@opengeni/config 0.21.0-canary.0 → 0.22.5-canary.0

package/dist/index.d.ts

@@ -273,6 +273,8 @@ declare const SettingsSchema: z.ZodObject<{
         variable_set_get_variable: "variable_set_get_variable";
         variable_set_list: "variable_set_list";
         variable_set_set_variable: "variable_set_set_variable";
+        work_claim_release: "work_claim_release";
+        work_claim_upsert: "work_claim_upsert";
         x_accounts_list: "x_accounts_list";
         x_mentions_live: "x_mentions_live";
         x_post_reply: "x_post_reply";
@@ -417,6 +419,8 @@ declare const SettingsSchema: z.ZodObject<{
         variable_set_get_variable: "variable_set_get_variable";
         variable_set_list: "variable_set_list";
         variable_set_set_variable: "variable_set_set_variable";
+        work_claim_release: "work_claim_release";
+        work_claim_upsert: "work_claim_upsert";
         x_accounts_list: "x_accounts_list";
         x_mentions_live: "x_mentions_live";
         x_post_reply: "x_post_reply";
@@ -426,6 +430,10 @@ declare const SettingsSchema: z.ZodObject<{
     }>>>>;
     streamTokenSecret: z.ZodOptional<z.ZodString>;
     streamControlEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
+    workDiscoveryEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
+    workClaimMutationsEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
+    workDiscoveryHumanAdvisoriesEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
+    workDiscoveryAutomaticNudgesEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
     ogtoolPackageSpec: z.ZodOptional<z.ZodString>;
     environmentsEncryptionKey: z.ZodOptional<z.ZodString>;
     integrationsEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
@@ -586,6 +594,8 @@ declare const SettingsSchema: z.ZodObject<{
     modalImageId: z.ZodOptional<z.ZodString>;
     modalImageRegistrySecret: z.ZodOptional<z.ZodString>;
     modalTimeoutSeconds: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    modalSandboxCpu: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+    modalSandboxMemoryMiB: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
     modalTokenId: z.ZodOptional<z.ZodString>;
     modalTokenSecret: z.ZodOptional<z.ZodString>;
     modalEnvironment: z.ZodOptional<z.ZodString>;
@@ -600,8 +610,6 @@ declare const SettingsSchema: z.ZodObject<{
     sandboxTerminalEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
     streamResolutionWidth: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     streamResolutionHeight: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
-    computerUseEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
-    computerUseReadOnly: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
     recordingEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
     recordingDefaultCodec: z.ZodDefault<z.ZodEnum<{
         "h264-mp4": "h264-mp4";
@@ -770,6 +778,10 @@ declare const SettingsSchema: z.ZodObject<{
     betterAuthAllowedHosts: z.ZodDefault<z.ZodString>;
     betterAuthCookieDomain: z.ZodOptional<z.ZodString>;
     betterAuthTrustedOrigins: z.ZodDefault<z.ZodString>;
+    managedAuthGoogleClientId: z.ZodOptional<z.ZodString>;
+    managedAuthGoogleClientSecret: z.ZodOptional<z.ZodString>;
+    managedAuthGithubClientId: z.ZodOptional<z.ZodString>;
+    managedAuthGithubClientSecret: z.ZodOptional<z.ZodString>;
     managedAuthSessionSetMode: z.ZodDefault<z.ZodEnum<{
         broker: "broker";
         dual: "dual";

package/dist/index.js

@@ -304,6 +304,21 @@ var SettingsSchema = z.object({
   // holder of stream:control gets 403 until this flips. Keeps stream:control a
   // declared-but-inert permission so later hardening is a flag flip.
   streamControlEnabled: EnvBoolean.default(false),
+  // Provider-neutral advisory work discovery rollout. Disabling this keeps
+  // ordinary session listings available while rejecting relevance discovery
+  // and omitting claim evidence from their compact projections.
+  workDiscoveryEnabled: EnvBoolean.default(true),
+  // Exact-attempt claim mutations are independently reversible. Turning this
+  // off removes the first-party mutation tools; durable claims and lifecycle
+  // settlement evidence remain readable.
+  workClaimMutationsEnabled: EnvBoolean.default(true),
+  // Human presentation is a separate rollout stage from the read API. The
+  // topology response carries this decision so clients can hide advisory UI
+  // without inventing authorization or ownership semantics.
+  workDiscoveryHumanAdvisoriesEnabled: EnvBoolean.default(true),
+  // Automatic overlap nudges are deliberately unshipped and default OFF until
+  // an evaluated precision threshold and operator runbook approve them.
+  workDiscoveryAutomaticNudgesEnabled: EnvBoolean.default(false),
   // Optional release-coherent bootstrap hint for custom rigs/connected machines
   // that do not carry the stock-image ogtool binary. Exact stable versions only:
   // the agent must never guess a tag or silently install `latest`.
@@ -636,6 +651,13 @@ var SettingsSchema = z.object({
   // larger timeout—is what lets a session outlive one finite provider box.
   // Knob: OPENGENI_MODAL_TIMEOUT_SECONDS.
   modalTimeoutSeconds: z.coerce.number().int().positive().max(86400).default(86400),
+  // Optional provider reservations for every new Modal sandbox. CPU is measured
+  // in physical cores and may be fractional; memory is measured in MiB. Leave
+  // both unset to preserve Modal's provider defaults. The Agents adapter stores
+  // the resolved values in its session state so snapshot replacement and exact
+  // resume cannot silently change the reservation.
+  modalSandboxCpu: z.coerce.number().positive().optional(),
+  modalSandboxMemoryMiB: z.coerce.number().int().positive().optional(),
   modalTokenId: z.string().optional(),
   modalTokenSecret: z.string().optional(),
   modalEnvironment: z.string().optional(),
@@ -673,8 +695,8 @@ var SettingsSchema = z.object({
   // cell advertises mode "interactive" — the noVNC viewer can drive mouse+keyboard
   // into :0 (x11vnc runs without -viewonly). Turn it OFF for a genuinely read-only
   // deployment: the cell reports mode "read-only" and the client disables the
-  // "Take control" affordance. Independent of computerUseReadOnly (the AGENT
-  // driver); this gates the HUMAN viewer plane.
+  // "Take control" affordance. This gates the HUMAN viewer plane; agent
+  // interaction is authorized through managed ComputerSession tools.
   sandboxDesktopInteractive: EnvBoolean.default(true),
   // REAL PTY terminal toggle (P5.t): gates the ttyd pty-ws plane (7681) the API
   // mints over the SAME tunnel as the desktop. Defaults ON — the interactive
@@ -688,13 +710,7 @@ var SettingsSchema = z.object({
   // down→up restart. Defaults match the proven spike geometry (1280x800).
   streamResolutionWidth: z.coerce.number().int().positive().default(1280),
   streamResolutionHeight: z.coerce.number().int().positive().default(800),
-  // P4.3 computer-use: the agent drives the SAME :0 humans watch (xdotool/XTEST +
-  // scrot). Gated by sandboxDesktopEnabled + a desktop-capable backend in
-  // buildAgentCapabilities; computerUseReadOnly:false is the agent-driver default
-  // (it must click/type — the human viewer plane is the read-only one).
-  computerUseEnabled: EnvBoolean.default(true),
-  computerUseReadOnly: EnvBoolean.default(false),
-  // P4.3 recording loop: ffmpeg x11grab of :0 → mp4/webm → @opengeni/storage.
+  // Recording loop: ffmpeg x11grab of :0 → mp4/webm → @opengeni/storage.
   // recordingMaxBytes caps the in-memory finalize buffer (≤ storage single-PUT);
   // recordingMaxSeconds is the ffmpeg -t hard ceiling (bounds a multi-day turn).
   recordingEnabled: EnvBoolean.default(true),
@@ -1050,6 +1066,10 @@ var SettingsSchema = z.object({
   betterAuthAllowedHosts: z.string().default(""),
   betterAuthCookieDomain: z.string().optional(),
   betterAuthTrustedOrigins: z.string().default(""),
+  managedAuthGoogleClientId: z.string().optional(),
+  managedAuthGoogleClientSecret: z.string().optional(),
+  managedAuthGithubClientId: z.string().optional(),
+  managedAuthGithubClientSecret: z.string().optional(),
   // Rolling browser login-slot compatibility. Repository/deployment default is
   // deliberately legacy; changing to broker is an operator-authorized rollout.
   managedAuthSessionSetMode: z.enum(["legacy", "dual", "broker"]).default("legacy"),
@@ -1740,6 +1760,14 @@ function getSettings() {
     allowedFirstPartyMcpTools: optional("OPENGENI_ALLOWED_FIRST_PARTY_MCP_TOOLS"),
     streamTokenSecret: optional("OPENGENI_STREAM_TOKEN_SECRET"),
     streamControlEnabled: optional("OPENGENI_STREAM_CONTROL_ENABLED"),
+    workDiscoveryEnabled: optional("OPENGENI_WORK_DISCOVERY_ENABLED"),
+    workClaimMutationsEnabled: optional("OPENGENI_WORK_CLAIM_MUTATIONS_ENABLED"),
+    workDiscoveryHumanAdvisoriesEnabled: optional(
+      "OPENGENI_WORK_DISCOVERY_HUMAN_ADVISORIES_ENABLED"
+    ),
+    workDiscoveryAutomaticNudgesEnabled: optional(
+      "OPENGENI_WORK_DISCOVERY_AUTOMATIC_NUDGES_ENABLED"
+    ),
     ogtoolPackageSpec: optional("OPENGENI_OGTOOL_PACKAGE_SPEC"),
     environmentsEncryptionKey: optional("OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY"),
     integrationsEnabled: optional("OPENGENI_INTEGRATIONS_ENABLED"),
@@ -1892,6 +1920,8 @@ function getSettings() {
     modalImageId: optional("OPENGENI_MODAL_IMAGE_ID"),
     modalImageRegistrySecret: optional("OPENGENI_MODAL_IMAGE_REGISTRY_SECRET"),
     modalTimeoutSeconds: optional("OPENGENI_MODAL_TIMEOUT_SECONDS"),
+    modalSandboxCpu: optional("OPENGENI_MODAL_SANDBOX_CPU"),
+    modalSandboxMemoryMiB: optional("OPENGENI_MODAL_SANDBOX_MEMORY_MIB"),
     modalTokenId: optional("OPENGENI_MODAL_TOKEN_ID"),
     modalTokenSecret: optional("OPENGENI_MODAL_TOKEN_SECRET"),
     modalEnvironment: optional("OPENGENI_MODAL_ENVIRONMENT"),
@@ -1902,8 +1932,6 @@ function getSettings() {
     sandboxTerminalEnabled: optional("OPENGENI_SANDBOX_TERMINAL_ENABLED"),
     streamResolutionWidth: optional("OPENGENI_STREAM_RESOLUTION_WIDTH"),
     streamResolutionHeight: optional("OPENGENI_STREAM_RESOLUTION_HEIGHT"),
-    computerUseEnabled: optional("OPENGENI_COMPUTER_USE_ENABLED"),
-    computerUseReadOnly: optional("OPENGENI_COMPUTER_USE_READONLY"),
     recordingEnabled: optional("OPENGENI_RECORDING_ENABLED"),
     workspaceCaptureEnabled: optional("OPENGENI_WORKSPACE_CAPTURE"),
     recordingDefaultCodec: optional("OPENGENI_RECORDING_DEFAULT_CODEC"),
@@ -2059,6 +2087,10 @@ function getSettings() {
     betterAuthAllowedHosts: optional("OPENGENI_BETTER_AUTH_ALLOWED_HOSTS"),
     betterAuthCookieDomain: optional("OPENGENI_BETTER_AUTH_COOKIE_DOMAIN"),
     betterAuthTrustedOrigins: optional("OPENGENI_BETTER_AUTH_TRUSTED_ORIGINS"),
+    managedAuthGoogleClientId: optional("OPENGENI_MANAGED_AUTH_GOOGLE_CLIENT_ID"),
+    managedAuthGoogleClientSecret: optional("OPENGENI_MANAGED_AUTH_GOOGLE_CLIENT_SECRET"),
+    managedAuthGithubClientId: optional("OPENGENI_MANAGED_AUTH_GITHUB_CLIENT_ID"),
+    managedAuthGithubClientSecret: optional("OPENGENI_MANAGED_AUTH_GITHUB_CLIENT_SECRET"),
     managedAuthSessionSetMode: optional("OPENGENI_MANAGED_AUTH_SESSION_SET_MODE"),
     resendApiKey: optional("OPENGENI_RESEND_API_KEY"),
     emailFrom: optional("OPENGENI_EMAIL_FROM"),
@@ -2674,8 +2706,9 @@ function canonicalJson(value) {
   };
   return JSON.stringify(normalize(value));
 }
-function definitionVersionFor(model, provider) {
+function definitionVersionFor(model, provider, options = {}) {
   const requestMetadata = staticRequestMetadataForDigest(provider);
+  const includeWireProfile = options.includeWireProfile ?? true;
   const digestInput = canonicalJson({
     schemaVersion: model.schemaVersion,
     id: model.id,
@@ -2684,7 +2717,7 @@ function definitionVersionFor(model, provider) {
     provider: {
       adapterKind: provider.kind,
       wireApi: provider.api,
-      wireProfile: provider.wireProfile,
+      ...includeWireProfile ? { wireProfile: provider.wireProfile } : {},
       baseUrl: provider.baseUrl ?? null,
       defaultHeaders: requestMetadata.headers,
       defaultQuery: requestMetadata.query
@@ -2698,6 +2731,11 @@ function definitionVersionFor(model, provider) {
   });
   return `sha256:${createHash("sha256").update("opengeni:model-definition:v1\n", "utf8").update(digestInput, "utf8").digest("hex")}`;
 }
+function legacyImplicitOpenAiDefinitionVersionFor(model, provider) {
+  if (provider.wireProfile !== "openai") return null;
+  const { definitionVersion: _definitionVersion, ...modelWithoutVersion } = model;
+  return definitionVersionFor(modelWithoutVersion, provider, { includeWireProfile: false });
+}
 function builtinProviderId(settings) {
   return settings.openaiProvider === "azure" ? "azure" : "openai";
 }
@@ -3080,7 +3118,12 @@ function assertTurnExecutionPolicyMatchesConfigV1(settings, policy, expected) {
   if (!resolved) {
     throw new Error("Turn execution policy model is no longer configured");
   }
-  const mismatched = parsed.providerId !== resolved.provider.id || parsed.upstreamModelId !== resolved.model.upstreamModelId || parsed.wireApi !== resolved.model.api || parsed.definitionVersion !== resolved.model.definitionVersion || canonicalJson(parsed.credentialSource) !== canonicalJson(resolved.model.credentialSource) || canonicalJson(parsed.billing) !== canonicalJson(resolved.model.billing);
+  const legacyImplicitOpenAiDefinitionVersion = legacyImplicitOpenAiDefinitionVersionFor(
+    resolved.model,
+    resolved.provider
+  );
+  const definitionVersionMatches = parsed.definitionVersion === resolved.model.definitionVersion || parsed.definitionVersion === legacyImplicitOpenAiDefinitionVersion;
+  const mismatched = parsed.providerId !== resolved.provider.id || parsed.upstreamModelId !== resolved.model.upstreamModelId || parsed.wireApi !== resolved.model.api || !definitionVersionMatches || canonicalJson(parsed.credentialSource) !== canonicalJson(resolved.model.credentialSource) || canonicalJson(parsed.billing) !== canonicalJson(resolved.model.billing);
   if (mismatched) {
     throw new Error("Turn execution policy does not match the current provider definition");
   }
@@ -3868,6 +3911,37 @@ function validateSettings(settings) {
       );
     }
   }
+  if (Boolean(settings.managedAuthGoogleClientId) !== Boolean(settings.managedAuthGoogleClientSecret)) {
+    throw new Error(
+      "OPENGENI_MANAGED_AUTH_GOOGLE_CLIENT_ID and OPENGENI_MANAGED_AUTH_GOOGLE_CLIENT_SECRET must be configured together"
+    );
+  }
+  if (Boolean(settings.managedAuthGithubClientId) !== Boolean(settings.managedAuthGithubClientSecret)) {
+    throw new Error(
+      "OPENGENI_MANAGED_AUTH_GITHUB_CLIENT_ID and OPENGENI_MANAGED_AUTH_GITHUB_CLIENT_SECRET must be configured together"
+    );
+  }
+  const managedSocialAuthConfigured = Boolean(
+    settings.managedAuthGoogleClientId || settings.managedAuthGithubClientId
+  );
+  if (managedSocialAuthConfigured) {
+    if (settings.productAccessMode !== "managed") {
+      throw new Error(
+        "Managed Google/GitHub authentication requires OPENGENI_PRODUCT_ACCESS_MODE=managed"
+      );
+    }
+    const publicOrigin = canonicalPublicOrigin(settings.publicBaseUrl);
+    if (!publicOrigin) {
+      throw new Error(
+        "OPENGENI_PUBLIC_BASE_URL must be a credential-free HTTP(S) origin when managed social authentication is configured"
+      );
+    }
+    if (!publicOrigin.startsWith("https://") && !["local", "test"].includes(settings.environment)) {
+      throw new Error(
+        "OPENGENI_PUBLIC_BASE_URL must use https when managed social authentication is configured outside local/test"
+      );
+    }
+  }
   environmentsEncryptionKeyBytes(settings);
   if (settings.integrationsEnabled) {
     if (settings.productAccessMode === "managed" && !settings.publicBaseUrl) {
@@ -3924,11 +3998,6 @@ function validateSettings(settings) {
         "OPENGENI_INTEGRATIONS_ENABLED=true is required when personal GitHub OAuth is enabled"
       );
     }
-    if (settings.productAccessMode !== "managed") {
-      throw new Error(
-        "OPENGENI_GITHUB_PERSONAL_OAUTH_ENABLED=true requires OPENGENI_PRODUCT_ACCESS_MODE=managed"
-      );
-    }
     if (!settings.githubPersonalOauthClientId || !settings.githubPersonalOauthClientSecret) {
       throw new Error(
         "personal GitHub OAuth requires OPENGENI_GITHUB_PERSONAL_OAUTH_CLIENT_ID and OPENGENI_GITHUB_PERSONAL_OAUTH_CLIENT_SECRET"