsing.\nRESUME_PARSE_QUEUE_ATTEMPTS=3\nRESUME_PARSE_QUEUE_BACKOFF_MS=30000\n\n# processing 状态超过该秒数才视为 worker 中断残留，避免长 OCR/评价被误判。\n# Processing items older than this are treated as interrupted worker leftovers.\nRESUME_PARSE_STALE_PROCESSING_SECONDS=900\n\n# 单份 PDF 内 OCR 页级并发与连接类瞬断重试配置。\n# Per-PDF OCR page concurrency and transient connection retry settings.\nRESUME_PARSE_OCR_PAGE_CONCURRENCY=1\nRESUME_PARSE_OCR_ATTEMPTS=3\nRESUME_PARSE_OCR_RETRY_DELAY_MS=1000\n\n# 测试真实解析链路时可设为 true：即使命中同 hash 的已解析缓存，也强制重新从 S3 读取并解析。\n# Set to true when benchmarking the real parse path: bypasses same-hash parsed cache.\nRESUME_PARSE_DISABLE_CACHE=false\n\n# =====================================================================\n# Cloudflare R2 — LiveKit Egress 面试录制存储\n# Cloudflare R2 — LiveKit Egress interview recording storage\n# =====================================================================\n# Endpoint format: https://<account_id>.r2.cloudflarestorage.com\nRECORDING_R2_ENDPOINT=\nRECORDING_R2_BUCKET_NAME=\nRECORDING_R2_REGION=auto\nRECORDING_R2_ACCESS_KEY_ID=\nRECORDING_R2_SECRET_ACCESS_KEY=\nRECORDING_R2_KEY_PREFIX=\nRECORDING_R2_FORCE_PATH_STYLE=true\n\n# =====================================================================\n# 模型覆盖（可选，均带默认值）\n# Model overrides (optional, all have sensible defaults)\n# =====================================================================\n\n# 可选,带默认值。覆盖面试结果评估用的模型(走 Vercel AI gateway),默认 google/gemini-2.5-flash。\n# Optional, has a default. Overrides the interview-evaluation model\n# (via Vercel AI gateway). Defaults to google/gemini-2.5-flash.\nINTERVIEW_EVALUATION_MODEL=\n\n# 可选,带默认值。覆盖 Qwen-VL OCR 模型 ID,默认 qwen-vl-ocr-latest。\n# Optional, has a default. Overrides the Qwen-VL OCR model id. Defaults to\n# qwen-vl-ocr-latest.\nQWEN_OCR_MODEL=\n\n# =====================================================================\n# Resend (transactional email)\n# =====================================================================\n\n# 中文：发件人地址。只写裸邮箱地址（不要加 \"Display <...>\"），\n# 域名必须在 Resend 控制台已验证，否则会被拒绝。\n# 邮件 From 头里的显示名会在运行时由代码动态拼接：\n# 「{系统设置里的公司名} AI HR」<addr>，没填公司名退化为「AI HR」<addr>。\n# 写成 \"Name <addr>\" 也能跑（代码会自动剥掉显示名），但部署脚本里出现\n# `<...>` 会被 shell 当成 stdin 重定向，所以推荐裸地址。\n# English: From address. Use a bare email address (no \"Display <...>\"). The\n# domain MUST be verified in the Resend dashboard. The actual From-header\n# display name is built at runtime as \"{globalConfig.companyName} AI HR\"\n# (or \"AI HR\" when blank). \"Name <addr>\" works too — the code strips the\n# display part — but bare avoids shell-redirection breakage in deploy scripts.\nRESEND_API_KEY=\nRESEND_FROM=noreply@yourdomain.com\n"}, "1d51457ce39145d85fcd257e7d240306033bcae2": {"t": 1785767487.9423048, "n": 10504, "h": "96b8a71cda0158b7", "c": "# =====================================================================\n# Database\n# =====================================================================\n\n# Postgres 连接串，Drizzle ORM 和 Better Auth 共用。\n# Postgres connection string — shared by Drizzle ORM and Better Auth.\nDATABASE_URL=\n\n# =====================================================================\n# Better Auth\n# =====================================================================\n\n# Better Auth 用来签名 / 加密 session、CSRF token 等的随机密钥；\n# 生产环境必须独立设置（建议 `openssl rand -base64 32`），切勿提交到仓库。\n# Random secret Better Auth uses to sign/encrypt sessions, CSRF tokens, etc.\n# Generate a fresh value in production (e.g. `openssl rand -base64 32`); never commit.\nBETTER_AUTH_SECRET=\n\n# 生产环境必须设为真实域名（不带尾斜杠），如 https://app.example.com。\n# Google Cloud Console「已获授权的重定向 URI」需要登记\n# `${BETTER_AUTH_URL}/api/auth/callback/google`，否则会触发 redirect_uri_mismatch。\n# Production must be the real domain (no trailing slash), e.g. https://app.example.com.\n# Register `${BETTER_AUTH_URL}/api/auth/callback/google` in Google Cloud Console\n# under \"Authorised redirect URIs\" — mismatch causes redirect_uri_mismatch.\nBETTER_AUTH_URL=\n\n# 浏览器侧拼绝对 callbackURL 用，跟 BETTER_AUTH_URL 保持一致。\n# Used in the browser to build an absolute callbackURL; keep in sync with BETTER_AUTH_URL.\nNEXT_PUBLIC_BASE_URL=\n\n# 可选：浏览器侧 Better Auth API origin。留空时使用当前站点 origin；\n# 当前端和 Hono 后端分域/分端口部署时，填 Hono 后端公开地址，如 http://localhost:8787。\n# Optional browser-side Better Auth API origin. Empty means current site origin;\n# set it when the frontend and Hono backend are on different domains/ports.\nVITE_BETTER_AUTH_URL=\n\n# Google OAuth 凭据（来自 Google Cloud Console -> Credentials -> OAuth 2.0 Client）。\n# Google OAuth credentials (Google Cloud Console -> Credentials -> OAuth 2.0 Client).\nGOOGLE_CLIENT_ID=\nGOOGLE_CLIENT_SECRET=\n\n# 登录入口开关：设置任意非空值后，登录页会显示 Google 登录并隐藏飞书登录；\n# 留空则保持默认（飞书登录）。生产国内 IDC 无法连通 oauth2.googleapis.com，\n# 应当留空；本地 dev 或有海外出口的部署可设为 `1` 开启。Vite 已配置\n# envPrefix 暴露 NEXT_PUBLIC_*，客户端通过 import.meta.env 读取。\n# Login entry toggle: set to any non-empty value to show Google sign-in and\n# hide Feishu on the login page; leave blank for the default (Feishu).\n# Production runs from a domestic IDC that can't reach oauth2.googleapis.com,\n# so keep it blank there; local dev or overseas-egress deployments can set it\n# to `1`. Vite is configured with envPrefix for NEXT_PUBLIC_*, and client code\n# reads these values from import.meta.env.\nNEXT_PUBLIC_ENABLE_GOOGLE_LOGIN=\n\n# =====================================================================\n# 主 LLM 提供方：阿里云 DashScope（Qwen 系列 + DeepSeek 兼容模式）\n# Primary LLM provider: Aliyun DashScope (Qwen + DeepSeek compat endpoint)\n# =====================================================================\n\n# DashScope API key，用于简历筛选 chat / 标题生成 / Qwen-VL OCR / JD ranker。\n# DashScope API key — powers screening chat, title generation, Qwen-VL OCR, JD ranker.\nALIBABA_API_KEY=\n\n# DashScope base URL。留空走默认值 https://dashscope.aliyuncs.com/compatible-mode/v1，\n# 私有部署或代理时填入对应地址。\n# DashScope base URL. Leave blank to use the default\n# https://dashscope.aliyuncs.com/compatible-mode/v1; override for private / proxied deploys.\nALIBABA_BASE_URL=\n\n# =====================================================================\n# Voice agent / 语音相关\n# =====================================================================\n\n# ElevenLabs API key，被 LiveKit Python agent 通过 livekit-plugins-elevenlabs 隐式读取\n# （TTS / STT）。在 web 侧的 .env 里写一份，agent 启动时也能拿到。\n# ElevenLabs API key — implicitly read by the LiveKit Python agent\n# (livekit-plugins-elevenlabs) for TTS / STT. Defined here so the agent picks it up too.\nELEVENLABS_API_KEY=\n\n# MiniMax API key。Python agent 用它做正式面试 TTS；web 后端也用它为面试官音色生成\n# 公共试听音频（首次试听生成并上传，后续复用缓存）。\n# MiniMax API key. The Python agent uses it for interview TTS; the web server\n# also uses it to generate public interviewer-voice preview audio on cache miss.\nMINIMAX_API_KEY=\n\n# 可选。MiniMax TTS HTTP base URL，留空默认 https://api.minimax.chat。\n# Optional. MiniMax TTS HTTP base URL. Defaults to https://api.minimax.chat.\nMINIMAX_TTS_BASE_URL=\n\n# =====================================================================\n# Vercel AI Gateway\n# =====================================================================\n\n# Vercel AI Gateway key（用于面试结束后的评估，模型走 google/gemini-2.5-flash 等）。\n# 由 `ai` SDK 的 gateway provider 隐式读取，无需手动 import。\n# Vercel AI Gateway key — used for post-interview evaluation\n# (default model google/gemini-2.5-flash). Read implicitly by the `ai` SDK gateway provider.\nAI_GATEWAY_API_KEY=\n\n# =====================================================================\n# LiveKit Cloud — 语音 agent 运行时\n# LiveKit Cloud — voice agent runtime\n# =====================================================================\n\n# LiveKit Cloud 项目地址 / API 凭据。LIVEKIT_URL 为 wss:// 形式。\n# LiveKit Cloud project URL / API credentials. LIVEKIT_URL is a wss:// endpoint.\n# LIVEKIT_URL=wss://ai-interview-livekit.guadd.fun\n# LIVEKIT_API_KEY=livekit\n# LIVEKIT_API_SECRET=ai-interview\nLIVEKIT_URL=\nLIVEKIT_API_KEY=\nLIVEKIT_API_SECRET=\n\n# 必须与 Python worker 注册的 agent_name 一致（见 agent/src/agent.py）。\n# 服务端用它在 dispatch interview 时定向唤起对应 worker。\n# Must match the agent_name registered by the Python worker (agent/src/agent.py).\n# Used server-side to dispatch interview sessions to the correct worker.\nAGENT_NAME=\n\n# 浏览器侧 AgentDispatch 也需要知道 agent_name，因此暴露一份 NEXT_PUBLIC_ 版本，\n# 保持与 AGENT_NAME 同步。\n# Browser-side AgentDispatch also needs the agent_name; expose a NEXT_PUBLIC_ mirror\n# kept in lock-step with AGENT_NAME.\nNEXT_PUBLIC_AGENT_NAME=\n\n\n# Agent → web 回调的共享密钥，web 端 `/api/agent/*` 路由用它做 HMAC / bearer 校验，\n# 防止任何第三方伪造面试事件。两端值必须一致。\n# Shared secret for agent → web callbacks. The web `/api/agent/*` routes validate it\n# (HMAC / bearer) to reject forged interview events. Both sides must match.\nAGENT_CALLBACK_SECRET=\n\n# =====================================================================\n# Feishu 集成（可选，用于飞书机器人 / 多租户）\n# Feishu integration (optional — Feishu bot / multi-tenant)\n# =====================================================================\n\n# Feishu 应用凭据（来自飞书开放平台 -> 应用 -> 凭证与基础信息）。\n# 支持配置两个独立应用：默认应用走 *_APP_ID / *_APP_SECRET，副应用走带 2 的变量。\n# Feishu app credentials (Feishu Open Platform -> App -> Credentials).\n# Two independent apps are supported: primary uses *_APP_ID / *_APP_SECRET,\n# secondary uses the variables suffixed with 2.\nFEISHU_APP_ID=\nFEISHU_APP_SECRET=\nFEISHU_APP_ID2=\nFEISHU_APP_SECRET2=\n\n# 飞书事件订阅的加密 key 与校验 token，用于解密 / 校验回调消息。\n# Encryption key + verification token for Feishu event subscriptions\n# (decrypt / verify incoming callbacks).\nFEISHU_ENCRYPT_KEY=\nFEISHU_VERIFICATION_TOKEN=\n\n# =====================================================================\n# S3-compatible object storage（简历 PDF、附件上传）\n# S3-compatible object storage (resume PDFs, general attachments)\n# =====================================================================\n\n# S3 / 兼容服务端点。如使用 AWS S3 可留空（SDK 默认走 AWS）。\n# S3 / S3-compatible endpoint. Leave blank for AWS S3 (SDK default).\nS3_ENDPOINT=\nS3_BUCKET_NAME=\nS3_REGION=\nS3_ACCESS_KEY_ID=\nS3_SECRET_ACCESS_KEY=\n\n# 对象 key 前缀，便于把上传和录制隔离到不同子目录（可留空）。\n# Optional key prefix used to namespace uploaded objects (may be empty).\nS3_KEY_PREFIX=\n\n# 是否强制 path-style 访问（MinIO / 部分私有 S3 必须为 true）。\n# Force path-style addressing (required by MinIO / some self-hosted S3). Default false.\nS3_FORCE_PATH_STYLE=\n\n# =====================================================================\n# Redis / resume parse queue（批量简历异步解析）\n# Redis / resume parse queue (async bulk resume parsing)\n# =====================================================================\n\n# Redis 连接串。无用户名但有密码时写作 redis://:password@host:6379/0\n# Redis connection string. For password-only Redis, use redis://:password@host:6379/0\nREDIS_URL=redis://:de893df257e31c51873583cb292a8b24@10.210.16.3:6379/2\n\n# 批量简历解析任务重试次数与指数退避基准时间。\n# Queue retry attempts and exponential-backoff base delay for bulk resume parsing.\nRESUME_PARSE_QUEUE_ATTEMPTS=3\nRESUME_PARSE_QUEUE_BACKOFF_MS=30000\n\n# processing 状态超过该秒数才视为 worker 中断残留，避免长 OCR/评价被误判。\n# Processing items older than this are treated as interrupted worker leftovers.\nRESUME_PARSE_STALE_PROCESSING_SECONDS=900\n\n# 单份 PDF 内 OCR 页级并发与连接类瞬断重试配置。\n# Per-PDF OCR page concurrency and transient connection retry settings.\nRESUME_PARSE_OCR_PAGE_CONCURRENCY=1\nRESUME_PARSE_OCR_ATTEMPTS=3\nRESUME_PARSE_OCR_RETRY_DELAY_MS=1000\n\n# 测试真实解析链路时可设为 true：即使命中同 hash 的已解析缓存，也强制重新从 S3 读取并解析。\n# Set to true when benchmarking the real parse path: bypasses same-hash parsed cache.\nRESUME_PARSE_DISABLE_CACHE=false\n\n# =====================================================================\n# Cloudflare R2 — LiveKit Egress 面试录制存储\n# Cloudflare R2 — LiveKit Egress interview recording storage\n# =====================================================================\n# Endpoint format: https://<account_id>.r2.cloudflarestorage.com\nRECORDING_R2_ENDPOINT=\nRECORDING_R2_BUCKET_NAME=\nRECORDING_R2_REGION=auto\nRECORDING_R2_ACCESS_KEY_ID=\nRECORDING_R2_SECRET_ACCESS_KEY=\nRECORDING_R2_KEY_PREFIX=\nRECORDING_R2_FORCE_PATH_STYLE=true\n\n# =====================================================================\n# 模型覆盖（可选，均带默认值）\n# Model overrides (optional, all have sensible defaults)\n# =====================================================================\n\n# 可选,带默认值。覆盖面试结果评估用的模型(走 Vercel AI gateway),默认 google/gemini-2.5-flash。\n# Optional, has a default. Overrides the interview-evaluation model\n# (via Vercel AI gateway). Defaults to google/gemini-2.5-flash.\nINTERVIEW_EVALUATION_MODEL=\n\n# 可选,带默认值。覆盖 Qwen-VL OCR 模型 ID,默认 qwen-vl-ocr-latest。\n# Optional, has a default. Overrides the Qwen-VL OCR model id. Defaults to\n# qwen-vl-ocr-latest.\nQWEN_OCR_MODEL=\n\n# =====================================================================\n# Resend (transactional email)\n# =====================================================================\n\n# 中文：发件人地址。只写裸邮箱地址（不要加 \"Display <...>\"），\n# 域名必须在 Resend 控制台已验证，否则会被拒绝。\n# 邮件 From 头里的显示名会在运行时由代码动态拼接：\n# 「{系统设置里的公司名} AI HR」<addr>，没填公司名退化为「AI HR」<addr>。\n# 写成 \"Name <addr>\" 也能跑（代码会自动剥掉显示名），但部署脚本里出现\n# `<...>` 会被 shell 当成 stdin 重定向，所以推荐裸地址。\n# English: From address. Use a bare email address (no \"Display <...>\"). The\n# domain MUST be verified in the Resend dashboard. The actual From-header\n# display name is built at runtime as \"{globalConfig.companyName} AI HR\"\n# (or \"AI HR\" when blank). \"Name <addr>\" works too — the code strips the\n# display part — but bare avoids shell-redirection breakage in deploy scripts.\nRESEND_API_KEY=\nRESEND_FROM=noreply@yourdomain.com\n"}, "056ccf811fe50c87babb3f016376c0353c3d98a7": {"t": 1785767489.373626, "n": 11949, "h": "ba0ccf242065d417", "c": "# =====================================================================\n# Database\n# =====================================================================\n\n# Postgres 连接串，Drizzle ORM 和 Better Auth 共用。\n# Postgres connection string — shared by Drizzle ORM and Better Auth.\nDATABASE_URL=\n\n# =====================================================================\n# Better Auth\n# =====================================================================\n\n# Better Auth 用来签名 / 加密 session、CSRF token 等的随机密钥；\n# 生产环境必须独立设置（建议 `openssl rand -base64 32`），切勿提交到仓库。\n# Random secret Better Auth uses to sign/encrypt sessions, CSRF tokens, etc.\n# Generate a fresh value in production (e.g. `openssl rand -base64 32`); never commit.\nBETTER_AUTH_SECRET=\n\n# 生产环境必须设为真实域名（不带尾斜杠），如 https://app.example.com。\n# Google Cloud Console「已获授权的重定向 URI」需要登记\n# `${BETTER_AUTH_URL}/api/auth/callback/google`，否则会触发 redirect_uri_mismatch。\n# Production must be the real domain (no trailing slash), e.g. https://app.example.com.\n# Register `${BETTER_AUTH_URL}/api/auth/callback/google` in Google Cloud Console\n# under \"Authorised redirect URIs\" — mismatch causes redirect_uri_mismatch.\nBETTER_AUTH_URL=\n\n# 浏览器侧拼绝对 callbackURL 用，跟 BETTER_AUTH_URL 保持一致。\n# Used in the browser to build an absolute callbackURL; keep in sync with BETTER_AUTH_URL.\nNEXT_PUBLIC_BASE_URL=\n\n# 可选：浏览器侧 Better Auth API origin。留空时使用当前站点 origin；\n# 当前端和 Hono 后端分域/分端口部署时，填 Hono 后端公开地址，如 http://localhost:8787。\n# Optional browser-side Better Auth API origin. Empty means current site origin;\n# set it when the frontend and Hono backend are on different domains/ports.\nVITE_BETTER_AUTH_URL=\n\n# Google OAuth 凭据（来自 Google Cloud Console -> Credentials -> OAuth 2.0 Client）。\n# Google OAuth credentials (Google Cloud Console -> Credentials -> OAuth 2.0 Client).\nGOOGLE_CLIENT_ID=\nGOOGLE_CLIENT_SECRET=\n\n# 登录入口开关：设置任意非空值后，登录页会显示 Google 登录并隐藏飞书登录；\n# 留空则保持默认（飞书登录）。生产国内 IDC 无法连通 oauth2.googleapis.com，\n# 应当留空；本地 dev 或有海外出口的部署可设为 `1` 开启。Vite 已配置\n# envPrefix 暴露 NEXT_PUBLIC_*，客户端通过 import.meta.env 读取。\n# Login entry toggle: set to any non-empty value to show Google sign-in and\n# hide Feishu on the login page; leave blank for the default (Feishu).\n# Production runs from a domestic IDC that can't reach oauth2.googleapis.com,\n# so keep it blank there; local dev or overseas-egress deployments can set it\n# to `1`. Vite is configured with envPrefix for NEXT_PUBLIC_*, and client code\n# reads these values from import.meta.env.\nNEXT_PUBLIC_ENABLE_GOOGLE_LOGIN=\n\n# =====================================================================\n# 主 LLM 提供方：阿里云 DashScope（Qwen 系列 + DeepSeek 兼容模式）\n# Primary LLM provider: Aliyun DashScope (Qwen + DeepSeek compat endpoint)\n# =====================================================================\n\n# DashScope API key，用于简历筛选 chat / 标题生成 / Qwen-VL OCR / JD ranker。\n# DashScope API key — powers screening chat, title generation, Qwen-VL OCR, JD ranker.\nALIBABA_API_KEY=\n\n# DashScope base URL。留空走默认值 https://dashscope.aliyuncs.com/compatible-mode/v1，\n# 私有部署或代理时填入对应地址。\n# DashScope base URL. Leave blank to use the default\n# https://dashscope.aliyuncs.com/compatible-mode/v1; override for private / proxied deploys.\nALIBABA_BASE_URL=\n\n# =====================================================================\n# Voice agent / 语音相关\n# =====================================================================\n\n# ElevenLabs API key，被 LiveKit Python agent 通过 livekit-plugins-elevenlabs 隐式读取\n# （TTS / STT）。在 web 侧的 .env 里写一份，agent 启动时也能拿到。\n# ElevenLabs API key — implicitly read by the LiveKit Python agent\n# (livekit-plugins-elevenlabs) for TTS / STT. Defined here so the agent picks it up too.\nELEVENLABS_API_KEY=\n\n# MiniMax API key。Python agent 用它做正式面试 TTS；web 后端也用它为面试官音色生成\n# 公共试听音频（首次试听生成并上传，后续复用缓存）。\n# MiniMax API key. The Python agent uses it for interview TTS; the web server\n# also uses it to generate public interviewer-voice preview audio on cache miss.\nMINIMAX_API_KEY=\n\n# 可选。MiniMax TTS HTTP base URL，留空默认 https://api.minimax.chat。\n# Optional. MiniMax TTS HTTP base URL. Defaults to https://api.minimax.chat.\nMINIMAX_TTS_BASE_URL=\n\n# =====================================================================\n# Vercel AI Gateway\n# =====================================================================\n\n# Vercel AI Gateway key（用于面试结束后的评估，模型走 google/gemini-2.5-flash 等）。\n# 由 `ai` SDK 的 gateway provider 隐式读取，无需手动 import。\n# Vercel AI Gateway key — used for post-interview evaluation\n# (default model google/gemini-2.5-flash). Read implicitly by the `ai` SDK gateway provider.\nAI_GATEWAY_API_KEY=\n\n# =====================================================================\n# LiveKit Cloud — 语音 agent 运行时\n# LiveKit Cloud — voice agent runtime\n# =====================================================================\n\n# LiveKit Cloud 项目地址 / API 凭据。LIVEKIT_URL 为 wss:// 形式。\n# LiveKit Cloud project URL / API credentials. LIVEKIT_URL is a wss:// endpoint.\n# LIVEKIT_URL=wss://ai-interview-livekit.guadd.fun\n# LIVEKIT_API_KEY=livekit\n# LIVEKIT_API_SECRET=ai-interview\nLIVEKIT_URL=\nLIVEKIT_API_KEY=\nLIVEKIT_API_SECRET=\n\n# 必须与 Python worker 注册的 agent_name 一致（见 agent/src/agent.py）。\n# 服务端用它在 dispatch interview 时定向唤起对应 worker。\n# Must match the agent_name registered by the Python worker (agent/src/agent.py).\n# Used server-side to dispatch interview sessions to the correct worker.\nAGENT_NAME=\n\n# 浏览器侧 AgentDispatch 也需要知道 agent_name，因此暴露一份 NEXT_PUBLIC_ 版本，\n# 保持与 AGENT_NAME 同步。\n# Browser-side AgentDispatch also needs the agent_name; expose a NEXT_PUBLIC_ mirror\n# kept in lock-step with AGENT_NAME.\nNEXT_PUBLIC_AGENT_NAME=\n\n\n# Agent → web 回调的共享密钥，web 端 `/api/agent/*` 路由用它做 HMAC / bearer 校验，\n# 防止任何第三方伪造面试事件。两端值必须一致。\n# Shared secret for agent → web callbacks. The web `/api/agent/*` routes validate it\n# (HMAC / bearer) to reject forged interview events. Both sides must match.\nAGENT_CALLBACK_SECRET=\n\n# =====================================================================\n# PostHog（产品埋点，可选）\n# PostHog (optional product analytics)\n# =====================================================================\n\n# 设为 true 后启用 PostHog 客户端埋点。默认关闭，避免本地开发误上报。\n# Set to true to enable PostHog client-side analytics. Disabled by default\n# to avoid accidental local event capture.\nNEXT_PUBLIC_ENABLE_POSTHOG=false\n\n# PostHog Project token（通常以 phc_ 开头）。这是公开 token，可暴露给浏览器。\n# PostHog project token (usually starts with phc_). This is a public token\n# and is safe to expose to the browser.\nNEXT_PUBLIC_POSTHOG_PROJECT_TOKEN=\n\n# PostHog ingest host。US Cloud 默认 https://us.i.posthog.com；\n# EU Cloud 按 PostHog 项目设置填写对应地址。\n# PostHog ingest host. US Cloud default is https://us.i.posthog.com;\n# use the EU host if the project is hosted in PostHog EU.\nNEXT_PUBLIC_POSTHOG_HOST=https://us.i.posthog.com\n\n# Platform 埋点 dashboard 服务端查询 PostHog 用。PERSONAL_API_KEY 只能放服务端，\n# 不要加 NEXT_PUBLIC_ 前缀。API host 是 PostHog app/API host，不是 ingest host；\n# US Cloud 通常为 https://us.posthog.com，EU Cloud 按项目区域填写。\n# Server-side PostHog query config for the platform analytics dashboard.\n# PERSONAL_API_KEY must stay on the server (no NEXT_PUBLIC_ prefix). API host is\n# the PostHog app/API host, not the ingest host; US Cloud is usually\n# https://us.posthog.com, EU Cloud depends on the project region.\nPOSTHOG_PERSONAL_API_KEY=\nPOSTHOG_PROJECT_ID=\nPOSTHOG_API_HOST=https://us.posthog.com\n\n# =====================================================================\n# Feishu 集成（可选，用于飞书机器人 / 多租户）\n# Feishu integration (optional — Feishu bot / multi-tenant)\n# =====================================================================\n\n# Feishu 应用凭据（来自飞书开放平台 -> 应用 -> 凭证与基础信息）。\n# 支持配置两个独立应用：默认应用走 *_APP_ID / *_APP_SECRET，副应用走带 2 的变量。\n# Feishu app credentials (Feishu Open Platform -> App -> Credentials).\n# Two independent apps are supported: primary uses *_APP_ID / *_APP_SECRET,\n# secondary uses the variables suffixed with 2.\nFEISHU_APP_ID=\nFEISHU_APP_SECRET=\nFEISHU_APP_ID2=\nFEISHU_APP_SECRET2=\n\n# 飞书事件订阅的加密 key 与校验 token，用于解密 / 校验回调消息。\n# Encryption key + verification token for Feishu event subscriptions\n# (decrypt / verify incoming callbacks).\nFEISHU_ENCRYPT_KEY=\nFEISHU_VERIFICATION_TOKEN=\n\n# =====================================================================\n# S3-compatible object storage（简历 PDF、附件上传）\n# S3-compatible object storage (resume PDFs, general attachments)\n# =====================================================================\n\n# S3 / 兼容服务端点。如使用 AWS S3 可留空（SDK 默认走 AWS）。\n# S3 / S3-compatible endpoint. Leave blank for AWS S3 (SDK default).\nS3_ENDPOINT=\nS3_BUCKET_NAME=\nS3_REGION=\nS3_ACCESS_KEY_ID=\nS3_SECRET_ACCESS_KEY=\n\n# 对象 key 前缀，便于把上传和录制隔离到不同子目录（可留空）。\n# Optional key prefix used to namespace uploaded objects (may be empty).\nS3_KEY_PREFIX=\n\n# 是否强制 path-style 访问（MinIO / 部分私有 S3 必须为 true）。\n# Force path-style addressing (required by MinIO / some self-hosted S3). Default false.\nS3_FORCE_PATH_STYLE=\n\n# =====================================================================\n# Redis / resume parse queue（批量简历异步解析）\n# Redis / resume parse queue (async bulk resume parsing)\n# =====================================================================\n\n# Redis 连接串。无用户名但有密码时写作 redis://:password@host:6379/0\n# Redis connection string. For password-only Redis, use redis://:password@host:6379/0\nREDIS_URL=redis://:de893df257e31c51873583cb292a8b24@10.210.16.3:6379/2\n\n# 批量简历解析任务重试次数与指数退避基准时间。\n# Queue retry attempts and exponential-backoff base delay for bulk resume parsing.\nRESUME_PARSE_QUEUE_ATTEMPTS=3\nRESUME_PARSE_QUEUE_BACKOFF_MS=30000\n\n# processing 状态超过该秒数才视为 worker 中断残留，避免长 OCR/评价被误判。\n# Processing items older than this are treated as interrupted worker leftovers.\nRESUME_PARSE_STALE_PROCESSING_SECONDS=900\n\n# 单份 PDF 内 OCR 页级并发与连接类瞬断重试配置。\n# Per-PDF OCR page concurrency and transient connection retry settings.\nRESUME_PARSE_OCR_PAGE_CONCURRENCY=1\nRESUME_PARSE_OCR_ATTEMPTS=3\nRESUME_PARSE_OCR_RETRY_DELAY_MS=1000\n\n# 测试真实解析链路时可设为 true：即使命中同 hash 的已解析缓存，也强制重新从 S3 读取并解析。\n# Set to true when benchmarking the real parse path: bypasses same-hash parsed cache.\nRESUME_PARSE_DISABLE_CACHE=false\n\n# =====================================================================\n# Cloudflare R2 — LiveKit Egress 面试录制存储\n# Cloudflare R2 — LiveKit Egress interview recording storage\n# =====================================================================\n# Endpoint format: https://<account_id>.r2.cloudflarestorage.com\nRECORDING_R2_ENDPOINT=\nRECORDING_R2_BUCKET_NAME=\nRECORDING_R2_REGION=auto\nRECORDING_R2_ACCESS_KEY_ID=\nRECORDING_R2_SECRET_ACCESS_KEY=\nRECORDING_R2_KEY_PREFIX=\nRECORDING_R2_FORCE_PATH_STYLE=true\n\n# =====================================================================\n# 模型覆盖（可选，均带默认值）\n# Model overrides (optional, all have sensible defaults)\n# =====================================================================\n\n# 可选,带默认值。覆盖面试结果评估用的模型(走 Vercel AI gateway),默认 google/gemini-2.5-flash。\n# Optional, has a default. Overrides the interview-evaluation model\n# (via Vercel AI gateway). Defaults to google/gemini-2.5-flash.\nINTERVIEW_EVALUATION_MODEL=\n\n# 可选,带默认值。覆盖 Qwen-VL OCR 模型 ID,默认 qwen-vl-ocr-latest。\n# Optional, has a default. Overrides the Qwen-VL OCR model id. Defaults to\n# qwen-vl-ocr-latest.\nQWEN_OCR_MODEL=\n\n# =====================================================================\n# Resend (transactional email)\n# =====================================================================\n\n# 中文：发件人地址。只写裸邮箱地址（不要加 \"Display <...>\"），\n# 域名必须在 Resend 控制台已验证，否则会被拒绝。\n# 邮件 From 头里的显示名会在运行时由代码动态拼接：\n# 「{系统设置里的公司名} AI HR」<addr>，没填公司名退化为「AI HR」<addr>。\n# 写成 \"Name <addr>\" 也能跑（代码会自动剥掉显示名），但部署脚本里出现\n# `<...>` 会被 shell 当成 stdin 重定向，所以推荐裸地址。\n# English: From address. Use a bare email address (no \"Display <...>\"). The\n# domain MUST be verified in the Resend dashboard. The actual From-header\n# display name is built at runtime as \"{globalConfig.companyName} AI HR\"\n# (or \"AI HR\" when blank). \"Name <addr>\" works too — the code strips the\n# display part — but bare avoids shell-redirection breakage in deploy scripts.\nRESEND_API_KEY=\nRESEND_FROM=noreply@yourdomain.com\n"}, "0f705a9f6d3e3f619950b9af0f4a56e40a3d419d": {"t": 1785767490.7790942, "n": 11914, "h": "08e8dabc212fc768", "c": "# =====================================================================\n# Database\n# =====================================================================\n\n# Postgres 连接串，Drizzle ORM 和 Better Auth 共用。\n# Postgres connection string — shared by Drizzle ORM and Better Auth.\nDATABASE_URL=\n\n# =====================================================================\n# Better Auth\n# =====================================================================\n\n# Better Auth 用来签名 / 加密 session、CSRF token 等的随机密钥；\n# 生产环境必须独立设置（建议 `openssl rand -base64 32`），切勿提交到仓库。\n# Random secret Better Auth uses to sign/encrypt sessions, CSRF tokens, etc.\n# Generate a fresh value in production (e.g. `openssl rand -base64 32`); never commit.\nBETTER_AUTH_SECRET=\n\n# 生产环境必须设为真实域名（不带尾斜杠），如 https://app.example.com。\n# Google Cloud Console「已获授权的重定向 URI」需要登记\n# `${BETTER_AUTH_URL}/api/auth/callback/google`，否则会触发 redirect_uri_mismatch。\n# Production must be the real domain (no trailing slash), e.g. https://app.example.com.\n# Register `${BETTER_AUTH_URL}/api/auth/callback/google` in Google Cloud Console\n# under \"Authorised redirect URIs\" — mismatch causes redirect_uri_mismatch.\nBETTER_AUTH_URL=\n\n# 浏览器侧拼绝对 callbackURL 用，跟 BETTER_AUTH_URL 保持一致。\n# Used in the browser to build an absolute callbackURL; keep in sync with BETTER_AUTH_URL.\nNEXT_PUBLIC_BASE_URL=\n\n# 可选：浏览器侧 Better Auth API origin。留空时使用当前站点 origin；\n# 当前端和 Hono 后端分域/分端口部署时，填 Hono 后端公开地址，如 http://localhost:8787。\n# Optional browser-side Better Auth API origin. Empty means current site origin;\n# set it when the frontend and Hono backend are on different domains/ports.\nVITE_BETTER_AUTH_URL=\n\n# Google OAuth 凭据（来自 Google Cloud Console -> Credentials -> OAuth 2.0 Client）。\n# Google OAuth credentials (Google Cloud Console -> Credentials -> OAuth 2.0 Client).\nGOOGLE_CLIENT_ID=\nGOOGLE_CLIENT_SECRET=\n\n# 登录入口开关：设置任意非空值后，登录页会显示 Google 登录并隐藏飞书登录；\n# 留空则保持默认（飞书登录）。生产国内 IDC 无法连通 oauth2.googleapis.com，\n# 应当留空；本地 dev 或有海外出口的部署可设为 `1` 开启。NEXT_PUBLIC_ 前缀\n# 让 Next.js 在构建时把值内联到客户端 bundle。\n# Login entry toggle: set to any non-empty value to show Google sign-in and\n# hide Feishu on the login page; leave blank for the default (Feishu).\n# Production runs from a domestic IDC that can't reach oauth2.googleapis.com,\n# so keep it blank there; local dev or overseas-egress deployments can set it\n# to `1`. The NEXT_PUBLIC_ prefix lets Next.js inline the value into the\n# client bundle at build time.\nNEXT_PUBLIC_ENABLE_GOOGLE_LOGIN=\n\n# =====================================================================\n# 主 LLM 提供方：阿里云 DashScope（Qwen 系列 + DeepSeek 兼容模式）\n# Primary LLM provider: Aliyun DashScope (Qwen + DeepSeek compat endpoint)\n# =====================================================================\n\n# DashScope API key，用于简历筛选 chat / 标题生成 / Qwen-VL OCR / JD ranker。\n# DashScope API key — powers screening chat, title generation, Qwen-VL OCR, JD ranker.\nALIBABA_API_KEY=\n\n# DashScope base URL。留空走默认值 https://dashscope.aliyuncs.com/compatible-mode/v1，\n# 私有部署或代理时填入对应地址。\n# DashScope base URL. Leave blank to use the default\n# https://dashscope.aliyuncs.com/compatible-mode/v1; override for private / proxied deploys.\nALIBABA_BASE_URL=\n\n# =====================================================================\n# Voice agent / 语音相关\n# =====================================================================\n\n# ElevenLabs API key，被 LiveKit Python agent 通过 livekit-plugins-elevenlabs 隐式读取\n# （TTS / STT）。在 web 侧的 .env 里写一份，agent 启动时也能拿到。\n# ElevenLabs API key — implicitly read by the LiveKit Python agent\n# (livekit-plugins-elevenlabs) for TTS / STT. Defined here so the agent picks it up too.\nELEVENLABS_API_KEY=\n\n# MiniMax API key。Python agent 用它做正式面试 TTS；web 后端也用它为面试官音色生成\n# 公共试听音频（首次试听生成并上传，后续复用缓存）。\n# MiniMax API key. The Python agent uses it for interview TTS; the web server\n# also uses it to generate public interviewer-voice preview audio on cache miss.\nMINIMAX_API_KEY=\n\n# 可选。MiniMax TTS HTTP base URL，留空默认 https://api.minimax.chat。\n# Optional. MiniMax TTS HTTP base URL. Defaults to https://api.minimax.chat.\nMINIMAX_TTS_BASE_URL=\n\n# =====================================================================\n# Vercel AI Gateway\n# =====================================================================\n\n# Vercel AI Gateway key（用于面试结束后的评估，模型走 google/gemini-2.5-flash 等）。\n# 由 `ai` SDK 的 gateway provider 隐式读取，无需手动 import。\n# Vercel AI Gateway key — used for post-interview evaluation\n# (default model google/gemini-2.5-flash). Read implicitly by the `ai` SDK gateway provider.\nAI_GATEWAY_API_KEY=\n\n# =====================================================================\n# LiveKit Cloud — 语音 agent 运行时\n# LiveKit Cloud — voice agent runtime\n# =====================================================================\n\n# LiveKit Cloud 项目地址 / API 凭据。LIVEKIT_URL 为 wss:// 形式。\n# LiveKit Cloud project URL / API credentials. LIVEKIT_URL is a wss:// endpoint.\n# LIVEKIT_URL=wss://ai-interview-livekit.guadd.fun\n# LIVEKIT_API_KEY=livekit\n# LIVEKIT_API_SECRET=ai-interview\nLIVEKIT_URL=\nLIVEKIT_API_KEY=\nLIVEKIT_API_SECRET=\n\n# 必须与 Python worker 注册的 agent_name 一致（见 agent/src/agent.py）。\n# 服务端用它在 dispatch interview 时定向唤起对应 worker。\n# Must match the agent_name registered by the Python worker (agent/src/agent.py).\n# Used server-side to dispatch interview sessions to the correct worker.\nAGENT_NAME=\n\n# 浏览器侧 AgentDispatch 也需要知道 agent_name，因此暴露一份 NEXT_PUBLIC_ 版本，\n# 保持与 AGENT_NAME 同步。\n# Browser-side AgentDispatch also needs the agent_name; expose a NEXT_PUBLIC_ mirror\n# kept in lock-step with AGENT_NAME.\nNEXT_PUBLIC_AGENT_NAME=\n\n\n# Agent → web 回调的共享密钥，web 端 `/api/agent/*` 路由用它做 HMAC / bearer 校验，\n# 防止任何第三方伪造面试事件。两端值必须一致。\n# Shared secret for agent → web callbacks. The web `/api/agent/*` routes validate it\n# (HMAC / bearer) to reject forged interview events. Both sides must match.\nAGENT_CALLBACK_SECRET=\n\n# =====================================================================\n# PostHog（产品埋点，可选）\n# PostHog (optional product analytics)\n# =====================================================================\n\n# 设为 true 后启用 PostHog 客户端埋点。默认关闭，避免本地开发误上报。\n# Set to true to enable PostHog client-side analytics. Disabled by default\n# to avoid accidental local event capture.\nNEXT_PUBLIC_ENABLE_POSTHOG=false\n\n# PostHog Project token（通常以 phc_ 开头）。这是公开 token，可暴露给浏览器。\n# PostHog project token (usually starts with phc_). This is a public token\n# and is safe to expose to the browser.\nNEXT_PUBLIC_POSTHOG_PROJECT_TOKEN=\n\n# PostHog ingest host。US Cloud 默认 https://us.i.posthog.com；\n# EU Cloud 按 PostHog 项目设置填写对应地址。\n# PostHog ingest host. US Cloud default is https://us.i.posthog.com;\n# use the EU host if the project is hosted in PostHog EU.\nNEXT_PUBLIC_POSTHOG_HOST=https://us.i.posthog.com\n\n# Platform 埋点 dashboard 服务端查询 PostHog 用。PERSONAL_API_KEY 只能放服务端，\n# 不要加 NEXT_PUBLIC_ 前缀。API host 是 PostHog app/API host，不是 ingest host；\n# US Cloud 通常为 https://us.posthog.com，EU Cloud 按项目区域填写。\n# Server-side PostHog query config for the platform analytics dashboard.\n# PERSONAL_API_KEY must stay server-only (no NEXT_PUBLIC_ prefix). API host is\n# the PostHog app/API host, not the ingest host; US Cloud is usually\n# https://us.posthog.com, EU Cloud depends on the project region.\nPOSTHOG_PERSONAL_API_KEY=\nPOSTHOG_PROJECT_ID=\nPOSTHOG_API_HOST=https://us.posthog.com\n\n# =====================================================================\n# Feishu 集成（可选，用于飞书机器人 / 多租户）\n# Feishu integration (optional — Feishu bot / multi-tenant)\n# =====================================================================\n\n# Feishu 应用凭据（来自飞书开放平台 -> 应用 -> 凭证与基础信息）。\n# 支持配置两个独立应用：默认应用走 *_APP_ID / *_APP_SECRET，副应用走带 2 的变量。\n# Feishu app credentials (Feishu Open Platform -> App -> Credentials).\n# Two independent apps are supported: primary uses *_APP_ID / *_APP_SECRET,\n# secondary uses the variables suffixed with 2.\nFEISHU_APP_ID=\nFEISHU_APP_SECRET=\nFEISHU_APP_ID2=\nFEISHU_APP_SECRET2=\n\n# 飞书事件订阅的加密 key 与校验 token，用于解密 / 校验回调消息。\n# Encryption key + verification token for Feishu event subscriptions\n# (decrypt / verify incoming callbacks).\nFEISHU_ENCRYPT_KEY=\nFEISHU_VERIFICATION_TOKEN=\n\n# =====================================================================\n# S3-compatible object storage（简历 PDF、附件上传）\n# S3-compatible object storage (resume PDFs, general attachments)\n# =====================================================================\n\n# S3 / 兼容服务端点。如使用 AWS S3 可留空（SDK 默认走 AWS）。\n# S3 / S3-compatible endpoint. Leave blank for AWS S3 (SDK default).\nS3_ENDPOINT=\nS3_BUCKET_NAME=\nS3_REGION=\nS3_ACCESS_KEY_ID=\nS3_SECRET_ACCESS_KEY=\n\n# 对象 key 前缀，便于把上传和录制隔离到不同子目录（可留空）。\n# Optional key prefix used to namespace uploaded objects (may be empty).\nS3_KEY_PREFIX=\n\n# 是否强制 path-style 访问（MinIO / 部分私有 S3 必须为 true）。\n# Force path-style addressing (required by MinIO / some self-hosted S3). Default false.\nS3_FORCE_PATH_STYLE=\n\n# =====================================================================\n# Redis / resume parse queue（批量简历异步解析）\n# Redis / resume parse queue (async bulk resume parsing)\n# =====================================================================\n\n# Redis 连接串。无用户名但有密码时写作 redis://:password@host:6379/0\n# Redis connection string. For password-only Redis, use redis://:password@host:6379/0\nREDIS_URL=redis://:de893df257e31c51873583cb292a8b24@10.210.16.3:6379/2\n\n# 批量简历解析任务重试次数与指数退避基准时间。\n# Queue retry attempts and exponential-backoff base delay for bulk resume parsing.\nRESUME_PARSE_QUEUE_ATTEMPTS=3\nRESUME_PARSE_QUEUE_BACKOFF_MS=30000\n\n# processing 状态超过该秒数才视为 worker 中断残留，避免长 OCR/评价被误判。\n# Processing items older than this are treated as interrupted worker leftovers.\nRESUME_PARSE_STALE_PROCESSING_SECONDS=900\n\n# 单份 PDF 内 OCR 页级并发与连接类瞬断重试配置。\n# Per-PDF OCR page concurrency and transient connection retry settings.\nRESUME_PARSE_OCR_PAGE_CONCURRENCY=1\nRESUME_PARSE_OCR_ATTEMPTS=3\nRESUME_PARSE_OCR_RETRY_DELAY_MS=1000\n\n# 测试真实解析链路时可设为 true：即使命中同 hash 的已解析缓存，也强制重新从 S3 读取并解析。\n# Set to true when benchmarking the real parse path: bypasses same-hash parsed cache.\nRESUME_PARSE_DISABLE_CACHE=false\n\n# =====================================================================\n# Cloudflare R2 — LiveKit Egress 面试录制存储\n# Cloudflare R2 — LiveKit Egress interview recording storage\n# =====================================================================\n# Endpoint format: https://<account_id>.r2.cloudflarestorage.com\nRECORDING_R2_ENDPOINT=\nRECORDING_R2_BUCKET_NAME=\nRECORDING_R2_REGION=auto\nRECORDING_R2_ACCESS_KEY_ID=\nRECORDING_R2_SECRET_ACCESS_KEY=\nRECORDING_R2_KEY_PREFIX=\nRECORDING_R2_FORCE_PATH_STYLE=true\n\n# =====================================================================\n# 模型覆盖（可选，均带默认值）\n# Model overrides (optional, all have sensible defaults)\n# =====================================================================\n\n# 可选,带默认值。覆盖面试结果评估用的模型(走 Vercel AI gateway),默认 google/gemini-2.5-flash。\n# Optional, has a default. Overrides the interview-evaluation model\n# (via Vercel AI gateway). Defaults to google/gemini-2.5-flash.\nINTERVIEW_EVALUATION_MODEL=\n\n# 可选,带默认值。覆盖 Qwen-VL OCR 模型 ID,默认 qwen-vl-ocr-latest。\n# Optional, has a default. Overrides the Qwen-VL OCR model id. Defaults to\n# qwen-vl-ocr-latest.\nQWEN_OCR_MODEL=\n\n# =====================================================================\n# Resend (transactional email)\n# =====================================================================\n\n# 中文：发件人地址。只写裸邮箱地址（不要加 \"Display <...>\"），\n# 域名必须在 Resend 控制台已验证，否则会被拒绝。\n# 邮件 From 头里的显示名会在运行时由代码动态拼接：\n# 「{系统设置里的公司名} AI HR」<addr>，没填公司名退化为「AI HR」<addr>。\n# 写成 \"Name <addr>\" 也能跑（代码会自动剥掉显示名），但部署脚本里出现\n# `<...>` 会被 shell 当成 stdin 重定向，所以推荐裸地址。\n# English: From address. Use a bare email address (no \"Display <...>\"). The\n# domain MUST be verified in the Resend dashboard. The actual From-header\n# display name is built at runtime as \"{globalConfig.companyName} AI HR\"\n# (or \"AI HR\" when blank). \"Name <addr>\" works too — the code strips the\n# display part — but bare avoids shell-redirection breakage in deploy scripts.\nRESEND_API_KEY=\nRESEND_FROM=noreply@yourdomain.com\n"}, "4915bcd2222581a86d06312f3668e98bf94d39ba": {"t": 1785767492.2567892, "n": 11620, "h": "ad441cca6510ceaf", "c": "# =====================================================================\n# Database\n# =====================================================================\n\n# Postgres 连接串，Drizzle ORM 和 Better Auth 共用。\n# Postgres connection string — shared by Drizzle ORM and Better Auth.\nDATABASE_URL=\n\n# =====================================================================\n# Better Auth\n# =====================================================================\n\n# Better Auth 用来签名 / 加密 session、CSRF token 等的随机密钥；\n# 生产环境必须独立设置（建议 `openssl rand -base64 32`），切勿提交到仓库。\n# Random secret Better Auth uses to sign/encrypt sessions, CSRF tokens, etc.\n# Generate a fresh value in production (e.g. `openssl rand -base64 32`); never commit.\nBETTER_AUTH_SECRET=\n\n# 生产环境必须设为真实域名（不带尾斜杠），如 https://app.example.com。\n# Google Cloud Console「已获授权的重定向 URI」需要登记\n# `${BETTER_AUTH_URL}/api/auth/callback/google`，否则会触发 redirect_uri_mismatch。\n# Production must be the real domain (no trailing slash), e.g. https://app.example.com.\n# Register `${BETTER_AUTH_URL}/api/auth/callback/google` in Google Cloud Console\n# under \"Authorised redirect URIs\" — mismatch causes redirect_uri_mismatch.\nBETTER_AUTH_URL=\n\n# 浏览器侧拼绝对 callbackURL 用，跟 BETTER_AUTH_URL 保持一致。\n# Used in the browser to build an absolute callbackURL; keep in sync with BETTER_AUTH_URL.\nNEXT_PUBLIC_BASE_URL=\n\n# Google OAuth 凭据（来自 Google Cloud Console -> Credentials -> OAuth 2.0 Client）。\n# Google OAuth credentials (Google Cloud Console -> Credentials -> OAuth 2.0 Client).\nGOOGLE_CLIENT_ID=\nGOOGLE_CLIENT_SECRET=\n\n# 登录入口开关：设置任意非空值后，登录页会显示 Google 登录并隐藏飞书登录；\n# 留空则保持默认（飞书登录）。生产国内 IDC 无法连通 oauth2.googleapis.com，\n# 应当留空；本地 dev 或有海外出口的部署可设为 `1` 开启。NEXT_PUBLIC_ 前缀\n# 让 Next.js 在构建时把值内联到客户端 bundle。\n# Login entry toggle: set to any non-empty value to show Google sign-in and\n# hide Feishu on the login page; leave blank for the default (Feishu).\n# Production runs from a domestic IDC that can't reach oauth2.googleapis.com,\n# so keep it blank there; local dev or overseas-egress deployments can set it\n# to `1`. The NEXT_PUBLIC_ prefix lets Next.js inline the value into the\n# client bundle at build time.\nNEXT_PUBLIC_ENABLE_GOOGLE_LOGIN=\n\n# =====================================================================\n# 主 LLM 提供方：阿里云 DashScope（Qwen 系列 + DeepSeek 兼容模式）\n# Primary LLM provider: Aliyun DashScope (Qwen + DeepSeek compat endpoint)\n# =====================================================================\n\n# DashScope API key，用于简历筛选 chat / 标题生成 / Qwen-VL OCR / JD ranker。\n# DashScope API key — powers screening chat, title generation, Qwen-VL OCR, JD ranker.\nALIBABA_API_KEY=\n\n# DashScope base URL。留空走默认值 https://dashscope.aliyuncs.com/compatible-mode/v1，\n# 私有部署或代理时填入对应地址。\n# DashScope base URL. Leave blank to use the default\n# https://dashscope.aliyuncs.com/compatible-mode/v1; override for private / proxied deploys.\nALIBABA_BASE_URL=\n\n# =====================================================================\n# Voice agent / 语音相关\n# =====================================================================\n\n# ElevenLabs API key，被 LiveKit Python agent 通过 livekit-plugins-elevenlabs 隐式读取\n# （TTS / STT）。在 web 侧的 .env 里写一份，agent 启动时也能拿到。\n# ElevenLabs API key — implicitly read by the LiveKit Python agent\n# (livekit-plugins-elevenlabs) for TTS / STT. Defined here so the agent picks it up too.\nELEVENLABS_API_KEY=\n\n# MiniMax API key。Python agent 用它做正式面试 TTS；web 后端也用它为面试官音色生成\n# 公共试听音频（首次试听生成并上传，后续复用缓存）。\n# MiniMax API key. The Python agent uses it for interview TTS; the web server\n# also uses it to generate public interviewer-voice preview audio on cache miss.\nMINIMAX_API_KEY=\n\n# 可选。MiniMax TTS HTTP base URL，留空默认 https://api.minimax.chat。\n# Optional. MiniMax TTS HTTP base URL. Defaults to https://api.minimax.chat.\nMINIMAX_TTS_BASE_URL=\n\n# =====================================================================\n# Vercel AI Gateway\n# =====================================================================\n\n# Vercel AI Gateway key（用于面试结束后的评估，模型走 google/gemini-2.5-flash 等）。\n# 由 `ai` SDK 的 gateway provider 隐式读取，无需手动 import。\n# Vercel AI Gateway key — used for post-interview evaluation\n# (default model google/gemini-2.5-flash). Read implicitly by the `ai` SDK gateway provider.\nAI_GATEWAY_API_KEY=\n\n# =====================================================================\n# LiveKit Cloud — 语音 agent 运行时\n# LiveKit Cloud — voice agent runtime\n# =====================================================================\n\n# LiveKit Cloud 项目地址 / API 凭据。LIVEKIT_URL 为 wss:// 形式。\n# LiveKit Cloud project URL / API credentials. LIVEKIT_URL is a wss:// endpoint.\n# LIVEKIT_URL=wss://ai-interview-livekit.guadd.fun\n# LIVEKIT_API_KEY=livekit\n# LIVEKIT_API_SECRET=ai-interview\nLIVEKIT_URL=\nLIVEKIT_API_KEY=\nLIVEKIT_API_SECRET=\n\n# 必须与 Python worker 注册的 agent_name 一致（见 agent/src/agent.py）。\n# 服务端用它在 dispatch interview 时定向唤起对应 worker。\n# Must match the agent_name registered by the Python worker (agent/src/agent.py).\n# Used server-side to dispatch interview sessions to the correct worker.\nAGENT_NAME=\n\n# 浏览器侧 AgentDispatch 也需要知道 agent_name，因此暴露一份 NEXT_PUBLIC_ 版本，\n# 保持与 AGENT_NAME 同步。\n# Browser-side AgentDispatch also needs the agent_name; expose a NEXT_PUBLIC_ mirror\n# kept in lock-step with AGENT_NAME.\nNEXT_PUBLIC_AGENT_NAME=\n\n\n# Agent → web 回调的共享密钥，web 端 `/api/agent/*` 路由用它做 HMAC / bearer 校验，\n# 防止任何第三方伪造面试事件。两端值必须一致。\n# Shared secret for agent → web callbacks. The web `/api/agent/*` routes validate it\n# (HMAC / bearer) to reject forged interview events. Both sides must match.\nAGENT_CALLBACK_SECRET=\n\n# =====================================================================\n# PostHog（产品埋点，可选）\n# PostHog (optional product analytics)\n# =====================================================================\n\n# 设为 true 后启用 PostHog 客户端埋点。默认关闭，避免本地开发误上报。\n# Set to true to enable PostHog client-side analytics. Disabled by default\n# to avoid accidental local event capture.\nNEXT_PUBLIC_ENABLE_POSTHOG=false\n\n# PostHog Project token（通常以 phc_ 开头）。这是公开 token，可暴露给浏览器。\n# PostHog project token (usually starts with phc_). This is a public token\n# and is safe to expose to the browser.\nNEXT_PUBLIC_POSTHOG_PROJECT_TOKEN=\n\n# PostHog ingest host。US Cloud 默认 https://us.i.posthog.com；\n# EU Cloud 按 PostHog 项目设置填写对应地址。\n# PostHog ingest host. US Cloud default is https://us.i.posthog.com;\n# use the EU host if the project is hosted in PostHog EU.\nNEXT_PUBLIC_POSTHOG_HOST=https://us.i.posthog.com\n\n# Platform 埋点 dashboard 服务端查询 PostHog 用。PERSONAL_API_KEY 只能放服务端，\n# 不要加 NEXT_PUBLIC_ 前缀。API host 是 PostHog app/API host，不是 ingest host；\n# US Cloud 通常为 https://us.posthog.com，EU Cloud 按项目区域填写。\n# Server-side PostHog query config for the platform analytics dashboard.\n# PERSONAL_API_KEY must stay server-only (no NEXT_PUBLIC_ prefix). API host is\n# the PostHog app/API host, not the ingest host; US Cloud is usually\n# https://us.posthog.com, EU Cloud depends on the project region.\nPOSTHOG_PERSONAL_API_KEY=\nPOSTHOG_PROJECT_ID=\nPOSTHOG_API_HOST=https://us.posthog.com\n\n# =====================================================================\n# Feishu 集成（可选，用于飞书机器人 / 多租户）\n# Feishu integration (optional — Feishu bot / multi-tenant)\n# =====================================================================\n\n# Feishu 应用凭据（来自飞书开放平台 -> 应用 -> 凭证与基础信息）。\n# 支持配置两个独立应用：默认应用走 *_APP_ID / *_APP_SECRET，副应用走带 2 的变量。\n# Feishu app credentials (Feishu Open Platform -> App -> Credentials).\n# Two independent apps are supported: primary uses *_APP_ID / *_APP_SECRET,\n# secondary uses the variables suffixed with 2.\nFEISHU_APP_ID=\nFEISHU_APP_SECRET=\nFEISHU_APP_ID2=\nFEISHU_APP_SECRET2=\n\n# 飞书事件订阅的加密 key 与校验 token，用于解密 / 校验回调消息。\n# Encryption key + verification token for Feishu event subscriptions\n# (decrypt / verify incoming callbacks).\nFEISHU_ENCRYPT_KEY=\nFEISHU_VERIFICATION_TOKEN=\n\n# =====================================================================\n# S3-compatible object storage（简历 PDF、附件上传）\n# S3-compatible object storage (resume PDFs, general attachments)\n# =====================================================================\n\n# S3 / 兼容服务端点。如使用 AWS S3 可留空（SDK 默认走 AWS）。\n# S3 / S3-compatible endpoint. Leave blank for AWS S3 (SDK default).\nS3_ENDPOINT=\nS3_BUCKET_NAME=\nS3_REGION=\nS3_ACCESS_KEY_ID=\nS3_SECRET_ACCESS_KEY=\n\n# 对象 key 前缀，便于把上传和录制隔离到不同子目录（可留空）。\n# Optional key prefix used to namespace uploaded objects (may be empty).\nS3_KEY_PREFIX=\n\n# 是否强制 path-style 访问（MinIO / 部分私有 S3 必须为 true）。\n# Force path-style addressing (required by MinIO / some self-hosted S3). Default false.\nS3_FORCE_PATH_STYLE=\n\n# =====================================================================\n# Redis / resume parse queue（批量简历异步解析）\n# Redis / resume parse queue (async bulk resume parsing)\n# =====================================================================\n\n# Redis 连接串。无用户名但有密码时写作 redis://:password@host:6379/0\n# Redis connection string. For password-only Redis, use redis://:password@host:6379/0\nREDIS_URL=redis://:de893df257e31c51873583cb292a8b24@10.210.16.3:6379/2\n\n# 批量简历解析任务重试次数与指数退避基准时间。\n# Queue retry attempts and exponential-backoff base delay for bulk resume parsing.\nRESUME_PARSE_QUEUE_ATTEMPTS=3\nRESUME_PARSE_QUEUE_BACKOFF_MS=30000\n\n# processing 状态超过该秒数才视为 worker 中断残留，避免长 OCR/评价被误判。\n# Processing items older than this are treated as interrupted worker leftovers.\nRESUME_PARSE_STALE_PROCESSING_SECONDS=900\n\n# 单份 PDF 内 OCR 页级并发与连接类瞬断重试配置。\n# Per-PDF OCR page concurrency and transient connection retry settings.\nRESUME_PARSE_OCR_PAGE_CONCURRENCY=1\nRESUME_PARSE_OCR_ATTEMPTS=3\nRESUME_PARSE_OCR_RETRY_DELAY_MS=1000\n\n# 测试真实解析链路时可设为 true：即使命中同 hash 的已解析缓存，也强制重新从 S3 读取并解析。\n# Set to true when benchmarking the real parse path: bypasses same-hash parsed cache.\nRESUME_PARSE_DISABLE_CACHE=false\n\n# =====================================================================\n# Cloudflare R2 — LiveKit Egress 面试录制存储\n# Cloudflare R2 — LiveKit Egress interview recording storage\n# =====================================================================\n# Endpoint format: https://<account_id>.r2.cloudflarestorage.com\nRECORDING_R2_ENDPOINT=\nRECORDING_R2_BUCKET_NAME=\nRECORDING_R2_REGION=auto\nRECORDING_R2_ACCESS_KEY_ID=\nRECORDING_R2_SECRET_ACCESS_KEY=\nRECORDING_R2_KEY_PREFIX=\nRECORDING_R2_FORCE_PATH_STYLE=true\n\n# =====================================================================\n# 模型覆盖（可选，均带默认值）\n# Model overrides (optional, all have sensible defaults)\n# =====================================================================\n\n# 可选,带默认值。覆盖面试结果评估用的模型(走 Vercel AI gateway),默认 google/gemini-2.5-flash。\n# Optional, has a default. Overrides the interview-evaluation model\n# (via Vercel AI gateway). Defaults to google/gemini-2.5-flash.\nINTERVIEW_EVALUATION_MODEL=\n\n# 可选,带默认值。覆盖 Qwen-VL OCR 模型 ID,默认 qwen-vl-ocr-latest。\n# Optional, has a default. Overrides the Qwen-VL OCR model id. Defaults to\n# qwen-vl-ocr-latest.\nQWEN_OCR_MODEL=\n\n# =====================================================================\n# Resend (transactional email)\n# =====================================================================\n\n# 中文：发件人地址。只写裸邮箱地址（不要加 \"Display <...>\"），\n# 域名必须在 Resend 控制台已验证，否则会被拒绝。\n# 邮件 From 头里的显示名会在运行时由代码动态拼接：\n# 「{系统设置里的公司名} AI HR」<addr>，没填公司名退化为「AI HR」<addr>。\n# 写成 \"Name <addr>\" 也能跑（代码会自动剥掉显示名），但部署脚本里出现\n# `<...>` 会被 shell 当成 stdin 重定向，所以推荐裸地址。\n# English: From address. Use a bare email address (no \"Display <...>\"). The\n# domain MUST be verified in the Resend dashboard. The actual From-header\n# display name is built at runtime as \"{globalConfig.companyName} AI HR\"\n# (or \"AI HR\" when blank). \"Name <addr>\" works too — the code strips the\n# display part — but bare avoids shell-redirection breakage in deploy scripts.\nRESEND_API_KEY=\nRESEND_FROM=noreply@yourdomain.com\n"}, "756dd644ad41c524eeca852c265410e9dc67b5c9": {"t": 1785767493.5682585, "n": 10438, "h": "1b0ac0e82c474644", "c": "# =====================================================================\n# Database\n# =====================================================================\n\n# Postgres 连接串，Drizzle ORM 和 Better Auth 共用。\n# Postgres connection string — shared by Drizzle ORM and Better Auth.\nDATABASE_URL=\n\n# =====================================================================\n# Better Auth\n# =====================================================================\n\n# Better Auth 用来签名 / 加密 session、CSRF token 等的随机密钥；\n# 生产环境必须独立设置（建议 `openssl rand -base64 32`），切勿提交到仓库。\n# Random secret Better Auth uses to sign/encrypt sessions, CSRF tokens, etc.\n# Generate a fresh value in production (e.g. `openssl rand -base64 32`); never commit.\nBETTER_AUTH_SECRET=\n\n# 生产环境必须设为真实域名（不带尾斜杠），如 https://app.example.com。\n# Google Cloud Console「已获授权的重定向 URI」需要登记\n# `${BETTER_AUTH_URL}/api/auth/callback/google`，否则会触发 redirect_uri_mismatch。\n# Production must be the real domain (no trailing slash), e.g. https://app.example.com.\n# Register `${BETTER_AUTH_URL}/api/auth/callback/google` in Google Cloud Console\n# under \"Authorised redirect URIs\" — mismatch causes redirect_uri_mismatch.\nBETTER_AUTH_URL=\n\n# 浏览器侧拼绝对 callbackURL 用，跟 BETTER_AUTH_URL 保持一致。\n# Used in the browser to build an absolute callbackURL; keep in sync with BETTER_AUTH_URL.\nNEXT_PUBLIC_BASE_URL=\n\n# Google OAuth 凭据（来自 Google Cloud Console -> Credentials -> OAuth 2.0 Client）。\n# Google OAuth credentials (Google Cloud Console -> Credentials -> OAuth 2.0 Client).\nGOOGLE_CLIENT_ID=\nGOOGLE_CLIENT_SECRET=\n\n# 登录入口开关：设置任意非空值后，登录页会显示 Google 登录并隐藏飞书登录；\n# 留空则保持默认（飞书登录）。生产国内 IDC 无法连通 oauth2.googleapis.com，\n# 应当留空；本地 dev 或有海外出口的部署可设为 `1` 开启。NEXT_PUBLIC_ 前缀\n# 让 Next.js 在构建时把值内联到客户端 bundle。\n# Login entry toggle: set to any non-empty value to show Google sign-in and\n# hide Feishu on the login page; leave blank for the default (Feishu).\n# Production runs from a domestic IDC that can't reach oauth2.googleapis.com,\n# so keep it blank there; local dev or overseas-egress deployments can set it\n# to `1`. The NEXT_PUBLIC_ prefix lets Next.js inline the value into the\n# client bundle at build time.\nNEXT_PUBLIC_ENABLE_GOOGLE_LOGIN=\n\n# =====================================================================\n# 主 LLM 提供方：阿里云 DashScope（Qwen 系列 + DeepSeek 兼容模式）\n# Primary LLM provider: Aliyun DashScope (Qwen + DeepSeek compat endpoint)\n# =====================================================================\n\n# DashScope API key，用于简历筛选 chat / 标题生成 / Qwen-VL OCR / JD ranker。\n# DashScope API key — powers screening chat, title generation, Qwen-VL OCR, JD ranker.\nALIBABA_API_KEY=\n\n# DashScope base URL。留空走默认值 https://dashscope.aliyuncs.com/compatible-mode/v1，\n# 私有部署或代理时填入对应地址。\n# DashScope base URL. Leave blank to use the default\n# https://dashscope.aliyuncs.com/compatible-mode/v1; override for private / proxied deploys.\nALIBABA_BASE_URL=\n\n# =====================================================================\n# Voice agent / 语音相关\n# =====================================================================\n\n# ElevenLabs API key，被 LiveKit Python agent 通过 livekit-plugins-elevenlabs 隐式读取\n# （TTS / STT）。在 web 侧的 .env 里写一份，agent 启动时也能拿到。\n# ElevenLabs API key — implicitly read by the LiveKit Python agent\n# (livekit-plugins-elevenlabs) for TTS / STT. Defined here so the agent picks it up too.\nELEVENLABS_API_KEY=\n\n# MiniMax API key。Python agent 用它做正式面试 TTS；web 后端也用它为面试官音色生成\n# 公共试听音频（首次试听生成并上传，后续复用缓存）。\n# MiniMax API key. The Python agent uses it for interview TTS; the web server\n# also uses it to generate public interviewer-voice preview audio on cache miss.\nMINIMAX_API_KEY=\n\n# 可选。MiniMax TTS HTTP base URL，留空默认 https://api.minimax.chat。\n# Optional. MiniMax TTS HTTP base URL. Defaults to https://api.minimax.chat.\nMINIMAX_TTS_BASE_URL=\n\n# =====================================================================\n# Vercel AI Gateway\n# =====================================================================\n\n# Vercel AI Gateway key（用于面试结束后的评估，模型走 google/gemini-2.5-flash 等）。\n# 由 `ai` SDK 的 gateway provider 隐式读取，无需手动 import。\n# Vercel AI Gateway key — used for post-interview evaluation\n# (default model google/gemini-2.5-flash). Read implicitly by the `ai` SDK gateway provider.\nAI_GATEWAY_API_KEY=\n\n# =====================================================================\n# LiveKit Cloud — 语音 agent 运行时\n# LiveKit Cloud — voice agent runtime\n# =====================================================================\n\n# LiveKit Cloud 项目地址 / API 凭据。LIVEKIT_URL 为 wss:// 形式。\n# LiveKit Cloud project URL / API credentials. LIVEKIT_URL is a wss:// endpoint.\n# LIVEKIT_URL=wss://ai-interview-livekit.guadd.fun\n# LIVEKIT_API_KEY=livekit\n# LIVEKIT_API_SECRET=ai-interview\nLIVEKIT_URL=\nLIVEKIT_API_KEY=\nLIVEKIT_API_SECRET=\n\n# 必须与 Python worker 注册的 agent_name 一致（见 agent/src/agent.py）。\n# 服务端用它在 dispatch interview 时定向唤起对应 worker。\n# Must match the agent_name registered by the Python worker (agent/src/agent.py).\n# Used server-side to dispatch interview sessions to the correct worker.\nAGENT_NAME=\n\n# 浏览器侧 AgentDispatch 也需要知道 agent_name，因此暴露一份 NEXT_PUBLIC_ 版本，\n# 保持与 AGENT_NAME 同步。\n# Browser-side AgentDispatch also needs the agent_name; expose a NEXT_PUBLIC_ mirror\n# kept in lock-step with AGENT_NAME.\nNEXT_PUBLIC_AGENT_NAME=\n\n\n# Agent → web 回调的共享密钥，web 端 `/api/agent/*` 路由用它做 HMAC / bearer 校验，\n# 防止任何第三方伪造面试事件。两端值必须一致。\n# Shared secret for agent → web callbacks. The web `/api/agent/*` routes validate it\n# (HMAC / bearer) to reject forged interview events. Both sides must match.\nAGENT_CALLBACK_SECRET=\n\n# =====================================================================\n# PostHog（产品埋点，可选）\n# PostHog (optional product analytics)\n# =====================================================================\n\n# 设为 true 后启用 PostHog 客户端埋点。默认关闭，避免本地开发误上报。\n# Set to true to enable PostHog client-side analytics. Disabled by default\n# to avoid accidental local event capture.\nNEXT_PUBLIC_ENABLE_POSTHOG=false\n\n# PostHog Project token（通常以 phc_ 开头）。这是公开 token，可暴露给浏览器。\n# PostHog project token (usually starts with phc_). This is a public token\n# and is safe to expose to the browser.\nNEXT_PUBLIC_POSTHOG_PROJECT_TOKEN=\n\n# PostHog ingest host。US Cloud 默认 https://us.i.posthog.com；\n# EU Cloud 按 PostHog 项目设置填写对应地址。\n# PostHog ingest host. US Cloud default is https://us.i.posthog.com;\n# use the EU host if the project is hosted in PostHog EU.\nNEXT_PUBLIC_POSTHOG_HOST=https://us.i.posthog.com\n\n# Platform 埋点 dashboard 服务端查询 PostHog 用。PERSONAL_API_KEY 只能放服务端，\n# 不要加 NEXT_PUBLIC_ 前缀。API host 是 PostHog app/API host，不是 ingest host；\n# US Cloud 通常为 https://us.posthog.com，EU Cloud 按项目区域填写。\n# Server-side PostHog query config for the platform analytics dashboard.\n# PERSONAL_API_KEY must stay server-only (no NEXT_PUBLIC_ prefix). API host is\n# the PostHog app/API host, not the ingest host; US Cloud is usually\n# https://us.posthog.com, EU Cloud depends on the project region.\nPOSTHOG_PERSONAL_API_KEY=\nPOSTHOG_PROJECT_ID=\nPOSTHOG_API_HOST=https://us.posthog.com\n\n# =====================================================================\n# Feishu 集成（可选，用于飞书机器人 / 多租户）\n# Feishu integration (optional — Feishu bot / multi-tenant)\n# =====================================================================\n\n# Feishu 应用凭据（来自飞书开放平台 -> 应用 -> 凭证与基础信息）。\n# 支持配置两个独立应用：默认应用走 *_APP_ID / *_APP_SECRET，副应用走带 2 的变量。\n# Feishu app credentials (Feishu Open Platform -> App -> Credentials).\n# Two independent apps are supported: primary uses *_APP_ID / *_APP_SECRET,\n# secondary uses the variables suffixed with 2.\nFEISHU_APP_ID=\nFEISHU_APP_SECRET=\nFEISHU_APP_ID2=\nFEISHU_APP_SECRET2=\n\n# 飞书事件订阅的加密 key 与校验 token，用于解密 / 校验回调消息。\n# Encryption key + verification token for Feishu event subscriptions\n# (decrypt / verify incoming callbacks).\nFEISHU_ENCRYPT_KEY=\nFEISHU_VERIFICATION_TOKEN=\n\n# =====================================================================\n# S3-compatible object storage（简历 PDF、附件上传）\n# S3-compatible object storage (resume PDFs, general attachments)\n# =====================================================================\n\n# S3 / 兼容服务端点。如使用 AWS S3 可留空（SDK 默认走 AWS）。\n# S3 / S3-compatible endpoint. Leave blank for AWS S3 (SDK default).\nS3_ENDPOINT=\nS3_BUCKET_NAME=\nS3_REGION=\nS3_ACCESS_KEY_ID=\nS3_SECRET_ACCESS_KEY=\n\n# 对象 key 前缀，便于把上传和录制隔离到不同子目录（可留空）。\n# Optional key prefix used to namespace uploaded objects (may be empty).\nS3_KEY_PREFIX=\n\n# 是否强制 path-style 访问（MinIO / 部分私有 S3 必须为 true）。\n# Force path-style addressing (required by MinIO / some self-hosted S3). Default false.\nS3_FORCE_PATH_STYLE=\n\n# =====================================================================\n# Cloudflare R2 — LiveKit Egress 面试录制存储\n# Cloudflare R2 — LiveKit Egress interview recording storage\n# =====================================================================\n# Endpoint format: https://<account_id>.r2.cloudflarestorage.com\nRECORDING_R2_ENDPOINT=\nRECORDING_R2_BUCKET_NAME=\nRECORDING_R2_REGION=auto\nRECORDING_R2_ACCESS_KEY_ID=\nRECORDING_R2_SECRET_ACCESS_KEY=\nRECORDING_R2_KEY_PREFIX=\nRECORDING_R2_FORCE_PATH_STYLE=true\n\n# =====================================================================\n# 模型覆盖（可选，均带默认值）\n# Model overrides (optional, all have sensible defaults)\n# =====================================================================\n\n# 可选,带默认值。覆盖面试结果评估用的模型(走 Vercel AI gateway),默认 google/gemini-2.5-flash。\n# Optional, has a default. Overrides the interview-evaluation model\n# (via Vercel AI gateway). Defaults to google/gemini-2.5-flash.\nINTERVIEW_EVALUATION_MODEL=\n\n# 可选,带默认值。覆盖 Qwen-VL OCR 模型 ID,默认 qwen-vl-ocr-latest。\n# Optional, has a default. Overrides the Qwen-VL OCR model id. Defaults to\n# qwen-vl-ocr-latest.\nQWEN_OCR_MODEL=\n\n# =====================================================================\n# Resend (transactional email)\n# =====================================================================\n\n# 中文：发件人地址。只写裸邮箱地址（不要加 \"Display <...>\"），\n# 域名必须在 Resend 控制台已验证，否则会被拒绝。\n# 邮件 From 头里的显示名会在运行时由代码动态拼接：\n# 「{系统设置里的公司名} AI HR」<addr>，没填公司名退化为「AI HR」<addr>。\n# 写成 \"Name <addr>\" 也能跑（代码会自动剥掉显示名），但部署脚本里出现\n# `<...>` 会被 shell 当成 stdin 重定向，所以推荐裸地址。\n# English: From address. Use a bare email address (no \"Display <...>\"). The\n# domain MUST be verified in the Resend dashboard. The actual From-header\n# display name is built at runtime as \"{globalConfig.companyName} AI HR\"\n# (or \"AI HR\" when blank). \"Name <addr>\" works too — the code strips the\n# display part — but bare avoids shell-redirection breakage in deploy scripts.\nRESEND_API_KEY=\nRESEND_FROM=noreply@yourdomain.com\n"}, "7d2fc341723a70c7f42286ad22d8e022a7b39f7c": {"t": 1785767494.753013, "n": 9873, "h": "97f88112565e2084", "c": "# =====================================================================\n# Database\n# =====================================================================\n\n# Postgres 连接串，Drizzle ORM 和 Better Auth 共用。\n# Postgres connection string — shared by Drizzle ORM and Better Auth.\nDATABASE_URL=\n\n# =====================================================================\n# Better Auth\n# =====================================================================\n\n# Better Auth 用来签名 / 加密 session、CSRF token 等的随机密钥；\n# 生产环境必须独立设置（建议 `openssl rand -base64 32`），切勿提交到仓库。\n# Random secret Better Auth uses to sign/encrypt sessions, CSRF tokens, etc.\n# Generate a fresh value in production (e.g. `openssl rand -base64 32`); never commit.\nBETTER_AUTH_SECRET=\n\n# 生产环境必须设为真实域名（不带尾斜杠），如 https://app.example.com。\n# Google Cloud Console「已获授权的重定向 URI」需要登记\n# `${BETTER_AUTH_URL}/api/auth/callback/google`，否则会触发 redirect_uri_mismatch。\n# Production must be the real domain (no trailing slash), e.g. https://app.example.com.\n# Register `${BETTER_AUTH_URL}/api/auth/callback/google` in Google Cloud Console\n# under \"Authorised redirect URIs\" — mismatch causes redirect_uri_mismatch.\nBETTER_AUTH_URL=\n\n# 浏览器侧拼绝对 callbackURL 用，跟 BETTER_AUTH_URL 保持一致。\n# Used in the browser to build an absolute callbackURL; keep in sync with BETTER_AUTH_URL.\nNEXT_PUBLIC_BASE_URL=\n\n# Google OAuth 凭据（来自 Google Cloud Console -> Credentials -> OAuth 2.0 Client）。\n# Google OAuth credentials (Google Cloud Console -> Credentials -> OAuth 2.0 Client).\nGOOGLE_CLIENT_ID=\nGOOGLE_CLIENT_SECRET=\n\n# 登录入口开关：设置任意非空值后，登录页会显示 Google 登录并隐藏飞书登录；\n# 留空则保持默认（飞书登录）。生产国内 IDC 无法连通 oauth2.googleapis.com，\n# 应当留空；本地 dev 或有海外出口的部署可设为 `1` 开启。NEXT_PUBLIC_ 前缀\n# 让 Next.js 在构建时把值内联到客户端 bundle。\n# Login entry toggle: set to any non-empty value to show Google sign-in and\n# hide Feishu on the login page; leave blank for the default (Feishu).\n# Production runs from a domestic IDC that can't reach oauth2.googleapis.com,\n# so keep it blank there; local dev or overseas-egress deployments can set it\n# to `1`. The NEXT_PUBLIC_ prefix lets Next.js inline the value into the\n# client bundle at build time.\nNEXT_PUBLIC_ENABLE_GOOGLE_LOGIN=\n\n# =====================================================================\n# 主 LLM 提供方：阿里云 DashScope（Qwen 系列 + DeepSeek 兼容模式）\n# Primary LLM provider: Aliyun DashScope (Qwen + DeepSeek compat endpoint)\n# =====================================================================\n\n# DashScope API key，用于简历筛选 chat / 标题生成 / Qwen-VL OCR / JD ranker。\n# DashScope API key — powers screening chat, title generation, Qwen-VL OCR, JD ranker.\nALIBABA_API_KEY=\n\n# DashScope base URL。留空走默认值 https://dashscope.aliyuncs.com/compatible-mode/v1，\n# 私有部署或代理时填入对应地址。\n# DashScope base URL. Leave blank to use the default\n# https://dashscope.aliyuncs.com/compatible-mode/v1; override for private / proxied deploys.\nALIBABA_BASE_URL=\n\n# =====================================================================\n# Voice agent / 语音相关\n# =====================================================================\n\n# ElevenLabs API key，被 LiveKit Python agent 通过 livekit-plugins-elevenlabs 隐式读取\n# （TTS / STT）。在 web 侧的 .env 里写一份，agent 启动时也能拿到。\n# ElevenLabs API key — implicitly read by the LiveKit Python agent\n# (livekit-plugins-elevenlabs) for TTS / STT. Defined here so the agent picks it up too.\nELEVENLABS_API_KEY=\n\n# MiniMax API key。Python agent 用它做正式面试 TTS；web 后端也用它为面试官音色生成\n# 公共试听音频（首次试听生成并上传，后续复用缓存）。\n# MiniMax API key. The Python agent uses it for interview TTS; the web server\n# also uses it to generate public interviewer-voice preview audio on cache miss.\nMINIMAX_API_KEY=\n\n# 可选。MiniMax TTS HTTP base URL，留空默认 https://api.minimax.chat。\n# Optional. MiniMax TTS HTTP base URL. Defaults to https://api.minimax.chat.\nMINIMAX_TTS_BASE_URL=\n\n# =====================================================================\n# Vercel AI Gateway\n# =====================================================================\n\n# Vercel AI Gateway key（用于面试结束后的评估，模型走 google/gemini-2.5-flash 等）。\n# 由 `ai` SDK 的 gateway provider 隐式读取，无需手动 import。\n# Vercel AI Gateway key — used for post-interview evaluation\n# (default model google/gemini-2.5-flash). Read implicitly by the `ai` SDK gateway provider.\nAI_GATEWAY_API_KEY=\n\n# =====================================================================\n# LiveKit Cloud — 语音 agent 运行时\n# LiveKit Cloud — voice agent runtime\n# =====================================================================\n\n# LiveKit Cloud 项目地址 / API 凭据。LIVEKIT_URL 为 wss:// 形式。\n# LiveKit Cloud project URL / API credentials. LIVEKIT_URL is a wss:// endpoint.\n# LIVEKIT_URL=wss://ai-interview-livekit.guadd.fun\n# LIVEKIT_API_KEY=livekit\n# LIVEKIT_API_SECRET=ai-interview\nLIVEKIT_URL=\nLIVEKIT_API_KEY=\nLIVEKIT_API_SECRET=\n\n# 必须与 Python worker 注册的 agent_name 一致（见 agent/src/agent.py）。\n# 服务端用它在 dispatch interview 时定向唤起对应 worker。\n# Must match the agent_name registered by the Python worker (agent/src/agent.py).\n# Used server-side to dispatch interview sessions to the correct worker.\nAGENT_NAME=\n\n# 浏览器侧 AgentDispatch 也需要知道 agent_name，因此暴露一份 NEXT_PUBLIC_ 版本，\n# 保持与 AGENT_NAME 同步。\n# Browser-side AgentDispatch also needs the agent_name; expose a NEXT_PUBLIC_ mirror\n# kept in lock-step with AGENT_NAME.\nNEXT_PUBLIC_AGENT_NAME=\n\n\n# Agent → web 回调的共享密钥，web 端 `/api/agent/*` 路由用它做 HMAC / bearer 校验，\n# 防止任何第三方伪造面试事件。两端值必须一致。\n# Shared secret for agent → web callbacks. The web `/api/agent/*` routes validate it\n# (HMAC / bearer) to reject forged interview events. Both sides must match.\nAGENT_CALLBACK_SECRET=\n\n# =====================================================================\n# PostHog（产品埋点，可选）\n# PostHog (optional product analytics)\n# =====================================================================\n\n# 设为 true 后启用 PostHog 客户端埋点。默认关闭，避免本地开发误上报。\n# Set to true to enable PostHog client-side analytics. Disabled by default\n# to avoid accidental local event capture.\nNEXT_PUBLIC_ENABLE_POSTHOG=false\n\n# PostHog Project token（通常以 phc_ 开头）。这是公开 token，可暴露给浏览器。\n# PostHog project token (usually starts with phc_). This is a public token\n# and is safe to expose to the browser.\nNEXT_PUBLIC_POSTHOG_PROJECT_TOKEN=\n\n# PostHog ingest host。US Cloud 默认 https://us.i.posthog.com；\n# EU Cloud 按 PostHog 项目设置填写对应地址。\n# PostHog ingest host. US Cloud default is https://us.i.posthog.com;\n# use the EU host if the project is hosted in PostHog EU.\nNEXT_PUBLIC_POSTHOG_HOST=https://us.i.posthog.com\n\n# =====================================================================\n# Feishu 集成（可选，用于飞书机器人 / 多租户）\n# Feishu integration (optional — Feishu bot / multi-tenant)\n# =====================================================================\n\n# Feishu 应用凭据（来自飞书开放平台 -> 应用 -> 凭证与基础信息）。\n# 支持配置两个独立应用：默认应用走 *_APP_ID / *_APP_SECRET，副应用走带 2 的变量。\n# Feishu app credentials (Feishu Open Platform -> App -> Credentials).\n# Two independent apps are supported: primary uses *_APP_ID / *_APP_SECRET,\n# secondary uses the variables suffixed with 2.\nFEISHU_APP_ID=\nFEISHU_APP_SECRET=\nFEISHU_APP_ID2=\nFEISHU_APP_SECRET2=\n\n# 飞书事件订阅的加密 key 与校验 token，用于解密 / 校验回调消息。\n# Encryption key + verification token for Feishu event subscriptions\n# (decrypt / verify incoming callbacks).\nFEISHU_ENCRYPT_KEY=\nFEISHU_VERIFICATION_TOKEN=\n\n# =====================================================================\n# S3-compatible object storage（简历 PDF、附件上传）\n# S3-compatible object storage (resume PDFs, general attachments)\n# =====================================================================\n\n# S3 / 兼容服务端点。如使用 AWS S3 可留空（SDK 默认走 AWS）。\n# S3 / S3-compatible endpoint. Leave blank for AWS S3 (SDK default).\nS3_ENDPOINT=\nS3_BUCKET_NAME=\nS3_REGION=\nS3_ACCESS_KEY_ID=\nS3_SECRET_ACCESS_KEY=\n\n# 对象 key 前缀，便于把上传和录制隔离到不同子目录（可留空）。\n# Optional key prefix used to namespace uploaded objects (may be empty).\nS3_KEY_PREFIX=\n\n# 是否强制 path-style 访问（MinIO / 部分私有 S3 必须为 true）。\n# Force path-style addressing (required by MinIO / some self-hosted S3). Default false.\nS3_FORCE_PATH_STYLE=\n\n# =====================================================================\n# Cloudflare R2 — LiveKit Egress 面试录制存储\n# Cloudflare R2 — LiveKit Egress interview recording storage\n# =====================================================================\n# Endpoint format: https://<account_id>.r2.cloudflarestorage.com\nRECORDING_R2_ENDPOINT=\nRECORDING_R2_BUCKET_NAME=\nRECORDING_R2_REGION=auto\nRECORDING_R2_ACCESS_KEY_ID=\nRECORDING_R2_SECRET_ACCESS_KEY=\nRECORDING_R2_KEY_PREFIX=\nRECORDING_R2_FORCE_PATH_STYLE=true\n\n# =====================================================================\n# 模型覆盖（可选，均带默认值）\n# Model overrides (optional, all have sensible defaults)\n# =====================================================================\n\n# 可选,带默认值。覆盖面试结果评估用的模型(走 Vercel AI gateway),默认 google/gemini-2.5-flash。\n# Optional, has a default. Overrides the interview-evaluation model\n# (via Vercel AI gateway). Defaults to google/gemini-2.5-flash.\nINTERVIEW_EVALUATION_MODEL=\n\n# 可选,带默认值。覆盖 Qwen-VL OCR 模型 ID,默认 qwen-vl-ocr-latest。\n# Optional, has a default. Overrides the Qwen-VL OCR model id. Defaults to\n# qwen-vl-ocr-latest.\nQWEN_OCR_MODEL=\n\n# =====================================================================\n# Resend (transactional email)\n# =====================================================================\n\n# 中文：发件人地址。只写裸邮箱地址（不要加 \"Display <...>\"），\n# 域名必须在 Resend 控制台已验证，否则会被拒绝。\n# 邮件 From 头里的显示名会在运行时由代码动态拼接：\n# 「{系统设置里的公司名} AI HR」<addr>，没填公司名退化为「AI HR」<addr>。\n# 写成 \"Name <addr>\" 也能跑（代码会自动剥掉显示名），但部署脚本里出现\n# `<...>` 会被 shell 当成 stdin 重定向，所以推荐裸地址。\n# English: From address. Use a bare email address (no \"Display <...>\"). The\n# domain MUST be verified in the Resend dashboard. The actual From-header\n# display name is built at runtime as \"{globalConfig.companyName} AI HR\"\n# (or \"AI HR\" when blank). \"Name <addr>\" works too — the code strips the\n# display part — but bare avoids shell-redirection breakage in deploy scripts.\nRESEND_API_KEY=\nRESEND_FROM=noreply@yourdomain.com\n"}, "590b220b6998e217b15e5e4ef5f696f6ed66eaca": {"t": 1785767496.1015024, "n": 8995, "h": "ad7144a42ca9a869", "c": "# =====================================================================\n# Database\n# =====================================================================\n\n# Postgres 连接串，Drizzle ORM 和 Better Auth 共用。\n# Postgres connection string — shared by Drizzle ORM and Better Auth.\nDATABASE_URL=\n\n# =====================================================================\n# Better Auth\n# =====================================================================\n\n# Better Auth 用来签名 / 加密 session、CSRF token 等的随机密钥；\n# 生产环境必须独立设置（建议 `openssl rand -base64 32`），切勿提交到仓库。\n# Random secret Better Auth uses to sign/encrypt sessions, CSRF tokens, etc.\n# Generate a fresh value in production (e.g. `openssl rand -base64 32`); never commit.\nBETTER_AUTH_SECRET=\n\n# 生产环境必须设为真实域名（不带尾斜杠），如 https://app.example.com。\n# Google Cloud Console「已获授权的重定向 URI」需要登记\n# `${BETTER_AUTH_URL}/api/auth/callback/google`，否则会触发 redirect_uri_mismatch。\n# Production must be the real domain (no trailing slash), e.g. https://app.example.com.\n# Register `${BETTER_AUTH_URL}/api/auth/callback/google` in Google Cloud Console\n# under \"Authorised redirect URIs\" — mismatch causes redirect_uri_mismatch.\nBETTER_AUTH_URL=\n\n# 浏览器侧拼绝对 callbackURL 用，跟 BETTER_AUTH_URL 保持一致。\n# Used in the browser to build an absolute callbackURL; keep in sync with BETTER_AUTH_URL.\nNEXT_PUBLIC_BASE_URL=\n\n# Google OAuth 凭据（来自 Google Cloud Console -> Credentials -> OAuth 2.0 Client）。\n# Google OAuth credentials (Google Cloud Console -> Credentials -> OAuth 2.0 Client).\nGOOGLE_CLIENT_ID=\nGOOGLE_CLIENT_SECRET=\n\n# 登录入口开关：设置任意非空值后，登录页会显示 Google 登录并隐藏飞书登录；\n# 留空则保持默认（飞书登录）。生产国内 IDC 无法连通 oauth2.googleapis.com，\n# 应当留空；本地 dev 或有海外出口的部署可设为 `1` 开启。NEXT_PUBLIC_ 前缀\n# 让 Next.js 在构建时把值内联到客户端 bundle。\n# Login entry toggle: set to any non-empty value to show Google sign-in and\n# hide Feishu on the login page; leave blank for the default (Feishu).\n# Production runs from a domestic IDC that can't reach oauth2.googleapis.com,\n# so keep it blank there; local dev or overseas-egress deployments can set it\n# to `1`. The NEXT_PUBLIC_ prefix lets Next.js inline the value into the\n# client bundle at build time.\nNEXT_PUBLIC_ENABLE_GOOGLE_LOGIN=\n\n# =====================================================================\n# 主 LLM 提供方：阿里云 DashScope（Qwen 系列 + DeepSeek 兼容模式）\n# Primary LLM provider: Aliyun DashScope (Qwen + DeepSeek compat endpoint)\n# =====================================================================\n\n# DashScope API key，用于简历筛选 chat / 标题生成 / Qwen-VL OCR / JD ranker。\n# DashScope API key — powers screening chat, title generation, Qwen-VL OCR, JD ranker.\nALIBABA_API_KEY=\n\n# DashScope base URL。留空走默认值 https://dashscope.aliyuncs.com/compatible-mode/v1，\n# 私有部署或代理时填入对应地址。\n# DashScope base URL. Leave blank to use the default\n# https://dashscope.aliyuncs.com/compatible-mode/v1; override for private / proxied deploys.\nALIBABA_BASE_URL=\n\n# =====================================================================\n# Voice agent / 语音相关\n# =====================================================================\n\n# ElevenLabs API key，被 LiveKit Python agent 通过 livekit-plugins-elevenlabs 隐式读取\n# （TTS / STT）。在 web 侧的 .env 里写一份，agent 启动时也能拿到。\n# ElevenLabs API key — implicitly read by the LiveKit Python agent\n# (livekit-plugins-elevenlabs) for TTS / STT. Defined here so the agent picks it up too.\nELEVENLABS_API_KEY=\n\n# MiniMax API key。Python agent 用它做正式面试 TTS；web 后端也用它为面试官音色生成\n# 公共试听音频（首次试听生成并上传，后续复用缓存）。\n# MiniMax API key. The Python agent uses it for interview TTS; the web server\n# also uses it to generate public interviewer-voice preview audio on cache miss.\nMINIMAX_API_KEY=\n\n# 可选。MiniMax TTS HTTP base URL，留空默认 https://api.minimax.chat。\n# Optional. MiniMax TTS HTTP base URL. Defaults to https://api.minimax.chat.\nMINIMAX_TTS_BASE_URL=\n\n# =====================================================================\n# Vercel AI Gateway\n# =====================================================================\n\n# Vercel AI Gateway key（用于面试结束后的评估，模型走 google/gemini-2.5-flash 等）。\n# 由 `ai` SDK 的 gateway provider 隐式读取，无需手动 import。\n# Vercel AI Gateway key — used for post-interview evaluation\n# (default model google/gemini-2.5-flash). Read implicitly by the `ai` SDK gateway provider.\nAI_GATEWAY_API_KEY=\n\n# =====================================================================\n# LiveKit Cloud — 语音 agent 运行时\n# LiveKit Cloud — voice agent runtime\n# =====================================================================\n\n# LiveKit Cloud 项目地址 / API 凭据。LIVEKIT_URL 为 wss:// 形式。\n# LiveKit Cloud project URL / API credentials. LIVEKIT_URL is a wss:// endpoint.\n# LIVEKIT_URL=wss://ai-interview-livekit.guadd.fun\n# LIVEKIT_API_KEY=livekit\n# LIVEKIT_API_SECRET=ai-interview\nLIVEKIT_URL=\nLIVEKIT_API_KEY=\nLIVEKIT_API_SECRET=\n\n# 必须与 Python worker 注册的 agent_name 一致（见 agent/src/agent.py）。\n# 服务端用它在 dispatch interview 时定向唤起对应 worker。\n# Must match the agent_name registered by the Python worker (agent/src/agent.py).\n# Used server-side to dispatch interview sessions to the correct worker.\nAGENT_NAME=\n\n# 浏览器侧 AgentDispatch 也需要知道 agent_name，因此暴露一份 NEXT_PUBLIC_ 版本，\n# 保持与 AGENT_NAME 同步。\n# Browser-side AgentDispatch also needs the agent_name; expose a NEXT_PUBLIC_ mirror\n# kept in lock-step with AGENT_NAME.\nNEXT_PUBLIC_AGENT_NAME=\n\n\n# Agent → web 回调的共享密钥，web 端 `/api/agent/*` 路由用它做 HMAC / bearer 校验，\n# 防止任何第三方伪造面试事件。两端值必须一致。\n# Shared secret for agent → web callbacks. The web `/api/agent/*` routes validate it\n# (HMAC / bearer) to reject forged interview events. Both sides must match.\nAGENT_CALLBACK_SECRET=\n\n# =====================================================================\n# Feishu 集成（可选，用于飞书机器人 / 多租户）\n# Feishu integration (optional — Feishu bot / multi-tenant)\n# =====================================================================\n\n# Feishu 应用凭据（来自飞书开放平台 -> 应用 -> 凭证与基础信息）。\n# 支持配置两个独立应用：默认应用走 *_APP_ID / *_APP_SECRET，副应用走带 2 的变量。\n# Feishu app credentials (Feishu Open Platform -> App -> Credentials).\n# Two independent apps are supported: primary uses *_APP_ID / *_APP_SECRET,\n# secondary uses the variables suffixed with 2.\nFEISHU_APP_ID=\nFEISHU_APP_SECRET=\nFEISHU_APP_ID2=\nFEISHU_APP_SECRET2=\n\n# 飞书事件订阅的加密 key 与校验 token，用于解密 / 校验回调消息。\n# Encryption key + verification token for Feishu event subscriptions\n# (decrypt / verify incoming callbacks).\nFEISHU_ENCRYPT_KEY=\nFEISHU_VERIFICATION_TOKEN=\n\n# =====================================================================\n# S3-compatible object storage（简历 PDF、附件上传）\n# S3-compatible object storage (resume PDFs, general attachments)\n# =====================================================================\n\n# S3 / 兼容服务端点。如使用 AWS S3 可留空（SDK 默认走 AWS）。\n# S3 / S3-compatible endpoint. Leave blank for AWS S3 (SDK default).\nS3_ENDPOINT=\nS3_BUCKET_NAME=\nS3_REGION=\nS3_ACCESS_KEY_ID=\nS3_SECRET_ACCESS_KEY=\n\n# 对象 key 前缀，便于把上传和录制隔离到不同子目录（可留空）。\n# Optional key prefix used to namespace uploaded objects (may be empty).\nS3_KEY_PREFIX=\n\n# 是否强制 path-style 访问（MinIO / 部分私有 S3 必须为 true）。\n# Force path-style addressing (required by MinIO / some self-hosted S3). Default false.\nS3_FORCE_PATH_STYLE=\n\n# =====================================================================\n# Cloudflare R2 — LiveKit Egress 面试录制存储\n# Cloudflare R2 — LiveKit Egress interview recording storage\n# =====================================================================\n# Endpoint format: https://<account_id>.r2.cloudflarestorage.com\nRECORDING_R2_ENDPOINT=\nRECORDING_R2_BUCKET_NAME=\nRECORDING_R2_REGION=auto\nRECORDING_R2_ACCESS_KEY_ID=\nRECORDING_R2_SECRET_ACCESS_KEY=\nRECORDING_R2_KEY_PREFIX=\nRECORDING_R2_FORCE_PATH_STYLE=true\n\n# =====================================================================\n# 模型覆盖（可选，均带默认值）\n# Model overrides (optional, all have sensible defaults)\n# =====================================================================\n\n# 可选,带默认值。覆盖面试结果评估用的模型(走 Vercel AI gateway),默认 google/gemini-2.5-flash。\n# Optional, has a default. Overrides the interview-evaluation model\n# (via Vercel AI gateway). Defaults to google/gemini-2.5-flash.\nINTERVIEW_EVALUATION_MODEL=\n\n# 可选,带默认值。覆盖 Qwen-VL OCR 模型 ID,默认 qwen-vl-ocr-latest。\n# Optional, has a default. Overrides the Qwen-VL OCR model id. Defaults to\n# qwen-vl-ocr-latest.\nQWEN_OCR_MODEL=\n\n# =====================================================================\n# Resend (transactional email)\n# =====================================================================\n\n# 中文：发件人地址。只写裸邮箱地址（不要加 \"Display <...>\"），\n# 域名必须在 Resend 控制台已验证，否则会被拒绝。\n# 邮件 From 头里的显示名会在运行时由代码动态拼接：\n# 「{系统设置里的公司名} AI HR」<addr>，没填公司名退化为「AI HR」<addr>。\n# 写成 \"Name <addr>\" 也能跑（代码会自动剥掉显示名），但部署脚本里出现\n# `<...>` 会被 shell 当成 stdin 重定向，所以推荐裸地址。\n# English: From address. Use a bare email address (no \"Display <...>\"). The\n# domain MUST be verified in the Resend dashboard. The actual From-header\n# display name is built at runtime as \"{globalConfig.companyName} AI HR\"\n# (or \"AI HR\" when blank). \"Name <addr>\" works too — the code strips the\n# display part — but bare avoids shell-redirection breakage in deploy scripts.\nRESEND_API_KEY=\nRESEND_FROM=noreply@yourdomain.com\n"}, "28e7ab7b1b6823b5d965094364d7db5c7d6c8591": {"t": 1785767497.3951657, "n": 8567, "h": "bec32f28404d6b47", "c": "# =====================================================================\n# Database\n# =====================================================================\n\n# Postgres 连接串，Drizzle ORM 和 Better Auth 共用。\n# Postgres connection string — shared by Drizzle ORM and Better Auth.\nDATABASE_URL=\n\n# =====================================================================\n# Better Auth\n# =====================================================================\n\n# Better Auth 用来签名 / 加密 session、CSRF token 等的随机密钥；\n# 生产环境必须独立设置（建议 `openssl rand -base64 32`），切勿提交到仓库。\n# Random secret Better Auth uses to sign/encrypt sessions, CSRF tokens, etc.\n# Generate a fresh value in production (e.g. `openssl rand -base64 32`); never commit.\nBETTER_AUTH_SECRET=\n\n# 生产环境必须设为真实域名（不带尾斜杠），如 https://app.example.com。\n# Google Cloud Console「已获授权的重定向 URI」需要登记\n# `${BETTER_AUTH_URL}/api/auth/callback/google`，否则会触发 redirect_uri_mismatch。\n# Production must be the real domain (no trailing slash), e.g. https://app.example.com.\n# Register `${BETTER_AUTH_URL}/api/auth/callback/google` in Google Cloud Console\n# under \"Authorised redirect URIs\" — mismatch causes redirect_uri_mismatch.\nBETTER_AUTH_URL=\n\n# 浏览器侧拼绝对 callbackURL 用，跟 BETTER_AUTH_URL 保持一致。\n# Used in the browser to build an absolute callbackURL; keep in sync with BETTER_AUTH_URL.\nNEXT_PUBLIC_BASE_URL=\n\n# Google OAuth 凭据（来自 Google Cloud Console -> Credentials -> OAuth 2.0 Client）。\n# Google OAuth credentials (Google Cloud Console -> Credentials -> OAuth 2.0 Client).\nGOOGLE_CLIENT_ID=\nGOOGLE_CLIENT_SECRET=\n\n# 登录入口开关：设置任意非空值后，登录页会显示 Google 登录并隐藏飞书登录；\n# 留空则保持默认（飞书登录）。生产国内 IDC 无法连通 oauth2.googleapis.com，\n# 应当留空；本地 dev 或有海外出口的部署可设为 `1` 开启。NEXT_PUBLIC_ 前缀\n# 让 Next.js 在构建时把值内联到客户端 bundle。\n# Login entry toggle: set to any non-empty value to show Google sign-in and\n# hide Feishu on the login page; leave blank for the default (Feishu).\n# Production runs from a domestic IDC that can't reach oauth2.googleapis.com,\n# so keep it blank there; local dev or overseas-egress deployments can set it\n# to `1`. The NEXT_PUBLIC_ prefix lets Next.js inline the value into the\n# client bundle at build time.\nNEXT_PUBLIC_ENABLE_GOOGLE_LOGIN=\n\n# =====================================================================\n# 主 LLM 提供方：阿里云 DashScope（Qwen 系列 + DeepSeek 兼容模式）\n# Primary LLM provider: Aliyun DashScope (Qwen + DeepSeek compat endpoint)\n# =====================================================================\n\n# DashScope API key，用于简历筛选 chat / 标题生成 / Qwen-VL OCR / JD ranker。\n# DashScope API key — powers screening chat, title generation, Qwen-VL OCR, JD ranker.\nALIBABA_API_KEY=\n\n# DashScope base URL。留空走默认值 https://dashscope.aliyuncs.com/compatible-mode/v1，\n# 私有部署或代理时填入对应地址。\n# DashScope base URL. Leave blank to use the default\n# https://dashscope.aliyuncs.com/compatible-mode/v1; override for private / proxied deploys.\nALIBABA_BASE_URL=\n\n# =====================================================================\n# Voice agent / 语音相关\n# =====================================================================\n\n# ElevenLabs API key，被 LiveKit Python agent 通过 livekit-plugins-elevenlabs 隐式读取\n# （TTS / STT）。在 web 侧的 .env 里写一份，agent 启动时也能拿到。\n# ElevenLabs API key — implicitly read by the LiveKit Python agent\n# (livekit-plugins-elevenlabs) for TTS / STT. Defined here so the agent picks it up too.\nELEVENLABS_API_KEY=\n\n# =====================================================================\n# Vercel AI Gateway\n# =====================================================================\n\n# Vercel AI Gateway key（用于面试结束后的评估，模型走 google/gemini-2.5-flash 等）。\n# 由 `ai` SDK 的 gateway provider 隐式读取，无需手动 import。\n# Vercel AI Gateway key — used for post-interview evaluation\n# (default model google/gemini-2.5-flash). Read implicitly by the `ai` SDK gateway provider.\nAI_GATEWAY_API_KEY=\n\n# =====================================================================\n# LiveKit Cloud — 语音 agent 运行时\n# LiveKit Cloud — voice agent runtime\n# =====================================================================\n\n# LiveKit Cloud 项目地址 / API 凭据。LIVEKIT_URL 为 wss:// 形式。\n# LiveKit Cloud project URL / API credentials. LIVEKIT_URL is a wss:// endpoint.\n# LIVEKIT_URL=wss://ai-interview-livekit.guadd.fun\n# LIVEKIT_API_KEY=livekit\n# LIVEKIT_API_SECRET=ai-interview\nLIVEKIT_URL=\nLIVEKIT_API_KEY=\nLIVEKIT_API_SECRET=\n\n# 必须与 Python worker 注册的 agent_name 一致（见 agent/src/agent.py）。\n# 服务端用它在 dispatch interview 时定向唤起对应 worker。\n# Must match the agent_name registered by the Python worker (agent/src/agent.py).\n# Used server-side to dispatch interview sessions to the correct worker.\nAGENT_NAME=\n\n# 浏览器侧 AgentDispatch 也需要知道 agent_name，因此暴露一份 NEXT_PUBLIC_ 版本，\n# 保持与 AGENT_NAME 同步。\n# Browser-side AgentDispatch also needs the agent_name; expose a NEXT_PUBLIC_ mirror\n# kept in lock-step with AGENT_NAME.\nNEXT_PUBLIC_AGENT_NAME=\n\n\n# Agent → web 回调的共享密钥，web 端 `/api/agent/*` 路由用它做 HMAC / bearer 校验，\n# 防止任何第三方伪造面试事件。两端值必须一致。\n# Shared secret for agent → web callbacks. The web `/api/agent/*` routes validate it\n# (HMAC / bearer) to reject forged interview events. Both sides must match.\nAGENT_CALLBACK_SECRET=\n\n# =====================================================================\n# Feishu 集成（可选，用于飞书机器人 / 多租户）\n# Feishu integration (optional — Feishu bot / multi-tenant)\n# =====================================================================\n\n# Feishu 应用凭据（来自飞书开放平台 -> 应用 -> 凭证与基础信息）。\n# 支持配置两个独立应用：默认应用走 *_APP_ID / *_APP_SECRET，副应用走带 2 的变量。\n# Feishu app credentials (Feishu Open Platform -> App -> Credentials).\n# Two independent apps are supported: primary uses *_APP_ID / *_APP_SECRET,\n# secondary uses the variables suffixed with 2.\nFEISHU_APP_ID=\nFEISHU_APP_SECRET=\nFEISHU_APP_ID2=\nFEISHU_APP_SECRET2=\n\n# 飞书事件订阅的加密 key 与校验 token，用于解密 / 校验回调消息。\n# Encryption key + verification token for Feishu event subscriptions\n# (decrypt / verify incoming callbacks).\nFEISHU_ENCRYPT_KEY=\nFEISHU_VERIFICATION_TOKEN=\n\n# =====================================================================\n# S3-compatible object storage（简历 PDF、附件上传）\n# S3-compatible object storage (resume PDFs, general attachments)\n# =====================================================================\n\n# S3 / 兼容服务端点。如使用 AWS S3 可留空（SDK 默认走 AWS）。\n# S3 / S3-compatible endpoint. Leave blank for AWS S3 (SDK default).\nS3_ENDPOINT=\nS3_BUCKET_NAME=\nS3_REGION=\nS3_ACCESS_KEY_ID=\nS3_SECRET_ACCESS_KEY=\n\n# 对象 key 前缀，便于把上传和录制隔离到不同子目录（可留空）。\n# Optional key prefix used to namespace uploaded objects (may be empty).\nS3_KEY_PREFIX=\n\n# 是否强制 path-style 访问（MinIO / 部分私有 S3 必须为 true）。\n# Force path-style addressing (required by MinIO / some self-hosted S3). Default false.\nS3_FORCE_PATH_STYLE=\n\n# =====================================================================\n# Cloudflare R2 — LiveKit Egress 面试录制存储\n# Cloudflare R2 — LiveKit Egress interview recording storage\n# =====================================================================\n# Endpoint format: https://<account_id>.r2.cloudflarestorage.com\nRECORDING_R2_ENDPOINT=\nRECORDING_R2_BUCKET_NAME=\nRECORDING_R2_REGION=auto\nRECORDING_R2_ACCESS_KEY_ID=\nRECORDING_R2_SECRET_ACCESS_KEY=\nRECORDING_R2_KEY_PREFIX=\nRECORDING_R2_FORCE_PATH_STYLE=true\n\n# =====================================================================\n# 模型覆盖（可选，均带默认值）\n# Model overrides (optional, all have sensible defaults)\n# =====================================================================\n\n# 可选,带默认值。覆盖面试结果评估用的模型(走 Vercel AI gateway),默认 google/gemini-2.5-flash。\n# Optional, has a default. Overrides the interview-evaluation model\n# (via Vercel AI gateway). Defaults to google/gemini-2.5-flash.\nINTERVIEW_EVALUATION_MODEL=\n\n# 可选,带默认值。覆盖 Qwen-VL OCR 模型 ID,默认 qwen-vl-ocr-latest。\n# Optional, has a default. Overrides the Qwen-VL OCR model id. Defaults to\n# qwen-vl-ocr-latest.\nQWEN_OCR_MODEL=\n\n# =====================================================================\n# Resend (transactional email)\n# =====================================================================\n\n# 中文：发件人地址。只写裸邮箱地址（不要加 \"Display <...>\"），\n# 域名必须在 Resend 控制台已验证，否则会被拒绝。\n# 邮件 From 头里的显示名会在运行时由代码动态拼接：\n# 「{系统设置里的公司名} AI HR」<addr>，没填公司名退化为「AI HR」<addr>。\n# 写成 \"Name <addr>\" 也能跑（代码会自动剥掉显示名），但部署脚本里出现\n# `<...>` 会被 shell 当成 stdin 重定向，所以推荐裸地址。\n# English: From address. Use a bare email address (no \"Display <...>\"). The\n# domain MUST be verified in the Resend dashboard. The actual From-header\n# display name is built at runtime as \"{globalConfig.companyName} AI HR\"\n# (or \"AI HR\" when blank). \"Name <addr>\" works too — the code strips the\n# display part — but bare avoids shell-redirection breakage in deploy scripts.\nRESEND_API_KEY=\nRESEND_FROM=noreply@yourdomain.com\n"}, "54d273798e22ae16d4b9757b666349231ea27bf9": {"t": 1785767499.1460445, "n": 8569, "h": "377d5166aef17817", "c": "# =====================================================================\n# Database\n# =====================================================================\n\n# Postgres 连接串，Drizzle ORM 和 Better Auth 共用。\n# Postgres connection string — shared by Drizzle ORM and Better Auth.\nDATABASE_URL=\n\n# =====================================================================\n# Better Auth\n# =====================================================================\n\n# Better Auth 用来签名 / 加密 session、CSRF token 等的随机密钥；\n# 生产环境必须独立设置（建议 `openssl rand -base64 32`），切勿提交到仓库。\n# Random secret Better Auth uses to sign/encrypt sessions, CSRF tokens, etc.\n# Generate a fresh value in production (e.g. `openssl rand -base64 32`); never commit.\nBETTER_AUTH_SECRET=\n\n# 生产环境必须设为真实域名（不带尾斜杠），如 https://app.example.com。\n# Google Cloud Console「已获授权的重定向 URI」需要登记\n# `${BETTER_AUTH_URL}/api/auth/callback/google`，否则会触发 redirect_uri_mismatch。\n# Production must be the real domain (no trailing slash), e.g. https://app.example.com.\n# Register `${BETTER_AUTH_URL}/api/auth/callback/google` in Google Cloud Console\n# under \"Authorised redirect URIs\" — mismatch causes redirect_uri_mismatch.\nBETTER_AUTH_URL=\n\n# 浏览器侧拼绝对 callbackURL 用，跟 BETTER_AUTH_URL 保持一致。\n# Used in the browser to build an absolute callbackURL; keep in sync with BETTER_AUTH_URL.\nNEXT_PUBLIC_PUBLIC_URL=\n\n# Google OAuth 凭据（来自 Google Cloud Console -> Credentials -> OAuth 2.0 Client）。\n# Google OAuth credentials (Google Cloud Console -> Credentials -> OAuth 2.0 Client).\nGOOGLE_CLIENT_ID=\nGOOGLE_CLIENT_SECRET=\n\n# 登录入口开关：设置任意非空值后，登录页会显示 Google 登录并隐藏飞书登录；\n# 留空则保持默认（飞书登录）。生产国内 IDC 无法连通 oauth2.googleapis.com，\n# 应当留空；本地 dev 或有海外出口的部署可设为 `1` 开启。NEXT_PUBLIC_ 前缀\n# 让 Next.js 在构建时把值内联到客户端 bundle。\n# Login entry toggle: set to any non-empty value to show Google sign-in and\n# hide Feishu on the login page; leave blank for the default (Feishu).\n# Production runs from a domestic IDC that can't reach oauth2.googleapis.com,\n# so keep it blank there; local dev or overseas-egress deployments can set it\n# to `1`. The NEXT_PUBLIC_ prefix lets Next.js inline the value into the\n# client bundle at build time.\nNEXT_PUBLIC_ENABLE_GOOGLE_LOGIN=\n\n# =====================================================================\n# 主 LLM 提供方：阿里云 DashScope（Qwen 系列 + DeepSeek 兼容模式）\n# Primary LLM provider: Aliyun DashScope (Qwen + DeepSeek compat endpoint)\n# =====================================================================\n\n# DashScope API key，用于简历筛选 chat / 标题生成 / Qwen-VL OCR / JD ranker。\n# DashScope API key — powers screening chat, title generation, Qwen-VL OCR, JD ranker.\nALIBABA_API_KEY=\n\n# DashScope base URL。留空走默认值 https://dashscope.aliyuncs.com/compatible-mode/v1，\n# 私有部署或代理时填入对应地址。\n# DashScope base URL. Leave blank to use the default\n# https://dashscope.aliyuncs.com/compatible-mode/v1; override for private / proxied deploys.\nALIBABA_BASE_URL=\n\n# =====================================================================\n# Voice agent / 语音相关\n# =====================================================================\n\n# ElevenLabs API key，被 LiveKit Python agent 通过 livekit-plugins-elevenlabs 隐式读取\n# （TTS / STT）。在 web 侧的 .env 里写一份，agent 启动时也能拿到。\n# ElevenLabs API key — implicitly read by the LiveKit Python agent\n# (livekit-plugins-elevenlabs) for TTS / STT. Defined here so the agent picks it up too.\nELEVENLABS_API_KEY=\n\n# =====================================================================\n# Vercel AI Gateway\n# =====================================================================\n\n# Vercel AI Gateway key（用于面试结束后的评估，模型走 google/gemini-2.5-flash 等）。\n# 由 `ai` SDK 的 gateway provider 隐式读取，无需手动 import。\n# Vercel AI Gateway key — used for post-interview evaluation\n# (default model google/gemini-2.5-flash). Read implicitly by the `ai` SDK gateway provider.\nAI_GATEWAY_API_KEY=\n\n# =====================================================================\n# LiveKit Cloud — 语音 agent 运行时\n# LiveKit Cloud — voice agent runtime\n# =====================================================================\n\n# LiveKit Cloud 项目地址 / API 凭据。LIVEKIT_URL 为 wss:// 形式。\n# LiveKit Cloud project URL / API credentials. LIVEKIT_URL is a wss:// endpoint.\n# LIVEKIT_URL=wss://ai-interview-livekit.guadd.fun\n# LIVEKIT_API_KEY=livekit\n# LIVEKIT_API_SECRET=ai-interview\nLIVEKIT_URL=\nLIVEKIT_API_KEY=\nLIVEKIT_API_SECRET=\n\n# 必须与 Python worker 注册的 agent_name 一致（见 agent/src/agent.py）。\n# 服务端用它在 dispatch interview 时定向唤起对应 worker。\n# Must match the agent_name registered by the Python worker (agent/src/agent.py).\n# Used server-side to dispatch interview sessions to the correct worker.\nAGENT_NAME=\n\n# 浏览器侧 AgentDispatch 也需要知道 agent_name，因此暴露一份 NEXT_PUBLIC_ 版本，\n# 保持与 AGENT_NAME 同步。\n# Browser-side AgentDispatch also needs the agent_name; expose a NEXT_PUBLIC_ mirror\n# kept in lock-step with AGENT_NAME.\nNEXT_PUBLIC_AGENT_NAME=\n\n\n# Agent → web 回调的共享密钥，web 端 `/api/agent/*` 路由用它做 HMAC / bearer 校验，\n# 防止任何第三方伪造面试事件。两端值必须一致。\n# Shared secret for agent → web callbacks. The web `/api/agent/*` routes validate it\n# (HMAC / bearer) to reject forged interview events. Both sides must match.\nAGENT_CALLBACK_SECRET=\n\n# =====================================================================\n# Feishu 集成（可选，用于飞书机器人 / 多租户）\n# Feishu integration (optional — Feishu bot / multi-tenant)\n# =====================================================================\n\n# Feishu 应用凭据（来自飞书开放平台 -> 应用 -> 凭证与基础信息）。\n# 支持配置两个独立应用：默认应用走 *_APP_ID / *_APP_SECRET，副应用走带 2 的变量。\n# Feishu app credentials (Feishu Open Platform -> App -> Credentials).\n# Two independent apps are supported: primary uses *_APP_ID / *_APP_SECRET,\n# secondary uses the variables suffixed with 2.\nFEISHU_APP_ID=\nFEISHU_APP_SECRET=\nFEISHU_APP_ID2=\nFEISHU_APP_SECRET2=\n\n# 飞书事件订阅的加密 key 与校验 token，用于解密 / 校验回调消息。\n# Encryption key + verification token for Feishu event subscriptions\n# (decrypt / verify incoming callbacks).\nFEISHU_ENCRYPT_KEY=\nFEISHU_VERIFICATION_TOKEN=\n\n# =====================================================================\n# S3-compatible object storage（简历 PDF、附件上传）\n# S3-compatible object storage (resume PDFs, general attachments)\n# =====================================================================\n\n# S3 / 兼容服务端点。如使用 AWS S3 可留空（SDK 默认走 AWS）。\n# S3 / S3-compatible endpoint. Leave blank for AWS S3 (SDK default).\nS3_ENDPOINT=\nS3_BUCKET_NAME=\nS3_REGION=\nS3_ACCESS_KEY_ID=\nS3_SECRET_ACCESS_KEY=\n\n# 对象 key 前缀，便于把上传和录制隔离到不同子目录（可留空）。\n# Optional key prefix used to namespace uploaded objects (may be empty).\nS3_KEY_PREFIX=\n\n# 是否强制 path-style 访问（MinIO / 部分私有 S3 必须为 true）。\n# Force path-style addressing (required by MinIO / some self-hosted S3). Default false.\nS3_FORCE_PATH_STYLE=\n\n# =====================================================================\n# Cloudflare R2 — LiveKit Egress 面试录制存储\n# Cloudflare R2 — LiveKit Egress interview recording storage\n# =====================================================================\n# Endpoint format: https://<account_id>.r2.cloudflarestorage.com\nRECORDING_R2_ENDPOINT=\nRECORDING_R2_BUCKET_NAME=\nRECORDING_R2_REGION=auto\nRECORDING_R2_ACCESS_KEY_ID=\nRECORDING_R2_SECRET_ACCESS_KEY=\nRECORDING_R2_KEY_PREFIX=\nRECORDING_R2_FORCE_PATH_STYLE=true\n\n# =====================================================================\n# 模型覆盖（可选，均带默认值）\n# Model overrides (optional, all have sensible defaults)\n# =====================================================================\n\n# 可选,带默认值。覆盖面试结果评估用的模型(走 Vercel AI gateway),默认 google/gemini-2.5-flash。\n# Optional, has a default. Overrides the interview-evaluation model\n# (via Vercel AI gateway). Defaults to google/gemini-2.5-flash.\nINTERVIEW_EVALUATION_MODEL=\n\n# 可选,带默认值。覆盖 Qwen-VL OCR 模型 ID,默认 qwen-vl-ocr-latest。\n# Optional, has a default. Overrides the Qwen-VL OCR model id. Defaults to\n# qwen-vl-ocr-latest.\nQWEN_OCR_MODEL=\n\n# =====================================================================\n# Resend (transactional email)\n# =====================================================================\n\n# 中文：发件人地址。只写裸邮箱地址（不要加 \"Display <...>\"），\n# 域名必须在 Resend 控制台已验证，否则会被拒绝。\n# 邮件 From 头里的显示名会在运行时由代码动态拼接：\n# 「{系统设置里的公司名} AI HR」<addr>，没填公司名退化为「AI HR」<addr>。\n# 写成 \"Name <addr>\" 也能跑（代码会自动剥掉显示名），但部署脚本里出现\n# `<...>` 会被 shell 当成 stdin 重定向，所以推荐裸地址。\n# English: From address. Use a bare email address (no \"Display <...>\"). The\n# domain MUST be verified in the Resend dashboard. The actual From-header\n# display name is built at runtime as \"{globalConfig.companyName} AI HR\"\n# (or \"AI HR\" when blank). \"Name <addr>\" works too — the code strips the\n# display part — but bare avoids shell-redirection breakage in deploy scripts.\nRESEND_API_KEY=\nRESEND_FROM=noreply@yourdomain.com\n"}, "3094b40f72a5225a6b73f486f8311d7c6f54f464": {"t": 1785767500.480303, "n": 8127, "h": "b1d98d80f1700e6a", "c": "# =====================================================================\n# Database\n# =====================================================================\n\n# Postgres 连接串，Drizzle ORM 和 Better Auth 共用。\n# Postgres connection string — shared by Drizzle ORM and Better Auth.\nDATABASE_URL=\n\n# =====================================================================\n# Better Auth\n# =====================================================================\n\n# Better Auth 用来签名 / 加密 session、CSRF token 等的随机密钥；\n# 生产环境必须独立设置（建议 `openssl rand -base64 32`），切勿提交到仓库。\n# Random secret Better Auth uses to sign/encrypt sessions, CSRF tokens, etc.\n# Generate a fresh value in production (e.g. `openssl rand -base64 32`); never commit.\nBETTER_AUTH_SECRET=\n\n# 生产环境必须设为真实域名（不带尾斜杠），如 https://app.example.com。\n# Google Cloud Console「已获授权的重定向 URI」需要登记\n# `${BETTER_AUTH_URL}/api/auth/callback/google`，否则会触发 redirect_uri_mismatch。\n# Production must be the real domain (no trailing slash), e.g. https://app.example.com.\n# Register `${BETTER_AUTH_URL}/api/auth/callback/google` in Google Cloud Console\n# under \"Authorised redirect URIs\" — mismatch causes redirect_uri_mismatch.\nBETTER_AUTH_URL=\n\n# 浏览器侧拼绝对 callbackURL 用，跟 BETTER_AUTH_URL 保持一致。\n# Used in the browser to build an absolute callbackURL; keep in sync with BETTER_AUTH_URL.\nNEXT_PUBLIC_PUBLIC_URL=\n\n# Google OAuth 凭据（来自 Google Cloud Console -> Credentials -> OAuth 2.0 Client）。\n# Google OAuth credentials (Google Cloud Console -> Credentials -> OAuth 2.0 Client).\nGOOGLE_CLIENT_ID=\nGOOGLE_CLIENT_SECRET=\n\n# 登录入口开关：设置任意非空值后，登录页会显示 Google 登录并隐藏飞书登录；\n# 留空则保持默认（飞书登录）。生产国内 IDC 无法连通 oauth2.googleapis.com，\n# 应当留空；本地 dev 或有海外出口的部署可设为 `1` 开启。NEXT_PUBLIC_ 前缀\n# 让 Next.js 在构建时把值内联到客户端 bundle。\n# Login entry toggle: set to any non-empty value to show Google sign-in and\n# hide Feishu on the login page; leave blank for the default (Feishu).\n# Production runs from a domestic IDC that can't reach oauth2.googleapis.com,\n# so keep it blank there; local dev or overseas-egress deployments can set it\n# to `1`. The NEXT_PUBLIC_ prefix lets Next.js inline the value into the\n# client bundle at build time.\nNEXT_PUBLIC_ENABLE_GOOGLE_LOGIN=\n\n# =====================================================================\n# 主 LLM 提供方：阿里云 DashScope（Qwen 系列 + DeepSeek 兼容模式）\n# Primary LLM provider: Aliyun DashScope (Qwen + DeepSeek compat endpoint)\n# =====================================================================\n\n# DashScope API key，用于简历筛选 chat / 标题生成 / Qwen-VL OCR / JD ranker。\n# DashScope API key — powers screening chat, title generation, Qwen-VL OCR, JD ranker.\nALIBABA_API_KEY=\n\n# DashScope base URL。留空走默认值 https://dashscope.aliyuncs.com/compatible-mode/v1，\n# 私有部署或代理时填入对应地址。\n# DashScope base URL. Leave blank to use the default\n# https://dashscope.aliyuncs.com/compatible-mode/v1; override for private / proxied deploys.\nALIBABA_BASE_URL=\n\n# =====================================================================\n# Voice agent / 语音相关\n# =====================================================================\n\n# ElevenLabs API key，被 LiveKit Python agent 通过 livekit-plugins-elevenlabs 隐式读取\n# （TTS / STT）。在 web 侧的 .env 里写一份，agent 启动时也能拿到。\n# ElevenLabs API key — implicitly read by the LiveKit Python agent\n# (livekit-plugins-elevenlabs) for TTS / STT. Defined here so the agent picks it up too.\nELEVENLABS_API_KEY=\n\n# =====================================================================\n# Vercel AI Gateway\n# =====================================================================\n\n# Vercel AI Gateway key（用于面试结束后的评估，模型走 google/gemini-2.5-flash 等）。\n# 由 `ai` SDK 的 gateway provider 隐式读取，无需手动 import。\n# Vercel AI Gateway key — used for post-interview evaluation\n# (default model google/gemini-2.5-flash). Read implicitly by the `ai` SDK gateway provider.\nAI_GATEWAY_API_KEY=\n\n# =====================================================================\n# LiveKit Cloud — 语音 agent 运行时\n# LiveKit Cloud — voice agent runtime\n# =====================================================================\n\n# LiveKit Cloud 项目地址 / API 凭据。LIVEKIT_URL 为 wss:// 形式。\n# LiveKit Cloud project URL / API credentials. LIVEKIT_URL is a wss:// endpoint.\n# LIVEKIT_URL=wss://ai-interview-livekit.guadd.fun\n# LIVEKIT_API_KEY=livekit\n# LIVEKIT_API_SECRET=ai-interview\nLIVEKIT_URL=\nLIVEKIT_API_KEY=\nLIVEKIT_API_SECRET=\n\n# 必须与 Python worker 注册的 agent_name 一致（见 agent/src/agent.py）。\n# 服务端用它在 dispatch interview 时定向唤起对应 worker。\n# Must match the agent_name registered by the Python worker (agent/src/agent.py).\n# Used server-side to dispatch interview sessions to the correct worker.\nAGENT_NAME=\n\n# 浏览器侧 AgentDispatch 也需要知道 agent_name，因此暴露一份 NEXT_PUBLIC_ 版本，\n# 保持与 AGENT_NAME 同步。\n# Browser-side AgentDispatch also needs the agent_name; expose a NEXT_PUBLIC_ mirror\n# kept in lock-step with AGENT_NAME.\nNEXT_PUBLIC_AGENT_NAME=\n\n\n# Agent → web 回调的共享密钥，web 端 `/api/agent/*` 路由用它做 HMAC / bearer 校验，\n# 防止任何第三方伪造面试事件。两端值必须一致。\n# Shared secret for agent → web callbacks. The web `/api/agent/*` routes validate it\n# (HMAC / bearer) to reject forged interview events. Both sides must match.\nAGENT_CALLBACK_SECRET=\n\n# =====================================================================\n# Feishu 集成（可选，用于飞书机器人 / 多租户）\n# Feishu integration (optional — Feishu bot / multi-tenant)\n# =====================================================================\n\n# Feishu 应用凭据（来自飞书开放平台 -> 应用 -> 凭证与基础信息）。\n# 支持配置两个独立应用：默认应用走 *_APP_ID / *_APP_SECRET，副应用走带 2 的变量。\n# Feishu app credentials (Feishu Open Platform -> App -> Credentials).\n# Two independent apps are supported: primary uses *_APP_ID / *_APP_SECRET,\n# secondary uses the variables suffixed with 2.\nFEISHU_APP_ID=\nFEISHU_APP_SECRET=\nFEISHU_APP_ID2=\nFEISHU_APP_SECRET2=\n\n# 飞书事件订阅的加密 key 与校验 token，用于解密 / 校验回调消息。\n# Encryption key + verification token for Feishu event subscriptions\n# (decrypt / verify incoming callbacks).\nFEISHU_ENCRYPT_KEY=\nFEISHU_VERIFICATION_TOKEN=\n\n# =====================================================================\n# S3-compatible object storage（简历 PDF、附件上传）\n# S3-compatible object storage (resume PDFs, general attachments)\n# =====================================================================\n\n# S3 / 兼容服务端点。如使用 AWS S3 可留空（SDK 默认走 AWS）。\n# S3 / S3-compatible endpoint. Leave blank for AWS S3 (SDK default).\nS3_ENDPOINT=\nS3_BUCKET_NAME=\nS3_REGION=\nS3_ACCESS_KEY_ID=\nS3_SECRET_ACCESS_KEY=\n\n# 对象 key 前缀，便于把上传和录制隔离到不同子目录（可留空）。\n# Optional key prefix used to namespace uploaded objects (may be empty).\nS3_KEY_PREFIX=\n\n# 是否强制 path-style 访问（MinIO / 部分私有 S3 必须为 true）。\n# Force path-style addressing (required by MinIO / some self-hosted S3). Default false.\nS3_FORCE_PATH_STYLE=\n\n# =====================================================================\n# Cloudflare R2 — LiveKit Egress 面试录制存储\n# Cloudflare R2 — LiveKit Egress interview recording storage\n# =====================================================================\n# Endpoint format: https://<account_id>.r2.cloudflarestorage.com\nRECORDING_R2_ENDPOINT=\nRECORDING_R2_BUCKET_NAME=\nRECORDING_R2_REGION=auto\nRECORDING_R2_ACCESS_KEY_ID=\nRECORDING_R2_SECRET_ACCESS_KEY=\nRECORDING_R2_KEY_PREFIX=\nRECORDING_R2_FORCE_PATH_STYLE=true\n\n# =====================================================================\n# 模型覆盖（可选，均带默认值）\n# Model overrides (optional, all have sensible defaults)\n# =====================================================================\n\n# 可选,带默认值。覆盖面试结果评估用的模型(走 Vercel AI gateway),默认 google/gemini-2.5-flash。\n# Optional, has a default. Overrides the interview-evaluation model\n# (via Vercel AI gateway). Defaults to google/gemini-2.5-flash.\nINTERVIEW_EVALUATION_MODEL=\n\n# 可选,带默认值。覆盖 Qwen-VL OCR 模型 ID,默认 qwen-vl-ocr-latest。\n# Optional, has a default. Overrides the Qwen-VL OCR model id. Defaults to\n# qwen-vl-ocr-latest.\nQWEN_OCR_MODEL=\n\n# =====================================================================\n# Resend (transactional email)\n# =====================================================================\n\n# 中文：发件人地址。必须使用在 Resend 控制台已验证的域名，否则会被拒绝。\n# English: From address. The domain MUST be verified in the Resend dashboard,\n# otherwise Resend will reject the send.\nRESEND_API_KEY=\nRESEND_FROM=\"Acme <noreply@yourdomain.com>\"\n"}, "af5f4176b9d0bbfe9bd4bcf9939344330442f4eb": {"t": 1785767501.9053535, "n": 8124, "h": "903c17ebe7696d4f", "c": "# =====================================================================\n# Database\n# =====================================================================\n\n# Postgres 连接串，Drizzle ORM 和 Better Auth 共用。\n# Postgres connection string — shared by Drizzle ORM and Better Auth.\nDATABASE_URL=\n\n# =====================================================================\n# Better Auth\n# =====================================================================\n\n# Better Auth 用来签名 / 加密 session、CSRF token 等的随机密钥；\n# 生产环境必须独立设置（建议 `openssl rand -base64 32`），切勿提交到仓库。\n# Random secret Better Auth uses to sign/encrypt sessions, CSRF tokens, etc.\n# Generate a fresh value in production (e.g. `openssl rand -base64 32`); never commit.\nBETTER_AUTH_SECRET=\n\n# 生产环境必须设为真实域名（不带尾斜杠），如 https://app.example.com。\n# Google Cloud Console「已获授权的重定向 URI」需要登记\n# `${BETTER_AUTH_URL}/api/auth/callback/google`，否则会触发 redirect_uri_mismatch。\n# Production must be the real domain (no trailing slash), e.g. https://app.example.com.\n# Register `${BETTER_AUTH_URL}/api/auth/callback/google` in Google Cloud Console\n# under \"Authorised redirect URIs\" — mismatch causes redirect_uri_mismatch.\nBETTER_AUTH_URL=\n\n# 浏览器侧拼绝对 callbackURL 用，跟 BETTER_AUTH_URL 保持一致。\n# Used in the browser to build an absolute callbackURL; keep in sync with BETTER_AUTH_URL.\nNEXT_PUBLIC_APP_URL=\n\n# Google OAuth 凭据（来自 Google Cloud Console -> Credentials -> OAuth 2.0 Client）。\n# Google OAuth credentials (Google Cloud Console -> Credentials -> OAuth 2.0 Client).\nGOOGLE_CLIENT_ID=\nGOOGLE_CLIENT_SECRET=\n\n# 登录入口开关：设置任意非空值后，登录页会显示 Google 登录并隐藏飞书登录；\n# 留空则保持默认（飞书登录）。生产国内 IDC 无法连通 oauth2.googleapis.com，\n# 应当留空；本地 dev 或有海外出口的部署可设为 `1` 开启。NEXT_PUBLIC_ 前缀\n# 让 Next.js 在构建时把值内联到客户端 bundle。\n# Login entry toggle: set to any non-empty value to show Google sign-in and\n# hide Feishu on the login page; leave blank for the default (Feishu).\n# Production runs from a domestic IDC that can't reach oauth2.googleapis.com,\n# so keep it blank there; local dev or overseas-egress deployments can set it\n# to `1`. The NEXT_PUBLIC_ prefix lets Next.js inline the value into the\n# client bundle at build time.\nNEXT_PUBLIC_ENABLE_GOOGLE_LOGIN=\n\n# =====================================================================\n# 主 LLM 提供方：阿里云 DashScope（Qwen 系列 + DeepSeek 兼容模式）\n# Primary LLM provider: Aliyun DashScope (Qwen + DeepSeek compat endpoint)\n# =====================================================================\n\n# DashScope API key，用于简历筛选 chat / 标题生成 / Qwen-VL OCR / JD ranker。\n# DashScope API key — powers screening chat, title generation, Qwen-VL OCR, JD ranker.\nALIBABA_API_KEY=\n\n# DashScope base URL。留空走默认值 https://dashscope.aliyuncs.com/compatible-mode/v1，\n# 私有部署或代理时填入对应地址。\n# DashScope base URL. Leave blank to use the default\n# https://dashscope.aliyuncs.com/compatible-mode/v1; override for private / proxied deploys.\nALIBABA_BASE_URL=\n\n# =====================================================================\n# Voice agent / 语音相关\n# =====================================================================\n\n# ElevenLabs API key，被 LiveKit Python agent 通过 livekit-plugins-elevenlabs 隐式读取\n# （TTS / STT）。在 web 侧的 .env 里写一份，agent 启动时也能拿到。\n# ElevenLabs API key — implicitly read by the LiveKit Python agent\n# (livekit-plugins-elevenlabs) for TTS / STT. Defined here so the agent picks it up too.\nELEVENLABS_API_KEY=\n\n# =====================================================================\n# Vercel AI Gateway\n# =====================================================================\n\n# Vercel AI Gateway key（用于面试结束后的评估，模型走 google/gemini-2.5-flash 等）。\n# 由 `ai` SDK 的 gateway provider 隐式读取，无需手动 import。\n# Vercel AI Gateway key — used for post-interview evaluation\n# (default model google/gemini-2.5-flash). Read implicitly by the `ai` SDK gateway provider.\nAI_GATEWAY_API_KEY=\n\n# =====================================================================\n# LiveKit Cloud — 语音 agent 运行时\n# LiveKit Cloud — voice agent runtime\n# =====================================================================\n\n# LiveKit Cloud 项目地址 / API 凭据。LIVEKIT_URL 为 wss:// 形式。\n# LiveKit Cloud project URL / API credentials. LIVEKIT_URL is a wss:// endpoint.\n# LIVEKIT_URL=wss://ai-interview-livekit.guadd.fun\n# LIVEKIT_API_KEY=livekit\n# LIVEKIT_API_SECRET=ai-interview\nLIVEKIT_URL=\nLIVEKIT_API_KEY=\nLIVEKIT_API_SECRET=\n\n# 必须与 Python worker 注册的 agent_name 一致（见 agent/src/agent.py）。\n# 服务端用它在 dispatch interview 时定向唤起对应 worker。\n# Must match the agent_name registered by the Python worker (agent/src/agent.py).\n# Used server-side to dispatch interview sessions to the correct worker.\nAGENT_NAME=\n\n# 浏览器侧 AgentDispatch 也需要知道 agent_name，因此暴露一份 NEXT_PUBLIC_ 版本，\n# 保持与 AGENT_NAME 同步。\n# Browser-side AgentDispatch also needs the agent_name; expose a NEXT_PUBLIC_ mirror\n# kept in lock-step with AGENT_NAME.\nNEXT_PUBLIC_AGENT_NAME=\n\n\n# Agent → web 回调的共享密钥，web 端 `/api/agent/*` 路由用它做 HMAC / bearer 校验，\n# 防止任何第三方伪造面试事件。两端值必须一致。\n# Shared secret for agent → web callbacks. The web `/api/agent/*` routes validate it\n# (HMAC / bearer) to reject forged interview events. Both sides must match.\nAGENT_CALLBACK_SECRET=\n\n# =====================================================================\n# Feishu 集成（可选，用于飞书机器人 / 多租户）\n# Feishu integration (optional — Feishu bot / multi-tenant)\n# =====================================================================\n\n# Feishu 应用凭据（来自飞书开放平台 -> 应用 -> 凭证与基础信息）。\n# 支持配置两个独立应用：默认应用走 *_APP_ID / *_APP_SECRET，副应用走带 2 的变量。\n# Feishu app credentials (Feishu Open Platform -> App -> Credentials).\n# Two independent apps are supported: primary uses *_APP_ID / *_APP_SECRET,\n# secondary uses the variables suffixed with 2.\nFEISHU_APP_ID=\nFEISHU_APP_SECRET=\nFEISHU_APP_ID2=\nFEISHU_APP_SECRET2=\n\n# 飞书事件订阅的加密 key 与校验 token，用于解密 / 校验回调消息。\n# Encryption key + verification token for Feishu event subscriptions\n# (decrypt / verify incoming callbacks).\nFEISHU_ENCRYPT_KEY=\nFEISHU_VERIFICATION_TOKEN=\n\n# =====================================================================\n# S3-compatible object storage（简历 PDF、附件上传）\n# S3-compatible object storage (resume PDFs, general attachments)\n# =====================================================================\n\n# S3 / 兼容服务端点。如使用 AWS S3 可留空（SDK 默认走 AWS）。\n# S3 / S3-compatible endpoint. Leave blank for AWS S3 (SDK default).\nS3_ENDPOINT=\nS3_BUCKET_NAME=\nS3_REGION=\nS3_ACCESS_KEY_ID=\nS3_SECRET_ACCESS_KEY=\n\n# 对象 key 前缀，便于把上传和录制隔离到不同子目录（可留空）。\n# Optional key prefix used to namespace uploaded objects (may be empty).\nS3_KEY_PREFIX=\n\n# 是否强制 path-style 访问（MinIO / 部分私有 S3 必须为 true）。\n# Force path-style addressing (required by MinIO / some self-hosted S3). Default false.\nS3_FORCE_PATH_STYLE=\n\n# =====================================================================\n# Cloudflare R2 — LiveKit Egress 面试录制存储\n# Cloudflare R2 — LiveKit Egress interview recording storage\n# =====================================================================\n# Endpoint format: https://<account_id>.r2.cloudflarestorage.com\nRECORDING_R2_ENDPOINT=\nRECORDING_R2_BUCKET_NAME=\nRECORDING_R2_REGION=auto\nRECORDING_R2_ACCESS_KEY_ID=\nRECORDING_R2_SECRET_ACCESS_KEY=\nRECORDING_R2_KEY_PREFIX=\nRECORDING_R2_FORCE_PATH_STYLE=true\n\n# =====================================================================\n# 模型覆盖（可选，均带默认值）\n# Model overrides (optional, all have sensible defaults)\n# =====================================================================\n\n# 可选,带默认值。覆盖面试结果评估用的模型(走 Vercel AI gateway),默认 google/gemini-2.5-flash。\n# Optional, has a default. Overrides the interview-evaluation model\n# (via Vercel AI gateway). Defaults to google/gemini-2.5-flash.\nINTERVIEW_EVALUATION_MODEL=\n\n# 可选,带默认值。覆盖 Qwen-VL OCR 模型 ID,默认 qwen-vl-ocr-latest。\n# Optional, has a default. Overrides the Qwen-VL OCR model id. Defaults to\n# qwen-vl-ocr-latest.\nQWEN_OCR_MODEL=\n\n# =====================================================================\n# Resend (transactional email)\n# =====================================================================\n\n# 中文：发件人地址。必须使用在 Resend 控制台已验证的域名，否则会被拒绝。\n# English: From address. The domain MUST be verified in the Resend dashboard,\n# otherwise Resend will reject the send.\nRESEND_API_KEY=\nRESEND_FROM=\"Acme <noreply@yourdomain.com>\"\n"}, "0cd89c0424fea06ff23b08c458c1d6859a6ae3d4": {"t": 1785767503.306211, "n": 7963, "h": "3ed9c40299caa483", "c": "# =====================================================================\n# Database\n# =====================================================================\n\n# Postgres 连接串，Drizzle ORM 和 Better Auth 共用。\n# Postgres connection string — shared by Drizzle ORM and Better Auth.\nDATABASE_URL=\n\n# =====================================================================\n# Better Auth\n# =====================================================================\n\n# Better Auth 用来签名 / 加密 session、CSRF token 等的随机密钥；\n# 生产环境必须独立设置（建议 `openssl rand -base64 32`），切勿提交到仓库。\n# Random secret Better Auth uses to sign/encrypt sessions, CSRF tokens, etc.\n# Generate a fresh value in production (e.g. `openssl rand -base64 32`); never commit.\nBETTER_AUTH_SECRET=\n\n# 生产环境必须设为真实域名（不带尾斜杠），如 https://app.example.com。\n# Google Cloud Console「已获授权的重定向 URI」需要登记\n# `${BETTER_AUTH_URL}/api/auth/callback/google`，否则会触发 redirect_uri_mismatch。\n# Production must be the real domain (no trailing slash), e.g. https://app.example.com.\n# Register `${BETTER_AUTH_URL}/api/auth/callback/google` in Google Cloud Console\n# under \"Authorised redirect URIs\" — mismatch causes redirect_uri_mismatch.\nBETTER_AUTH_URL=\n\n# 浏览器侧拼绝对 callbackURL 用，跟 BETTER_AUTH_URL 保持一致。\n# Used in the browser to build an absolute callbackURL; keep in sync with BETTER_AUTH_URL.\nNEXT_PUBLIC_APP_URL=\n\n# Google OAuth 凭据（来自 Google Cloud Console -> Credentials -> OAuth 2.0 Client）。\n# Google OAuth credentials (Google Cloud Console -> Credentials -> OAuth 2.0 Client).\nGOOGLE_CLIENT_ID=\nGOOGLE_CLIENT_SECRET=\n\n# 登录入口开关：设置任意非空值后，登录页会显示 Google 登录并隐藏飞书登录；\n# 留空则保持默认（飞书登录）。生产国内 IDC 无法连通 oauth2.googleapis.com，\n# 应当留空；本地 dev 或有海外出口的部署可设为 `1` 开启。NEXT_PUBLIC_ 前缀\n# 让 Next.js 在构建时把值内联到客户端 bundle。\n# Login entry toggle: set to any non-empty value to show Google sign-in and\n# hide Feishu on the login page; leave blank for the default (Feishu).\n# Production runs from a domestic IDC that can't reach oauth2.googleapis.com,\n# so keep it blank there; local dev or overseas-egress deployments can set it\n# to `1`. The NEXT_PUBLIC_ prefix lets Next.js inline the value into the\n# client bundle at build time.\nNEXT_PUBLIC_ENABLE_GOOGLE_LOGIN=\n\n# =====================================================================\n# 主 LLM 提供方：阿里云 DashScope（Qwen 系列 + DeepSeek 兼容模式）\n# Primary LLM provider: Aliyun DashScope (Qwen + DeepSeek compat endpoint)\n# =====================================================================\n\n# DashScope API key，用于简历筛选 chat / 标题生成 / Qwen-VL OCR / JD ranker。\n# DashScope API key — powers screening chat, title generation, Qwen-VL OCR, JD ranker.\nALIBABA_API_KEY=\n\n# DashScope base URL。留空走默认值 https://dashscope.aliyuncs.com/compatible-mode/v1，\n# 私有部署或代理时填入对应地址。\n# DashScope base URL. Leave blank to use the default\n# https://dashscope.aliyuncs.com/compatible-mode/v1; override for private / proxied deploys.\nALIBABA_BASE_URL=\n\n# =====================================================================\n# Voice agent / 语音相关\n# =====================================================================\n\n# ElevenLabs API key，被 LiveKit Python agent 通过 livekit-plugins-elevenlabs 隐式读取\n# （TTS / STT）。在 web 侧的 .env 里写一份，agent 启动时也能拿到。\n# ElevenLabs API key — implicitly read by the LiveKit Python agent\n# (livekit-plugins-elevenlabs) for TTS / STT. Defined here so the agent picks it up too.\nELEVENLABS_API_KEY=\n\n# =====================================================================\n# Vercel AI Gateway\n# =====================================================================\n\n# Vercel AI Gateway key（用于面试结束后的评估，模型走 google/gemini-2.5-flash 等）。\n# 由 `ai` SDK 的 gateway provider 隐式读取，无需手动 import。\n# Vercel AI Gateway key — used for post-interview evaluation\n# (default model google/gemini-2.5-flash). Read implicitly by the `ai` SDK gateway provider.\nAI_GATEWAY_API_KEY=\n\n# =====================================================================\n# LiveKit Cloud — 语音 agent 运行时\n# LiveKit Cloud — voice agent runtime\n# =====================================================================\n\n# LiveKit Cloud 项目地址 / API 凭据。LIVEKIT_URL 为 wss:// 形式。\n# LiveKit Cloud project URL / API credentials. LIVEKIT_URL is a wss:// endpoint.\n# LIVEKIT_URL=wss://ai-interview-livekit.guadd.fun\n# LIVEKIT_API_KEY=livekit\n# LIVEKIT_API_SECRET=ai-interview\nLIVEKIT_URL=\nLIVEKIT_API_KEY=\nLIVEKIT_API_SECRET=\n\n# 必须与 Python worker 注册的 agent_name 一致（见 agent/src/agent.py）。\n# 服务端用它在 dispatch interview 时定向唤起对应 worker。\n# Must match the agent_name registered by the Python worker (agent/src/agent.py).\n# Used server-side to dispatch interview sessions to the correct worker.\nAGENT_NAME=\n\n# 浏览器侧 AgentDispatch 也需要知道 agent_name，因此暴露一份 NEXT_PUBLIC_ 版本，\n# 保持与 AGENT_NAME 同步。\n# Browser-side AgentDispatch also needs the agent_name; expose a NEXT_PUBLIC_ mirror\n# kept in lock-step with AGENT_NAME.\nNEXT_PUBLIC_AGENT_NAME=\n\n\n# Agent → web 回调的共享密钥，web 端 `/api/agent/*` 路由用它做 HMAC / bearer 校验，\n# 防止任何第三方伪造面试事件。两端值必须一致。\n# Shared secret for agent → web callbacks. The web `/api/agent/*` routes validate it\n# (HMAC / bearer) to reject forged interview events. Both sides must match.\nAGENT_CALLBACK_SECRET=\n\n# =====================================================================\n# Feishu 集成（可选，用于飞书机器人 / 多租户）\n# Feishu integration (optional — Feishu bot / multi-tenant)\n# =====================================================================\n\n# Feishu 应用凭据（来自飞书开放平台 -> 应用 -> 凭证与基础信息）。\n# 支持配置两个独立应用：默认应用走 *_APP_ID / *_APP_SECRET，副应用走带 2 的变量。\n# Feishu app credentials (Feishu Open Platform -> App -> Credentials).\n# Two independent apps are supported: primary uses *_APP_ID / *_APP_SECRET,\n# secondary uses the variables suffixed with 2.\nFEISHU_APP_ID=\nFEISHU_APP_SECRET=\nFEISHU_APP_ID2=\nFEISHU_APP_SECRET2=\n\n# 飞书事件订阅的加密 key 与校验 token，用于解密 / 校验回调消息。\n# Encryption key + verification token for Feishu event subscriptions\n# (decrypt / verify incoming callbacks).\nFEISHU_ENCRYPT_KEY=\nFEISHU_VERIFICATION_TOKEN=\n\n# =====================================================================\n# S3-compatible object storage（简历 PDF、附件上传）\n# S3-compatible object storage (resume PDFs, general attachments)\n# =====================================================================\n\n# S3 / 兼容服务端点。如使用 AWS S3 可留空（SDK 默认走 AWS）。\n# S3 / S3-compatible endpoint. Leave blank for AWS S3 (SDK default).\nS3_ENDPOINT=\nS3_BUCKET_NAME=\nS3_REGION=\nS3_ACCESS_KEY_ID=\nS3_SECRET_ACCESS_KEY=\n\n# 对象 key 前缀，便于把上传和录制隔离到不同子目录（可留空）。\n# Optional key prefix used to namespace uploaded objects (may be empty).\nS3_KEY_PREFIX=\n\n# 是否强制 path-style 访问（MinIO / 部分私有 S3 必须为 true）。\n# Force path-style addressing (required by MinIO / some self-hosted S3). Default false.\nS3_FORCE_PATH_STYLE=\n\n# =====================================================================\n# Cloudflare R2 — LiveKit Egress 面试录制存储\n# Cloudflare R2 — LiveKit Egress interview recording storage\n# =====================================================================\n# Endpoint format: https://<account_id>.r2.cloudflarestorage.com\nRECORDING_R2_ENDPOINT=\nRECORDING_R2_BUCKET_NAME=\nRECORDING_R2_REGION=auto\nRECORDING_R2_ACCESS_KEY_ID=\nRECORDING_R2_SECRET_ACCESS_KEY=\nRECORDING_R2_KEY_PREFIX=\nRECORDING_R2_FORCE_PATH_STYLE=true\n\n# =====================================================================\n# 模型覆盖（可选，均带默认值）\n# Model overrides (optional, all have sensible defaults)\n# =====================================================================\n\n# 可选,带默认值。覆盖面试结果评估用的模型(走 Vercel AI gateway),默认 google/gemini-2.5-flash。\n# Optional, has a default. Overrides the interview-evaluation model\n# (via Vercel AI gateway). Defaults to google/gemini-2.5-flash.\nINTERVIEW_EVALUATION_MODEL=\n\n# 可选,带默认值。覆盖 Qwen-VL OCR 模型 ID,默认 qwen-vl-ocr-latest。\n# Optional, has a default. Overrides the Qwen-VL OCR model id. Defaults to\n# qwen-vl-ocr-latest.\nQWEN_OCR_MODEL=\n\n# =====================================================================\n# Resend (transactional email)\n# =====================================================================\n\nRESEND_API_KEY=\nRESEND_FROM=\"Acme <noreply@yourdomain.com>\"\n"}, "6b5926cbc99eb8ad0da9507d7f1f6e5a1c3271e8": {"t": 1785767504.774875, "n": 7726, "h": "d2df61700b50e9fd", "c": "# =====================================================================\n# Database\n# =====================================================================\n\n# Postgres 连接串，Drizzle ORM 和 Better Auth 共用。\n# Postgres connection string — shared by Drizzle ORM and Better Auth.\nDATABASE_URL=\n\n# =====================================================================\n# Better Auth\n# =====================================================================\n\n# Better Auth 用来签名 / 加密 session、CSRF token 等的随机密钥；\n# 生产环境必须独立设置（建议 `openssl rand -base64 32`），切勿提交到仓库。\n# Random secret Better Auth uses to sign/encrypt sessions, CSRF tokens, etc.\n# Generate a fresh value in production (e.g. `openssl rand -base64 32`); never commit.\nBETTER_AUTH_SECRET=\n\n# 生产环境必须设为真实域名（不带尾斜杠），如 https://app.example.com。\n# Google Cloud Console「已获授权的重定向 URI」需要登记\n# `${BETTER_AUTH_URL}/api/auth/callback/google`，否则会触发 redirect_uri_mismatch。\n# Production must be the real domain (no trailing slash), e.g. https://app.example.com.\n# Register `${BETTER_AUTH_URL}/api/auth/callback/google` in Google Cloud Console\n# under \"Authorised redirect URIs\" — mismatch causes redirect_uri_mismatch.\nBETTER_AUTH_URL=\n\n# 浏览器侧拼绝对 callbackURL 用，跟 BETTER_AUTH_URL 保持一致。\n# Used in the browser to build an absolute callbackURL; keep in sync with BETTER_AUTH_URL.\nNEXT_PUBLIC_APP_URL=\n\n# Google OAuth 凭据（来自 Google Cloud Console -> Credentials -> OAuth 2.0 Client）。\n# Google OAuth credentials (Google Cloud Console -> Credentials -> OAuth 2.0 Client).\nGOOGLE_CLIENT_ID=\nGOOGLE_CLIENT_SECRET=\n\n# 登录入口开关：设置任意非空值后，登录页会显示 Google 登录并隐藏飞书登录；\n# 留空则保持默认（飞书登录）。生产国内 IDC 无法连通 oauth2.googleapis.com，\n# 应当留空；本地 dev 或有海外出口的部署可设为 `1` 开启。NEXT_PUBLIC_ 前缀\n# 让 Next.js 在构建时把值内联到客户端 bundle。\n# Login entry toggle: set to any non-empty value to show Google sign-in and\n# hide Feishu on the login page; leave blank for the default (Feishu).\n# Production runs from a domestic IDC that can't reach oauth2.googleapis.com,\n# so keep it blank there; local dev or overseas-egress deployments can set it\n# to `1`. The NEXT_PUBLIC_ prefix lets Next.js inline the value into the\n# client bundle at build time.\nNEXT_PUBLIC_ENABLE_GOOGLE_LOGIN=\n\n# =====================================================================\n# 主 LLM 提供方：阿里云 DashScope（Qwen 系列 + DeepSeek 兼容模式）\n# Primary LLM provider: Aliyun DashScope (Qwen + DeepSeek compat endpoint)\n# =====================================================================\n\n# DashScope API key，用于简历筛选 chat / 标题生成 / Qwen-VL OCR / JD ranker。\n# DashScope API key — powers screening chat, title generation, Qwen-VL OCR, JD ranker.\nALIBABA_API_KEY=\n\n# DashScope base URL。留空走默认值 https://dashscope.aliyuncs.com/compatible-mode/v1，\n# 私有部署或代理时填入对应地址。\n# DashScope base URL. Leave blank to use the default\n# https://dashscope.aliyuncs.com/compatible-mode/v1; override for private / proxied deploys.\nALIBABA_BASE_URL=\n\n# =====================================================================\n# Voice agent / 语音相关\n# =====================================================================\n\n# ElevenLabs API key，被 LiveKit Python agent 通过 livekit-plugins-elevenlabs 隐式读取\n# （TTS / STT）。在 web 侧的 .env 里写一份，agent 启动时也能拿到。\n# ElevenLabs API key — implicitly read by the LiveKit Python agent\n# (livekit-plugins-elevenlabs) for TTS / STT. Defined here so the agent picks it up too.\nELEVENLABS_API_KEY=\n\n# =====================================================================\n# Vercel AI Gateway\n# =====================================================================\n\n# Vercel AI Gateway key（用于面试结束后的评估，模型走 google/gemini-2.5-flash 等）。\n# 由 `ai` SDK 的 gateway provider 隐式读取，无需手动 import。\n# Vercel AI Gateway key — used for post-interview evaluation\n# (default model google/gemini-2.5-flash). Read implicitly by the `ai` SDK gateway provider.\nAI_GATEWAY_API_KEY=\n\n# =====================================================================\n# LiveKit Cloud — 语音 agent 运行时\n# LiveKit Cloud — voice agent runtime\n# =====================================================================\n\n# LiveKit Cloud 项目地址 / API 凭据。LIVEKIT_URL 为 wss:// 形式。\n# LiveKit Cloud project URL / API credentials. LIVEKIT_URL is a wss:// endpoint.\n# LIVEKIT_URL=wss://ai-interview-livekit.guadd.fun\n# LIVEKIT_API_KEY=livekit\n# LIVEKIT_API_SECRET=ai-interview\nLIVEKIT_URL=\nLIVEKIT_API_KEY=\nLIVEKIT_API_SECRET=\n\n# 必须与 Python worker 注册的 agent_name 一致（见 agent/src/agent.py）。\n# 服务端用它在 dispatch interview 时定向唤起对应 worker。\n# Must match the agent_name registered by the Python worker (agent/src/agent.py).\n# Used server-side to dispatch interview sessions to the correct worker.\nAGENT_NAME=\n\n# 浏览器侧 AgentDispatch 也需要知道 agent_name，因此暴露一份 NEXT_PUBLIC_ 版本，\n# 保持与 AGENT_NAME 同步。\n# Browser-side AgentDispatch also needs the agent_name; expose a NEXT_PUBLIC_ mirror\n# kept in lock-step with AGENT_NAME.\nNEXT_PUBLIC_AGENT_NAME=\n\n\n# Agent → web 回调的共享密钥，web 端 `/api/agent/*` 路由用它做 HMAC / bearer 校验，\n# 防止任何第三方伪造面试事件。两端值必须一致。\n# Shared secret for agent → web callbacks. The web `/api/agent/*` routes validate it\n# (HMAC / bearer) to reject forged interview events. Both sides must match.\nAGENT_CALLBACK_SECRET=\n\n# =====================================================================\n# Feishu 集成（可选，用于飞书机器人 / 多租户）\n# Feishu integration (optional — Feishu bot / multi-tenant)\n# =====================================================================\n\n# Feishu 应用凭据（来自飞书开放平台 -> 应用 -> 凭证与基础信息）。\n# 支持配置两个独立应用：默认应用走 *_APP_ID / *_APP_SECRET，副应用走带 2 的变量。\n# Feishu app credentials (Feishu Open Platform -> App -> Credentials).\n# Two independent apps are supported: primary uses *_APP_ID / *_APP_SECRET,\n# secondary uses the variables suffixed with 2.\nFEISHU_APP_ID=\nFEISHU_APP_SECRET=\nFEISHU_APP_ID2=\nFEISHU_APP_SECRET2=\n\n# 飞书事件订阅的加密 key 与校验 token，用于解密 / 校验回调消息。\n# Encryption key + verification token for Feishu event subscriptions\n# (decrypt / verify incoming callbacks).\nFEISHU_ENCRYPT_KEY=\nFEISHU_VERIFICATION_TOKEN=\n\n# =====================================================================\n# S3-compatible object storage（简历 PDF、附件上传）\n# S3-compatible object storage (resume PDFs, general attachments)\n# =====================================================================\n\n# S3 / 兼容服务端点。如使用 AWS S3 可留空（SDK 默认走 AWS）。\n# S3 / S3-compatible endpoint. Leave blank for AWS S3 (SDK default).\nS3_ENDPOINT=\nS3_BUCKET_NAME=\nS3_REGION=\nS3_ACCESS_KEY_ID=\nS3_SECRET_ACCESS_KEY=\n\n# 对象 key 前缀，便于把上传和录制隔离到不同子目录（可留空）。\n# Optional key prefix used to namespace uploaded objects (may be empty).\nS3_KEY_PREFIX=\n\n# 是否强制 path-style 访问（MinIO / 部分私有 S3 必须为 true）。\n# Force path-style addressing (required by MinIO / some self-hosted S3). Default false.\nS3_FORCE_PATH_STYLE=\n\n# =====================================================================\n# Cloudflare R2 — LiveKit Egress 面试录制存储\n# Cloudflare R2 — LiveKit Egress interview recording storage\n# =====================================================================\n# Endpoint format: https://<account_id>.r2.cloudflarestorage.com\nRECORDING_R2_ENDPOINT=\nRECORDING_R2_BUCKET_NAME=\nRECORDING_R2_REGION=auto\nRECORDING_R2_ACCESS_KEY_ID=\nRECORDING_R2_SECRET_ACCESS_KEY=\nRECORDING_R2_KEY_PREFIX=\nRECORDING_R2_FORCE_PATH_STYLE=true\n\n# =====================================================================\n# 模型覆盖（可选，均带默认值）\n# Model overrides (optional, all have sensible defaults)\n# =====================================================================\n\n# 可选,带默认值。覆盖面试结果评估用的模型(走 Vercel AI gateway),默认 google/gemini-2.5-flash。\n# Optional, has a default. Overrides the interview-evaluation model\n# (via Vercel AI gateway). Defaults to google/gemini-2.5-flash.\nINTERVIEW_EVALUATION_MODEL=\n\n# 可选,带默认值。覆盖 Qwen-VL OCR 模型 ID,默认 qwen-vl-ocr-latest。\n# Optional, has a default. Overrides the Qwen-VL OCR model id. Defaults to\n# qwen-vl-ocr-latest.\nQWEN_OCR_MODEL=\n"}, "7603726b7c084d9b4ac655dc7b4b07fa88bcc57f": {"t": 1785767506.3180556, "n": 7963, "h": "63a861ba41ac8519", "c": "# =====================================================================\n# Database\n# =====================================================================\n\n# Postgres 连接串，Drizzle ORM 和 Better Auth 共用。\n# Postgres connection string — shared by Drizzle ORM and Better Auth.\nDATABASE_URL=\n\n# =====================================================================\n# Better Auth\n# =====================================================================\n\n# Better Auth 用来签名 / 加密 session、CSRF token 等的随机密钥；\n# 生产环境必须独立设置（建议 `openssl rand -base64 32`），切勿提交到仓库。\n# Random secret Better Auth uses to sign/encrypt sessions, CSRF tokens, etc.\n# Generate a fresh value in production (e.g. `openssl rand -base64 32`); never commit.\nBETTER_AUTH_SECRET=\n\n# 生产环境必须设为真实域名（不带尾斜杠），如 https://app.example.com。\n# Google Cloud Console「已获授权的重定向 URI」需要登记\n# `${BETTER_AUTH_URL}/api/auth/callback/google`，否则会触发 redirect_uri_mismatch。\n# Production must be the real domain (no trailing slash), e.g. https://app.example.com.\n# Register `${BETTER_AUTH_URL}/api/auth/callback/google` in Google Cloud Console\n# under \"Authorised redirect URIs\" — mismatch causes redirect_uri_mismatch.\nBETTER_AUTH_URL=\n\n# 浏览器侧拼绝对 callbackURL 用，跟 BETTER_AUTH_URL 保持一致。\n# Used in the browser to build an absolute callbackURL; keep in sync with BETTER_AUTH_URL.\nNEXT_PUBLIC_APP_URL=\n\n# Google OAuth 凭据（来自 Google Cloud Console -> Credentials -> OAuth 2.0 Client）。\n# Google OAuth credentials (Google Cloud Console -> Credentials -> OAuth 2.0 Client).\nGOOGLE_CLIENT_ID=\nGOOGLE_CLIENT_SECRET=\n\n# 登录入口开关：设置任意非空值后，登录页会显示 Google 登录并隐藏飞书登录；\n# 留空则保持默认（飞书登录）。生产国内 IDC 无法连通 oauth2.googleapis.com，\n# 应当留空；本地 dev 或有海外出口的部署可设为 `1` 开启。NEXT_PUBLIC_ 前缀\n# 让 Next.js 在构建时把值内联到客户端 bundle。\n# Login entry toggle: set to any non-empty value to show Google sign-in and\n# hide Feishu on the login page; leave blank for the default (Feishu).\n# Production runs from a domestic IDC that can't reach oauth2.googleapis.com,\n# so keep it blank there; local dev or overseas-egress deployments can set it\n# to `1`. The NEXT_PUBLIC_ prefix lets Next.js inline the value into the\n# client bundle at build time.\nNEXT_PUBLIC_ENABLE_GOOGLE_LOGIN=\n\n# =====================================================================\n# 主 LLM 提供方：阿里云 DashScope（Qwen 系列 + DeepSeek 兼容模式）\n# Primary LLM provider: Aliyun DashScope (Qwen + DeepSeek compat endpoint)\n# =====================================================================\n\n# DashScope API key，用于简历筛选 chat / 标题生成 / Qwen-VL OCR / JD ranker。\n# DashScope API key — powers screening chat, title generation, Qwen-VL OCR, JD ranker.\nALIBABA_API_KEY=\n\n# DashScope base URL。留空走默认值 https://dashscope.aliyuncs.com/compatible-mode/v1，\n# 私有部署或代理时填入对应地址。\n# DashScope base URL. Leave blank to use the default\n# https://dashscope.aliyuncs.com/compatible-mode/v1; override for private / proxied deploys.\nALIBABA_BASE_URL=\n\n# =====================================================================\n# Voice agent / 语音相关\n# =====================================================================\n\n# ElevenLabs API key，被 LiveKit Python agent 通过 livekit-plugins-elevenlabs 隐式读取\n# （TTS / STT）。在 web 侧的 .env 里写一份，agent 启动时也能拿到。\n# ElevenLabs API key — implicitly read by the LiveKit Python agent\n# (livekit-plugins-elevenlabs) for TTS / STT. Defined here so the agent picks it up too.\nELEVENLABS_API_KEY=\n\n# =====================================================================\n# Vercel AI Gateway\n# =====================================================================\n\n# Vercel AI Gateway key（用于面试结束后的评估，模型走 google/gemini-2.5-flash 等）。\n# 由 `ai` SDK 的 gateway provider 隐式读取，无需手动 import。\n# Vercel AI Gateway key — used for post-interview evaluation\n# (default model google/gemini-2.5-flash). Read implicitly by the `ai` SDK gateway provider.\nAI_GATEWAY_API_KEY=\n\n# =====================================================================\n# LiveKit Cloud — 语音 agent 运行时\n# LiveKit Cloud — voice agent runtime\n# =====================================================================\n\n# LiveKit Cloud 项目地址 / API 凭据。LIVEKIT_URL 为 wss:// 形式。\n# LiveKit Cloud project URL / API credentials. LIVEKIT_URL is a wss:// endpoint.\n# LIVEKIT_URL=wss://ai-interview-livekit.guadd.fun\n# LIVEKIT_API_KEY=livekit\n# LIVEKIT_API_SECRET=ai-interview\nLIVEKIT_URL=\nLIVEKIT_API_KEY=\nLIVEKIT_API_SECRET=\n\n# 必须与 Python worker 注册的 agent_name 一致（见 agent/src/agent.py）。\n# 服务端用它在 dispatch interview 时定向唤起对应 worker。\n# Must match the agent_name registered by the Python worker (agent/src/agent.py).\n# Used server-side to dispatch interview sessions to the correct worker.\nAGENT_NAME=\n\n# 浏览器侧 AgentDispatch 也需要知道 agent_name，因此暴露一份 NEXT_PUBLIC_ 版本，\n# 保持与 AGENT_NAME 同步。\n# Browser-side AgentDispatch also needs the agent_name; expose a NEXT_PUBLIC_ mirror\n# kept in lock-step with AGENT_NAME.\nNEXT_PUBLIC_AGENT_NAME=\n\n# Python agent 回调 web 时的基础地址（可达的公网 https 地址）。\n# 用法：`${CALLBACK_BASE_URL}/api/agent/...`。\n# Base URL the Python agent calls back into web with (publicly reachable https).\n# Used as `${CALLBACK_BASE_URL}/api/agent/...`.\nCALLBACK_BASE_URL=\n\n# Agent → web 回调的共享密钥，web 端 `/api/agent/*` 路由用它做 HMAC / bearer 校验，\n# 防止任何第三方伪造面试事件。两端值必须一致。\n# Shared secret for agent → web callbacks. The web `/api/agent/*` routes validate it\n# (HMAC / bearer) to reject forged interview events. Both sides must match.\nAGENT_CALLBACK_SECRET=\n\n# =====================================================================\n# Feishu 集成（可选，用于飞书机器人 / 多租户）\n# Feishu integration (optional — Feishu bot / multi-tenant)\n# =====================================================================\n\n# Feishu 应用凭据（来自飞书开放平台 -> 应用 -> 凭证与基础信息）。\n# 支持配置两个独立应用：默认应用走 *_APP_ID / *_APP_SECRET，副应用走带 2 的变量。\n# Feishu app credentials (Feishu Open Platform -> App -> Credentials).\n# Two independent apps are supported: primary uses *_APP_ID / *_APP_SECRET,\n# secondary uses the variables suffixed with 2.\nFEISHU_APP_ID=\nFEISHU_APP_SECRET=\nFEISHU_APP_ID2=\nFEISHU_APP_SECRET2=\n\n# 飞书事件订阅的加密 key 与校验 token，用于解密 / 校验回调消息。\n# Encryption key + verification token for Feishu event subscriptions\n# (decrypt / verify incoming callbacks).\nFEISHU_ENCRYPT_KEY=\nFEISHU_VERIFICATION_TOKEN=\n\n# =====================================================================\n# S3-compatible object storage（简历 PDF、附件上传）\n# S3-compatible object storage (resume PDFs, general attachments)\n# =====================================================================\n\n# S3 / 兼容服务端点。如使用 AWS S3 可留空（SDK 默认走 AWS）。\n# S3 / S3-compatible endpoint. Leave blank for AWS S3 (SDK default).\nS3_ENDPOINT=\nS3_BUCKET_NAME=\nS3_REGION=\nS3_ACCESS_KEY_ID=\nS3_SECRET_ACCESS_KEY=\n\n# 对象 key 前缀，便于把上传和录制隔离到不同子目录（可留空）。\n# Optional key prefix used to namespace uploaded objects (may be empty).\nS3_KEY_PREFIX=\n\n# 是否强制 path-style 访问（MinIO / 部分私有 S3 必须为 true）。\n# Force path-style addressing (required by MinIO / some self-hosted S3). Default false.\nS3_FORCE_PATH_STYLE=\n\n# =====================================================================\n# Cloudflare R2 — LiveKit Egress 面试录制存储\n# Cloudflare R2 — LiveKit Egress interview recording storage\n# =====================================================================\n# Endpoint format: https://<account_id>.r2.cloudflarestorage.com\nRECORDING_R2_ENDPOINT=\nRECORDING_R2_BUCKET_NAME=\nRECORDING_R2_REGION=auto\nRECORDING_R2_ACCESS_KEY_ID=\nRECORDING_R2_SECRET_ACCESS_KEY=\nRECORDING_R2_KEY_PREFIX=\nRECORDING_R2_FORCE_PATH_STYLE=true\n\n# =====================================================================\n# 模型覆盖（可选，均带默认值）\n# Model overrides (optional, all have sensible defaults)\n# =====================================================================\n\n# 可选,带默认值。覆盖面试结果评估用的模型(走 Vercel AI gateway),默认 google/gemini-2.5-flash。\n# Optional, has a default. Overrides the interview-evaluation model\n# (via Vercel AI gateway). Defaults to google/gemini-2.5-flash.\nINTERVIEW_EVALUATION_MODEL=\n\n# 可选,带默认值。覆盖 Qwen-VL OCR 模型 ID,默认 qwen-vl-ocr-latest。\n# Optional, has a default. Overrides the Qwen-VL OCR model id. Defaults to\n# qwen-vl-ocr-latest.\nQWEN_OCR_MODEL=\n"}}}}