@opengeni/config 0.10.14 → 0.12.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/config",
-  "version": "0.10.14",
+  "version": "0.12.1",
   "description": "OpenGeni runtime configuration: settings resolution, deployment knobs, and config validation shared across the server packages.",
   "license": "Apache-2.0",
   "repository": {
@@ -33,8 +33,8 @@
     "prepublishOnly": "bash ../../scripts/prepublish-guard"
   },
   "dependencies": {
-    "@opengeni/codex": "^0.2.11",
-    "@opengeni/contracts": "^0.38.3",
+    "@opengeni/codex": "^0.2.13",
+    "@opengeni/contracts": "^0.40.0",
     "zod": "^4.2.1"
   },
   "engines": {

package/src/index.ts

@@ -249,7 +249,13 @@ const SettingsSchema = z.object({
   agentStableVersion: z
     .string()
     .regex(/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/u)
-    .default("0.1.9"),
+    .default("0.1.12"),
+  // Optional independent beta-channel pointer. When unset, the beta update
+  // manifest route is unavailable rather than silently serving stable.
+  agentBetaVersion: z
+    .string()
+    .regex(/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/u)
+    .optional(),
   productAccessMode: ProductAccessMode.default("local"),
   billingMode: BillingMode.default("disabled"),
   entitlementsMode: EntitlementsMode.default("none"),
@@ -370,6 +376,35 @@ const SettingsSchema = z.object({
     .positive()
     .max(25 * 1024 * 1024)
     .default(25 * 1024 * 1024),
+  // Durable long-form capture uploads bounded chunks to object storage, then
+  // normalizes them into provider-safe segments. It is advertised only when
+  // object storage and the configured ffmpeg executable are both available.
+  voiceInputResumableEnabled: EnvBoolean.default(true),
+  voiceInputResumableMaxDurationSeconds: z.coerce
+    .number()
+    .int()
+    .positive()
+    .max(8 * 60 * 60)
+    .default(2 * 60 * 60),
+  voiceInputResumableMaxSizeBytes: z.coerce
+    .number()
+    .int()
+    .positive()
+    .max(512 * 1024 * 1024)
+    .default(512 * 1024 * 1024),
+  voiceInputResumableMaxChunkSizeBytes: z.coerce
+    .number()
+    .int()
+    .positive()
+    .max(25 * 1024 * 1024)
+    .default(8 * 1024 * 1024),
+  voiceInputResumableRetentionSeconds: z.coerce
+    .number()
+    .int()
+    .positive()
+    .max(7 * 24 * 60 * 60)
+    .default(24 * 60 * 60),
+  voiceInputFfmpegPath: z.string().trim().min(1).max(1024).default("ffmpeg"),
   // Preferred provider order (comma-separated ids). First configured+ready wins.
   // Codex subscription STT is preferred by default when subscription routing is
   // enabled; operators can put openai/azure-openai first explicitly.
@@ -415,9 +450,11 @@ const SettingsSchema = z.object({
   // flag non-mandatory selected MCP tools `defer_loading:true` (dropping their
   // schemas from model context) and add one client-executed tool_search tool
   // that BM25-discloses bounded matches. The mandatory OpenGeni tools stay
-  // eager. Default OFF — a codex turn is byte-for-byte unchanged until enabled.
+  // eager. Default ON so selected connector catalogues do not consume every
+  // Codex turn's context. Operators may explicitly disable it for emergency
+  // compatibility diagnosis.
   // OPENGENI_CODEX_TOOL_SEARCH_ENABLED
-  codexToolSearchEnabled: EnvBoolean.default(false),
+  codexToolSearchEnabled: EnvBoolean.default(true),
   // credential allocator atomic, workspace-local credential allocation. Default OFF is a
   // deliberate rolling-deploy fence: migrate + roll every worker first, then
   // enable. Turning it off restores the legacy sticky selector without a schema
@@ -669,10 +706,13 @@ const SettingsSchema = z.object({
   // the deploy-staging IaC secret/configmap pattern.
   sandboxSelfhostedEnabled: EnvBoolean.default(false),
   // Gates the op-stream (streaming exec) transport to Connected Machines. The
-  // runner must ALSO advertise Capabilities.op_stream; default off, and legacy
-  // request/reply exec is the permanent fallback. EnvBoolean (NOT
+  // runner must ALSO advertise Capabilities.op_stream. Streaming is the default
+  // because it is the only transport that can keep a command alive without an
+  // arbitrary request/reply wall while still supporting replay and cancellation.
+  // Older runners remain usable when an explicit positive exec timeout is set.
+  // EnvBoolean (NOT
   // z.coerce.boolean(), which coerces "false" -> true).
-  agentOpStreamEnabled: EnvBoolean.default(false),
+  agentOpStreamEnabled: EnvBoolean.default(true),
   // The HMAC secret the control plane signs the enrollment bearer credential with
   // (the `oge_` envelope the agent presents back to the control plane). Optional:
   // when ABSENT and sandboxSelfhostedEnabled is on, the poll route reports the
@@ -730,23 +770,15 @@ const SettingsSchema = z.object({
   selfhostedNatsControlUser: z.string().optional(),
   selfhostedNatsControlPassword: z.string().optional(),
   // --- selfhosted (Connected Machine) control/exec op deadlines ---------------
-  // The control plane splits its op deadline in two. CONTROL ops (ping / fs / git /
-  // desktop / pty) must stay responsive so a machine's liveness is never masked by a
-  // slow op, so they use the short control timeout. EXEC gets its OWN, larger budget:
-  // a real command (compile, test run, dependency install) routinely outlives the
-  // control timeout, and before the split a long command was killed at the ~30s
-  // control wall. The agent kills the exec child at this deadline; the wire waits
-  // slightly longer (SELFHOSTED_EXEC_REPLY_GRACE_MS) for the typed timed-out reply.
-  //
-  // The exec default is a DELIBERATELY MODEST 2min (not 5): the agent-side admission
-  // pool is (until a later agent release) a FLAT 8 permits with no per-class split,
-  // so 8 slow execs holding a permit for 5 minutes would blanket-DRAIN every fs/git
-  // op — shipping the amplifier before the class-aware-admission fix. 2min still
-  // clears the large majority of the observed >30s exec tail; genuinely long jobs run
-  // in the background (see the exec-deadline hint) or raise the knob per deployment.
-  // Knobs: OPENGENI_SANDBOX_SELFHOSTED_EXEC_TIMEOUT_MS (default 2min) and
+  // CONTROL ops (ping / fs / git / desktop / pty) keep a short request timeout so
+  // liveness failures surface promptly. EXEC duration is a different concern: by
+  // default it is unbounded (0), exactly like a command launched by an unrestricted
+  // local agent. The op-stream transport keeps control liveness, replay, and explicit
+  // cancellation independent of command duration. A deployment may opt into a hard
+  // process deadline by setting a positive value; 0 never schedules a process kill.
+  // Knobs: OPENGENI_SANDBOX_SELFHOSTED_EXEC_TIMEOUT_MS (default 0 = none) and
   // OPENGENI_SANDBOX_SELFHOSTED_CONTROL_TIMEOUT_MS (default 30s).
-  sandboxSelfhostedExecTimeoutMs: z.coerce.number().int().positive().default(120_000),
+  sandboxSelfhostedExecTimeoutMs: z.coerce.number().int().nonnegative().default(0),
   sandboxSelfhostedControlTimeoutMs: z.coerce.number().int().positive().default(30_000),
   // --- sandbox lease cadences (cadence invariant validated at boot below) ---
   // reaperPeriod < viewerHolderTTL, and reaperPeriod + idleGrace < the EFFECTIVE
@@ -1726,6 +1758,7 @@ export function getSettings(): Settings {
     webBaseUrl: optional("OPENGENI_WEB_BASE_URL"),
     agentReleasesBaseUrl: optional("OPENGENI_AGENT_RELEASES_BASE_URL"),
     agentStableVersion: optional("OPENGENI_AGENT_STABLE_VERSION"),
+    agentBetaVersion: optional("OPENGENI_AGENT_BETA_VERSION"),
     productAccessMode: optional("OPENGENI_PRODUCT_ACCESS_MODE"),
     billingMode: optional("OPENGENI_BILLING_MODE"),
     entitlementsMode: optional("OPENGENI_ENTITLEMENTS_MODE"),
@@ -1778,6 +1811,18 @@ export function getSettings(): Settings {
     vercelAiGatewayApiKey: optional("OPENGENI_VERCEL_AI_GATEWAY_API_KEY"),
     voiceInputMaxDurationSeconds: optional("OPENGENI_VOICE_INPUT_MAX_DURATION_SECONDS"),
     voiceInputMaxSizeBytes: optional("OPENGENI_VOICE_INPUT_MAX_SIZE_BYTES"),
+    voiceInputResumableEnabled: optional("OPENGENI_VOICE_INPUT_RESUMABLE_ENABLED"),
+    voiceInputResumableMaxDurationSeconds: optional(
+      "OPENGENI_VOICE_INPUT_RESUMABLE_MAX_DURATION_SECONDS",
+    ),
+    voiceInputResumableMaxSizeBytes: optional("OPENGENI_VOICE_INPUT_RESUMABLE_MAX_SIZE_BYTES"),
+    voiceInputResumableMaxChunkSizeBytes: optional(
+      "OPENGENI_VOICE_INPUT_RESUMABLE_MAX_CHUNK_SIZE_BYTES",
+    ),
+    voiceInputResumableRetentionSeconds: optional(
+      "OPENGENI_VOICE_INPUT_RESUMABLE_RETENTION_SECONDS",
+    ),
+    voiceInputFfmpegPath: optional("OPENGENI_VOICE_INPUT_FFMPEG_PATH"),
     voiceInputProviderOrder: optional("OPENGENI_VOICE_INPUT_PROVIDER_ORDER"),
     voiceInputOpenaiEnabled: optional("OPENGENI_VOICE_INPUT_OPENAI_ENABLED"),
     voiceInputOpenaiApiKey: optional("OPENGENI_VOICE_INPUT_OPENAI_API_KEY"),
@@ -3661,16 +3706,8 @@ export function stableSandboxEnvironmentForRun(
     environment.OPENGENI_GIT_CLI_WRAPPER_DIR ??= `${home}/.opengeni/bin`;
     environment.PATH = prependPathEntry(environment.PATH, environment.OPENGENI_GIT_CLI_WRAPPER_DIR);
   }
-  if (settings.toolspaceEnabled) {
-    // Connected Machines do not share one control-plane-known home path. Keep a
-    // stable shell-resolved pointer in the manifest; runtime expands this trusted
-    // marker against the machine's own HOME for seed, renewal, and every command.
-    // Never derive it from the selfhosted descriptor root (`/`), which would try
-    // to write `/.opengeni` as an ordinary machine user.
-    environment.OPENGENI_TOOLSPACE_TOKEN_FILE ??=
-      settings.sandboxBackend === "selfhosted"
-        ? "$HOME/.opengeni/toolspace-token"
-        : `${environment.HOME ?? descriptor.workspaceRoot}/.opengeni/toolspace-token`;
+  if (settings.toolspaceEnabled && settings.sandboxBackend !== "selfhosted") {
+    environment.OPENGENI_TOOLSPACE_TOKEN_FILE ??= `${environment.HOME ?? descriptor.workspaceRoot}/.opengeni/toolspace-token`;
     if (settings.ogtoolPackageSpec) {
       environment.OPENGENI_OGTOOL_PACKAGE_SPEC ??= settings.ogtoolPackageSpec;
     }