@opengeni/config 0.13.2 → 0.16.1

package/dist/index.js

@@ -2,12 +2,15 @@
 import {
   BillingMode,
   CAPABILITY_DESCRIPTORS,
+  DEFAULT_FIRST_PARTY_MCP_TOOLS,
   Entitlements,
   EntitlementsMode,
   LatencyMode,
   MAX_NESTED_AGENT_DEPTH,
   ProductAccessMode,
   ReasoningEffort,
+  FIRST_PARTY_MCP_TOOL_NAMES,
+  FirstPartyMcpToolName,
   SandboxBackend,
   SessionMcpApprovalPolicy,
   SEEDANCE_2_5_MODEL_ID,
@@ -25,6 +28,16 @@ import {
   CODEX_PROVIDER_BASE_URL,
   CODEX_PROVIDER_ID
 } from "@opengeni/codex/constants";
+import {
+  XAI_SUBSCRIPTION_MODEL_SLUGS,
+  XAI_SUBSCRIPTION_MODEL_AUTO_COMPACT_TOKEN_LIMIT,
+  XAI_SUBSCRIPTION_MODEL_CONTEXT_WINDOW_TOKENS,
+  XAI_SUBSCRIPTION_MODEL_EFFECTIVE_CONTEXT_WINDOW_TOKENS,
+  XAI_SUBSCRIPTION_MODEL_ID_PREFIX,
+  XAI_SUBSCRIPTION_PROVIDER_ID,
+  XAI_SUBSCRIPTION_PROXY_BASE_URL
+} from "@opengeni/xai-subscription";
+import { XAI_SUBSCRIPTION_MODEL_ID_PREFIX as XAI_SUBSCRIPTION_MODEL_ID_PREFIX2 } from "@opengeni/xai-subscription";
 import { createHash } from "crypto";
 import { z } from "zod";
 var envName = /^[A-Za-z_][A-Za-z0-9_]*$/;
@@ -47,6 +60,34 @@ var EnvBoolean = z.preprocess((value) => {
   }
   return value;
 }, z.boolean());
+var EnvFirstPartyMcpTools = z.preprocess(
+  (value) => {
+    if (typeof value !== "string") return value;
+    const source = value.trim();
+    if (!source) return void 0;
+    if (source.startsWith("[")) {
+      try {
+        return JSON.parse(source);
+      } catch {
+        return value;
+      }
+    }
+    return source.split(",").map((entry) => entry.trim());
+  },
+  z.array(FirstPartyMcpToolName).superRefine((tools, context) => {
+    const seen = /* @__PURE__ */ new Set();
+    for (const [index, tool] of tools.entries()) {
+      if (seen.has(tool)) {
+        context.addIssue({
+          code: "custom",
+          message: "first-party MCP tool lists must not contain duplicates",
+          path: [index]
+        });
+      }
+      seen.add(tool);
+    }
+  }).optional()
+);
 var sandboxPreparationProfiles = {
   none: {
     env: [],
@@ -86,7 +127,7 @@ var DEFAULT_AGENT_INSTRUCTIONS = [
   "Repository resources are mounted under repos/<host>/<owner>/<repo> unless the session specifies another collision-free mount path.",
   "File resources are mounted under .opengeni/files/<file-id>/ unless the session specifies another mount path.",
   "Attached files are mounted read-only; copy them before modifying.",
-  "Bundled skills are under .agents/ and can include infrastructure, marketing, or other role-specific guidance.",
+  "Installed and selected Skills are indexed under .agents/ and may include role-specific guidance.",
   "Use Checkov, Terraform, Azure CLI, git provider CLIs, and repository tools when relevant; gh, glab, and az repos are pre-authenticated when the host brokers matching git credentials.",
   "When the Azure sandbox preparation profile is enabled and service-principal variables are present, the sandbox is pre-authenticated with normal Azure CLI before work starts.",
   "Treat code-changing work as GitOps work: create a focused branch/commit/PR when git provider credentials are available; otherwise report exact commands and blockers.",
@@ -215,6 +256,8 @@ var SettingsSchema = z.object({
   staticEntitlementsJson: z.string().default("{}"),
   staticUsageLimitsJson: z.string().default("{}"),
   delegationSecret: z.string().optional(),
+  defaultFirstPartyMcpTools: EnvFirstPartyMcpTools,
+  allowedFirstPartyMcpTools: EnvFirstPartyMcpTools,
   // sandbox workspace scoped stream-token HMAC secret (sandbox contract §C.3 / stream-token availability contract).
   // When unset, the API falls back to `delegationSecret` (the same HMAC envelope
   // family, `ogs_` vs `ogd_` prefix). REQUIRED-WHEN-DESKTOP, but the absence of
@@ -241,6 +284,8 @@ var SettingsSchema = z.object({
   slackSigningSecret: z.string().optional(),
   googleDriveClientId: z.string().optional(),
   googleDriveClientSecret: z.string().optional(),
+  fikenClientId: z.string().optional(),
+  fikenClientSecret: z.string().optional(),
   googleDriveWorkspaceEventsEnabled: EnvBoolean.optional(),
   atlassianClientId: z.string().optional(),
   atlassianClientSecret: z.string().optional(),
@@ -344,10 +389,10 @@ var SettingsSchema = z.object({
   voiceInputResumableRetentionSeconds: z.coerce.number().int().positive().max(7 * 24 * 60 * 60).default(24 * 60 * 60),
   voiceInputFfmpegPath: z.string().trim().min(1).max(1024).default("ffmpeg"),
   // Preferred provider order (comma-separated ids). First configured+ready wins.
-  // Codex subscription STT is preferred by default when subscription routing is
-  // enabled; operators can put openai/azure-openai first explicitly.
-  // Supported: openai, azure-openai, codex-subscription.
-  voiceInputProviderOrder: z.string().default("codex-subscription,openai,azure-openai"),
+  // Connected subscription STT is preferred by default; operators can put
+  // openai/azure-openai first explicitly.
+  // Supported: supergrok-subscription, codex-subscription, openai, azure-openai.
+  voiceInputProviderOrder: z.string().default("supergrok-subscription,codex-subscription,openai,azure-openai"),
   // OpenAI public /v1/audio/transcriptions path. Reuses OPENGENI_OPENAI_API_KEY
   // when voiceInputOpenaiApiKey is unset. Default model is gpt-transcribe.
   voiceInputOpenaiEnabled: EnvBoolean.default(true),
@@ -380,6 +425,10 @@ var SettingsSchema = z.object({
   // provider whose models route through the ChatGPT backend (@opengeni/codex).
   codexSubscriptionEnabled: EnvBoolean.default(false),
   // OPENGENI_CODEX_SUBSCRIPTION_ENABLED
+  // SuperGrok/xAI connected subscription. This is a workspace-scoped OAuth
+  // account pool and a distinct rail from the existing xai/* API-key provider.
+  supergrokSubscriptionEnabled: EnvBoolean.default(false),
+  // OPENGENI_SUPERGROK_SUBSCRIPTION_ENABLED
   // Expose the connected apps attached to a Codex subscription through the
   // synthetic codex_apps MCP server. Independent from subscription routing so
   // operators can use Codex models without exposing ChatGPT connectors.
@@ -479,7 +528,7 @@ var SettingsSchema = z.object({
   // never asks Modal to parse or import the registry ref. The logical ref is
   // still persisted on the sandbox lease for provenance and conflict fencing;
   // the Modal session envelope persists the actual image ID.
-  modalImageId: z.string().regex(/^im-[A-Za-z0-9]{22}$/).optional(),
+  modalImageId: z.string().min(4).max(128).regex(/^im-[A-Za-z0-9]+$/).optional(),
   // Name of a Modal Secret (containing REGISTRY_USERNAME + REGISTRY_PASSWORD) used
   // to authenticate the pull of `modalImageRef` from a PRIVATE registry. When UNSET
   // (the default), the sandbox image is pulled UNAUTHENTICATED — i.e. it must be a
@@ -524,8 +573,9 @@ var SettingsSchema = z.object({
   // /workspace FILE PERSISTENCE across warm/cold cycles. Directory snapshots
   // preserve only the durable user workspace, so provider recovery does not
   // restore an entire machine image or replace the selected rig/base image.
-  // Existing serialized sessions retain their original persistence mode and
-  // remain recoverable; this default governs newly created Modal sandboxes.
+  // Cold restore derives the mode from its verified native artifact, so existing
+  // serialized sessions remain recoverable; this default governs archive-free
+  // Modal creations only.
   // `snapshot_filesystem` remains available for explicit compatibility and
   // immutable rig-image materialization. `tar` is the portable fallback.
   modalWorkspacePersistence: z.enum(["tar", "snapshot_filesystem", "snapshot_directory"]).default("snapshot_directory"),
@@ -610,6 +660,14 @@ var SettingsSchema = z.object({
   // --- cloudflare (headless) ---
   cloudflareWorkerUrl: z.string().url().optional(),
   cloudflareApiKey: z.string().optional(),
+  // --- remote browser placements ---
+  // Provider credentials are injected only into the placement-resident
+  // browserd launch. They never enter session contracts, journals, or sandboxes.
+  browserbaseApiKey: z.string().min(1).max(8192).optional(),
+  kernelApiKey: z.string().min(1).max(8192).optional(),
+  kernelEndpoint: z.string().url().optional(),
+  kernelBrowserTimeoutSeconds: z.coerce.number().int().positive().max(86400).default(3600),
+  kernelBrowserStealth: EnvBoolean.default(false),
   // --- vercel (headless) ---
   vercelToken: z.string().optional(),
   vercelProjectId: z.string().optional(),
@@ -896,7 +954,7 @@ function isUsableVoiceInputSecret(value) {
 }
 function resolveVoiceInputProviderRegistry(settings) {
   const order = settings.voiceInputProviderOrder.split(",").map((part) => part.trim()).filter(
-    (part) => part === "openai" || part === "azure-openai" || part === "codex-subscription"
+    (part) => part === "openai" || part === "azure-openai" || part === "codex-subscription" || part === "supergrok-subscription"
   );
   const seen = /* @__PURE__ */ new Set();
   const providers = [];
@@ -950,13 +1008,22 @@ function resolveVoiceInputProviderRegistry(settings) {
         kind: "codex-subscription",
         experimental: true
       });
+      continue;
+    }
+    if (id === "supergrok-subscription") {
+      if (!settings.supergrokSubscriptionEnabled) continue;
+      providers.push({
+        id: "supergrok-subscription",
+        kind: "supergrok-subscription",
+        experimental: true
+      });
     }
   }
   return providers;
 }
 function voiceInputDeploymentConfigured(settings) {
   return resolveVoiceInputProviderRegistry(settings).some(
-    (provider) => provider.kind !== "codex-subscription"
+    (provider) => provider.kind !== "codex-subscription" && provider.kind !== "supergrok-subscription"
   );
 }
 var ModelPricingSchema = z.object({
@@ -1093,6 +1160,7 @@ var ModelProviderApi = z.enum(["responses", "chat"]);
 var RegistryProviderKind = z.enum([
   "api-key",
   "codex-subscription",
+  "xai-subscription",
   "vercel-gateway-managed",
   "vercel-gateway-workspace"
 ]);
@@ -1173,6 +1241,7 @@ var WORKSPACE_GATEWAY_MODEL_ID_PREFIX = "workspace-gateway/";
 var VERCEL_AI_GATEWAY_CONNECTION_DOMAIN = "ai-gateway.vercel.sh";
 var VERCEL_AI_GATEWAY_CONNECTION_ROLE = "vercel_ai_gateway";
 var CODEX_REALTIME_MODEL_ID = "gpt-live-1-boulder-alpha";
+var SUPERGROK_REALTIME_MODEL_ID = "supergrok/grok-voice-think-fast-2.0";
 var OPENGENI_REALTIME_MODEL_ID_PREFIX = "opengeni-gateway/";
 var WORKSPACE_REALTIME_MODEL_ID_PREFIX = "workspace-gateway/";
 var AI_GATEWAY_REALTIME_MODELS = {
@@ -1410,6 +1479,8 @@ function getSettings() {
     staticEntitlementsJson: optional("OPENGENI_STATIC_ENTITLEMENTS_JSON"),
     staticUsageLimitsJson: optional("OPENGENI_STATIC_USAGE_LIMITS_JSON"),
     delegationSecret: optional("OPENGENI_DELEGATION_SECRET"),
+    defaultFirstPartyMcpTools: optional("OPENGENI_DEFAULT_FIRST_PARTY_MCP_TOOLS"),
+    allowedFirstPartyMcpTools: optional("OPENGENI_ALLOWED_FIRST_PARTY_MCP_TOOLS"),
     streamTokenSecret: optional("OPENGENI_STREAM_TOKEN_SECRET"),
     streamControlEnabled: optional("OPENGENI_STREAM_CONTROL_ENABLED"),
     codemodeMaxCallsPerTurn: optional("OPENGENI_CODEMODE_MAX_CALLS_PER_TURN"),
@@ -1427,6 +1498,8 @@ function getSettings() {
     slackSigningSecret: optional("OPENGENI_SLACK_SIGNING_SECRET"),
     googleDriveClientId: optional("OPENGENI_GOOGLE_DRIVE_CLIENT_ID"),
     googleDriveClientSecret: optional("OPENGENI_GOOGLE_DRIVE_CLIENT_SECRET"),
+    fikenClientId: optional("OPENGENI_FIKEN_OAUTH_CLIENT_ID"),
+    fikenClientSecret: optional("OPENGENI_FIKEN_OAUTH_CLIENT_SECRET"),
     googleDriveWorkspaceEventsEnabled: optional("OPENGENI_GOOGLE_DRIVE_WORKSPACE_EVENTS_ENABLED"),
     atlassianClientId: optional("OPENGENI_ATLASSIAN_CLIENT_ID"),
     atlassianClientSecret: optional("OPENGENI_ATLASSIAN_CLIENT_SECRET"),
@@ -1503,6 +1576,7 @@ function getSettings() {
     modelPricingJson: optional("OPENGENI_MODEL_PRICING_JSON"),
     modelProvidersJson: optional("OPENGENI_MODEL_PROVIDERS_JSON"),
     codexSubscriptionEnabled: optional("OPENGENI_CODEX_SUBSCRIPTION_ENABLED"),
+    supergrokSubscriptionEnabled: optional("OPENGENI_SUPERGROK_SUBSCRIPTION_ENABLED"),
     codexConnectedAppsEnabled: optional("OPENGENI_CODEX_CONNECTED_APPS_ENABLED"),
     codexToolSearchEnabled: optional("OPENGENI_CODEX_TOOL_SEARCH_ENABLED"),
     lazyToolSearchEnabled: optional("OPENGENI_LAZY_TOOL_SEARCH_ENABLED"),
@@ -1583,6 +1657,11 @@ function getSettings() {
     blaxelTtl: optional("OPENGENI_BLAXEL_TTL"),
     cloudflareWorkerUrl: optional("OPENGENI_CLOUDFLARE_WORKER_URL"),
     cloudflareApiKey: optional("OPENGENI_CLOUDFLARE_API_KEY"),
+    browserbaseApiKey: optional("OPENGENI_BROWSERBASE_API_KEY"),
+    kernelApiKey: optional("OPENGENI_KERNEL_API_KEY"),
+    kernelEndpoint: optional("OPENGENI_KERNEL_ENDPOINT"),
+    kernelBrowserTimeoutSeconds: optional("OPENGENI_KERNEL_BROWSER_TIMEOUT_SECONDS"),
+    kernelBrowserStealth: optional("OPENGENI_KERNEL_BROWSER_STEALTH"),
     vercelToken: optional("OPENGENI_VERCEL_TOKEN"),
     vercelProjectId: optional("OPENGENI_VERCEL_PROJECT_ID"),
     vercelTeamId: optional("OPENGENI_VERCEL_TEAM_ID"),
@@ -1693,8 +1772,26 @@ var LOCAL_FIRST_PARTY_DELEGATION_SECRET = "opengeni-local-first-party-delegation
 function resolveFirstPartyDelegationSecret(settings) {
   const explicit = settings.delegationSecret?.trim();
   if (explicit) return explicit;
+  const configuredAccessKey = settings.accessKey?.trim();
+  if (settings.productAccessMode === "configured" && settings.authRequired && configuredAccessKey) {
+    return configuredAccessKey;
+  }
   return settings.productAccessMode === "local" && (settings.environment === "local" || settings.environment === "test") ? LOCAL_FIRST_PARTY_DELEGATION_SECRET : void 0;
 }
+function resolveFirstPartyMcpToolPolicy(settings) {
+  const allowed = settings.allowedFirstPartyMcpTools ?? [...FIRST_PARTY_MCP_TOOL_NAMES];
+  const allowedSet = new Set(allowed);
+  const defaults = settings.defaultFirstPartyMcpTools ?? [...DEFAULT_FIRST_PARTY_MCP_TOOLS];
+  return {
+    default: defaults.filter((tool) => allowedSet.has(tool)),
+    allowed: [...allowed]
+  };
+}
+function allowedFirstPartyMcpToolsForSession(settings, selected) {
+  const policy = resolveFirstPartyMcpToolPolicy(settings);
+  const allowed = new Set(policy.allowed);
+  return [...selected ?? policy.default].filter((tool) => allowed.has(tool));
+}
 function effectiveModalIdleTimeoutSeconds(settings) {
   return settings.modalIdleTimeoutSeconds ?? settings.modalTimeoutSeconds;
 }
@@ -2070,6 +2167,10 @@ function withWorkspaceGatewayCredential(settings, apiKey) {
 var GPT56_FAST_BILLING_MULTIPLIER_BPS = 2e4;
 function productLabelForModelId(modelId) {
   const slug = modelId.startsWith(CODEX_MODEL_ID_PREFIX) ? modelId.slice(CODEX_MODEL_ID_PREFIX.length) : modelId;
+  const grokMatch = /^grok-(\d+(?:\.\d+)?)$/i.exec(slug);
+  if (grokMatch) {
+    return `Grok ${grokMatch[1]}`;
+  }
   const match = /^(gpt-\d+(?:\.\d+)?)(?:-(.+))?$/i.exec(slug);
   if (!match) {
     return slug;
@@ -2085,6 +2186,8 @@ function productLabelForModelId(modelId) {
 function productShortLabelForModelId(modelId) {
   const slug = modelId.startsWith(CODEX_MODEL_ID_PREFIX) ? modelId.slice(CODEX_MODEL_ID_PREFIX.length) : modelId;
   switch (slug) {
+    case "grok-4.6":
+      return "4.6";
     case "gpt-5.6-sol":
       return "5.6 Sol";
     case "gpt-5.6-terra":
@@ -2129,7 +2232,7 @@ function serviceTierForLatencyMode(providerId, latencyMode) {
   if (latencyMode === "standard") {
     return void 0;
   }
-  if (providerId === "azure" || providerId === CODEX_PROVIDER_ID) {
+  if (providerId === "azure" || providerId === CODEX_PROVIDER_ID || providerId === XAI_SUBSCRIPTION_PROVIDER_ID) {
     return "priority";
   }
   return "fast";
@@ -2162,13 +2265,16 @@ function registryCredentialSource(provider) {
   if (provider.kind === "codex-subscription") {
     return { kind: "connected_subscription", provider: "codex" };
   }
+  if (provider.kind === "xai-subscription") {
+    return { kind: "connected_subscription", provider: "xai" };
+  }
   if (provider.kind === "vercel-gateway-workspace") {
     return { kind: "workspace_connection", mechanism: "api_key" };
   }
   return { kind: "deployment", mechanism: "api_key" };
 }
 function registryBilling(provider) {
-  if (provider.kind === "codex-subscription") {
+  if (provider.kind === "codex-subscription" || provider.kind === "xai-subscription") {
     return { upstreamPayer: "connected_subscription", metering: "external" };
   }
   if (provider.kind === "vercel-gateway-workspace") {
@@ -2327,11 +2433,55 @@ function withCodexCatalogProvider(settings) {
     modelProvidersJson: JSON.stringify([...providers, provider])
   };
 }
+function withXaiSubscriptionCatalogProvider(settings) {
+  const providers = parseModelProvidersJson(settings.modelProvidersJson);
+  if (providers.some((provider2) => provider2.id === XAI_SUBSCRIPTION_PROVIDER_ID)) {
+    return settings;
+  }
+  const provider = {
+    kind: "xai-subscription",
+    id: XAI_SUBSCRIPTION_PROVIDER_ID,
+    label: "SuperGrok (xAI subscription)",
+    api: "responses",
+    baseUrl: XAI_SUBSCRIPTION_PROXY_BASE_URL,
+    models: XAI_SUBSCRIPTION_MODEL_SLUGS.map((slug) => {
+      const capabilities = legacyModelCapabilities(settings, {
+        reasoningEffort: true,
+        hostedWebSearch: true
+      });
+      capabilities.reasoning.efforts = ["low", "medium", "high", "xhigh"];
+      capabilities.reasoning.defaultEffort = "high";
+      capabilities.latencyModes = [
+        { id: "standard", upstream: "supported", runnable: true },
+        { id: "fast", upstream: "supported", runnable: true }
+      ];
+      capabilities.hostedTools.xSearch = { upstream: "supported", runnable: true };
+      capabilities.hostedTools.imageGeneration = { upstream: "supported", runnable: true };
+      return {
+        id: `${XAI_SUBSCRIPTION_MODEL_ID_PREFIX}${slug}`,
+        upstreamModelId: slug,
+        label: productLabelForModelId(slug),
+        ...productShortLabelForModelId(slug) ? { shortLabel: productShortLabelForModelId(slug) } : {},
+        reasoningEffort: true,
+        hostedWebSearch: true,
+        capabilities,
+        contextWindowTokens: XAI_SUBSCRIPTION_MODEL_CONTEXT_WINDOW_TOKENS,
+        effectiveContextWindowTokens: XAI_SUBSCRIPTION_MODEL_EFFECTIVE_CONTEXT_WINDOW_TOKENS,
+        autoCompactTokenLimit: XAI_SUBSCRIPTION_MODEL_AUTO_COMPACT_TOKEN_LIMIT,
+        toolOutputTruncationTokens: settings.modelToolOutputTruncationTokens
+      };
+    })
+  };
+  return { ...settings, modelProvidersJson: JSON.stringify([...providers, provider]) };
+}
 function policyProviderIdForModel(settings, modelId) {
   const canonicalModelId = canonicalizeConfiguredModelId(settings, modelId);
   if (canonicalModelId.startsWith(CODEX_MODEL_ID_PREFIX)) {
     return CODEX_PROVIDER_ID;
   }
+  if (canonicalModelId.startsWith(XAI_SUBSCRIPTION_MODEL_ID_PREFIX)) {
+    return XAI_SUBSCRIPTION_PROVIDER_ID;
+  }
   if (canonicalModelId.startsWith(WORKSPACE_GATEWAY_MODEL_ID_PREFIX)) {
     return WORKSPACE_GATEWAY_PROVIDER_ID;
   }
@@ -2403,7 +2553,7 @@ function configuredModels(settings) {
   const registryAliases = new Set(
     parsedRegistry.flatMap((provider) => provider.models.flatMap((model) => model.aliases ?? []))
   );
-  const isRegistryNamespaced = (id) => id.startsWith(CODEX_MODEL_ID_PREFIX) || registryAliases.has(id) || id.includes("/") && registryOwnedIds.has(id);
+  const isRegistryNamespaced = (id) => id.startsWith(CODEX_MODEL_ID_PREFIX) || id.startsWith(XAI_SUBSCRIPTION_MODEL_ID_PREFIX) || registryAliases.has(id) || id.includes("/") && registryOwnedIds.has(id);
   const builtinProvider = providerById.get(builtinId);
   if (!builtinProvider) {
     throw new Error(`Built-in model provider ${builtinId} is not configured`);
@@ -2513,6 +2663,9 @@ function settingsForTurnExecutionPolicy(settings, modelId) {
   if (settings.codexSubscriptionEnabled && modelId.startsWith(CODEX_MODEL_ID_PREFIX)) {
     return withCodexCatalogProvider(settings);
   }
+  if (settings.supergrokSubscriptionEnabled && modelId.startsWith(XAI_SUBSCRIPTION_MODEL_ID_PREFIX)) {
+    return withXaiSubscriptionCatalogProvider(settings);
+  }
   if (modelId.startsWith(WORKSPACE_GATEWAY_MODEL_ID_PREFIX)) {
     return withWorkspaceGatewayCatalogProvider(settings);
   }
@@ -3242,6 +3395,8 @@ function ensureBuiltInMcpServers(settings) {
           "list_document_bases",
           "list_indexed_documents",
           "knowledge_search",
+          "knowledge_get",
+          "knowledge_browse",
           "knowledge_fetch",
           "memory_search",
           "memory_propose"
@@ -3267,11 +3422,19 @@ function firstPartyMcpWorkspaceUrl(settings, workspaceId) {
   return url.toString();
 }
 function codemodeWorkspaceUrl(settings, workspaceId) {
-  const url = new URL(firstPartyMcpWorkspaceUrl(settings, workspaceId));
-  if (!url.pathname.endsWith("/mcp")) {
-    throw new Error("First-party MCP URL cannot be projected to the Codemode endpoint");
+  if (settings.opengeniMcpUrl) {
+    const url2 = new URL(firstPartyMcpWorkspaceUrl(settings, workspaceId));
+    if (!url2.pathname.endsWith("/mcp")) {
+      throw new Error("First-party MCP URL cannot be projected to the Codemode endpoint");
+    }
+    url2.pathname = `${url2.pathname.slice(0, -4)}/codemode`;
+    return url2.toString();
   }
-  url.pathname = `${url.pathname.slice(0, -4)}/codemode`;
+  const executionOrigin = settings.sandboxBackend === "docker" ? `http://host.docker.internal:${settings.apiPort}` : settings.sandboxBackend === "local" ? `http://127.0.0.1:${settings.apiPort}` : settings.publicBaseUrl ?? `http://127.0.0.1:${settings.apiPort}`;
+  const url = new URL(executionOrigin);
+  url.pathname = `${url.pathname.replace(/\/+$/u, "")}/v1/workspaces/${workspaceId}/codemode`;
+  url.search = "";
+  url.hash = "";
   return url.toString();
 }
 function firstPartyMcpServerUrl(settings) {
@@ -3285,6 +3448,17 @@ function firstPartyFilesMcpServerUrl(mcpUrl) {
 }
 function validateSettings(settings) {
   temporalConnectionOptions(settings);
+  const allowedFirstPartyMcpTools = new Set(
+    settings.allowedFirstPartyMcpTools ?? FIRST_PARTY_MCP_TOOL_NAMES
+  );
+  const disallowedDefaults = (settings.defaultFirstPartyMcpTools ?? []).filter(
+    (tool) => !allowedFirstPartyMcpTools.has(tool)
+  );
+  if (disallowedDefaults.length > 0) {
+    throw new Error(
+      `OPENGENI_DEFAULT_FIRST_PARTY_MCP_TOOLS must be a subset of OPENGENI_ALLOWED_FIRST_PARTY_MCP_TOOLS: ${disallowedDefaults.join(", ")}`
+    );
+  }
   if (settings.productAccessMode === "managed") {
     if (!settings.publicBaseUrl) {
       throw new Error(
@@ -3355,6 +3529,28 @@ function validateSettings(settings) {
       "OPENGENI_GOOGLE_DRIVE_CLIENT_ID and OPENGENI_GOOGLE_DRIVE_CLIENT_SECRET must be configured together"
     );
   }
+  if (Boolean(settings.fikenClientId) !== Boolean(settings.fikenClientSecret)) {
+    throw new Error(
+      "OPENGENI_FIKEN_OAUTH_CLIENT_ID and OPENGENI_FIKEN_OAUTH_CLIENT_SECRET must be configured together"
+    );
+  }
+  if (settings.fikenClientId) {
+    if (!settings.publicBaseUrl) {
+      throw new Error(
+        "OPENGENI_PUBLIC_BASE_URL is required when the Fiken OAuth integration is configured"
+      );
+    }
+    if (!settings.publicBaseUrl.startsWith("https://") && !["local", "test"].includes(settings.environment)) {
+      throw new Error(
+        "OPENGENI_PUBLIC_BASE_URL must use https when the Fiken OAuth integration is configured outside local/test"
+      );
+    }
+    if (!settings.integrationsStateSecret) {
+      throw new Error(
+        "OPENGENI_INTEGRATIONS_STATE_SECRET is required when the Fiken OAuth integration is configured"
+      );
+    }
+  }
   if (settings.googleDriveClientId) {
     if (!settings.publicBaseUrl) {
       throw new Error(
@@ -3601,9 +3797,9 @@ function validateSettings(settings) {
   const builtinId = builtinProviderId(settings);
   const providerIds = /* @__PURE__ */ new Set();
   for (const provider of registryProviders) {
-    if (provider.kind === "vercel-gateway-managed" || provider.kind === "vercel-gateway-workspace") {
+    if (provider.kind === "vercel-gateway-managed" || provider.kind === "vercel-gateway-workspace" || provider.kind === "xai-subscription") {
       throw new Error(
-        `OPENGENI_MODEL_PROVIDERS_JSON provider kind ${provider.kind} is reserved for the reviewed AI Gateway broker`
+        `OPENGENI_MODEL_PROVIDERS_JSON provider kind ${provider.kind} is reserved for a reviewed OpenGeni credential broker`
       );
     }
     if (provider.id === builtinId) {
@@ -3728,6 +3924,7 @@ export {
   SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS,
   SANDBOX_REQUIRED_ENV,
   SANDBOX_SNAPSHOT_MAX_TIMEOUT_MS,
+  SUPERGROK_REALTIME_MODEL_ID,
   SocialOAuthClientConfigSchema,
   VERCEL_AI_GATEWAY_AI_SDK_BASE_URL,
   VERCEL_AI_GATEWAY_BASE_URL,
@@ -3736,6 +3933,8 @@ export {
   WORKSPACE_GATEWAY_MODEL_ID_PREFIX,
   WORKSPACE_GATEWAY_PROVIDER_ID,
   WORKSPACE_REALTIME_MODEL_ID_PREFIX,
+  XAI_SUBSCRIPTION_MODEL_ID_PREFIX2 as XAI_SUBSCRIPTION_MODEL_ID_PREFIX,
+  allowedFirstPartyMcpToolsForSession,
   applyGitAuthPointerEnvironment,
   assertTurnExecutionPolicyMatchesConfigV1,
   builtinProviderId,
@@ -3785,6 +3984,7 @@ export {
   resolveAiGatewayRealtimeModel,
   resolveEnrollmentSigningSecret,
   resolveFirstPartyDelegationSecret,
+  resolveFirstPartyMcpToolPolicy,
   resolveModelProvider,
   resolveNatsCalloutConfig,
   resolveNatsControlPlaneAuth,
@@ -3812,6 +4012,7 @@ export {
   voiceInputDeploymentConfigured,
   withCodexCatalogProvider,
   withWorkspaceGatewayCatalogProvider,
-  withWorkspaceGatewayCredential
+  withWorkspaceGatewayCredential,
+  withXaiSubscriptionCatalogProvider
 };
 //# sourceMappingURL=index.js.map