@opengeni/config 0.11.0 → 0.13.2

package/dist/index.js

@@ -10,6 +10,7 @@ import {
   ReasoningEffort,
   SandboxBackend,
   SessionMcpApprovalPolicy,
+  SEEDANCE_2_5_MODEL_ID,
   StaticUsageLimits,
   TurnExecutionPolicyV1,
   UsageLimitsMode
@@ -28,6 +29,11 @@ import { createHash } from "crypto";
 import { z } from "zod";
 var envName = /^[A-Za-z_][A-Za-z0-9_]*$/;
 var registryId = /^[A-Za-z0-9_-]+$/;
+var SANDBOX_ARCHIVE_CAPTURE_MAX_TIMEOUT_MS = 60 * 6e4;
+var SANDBOX_ARCHIVE_CAPTURE_SETTLEMENT_GRACE_MS = 1e4;
+var SANDBOX_SNAPSHOT_MAX_TIMEOUT_MS = SANDBOX_ARCHIVE_CAPTURE_MAX_TIMEOUT_MS - SANDBOX_ARCHIVE_CAPTURE_SETTLEMENT_GRACE_MS;
+var SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS = 60 * 6e4;
+var SANDBOX_LIFECYCLE_RETRY_HANDOFF_GRACE_MS = 1e4;
 var EnvBoolean = z.preprocess((value) => {
   if (typeof value !== "string") {
     return value;
@@ -171,6 +177,12 @@ var SettingsSchema = z.object({
   turnWorkerMaxConcurrentTurns: z.coerce.number().int().positive().max(2e3).default(16),
   turnWorkerTargetCpuUsage: z.coerce.number().positive().max(1).default(0.8),
   turnWorkerTargetMemoryUsage: z.coerce.number().positive().max(0.8).default(0.75),
+  // Admission and emergency recovery are deliberately separate control loops.
+  // The Temporal tuner stops polling at the lower target; only genuine danger
+  // may invoke the disruptive graceful-drain fallback.
+  turnWorkerEmergencyMemoryUsage: z.coerce.number().min(0.85).max(0.95).default(0.9),
+  turnWorkerMemoryGuardIntervalMs: z.coerce.number().int().min(1e3).max(6e4).default(5e3),
+  turnWorkerMemoryGuardSustainMs: z.coerce.number().int().min(5e3).max(3e5).default(3e4),
   observabilityStructuredLogs: EnvBoolean.default(false),
   observabilityMetricsEnabled: EnvBoolean.default(true),
   observabilityOtlpEndpoint: z.string().url().optional(),
@@ -192,7 +204,10 @@ var SettingsSchema = z.object({
   // Explicit operator-controlled promotion pointer for `/agent/latest/*`.
   // Versioned agent releases are immutable; changing this setting promotes or
   // rolls back the stable channel without moving or deleting a provider tag.
-  agentStableVersion: z.string().regex(/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/u).default("0.1.9"),
+  agentStableVersion: z.string().regex(/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/u).default("0.1.14"),
+  // Optional independent beta-channel pointer. When unset, the beta update
+  // manifest route is unavailable rather than silently serving stable.
+  agentBetaVersion: z.string().regex(/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/u).optional(),
   productAccessMode: ProductAccessMode.default("local"),
   billingMode: BillingMode.default("disabled"),
   entitlementsMode: EntitlementsMode.default("none"),
@@ -210,8 +225,7 @@ var SettingsSchema = z.object({
   // holder of stream:control gets 403 until this flips. Keeps stream:control a
   // declared-but-inert permission so later hardening is a flag flip.
   streamControlEnabled: EnvBoolean.default(false),
-  toolspaceEnabled: EnvBoolean.default(false),
-  toolspaceMaxCallsPerTurn: z.coerce.number().int().positive().default(200),
+  codemodeMaxCallsPerTurn: z.coerce.number().int().positive().default(200),
   // Optional release-coherent bootstrap hint for custom rigs/connected machines
   // that do not carry the stock-image ogtool binary. Exact stable versions only:
   // the agent must never guess a tag or silently install `latest`.
@@ -221,11 +235,15 @@ var SettingsSchema = z.object({
   integrationsStateSecret: z.string().optional(),
   integrationsAllowPrivateNetworkTargets: EnvBoolean.default(false),
   integrationsOauthClientsJson: z.string().default("{}"),
+  gmailRestAdapterEnabled: EnvBoolean.default(false),
   slackClientId: z.string().optional(),
   slackClientSecret: z.string().optional(),
   slackSigningSecret: z.string().optional(),
   googleDriveClientId: z.string().optional(),
   googleDriveClientSecret: z.string().optional(),
+  googleDriveWorkspaceEventsEnabled: EnvBoolean.optional(),
+  atlassianClientId: z.string().optional(),
+  atlassianClientSecret: z.string().optional(),
   // Undefined is meaningful: the migration boundary persists the product
   // default of 3 when no deployment override is supplied.
   maxNestedAgentDepth: z.coerce.number().int().nonnegative().max(MAX_NESTED_AGENT_DEPTH).optional(),
@@ -296,6 +314,20 @@ var SettingsSchema = z.object({
   // Gateway models below are added to the managed-credit catalog. Workspace
   // Gateway keys use the encrypted connection broker and never this secret.
   vercelAiGatewayApiKey: z.string().optional(),
+  /** Image adapter route; native hosted providers ignore this model. */
+  imageGenerationModel: z.string().trim().min(1).max(256).default("openai/gpt-image-2"),
+  /** Durable video generation uses the workspace-owned Gateway credential. */
+  videoGenerationPollIntervalMs: z.coerce.number().int().min(1e3).max(6e4).default(5e3),
+  videoGenerationRecoveryDeadlineMs: z.coerce.number().int().min(6e4).max(24 * 60 * 6e4).default(2 * 60 * 6e4),
+  videoGenerationReferenceUrlTtlSeconds: z.coerce.number().int().min(300).max(6 * 60 * 60).default(60 * 60),
+  videoGenerationMaxConcurrentPerWorkspace: z.coerce.number().int().min(1).max(16).default(2),
+  videoGenerationWorkspaceQuotaBytes: z.coerce.number().int().positive().max(Number.MAX_SAFE_INTEGER).default(20 * 1024 * 1024 * 1024),
+  videoGenerationTempDirectory: z.string().trim().min(1).max(1024).default("/tmp/opengeni-video"),
+  videoGenerationFfprobePath: z.string().trim().min(1).max(1024).default("ffprobe"),
+  // OpenGeni's customer price, not a claim about the provider's delayed cost report.
+  // The durable operation freezes the exact resulting price before provider submit.
+  videoGenerationCredit480pMicrosPerSecond: z.coerce.number().int().positive().max(1e7).default(155e3),
+  videoGenerationCredit720pMicrosPerSecond: z.coerce.number().int().positive().max(1e7).default(35e4),
   // Native composer voice input (browser MediaRecorder → API transcription).
   // Provider credentials stay server-side; ClientConfig only projects availability
   // and hard ceilings. Selection happens once before audio is sent — never retry
@@ -364,6 +396,11 @@ var SettingsSchema = z.object({
   // compatibility diagnosis.
   // OPENGENI_CODEX_TOOL_SEARCH_ENABLED
   codexToolSearchEnabled: EnvBoolean.default(true),
+  // Provider-neutral progressive disclosure for direct OpenAI/Azure native
+  // client search and ordinary-function generic dispatch. Kept separate from
+  // the Codex rollout so an emergency Codex opt-out cannot disable every model.
+  // OPENGENI_LAZY_TOOL_SEARCH_ENABLED
+  lazyToolSearchEnabled: EnvBoolean.default(true),
   // credential allocator atomic, workspace-local credential allocation. Default OFF is a
   // deliberate rolling-deploy fence: migrate + roll every worker first, then
   // enable. Turning it off restores the legacy sticky selector without a schema
@@ -421,6 +458,13 @@ var SettingsSchema = z.object({
   disableOpenaiTracing: EnvBoolean.default(false),
   sandboxBackend: SandboxBackend.default("docker"),
   dockerImage: z.string().default("opengeni-sandbox:local"),
+  // Explicit deployment contract: the configured base sandbox image contains
+  // the verified, self-contained native artifact runtime at its fixed image
+  // paths. Disabled by default so arbitrary/custom provider images never make
+  // document/spreadsheet/presentation skills appear when their runtime is
+  // absent. Per-pack/per-rig image overrides fail closed in the worker even
+  // when this base-image contract is enabled.
+  sandboxArtifactRuntimeEnabled: EnvBoolean.default(false),
   dockerExposedPorts: z.string().default(""),
   dockerNetwork: z.string().optional(),
   // When the worker itself runs in a container and talks to a host Docker daemon,
@@ -477,15 +521,14 @@ var SettingsSchema = z.object({
   // SOONER than the hard lifetime; the boot invariant forbids a value that would
   // reap before reaperPeriod + idleGrace elapses.
   modalIdleTimeoutSeconds: z.coerce.number().int().positive().optional(),
-  // /workspace FILE PERSISTENCE across warm/cold cycles. Defaults to
-  // `snapshot_filesystem` so EVERY box is created persistence-capable: the reaper
-  // snapshots the live box before it terminates a drained group, and a later
-  // cold-restore hydrates a fresh box from that snapshot (sandbox-file-persistence).
-  // `snapshot_filesystem` requires the manifest declare NO ephemeralPersistencePaths
-  // (buildManifest never sets entry.ephemeral, so it never downgrades to tar). Set
-  // OPENGENI_MODAL_WORKSPACE_PERSISTENCE=tar to opt back out (no native snapshot;
-  // the reaper persists a tar archive — same store+hydrate plumbing, slower).
-  modalWorkspacePersistence: z.enum(["tar", "snapshot_filesystem", "snapshot_directory"]).default("snapshot_filesystem"),
+  // /workspace FILE PERSISTENCE across warm/cold cycles. Directory snapshots
+  // preserve only the durable user workspace, so provider recovery does not
+  // restore an entire machine image or replace the selected rig/base image.
+  // Existing serialized sessions retain their original persistence mode and
+  // remain recoverable; this default governs newly created Modal sandboxes.
+  // `snapshot_filesystem` remains available for explicit compatibility and
+  // immutable rig-image materialization. `tar` is the portable fallback.
+  modalWorkspacePersistence: z.enum(["tar", "snapshot_filesystem", "snapshot_directory"]).default("snapshot_directory"),
   // Shared desktop toggle: this module reads it for the 6080 port-merge; the
   // owner module (P4.x) acts on it to launch the display stack.
   sandboxDesktopEnabled: EnvBoolean.default(false),
@@ -613,10 +656,13 @@ var SettingsSchema = z.object({
   // the deploy-staging IaC secret/configmap pattern.
   sandboxSelfhostedEnabled: EnvBoolean.default(false),
   // Gates the op-stream (streaming exec) transport to Connected Machines. The
-  // runner must ALSO advertise Capabilities.op_stream; default off, and legacy
-  // request/reply exec is the permanent fallback. EnvBoolean (NOT
+  // runner must ALSO advertise Capabilities.op_stream. Streaming is the default
+  // because it is the only transport that can keep a command alive without an
+  // arbitrary request/reply wall while still supporting replay and cancellation.
+  // Older runners remain usable when an explicit positive exec timeout is set.
+  // EnvBoolean (NOT
   // z.coerce.boolean(), which coerces "false" -> true).
-  agentOpStreamEnabled: EnvBoolean.default(false),
+  agentOpStreamEnabled: EnvBoolean.default(true),
   // The HMAC secret the control plane signs the enrollment bearer credential with
   // (the `oge_` envelope the agent presents back to the control plane). Optional:
   // when ABSENT and sandboxSelfhostedEnabled is on, the poll route reports the
@@ -674,23 +720,15 @@ var SettingsSchema = z.object({
   selfhostedNatsControlUser: z.string().optional(),
   selfhostedNatsControlPassword: z.string().optional(),
   // --- selfhosted (Connected Machine) control/exec op deadlines ---------------
-  // The control plane splits its op deadline in two. CONTROL ops (ping / fs / git /
-  // desktop / pty) must stay responsive so a machine's liveness is never masked by a
-  // slow op, so they use the short control timeout. EXEC gets its OWN, larger budget:
-  // a real command (compile, test run, dependency install) routinely outlives the
-  // control timeout, and before the split a long command was killed at the ~30s
-  // control wall. The agent kills the exec child at this deadline; the wire waits
-  // slightly longer (SELFHOSTED_EXEC_REPLY_GRACE_MS) for the typed timed-out reply.
-  //
-  // The exec default is a DELIBERATELY MODEST 2min (not 5): the agent-side admission
-  // pool is (until a later agent release) a FLAT 8 permits with no per-class split,
-  // so 8 slow execs holding a permit for 5 minutes would blanket-DRAIN every fs/git
-  // op — shipping the amplifier before the class-aware-admission fix. 2min still
-  // clears the large majority of the observed >30s exec tail; genuinely long jobs run
-  // in the background (see the exec-deadline hint) or raise the knob per deployment.
-  // Knobs: OPENGENI_SANDBOX_SELFHOSTED_EXEC_TIMEOUT_MS (default 2min) and
+  // CONTROL ops (ping / fs / git / desktop / pty) keep a short request timeout so
+  // liveness failures surface promptly. EXEC duration is a different concern: by
+  // default it is unbounded (0), exactly like a command launched by an unrestricted
+  // local agent. The op-stream transport keeps control liveness, replay, and explicit
+  // cancellation independent of command duration. A deployment may opt into a hard
+  // process deadline by setting a positive value; 0 never schedules a process kill.
+  // Knobs: OPENGENI_SANDBOX_SELFHOSTED_EXEC_TIMEOUT_MS (default 0 = none) and
   // OPENGENI_SANDBOX_SELFHOSTED_CONTROL_TIMEOUT_MS (default 30s).
-  sandboxSelfhostedExecTimeoutMs: z.coerce.number().int().positive().default(12e4),
+  sandboxSelfhostedExecTimeoutMs: z.coerce.number().int().nonnegative().default(0),
   sandboxSelfhostedControlTimeoutMs: z.coerce.number().int().positive().default(3e4),
   // --- sandbox lease cadences (cadence invariant validated at boot below) ---
   // reaperPeriod < viewerHolderTTL, and reaperPeriod + idleGrace < the EFFECTIVE
@@ -701,6 +739,10 @@ var SettingsSchema = z.object({
   // snapshotted before the box dies (sandbox-file-persistence).
   sandboxLeaseReaperPeriodMs: z.coerce.number().int().positive().default(3e4),
   sandboxViewerHolderTtlMs: z.coerce.number().int().positive().default(9e4),
+  // A BrowserSession controller refreshes its durable resource and exact
+  // interaction lease holder together. This longer crash horizon tolerates API
+  // replacement while still releasing a placement whose controller died.
+  sandboxInteractionHolderTtlMs: z.coerce.number().int().positive().default(18e4),
   // The DRAIN grace: how long a refcount-0 (draining) lease stays WARM before the
   // reaper resume-by-ids the box and terminates it. This is the cost-vs-snappiness
   // dial — when the user navigates away the box keeps refcount 0, but it survives
@@ -726,7 +768,7 @@ var SettingsSchema = z.object({
   // graceful shutdown, or become permission to GC an older archive. Timeout is
   // treated exactly like a failed best-effort snapshot. Knob:
   // OPENGENI_SANDBOX_SNAPSHOT_TIMEOUT_MS. Default 60s.
-  sandboxSnapshotTimeoutMs: z.coerce.number().int().positive().default(6e4),
+  sandboxSnapshotTimeoutMs: z.coerce.number().int().positive().max(SANDBOX_SNAPSHOT_MAX_TIMEOUT_MS).default(6e4),
   // Begin a controlled snapshot/quiesce/drain/rematerialize transition this far
   // ahead of a finite provider deadline. Modal's 24h creation clock cannot be
   // extended; the logical sandbox outlives it by moving to one successor box.
@@ -736,13 +778,12 @@ var SettingsSchema = z.object({
   // an operator deliberately wants more rotation headroom; the boot invariant
   // still requires it to remain below the provider lifetime.
   sandboxRotationLeadMs: z.coerce.number().int().positive().default(36e5),
-  // Bound each global reaper pass so a rollout that discovers many legacy boxes
-  // with unknown creation clocks cannot create a provider/API thundering herd.
-  // One is the safe admission default: the reaper services provider transitions
-  // sequentially, so claiming a wider batch would fence boxes before the same
-  // sweep can service them. Larger fleets may raise this only as an explicit,
-  // observed deployment choice.
-  sandboxRotationBatchSize: z.coerce.number().int().positive().max(500).default(1),
+  // Bound provider-deadline rotation admission independently of execution.
+  // Every admitted box receives its own durable drain child; the control worker
+  // limits provider I/O to 32 concurrent activities. Matching that bound avoids
+  // both the old one-box-per-tick deadline backlog and an unbounded provider/API
+  // burst. Operators may tune this for a differently-sized worker pool.
+  sandboxRotationBatchSize: z.coerce.number().int().positive().max(500).default(32),
   // expires_at refresh window for a held lease (>> the turn 10s heartbeat so a
   // single missed heartbeat never TTL-reaps a live turn). The warming TTL is the
   // window a cold->warming spawner has to commit warm before a reaper resets it.
@@ -971,7 +1012,11 @@ var ModelCapabilitiesV1Schema = z.object({
   hostedTools: z.object({
     webSearch: CapabilityStateV1Schema,
     xSearch: CapabilityStateV1Schema,
-    codeExecution: CapabilityStateV1Schema
+    codeExecution: CapabilityStateV1Schema,
+    imageGeneration: CapabilityStateV1Schema.default({
+      upstream: "unknown",
+      runnable: false
+    })
   }),
   inputModalities: z.array(ModelModalityV1).min(1),
   /** Exact MIME types accepted as typed `input_file`; `text/*` is allowed. */
@@ -1340,6 +1385,9 @@ function getSettings() {
     turnWorkerMaxConcurrentTurns: optional("OPENGENI_TURN_WORKER_MAX_CONCURRENT_TURNS"),
     turnWorkerTargetCpuUsage: optional("OPENGENI_TURN_WORKER_TARGET_CPU_USAGE"),
     turnWorkerTargetMemoryUsage: optional("OPENGENI_TURN_WORKER_TARGET_MEMORY_USAGE"),
+    turnWorkerEmergencyMemoryUsage: optional("OPENGENI_TURN_WORKER_EMERGENCY_MEMORY_USAGE"),
+    turnWorkerMemoryGuardIntervalMs: optional("OPENGENI_TURN_WORKER_MEMORY_GUARD_INTERVAL_MS"),
+    turnWorkerMemoryGuardSustainMs: optional("OPENGENI_TURN_WORKER_MEMORY_GUARD_SUSTAIN_MS"),
     observabilityStructuredLogs: optional("OPENGENI_OBSERVABILITY_STRUCTURED_LOGS"),
     observabilityMetricsEnabled: optional("OPENGENI_OBSERVABILITY_METRICS_ENABLED"),
     observabilityOtlpEndpoint: optional("OPENGENI_OTEL_EXPORTER_OTLP_ENDPOINT") ?? optional("OTEL_EXPORTER_OTLP_ENDPOINT"),
@@ -1354,6 +1402,7 @@ function getSettings() {
     webBaseUrl: optional("OPENGENI_WEB_BASE_URL"),
     agentReleasesBaseUrl: optional("OPENGENI_AGENT_RELEASES_BASE_URL"),
     agentStableVersion: optional("OPENGENI_AGENT_STABLE_VERSION"),
+    agentBetaVersion: optional("OPENGENI_AGENT_BETA_VERSION"),
     productAccessMode: optional("OPENGENI_PRODUCT_ACCESS_MODE"),
     billingMode: optional("OPENGENI_BILLING_MODE"),
     entitlementsMode: optional("OPENGENI_ENTITLEMENTS_MODE"),
@@ -1363,8 +1412,7 @@ function getSettings() {
     delegationSecret: optional("OPENGENI_DELEGATION_SECRET"),
     streamTokenSecret: optional("OPENGENI_STREAM_TOKEN_SECRET"),
     streamControlEnabled: optional("OPENGENI_STREAM_CONTROL_ENABLED"),
-    toolspaceEnabled: optional("OPENGENI_TOOLSPACE_ENABLED"),
-    toolspaceMaxCallsPerTurn: optional("OPENGENI_TOOLSPACE_MAX_CALLS_PER_TURN"),
+    codemodeMaxCallsPerTurn: optional("OPENGENI_CODEMODE_MAX_CALLS_PER_TURN"),
     ogtoolPackageSpec: optional("OPENGENI_OGTOOL_PACKAGE_SPEC"),
     environmentsEncryptionKey: optional("OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY"),
     integrationsEnabled: optional("OPENGENI_INTEGRATIONS_ENABLED"),
@@ -1373,11 +1421,15 @@ function getSettings() {
       "OPENGENI_INTEGRATIONS_ALLOW_PRIVATE_NETWORK_TARGETS"
     ),
     integrationsOauthClientsJson: optional("OPENGENI_INTEGRATIONS_OAUTH_CLIENTS_JSON"),
+    gmailRestAdapterEnabled: optional("OPENGENI_GMAIL_REST_ADAPTER_ENABLED"),
     slackClientId: optional("OPENGENI_SLACK_CLIENT_ID"),
     slackClientSecret: optional("OPENGENI_SLACK_CLIENT_SECRET"),
     slackSigningSecret: optional("OPENGENI_SLACK_SIGNING_SECRET"),
     googleDriveClientId: optional("OPENGENI_GOOGLE_DRIVE_CLIENT_ID"),
     googleDriveClientSecret: optional("OPENGENI_GOOGLE_DRIVE_CLIENT_SECRET"),
+    googleDriveWorkspaceEventsEnabled: optional("OPENGENI_GOOGLE_DRIVE_WORKSPACE_EVENTS_ENABLED"),
+    atlassianClientId: optional("OPENGENI_ATLASSIAN_CLIENT_ID"),
+    atlassianClientSecret: optional("OPENGENI_ATLASSIAN_CLIENT_SECRET"),
     maxNestedAgentDepth: optional("OPENGENI_MAX_NESTED_AGENT_DEPTH"),
     socialOauthClientsJson: optional("OPENGENI_SOCIAL_OAUTH_CLIENTS_JSON"),
     goalMaxAutoContinuations: optional("OPENGENI_GOAL_MAX_AUTO_CONTINUATIONS"),
@@ -1404,6 +1456,24 @@ function getSettings() {
     openaiModel: optional("OPENGENI_OPENAI_MODEL"),
     openaiAllowedModels: optional("OPENGENI_OPENAI_ALLOWED_MODELS"),
     vercelAiGatewayApiKey: optional("OPENGENI_VERCEL_AI_GATEWAY_API_KEY"),
+    imageGenerationModel: optional("OPENGENI_IMAGE_GENERATION_MODEL"),
+    videoGenerationPollIntervalMs: optional("OPENGENI_VIDEO_GENERATION_POLL_INTERVAL_MS"),
+    videoGenerationRecoveryDeadlineMs: optional("OPENGENI_VIDEO_GENERATION_RECOVERY_DEADLINE_MS"),
+    videoGenerationReferenceUrlTtlSeconds: optional(
+      "OPENGENI_VIDEO_GENERATION_REFERENCE_URL_TTL_SECONDS"
+    ),
+    videoGenerationMaxConcurrentPerWorkspace: optional(
+      "OPENGENI_VIDEO_GENERATION_MAX_CONCURRENT_PER_WORKSPACE"
+    ),
+    videoGenerationWorkspaceQuotaBytes: optional("OPENGENI_VIDEO_GENERATION_WORKSPACE_QUOTA_BYTES"),
+    videoGenerationTempDirectory: optional("OPENGENI_VIDEO_GENERATION_TEMP_DIRECTORY"),
+    videoGenerationFfprobePath: optional("OPENGENI_VIDEO_GENERATION_FFPROBE_PATH"),
+    videoGenerationCredit480pMicrosPerSecond: optional(
+      "OPENGENI_VIDEO_GENERATION_CREDIT_480P_MICROS_PER_SECOND"
+    ),
+    videoGenerationCredit720pMicrosPerSecond: optional(
+      "OPENGENI_VIDEO_GENERATION_CREDIT_720P_MICROS_PER_SECOND"
+    ),
     voiceInputMaxDurationSeconds: optional("OPENGENI_VOICE_INPUT_MAX_DURATION_SECONDS"),
     voiceInputMaxSizeBytes: optional("OPENGENI_VOICE_INPUT_MAX_SIZE_BYTES"),
     voiceInputResumableEnabled: optional("OPENGENI_VOICE_INPUT_RESUMABLE_ENABLED"),
@@ -1435,6 +1505,7 @@ function getSettings() {
     codexSubscriptionEnabled: optional("OPENGENI_CODEX_SUBSCRIPTION_ENABLED"),
     codexConnectedAppsEnabled: optional("OPENGENI_CODEX_CONNECTED_APPS_ENABLED"),
     codexToolSearchEnabled: optional("OPENGENI_CODEX_TOOL_SEARCH_ENABLED"),
+    lazyToolSearchEnabled: optional("OPENGENI_LAZY_TOOL_SEARCH_ENABLED"),
     codexCredentialLeasingEnabled: optional("OPENGENI_CODEX_CREDENTIAL_LEASING_ENABLED"),
     codexFleetPolicyShadowEnabled: optional("OPENGENI_CODEX_FLEET_POLICY_SHADOW_ENABLED"),
     codexProductSku: optional("OPENGENI_CODEX_PRODUCT_SKU"),
@@ -1455,6 +1526,7 @@ function getSettings() {
     disableOpenaiTracing: optional("OPENGENI_DISABLE_OPENAI_TRACING"),
     sandboxBackend: optional("OPENGENI_SANDBOX_BACKEND"),
     dockerImage: optional("OPENGENI_DOCKER_IMAGE"),
+    sandboxArtifactRuntimeEnabled: optional("OPENGENI_SANDBOX_ARTIFACT_RUNTIME_ENABLED"),
     dockerExposedPorts: optional("OPENGENI_DOCKER_EXPOSED_PORTS"),
     dockerNetwork: optional("OPENGENI_DOCKER_NETWORK"),
     dockerWorkspaceBaseDir: optional("OPENGENI_DOCKER_WORKSPACE_BASE_DIR"),
@@ -1537,6 +1609,7 @@ function getSettings() {
     sandboxSelfhostedControlTimeoutMs: optional("OPENGENI_SANDBOX_SELFHOSTED_CONTROL_TIMEOUT_MS"),
     sandboxLeaseReaperPeriodMs: optional("OPENGENI_SANDBOX_LEASE_REAPER_PERIOD_MS"),
     sandboxViewerHolderTtlMs: optional("OPENGENI_SANDBOX_VIEWER_HOLDER_TTL_MS"),
+    sandboxInteractionHolderTtlMs: optional("OPENGENI_SANDBOX_INTERACTION_HOLDER_TTL_MS"),
     sandboxIdleGraceMs: optional("OPENGENI_SANDBOX_IDLE_GRACE_MS"),
     sandboxSnapshotIntervalMs: optional("OPENGENI_SANDBOX_SNAPSHOT_INTERVAL_MS"),
     sandboxSnapshotTimeoutMs: optional("OPENGENI_SANDBOX_SNAPSHOT_TIMEOUT_MS"),
@@ -1627,8 +1700,15 @@ function effectiveModalIdleTimeoutSeconds(settings) {
 }
 function sandboxArchiveCaptureTimeoutMs(settings) {
   return Math.min(
-    60 * 6e4,
-    Math.max(settings.sandboxSnapshotTimeoutMs + 3e4, settings.sandboxSnapshotTimeoutMs * 2)
+    SANDBOX_ARCHIVE_CAPTURE_MAX_TIMEOUT_MS,
+    settings.sandboxSnapshotTimeoutMs + SANDBOX_ARCHIVE_CAPTURE_SETTLEMENT_GRACE_MS
+  );
+}
+function sandboxLifecycleTransitionWaitMs(settings) {
+  const captureTimeoutMs = sandboxArchiveCaptureTimeoutMs(settings);
+  return Math.min(
+    SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS,
+    settings.sandboxLeaseReaperPeriodMs + captureTimeoutMs + SANDBOX_LIFECYCLE_RETRY_HANDOFF_GRACE_MS
   );
 }
 function collectSandboxEnvironment(settings, source = process.env) {
@@ -1856,7 +1936,11 @@ function legacyModelCapabilities(settings, input) {
         runnable: input.hostedWebSearch
       },
       xSearch: { upstream: "unknown", runnable: false },
-      codeExecution: { upstream: "unknown", runnable: false }
+      codeExecution: { upstream: "unknown", runnable: false },
+      imageGeneration: {
+        upstream: input.hostedImageGeneration ? "supported" : "unknown",
+        runnable: input.hostedImageGeneration ?? false
+      }
     },
     inputModalities: input.vision ? ["text", "image"] : ["text"],
     inputFileMediaTypes: [
@@ -2029,6 +2113,18 @@ function builtinPromptCachingForModel(modelId) {
   const slug = modelId.startsWith(CODEX_MODEL_ID_PREFIX) ? modelId.slice(CODEX_MODEL_ID_PREFIX.length) : modelId;
   return slug.startsWith("gpt-5.6-") ? { upstream: "supported", runnable: true, mode: "implicit" } : void 0;
 }
+function builtinHostedImageGenerationForModel(settings, modelId) {
+  return settings.openaiProvider === "openai" && isDirectOpenAiApiBaseUrl(settings.openaiBaseUrl) && ["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna"].includes(modelId);
+}
+function isDirectOpenAiApiBaseUrl(baseUrl) {
+  if (baseUrl === void 0) return true;
+  try {
+    const parsed = new URL(baseUrl);
+    return parsed.protocol === "https:" && parsed.hostname === "api.openai.com" && parsed.port === "" && parsed.username === "" && parsed.password === "" && parsed.search === "" && parsed.hash === "" && parsed.pathname.replace(/\/+$/, "") === "/v1";
+  } catch {
+    return false;
+  }
+}
 function serviceTierForLatencyMode(providerId, latencyMode) {
   if (latencyMode === "standard") {
     return void 0;
@@ -2320,6 +2416,7 @@ function configuredModels(settings) {
       ...legacyModelCapabilities(settings, {
         reasoningEffort: true,
         hostedWebSearch: settings.webSearchEnabled,
+        hostedImageGeneration: builtinHostedImageGenerationForModel(settings, id),
         vision: id.startsWith("gpt-5.6-")
       }),
       ...builtinPromptCachingForModel(id) ? { promptCaching: builtinPromptCachingForModel(id) } : {},
@@ -2563,6 +2660,9 @@ function configuredEntitlements(settings) {
   };
 }
 function calculateModelUsageCostMicros(settings, model, usage, options) {
+  return calculateModelUsageCostBreakdown(settings, model, usage, options).creditCostMicros;
+}
+function calculateModelUsageCostBreakdown(settings, model, usage, options) {
   const schedule = configuredModelPricingSchedules(settings)[model];
   if (!schedule) {
     throw new Error(`Missing model pricing for ${model}`);
@@ -2576,10 +2676,12 @@ function calculateModelUsageCostMicros(settings, model, usage, options) {
       (rawCostByPricing.get(pricing) ?? 0) + calculateEntryCostMicros(pricing, entry)
     );
   }
-  let total = 0;
+  let providerCostMicros = 0;
+  let creditCostMicros = 0;
   for (const [pricing, rawCost] of rawCostByPricing) {
     const marginBps = pricing.marginBps ?? 0;
-    total += Math.ceil(rawCost * (1e4 + marginBps) / 1e4);
+    providerCostMicros += rawCost;
+    creditCostMicros += Math.ceil(rawCost * (1e4 + marginBps) / 1e4);
   }
   const latencyMode = options?.latencyMode ?? "standard";
   if (latencyMode !== "standard") {
@@ -2592,12 +2694,16 @@ function calculateModelUsageCostMicros(settings, model, usage, options) {
       (mode) => mode.id === latencyMode && mode.runnable
     )?.billingMultiplierBps;
     if (multiplierBps && multiplierBps > 0) {
-      total = Math.ceil(total * multiplierBps / 1e4);
+      providerCostMicros = Math.ceil(providerCostMicros * multiplierBps / 1e4);
+      creditCostMicros = Math.ceil(creditCostMicros * multiplierBps / 1e4);
     }
   }
-  return total;
+  return { providerCostMicros, creditCostMicros };
 }
 function calculateGatewayReportedCostMicros(settings, model, inferenceCostUsd, options) {
+  return calculateGatewayReportedCostBreakdown(settings, model, inferenceCostUsd, options).creditCostMicros;
+}
+function calculateGatewayReportedCostBreakdown(settings, model, inferenceCostUsd, options) {
   const schedule = configuredModelPricingSchedules(settings)[model];
   if (!schedule) {
     throw new Error(`Missing model pricing for ${model}`);
@@ -2610,14 +2716,33 @@ function calculateGatewayReportedCostMicros(settings, model, inferenceCostUsd, o
   const fraction = match[2] ?? "";
   const decimalDigits = BigInt(`${match[1]}${fraction}`);
   const decimalScale = 10n ** BigInt(fraction.length);
+  const providerNumerator = decimalDigits * 1000000n;
+  const providerMicros = (providerNumerator + decimalScale - 1n) / decimalScale;
   const marginBps = BigInt(1e4 + (pricing.marginBps ?? 0));
-  const numerator = decimalDigits * 1000000n * marginBps;
+  const numerator = providerNumerator * marginBps;
   const denominator = decimalScale * 10000n;
-  const micros = (numerator + denominator - 1n) / denominator;
-  if (micros > BigInt(Number.MAX_SAFE_INTEGER)) {
+  const creditMicros = (numerator + denominator - 1n) / denominator;
+  if (providerMicros > BigInt(Number.MAX_SAFE_INTEGER) || creditMicros > BigInt(Number.MAX_SAFE_INTEGER)) {
     throw new Error("AI Gateway inference cost exceeds the supported billing range");
   }
-  return Number(micros);
+  return {
+    providerCostMicros: Number(providerMicros),
+    creditCostMicros: Number(creditMicros)
+  };
+}
+function calculateVideoGenerationCreditCostMicros(settings, input) {
+  if (input.modelId !== SEEDANCE_2_5_MODEL_ID) {
+    throw new Error(`Missing video generation credit pricing for ${input.modelId}`);
+  }
+  if (!Number.isSafeInteger(input.durationSeconds) || input.durationSeconds < 1) {
+    throw new Error("Video generation duration is invalid for credit pricing");
+  }
+  const rate = input.resolution === "480p" ? settings.videoGenerationCredit480pMicrosPerSecond : settings.videoGenerationCredit720pMicrosPerSecond;
+  const cost = rate * input.durationSeconds;
+  if (!Number.isSafeInteger(cost) || cost <= 0 || cost > 1e9) {
+    throw new Error("Video generation credit price exceeds the supported range");
+  }
+  return cost;
 }
 function configuredAllowedReasoningEfforts(settings) {
   return uniqueValues([
@@ -2735,16 +2860,13 @@ function stableSandboxEnvironmentForRun(settings, workspaceEnvironment = {}, opt
     environment.OPENGENI_GIT_CLI_WRAPPER_DIR ??= `${home}/.opengeni/bin`;
     environment.PATH = prependPathEntry(environment.PATH, environment.OPENGENI_GIT_CLI_WRAPPER_DIR);
   }
-  if (settings.toolspaceEnabled) {
-    environment.OPENGENI_TOOLSPACE_TOKEN_FILE ??= settings.sandboxBackend === "selfhosted" ? "$HOME/.opengeni/toolspace-token" : `${environment.HOME ?? descriptor.workspaceRoot}/.opengeni/toolspace-token`;
+  if (settings.sandboxBackend !== "selfhosted" && resolveFirstPartyDelegationSecret(settings)) {
+    environment.OPENGENI_CODEMODE_TOKEN_FILE ??= `${environment.HOME ?? descriptor.workspaceRoot}/.opengeni/codemode-token`;
     if (settings.ogtoolPackageSpec) {
       environment.OPENGENI_OGTOOL_PACKAGE_SPEC ??= settings.ogtoolPackageSpec;
     }
     if (options.workspaceId) {
-      environment.OPENGENI_TOOLSPACE_URL ??= firstPartyMcpWorkspaceUrl(
-        settings,
-        options.workspaceId
-      );
+      environment.OPENGENI_CODEMODE_URL ??= codemodeWorkspaceUrl(settings, options.workspaceId);
     }
   }
   return environment;
@@ -3118,6 +3240,7 @@ function ensureBuiltInMcpServers(settings) {
           "search_documents",
           "fetch_document_chunk",
           "list_document_bases",
+          "list_indexed_documents",
           "knowledge_search",
           "knowledge_fetch",
           "memory_search",
@@ -3143,6 +3266,14 @@ function firstPartyMcpWorkspaceUrl(settings, workspaceId) {
   url.hash = "";
   return url.toString();
 }
+function codemodeWorkspaceUrl(settings, workspaceId) {
+  const url = new URL(firstPartyMcpWorkspaceUrl(settings, workspaceId));
+  if (!url.pathname.endsWith("/mcp")) {
+    throw new Error("First-party MCP URL cannot be projected to the Codemode endpoint");
+  }
+  url.pathname = `${url.pathname.slice(0, -4)}/codemode`;
+  return url.toString();
+}
 function firstPartyMcpServerUrl(settings) {
   return firstPartyMcpBaseUrl(settings);
 }
@@ -3154,9 +3285,6 @@ function firstPartyFilesMcpServerUrl(mcpUrl) {
 }
 function validateSettings(settings) {
   temporalConnectionOptions(settings);
-  if (settings.toolspaceEnabled && !settings.delegationSecret) {
-    throw new Error("OPENGENI_DELEGATION_SECRET is required when OPENGENI_TOOLSPACE_ENABLED=true");
-  }
   if (settings.productAccessMode === "managed") {
     if (!settings.publicBaseUrl) {
       throw new Error(
@@ -3206,11 +3334,6 @@ function validateSettings(settings) {
     );
   }
   if (settings.slackClientId) {
-    if (!settings.slackSigningSecret) {
-      throw new Error(
-        "OPENGENI_SLACK_SIGNING_SECRET is required when the OpenGeni Slack app is configured"
-      );
-    }
     if (!settings.publicBaseUrl) {
       throw new Error(
         "OPENGENI_PUBLIC_BASE_URL is required when the OpenGeni Slack app is configured"
@@ -3249,6 +3372,28 @@ function validateSettings(settings) {
       );
     }
   }
+  if (Boolean(settings.atlassianClientId) !== Boolean(settings.atlassianClientSecret)) {
+    throw new Error(
+      "OPENGENI_ATLASSIAN_CLIENT_ID and OPENGENI_ATLASSIAN_CLIENT_SECRET must be configured together"
+    );
+  }
+  if (settings.atlassianClientId) {
+    if (!settings.publicBaseUrl) {
+      throw new Error(
+        "OPENGENI_PUBLIC_BASE_URL is required when the Atlassian integration is configured"
+      );
+    }
+    if (!settings.publicBaseUrl.startsWith("https://") && !["local", "test"].includes(settings.environment)) {
+      throw new Error(
+        "OPENGENI_PUBLIC_BASE_URL must use https when the Atlassian integration is configured outside local/test"
+      );
+    }
+    if (!settings.integrationsStateSecret) {
+      throw new Error(
+        "OPENGENI_INTEGRATIONS_STATE_SECRET is required when the Atlassian integration is configured"
+      );
+    }
+  }
   parseIntegrationsOauthClientsJson(settings.integrationsOauthClientsJson);
   parseSocialOauthClientsJson(settings.socialOauthClientsJson);
   if (settings.productAccessMode === "configured" && !["local", "test"].includes(settings.environment) && !settings.delegationSecret && !settings.authRequired) {
@@ -3400,6 +3545,7 @@ function validateSettings(settings) {
   {
     const reaperPeriod = settings.sandboxLeaseReaperPeriodMs;
     const viewerTtl = settings.sandboxViewerHolderTtlMs;
+    const interactionTtl = settings.sandboxInteractionHolderTtlMs;
     const idleGraceMs = settings.sandboxIdleGraceMs;
     const providerLifetimeMs = settings.modalTimeoutSeconds * 1e3;
     const rotationLeadMs = settings.sandboxRotationLeadMs;
@@ -3409,6 +3555,11 @@ function validateSettings(settings) {
         `OPENGENI_SANDBOX_LEASE_REAPER_PERIOD_MS (${reaperPeriod}) must be strictly less than OPENGENI_SANDBOX_VIEWER_HOLDER_TTL_MS (${viewerTtl}): the reaper must run more often than the TTL it polices, or stale viewer holders outlive a full reaper period.`
       );
     }
+    if (!(reaperPeriod < interactionTtl)) {
+      throw new Error(
+        `OPENGENI_SANDBOX_LEASE_REAPER_PERIOD_MS (${reaperPeriod}) must be strictly less than OPENGENI_SANDBOX_INTERACTION_HOLDER_TTL_MS (${interactionTtl}): the reaper must run more often than the controller-heartbeat horizon.`
+      );
+    }
     if (!(idleTimeoutMs <= providerLifetimeMs)) {
       throw new Error(
         `OPENGENI_MODAL_IDLE_TIMEOUT_SECONDS*1000 (${idleTimeoutMs}) must not exceed the hard provider lifetime (OPENGENI_MODAL_TIMEOUT_SECONDS*1000 = ${providerLifetimeMs}): the idle timeout is a floor under the hard lifetime, not above it.`
@@ -3419,9 +3570,10 @@ function validateSettings(settings) {
         `OPENGENI_SANDBOX_ROTATION_LEAD_MS (${rotationLeadMs}) must be strictly less than OPENGENI_MODAL_TIMEOUT_SECONDS*1000 (${providerLifetimeMs}).`
       );
     }
-    if (!(rotationLeadMs > settings.sandboxSnapshotTimeoutMs + 2 * reaperPeriod)) {
+    const captureTimeoutMs = sandboxArchiveCaptureTimeoutMs(settings);
+    if (!(rotationLeadMs > captureTimeoutMs + reaperPeriod)) {
       throw new Error(
-        `OPENGENI_SANDBOX_ROTATION_LEAD_MS (${rotationLeadMs}) must exceed the snapshot timeout plus two reaper periods (${settings.sandboxSnapshotTimeoutMs + 2 * reaperPeriod}).`
+        `OPENGENI_SANDBOX_ROTATION_LEAD_MS (${rotationLeadMs}) must exceed the durable capture timeout plus one reaper period (${captureTimeoutMs + reaperPeriod}).`
       );
     }
     if (!(viewerTtl < idleTimeoutMs)) {
@@ -3429,6 +3581,11 @@ function validateSettings(settings) {
         `OPENGENI_SANDBOX_VIEWER_HOLDER_TTL_MS (${viewerTtl}) must be strictly less than the effective box idle timeout (${idleTimeoutMs}): a viewer holder must be reapable before the box idles out from under it (the provider idle-timeout is the backstop).`
       );
     }
+    if (!(interactionTtl < idleTimeoutMs)) {
+      throw new Error(
+        `OPENGENI_SANDBOX_INTERACTION_HOLDER_TTL_MS (${interactionTtl}) must be strictly less than the effective box idle timeout (${idleTimeoutMs}): a dead browser controller must be reapable before the provider reclaims its placement.`
+      );
+    }
     if (!(reaperPeriod + idleGraceMs < idleTimeoutMs)) {
       throw new Error(
         `OPENGENI_SANDBOX_LEASE_REAPER_PERIOD_MS + OPENGENI_SANDBOX_IDLE_GRACE_MS (${reaperPeriod} + ${idleGraceMs} = ${reaperPeriod + idleGraceMs}) must be strictly less than the effective box idle timeout (${idleTimeoutMs}): a drained box must SURVIVE its full warm window so the reaper can resume + snapshot /workspace + terminate it on the sweep AFTER the drain grace elapses \u2014 Modal's idle-reap must NOT fire first (or /workspace is lost). Raise OPENGENI_MODAL_IDLE_TIMEOUT_SECONDS (defaults to OPENGENI_MODAL_TIMEOUT_SECONDS) or lower OPENGENI_SANDBOX_IDLE_GRACE_MS.`
@@ -3565,7 +3722,12 @@ export {
   OPENGENI_GATEWAY_PROVIDER_ID,
   OPENGENI_REALTIME_MODEL_ID_PREFIX,
   RegistryProviderKind,
+  SANDBOX_ARCHIVE_CAPTURE_MAX_TIMEOUT_MS,
+  SANDBOX_ARCHIVE_CAPTURE_SETTLEMENT_GRACE_MS,
+  SANDBOX_LIFECYCLE_RETRY_HANDOFF_GRACE_MS,
+  SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS,
   SANDBOX_REQUIRED_ENV,
+  SANDBOX_SNAPSHOT_MAX_TIMEOUT_MS,
   SocialOAuthClientConfigSchema,
   VERCEL_AI_GATEWAY_AI_SDK_BASE_URL,
   VERCEL_AI_GATEWAY_BASE_URL,
@@ -3577,9 +3739,13 @@ export {
   applyGitAuthPointerEnvironment,
   assertTurnExecutionPolicyMatchesConfigV1,
   builtinProviderId,
+  calculateGatewayReportedCostBreakdown,
   calculateGatewayReportedCostMicros,
+  calculateModelUsageCostBreakdown,
   calculateModelUsageCostMicros,
+  calculateVideoGenerationCreditCostMicros,
   canonicalizeConfiguredModelId,
+  codemodeWorkspaceUrl,
   collectGitIdentityEnvironment,
   collectSandboxEnvironment,
   configuredAllowedModels,
@@ -3601,6 +3767,7 @@ export {
   getSettings,
   hasGitCredentialRepositorySelection,
   hasGitHubRepositorySelection,
+  isDirectOpenAiApiBaseUrl,
   isUsableVoiceInputSecret,
   parseExposedPorts,
   parseIntegrationsOauthClientsJson,
@@ -3632,6 +3799,7 @@ export {
   sandboxArchiveCaptureTimeoutMs,
   sandboxEnvironmentVariableNames,
   sandboxLifecycleHookIds,
+  sandboxLifecycleTransitionWaitMs,
   sandboxPreparationProfiles,
   sandboxWarmRateMicrosPerSecond,
   selectModelPricing,