@opengeni/config 0.23.2-canary.0 → 1.0.0-canary.1

package/dist/index.d.ts

@@ -66,6 +66,8 @@ export declare const McpServerConnectionRefSchema: z.ZodObject<{
     }>>;
 }, z.core.$strict>;
 export type McpServerConnectionRef = z.infer<typeof McpServerConnectionRefSchema>;
+/** Public, digest-pinned desktop image used by Modal unless the operator overrides it. */
+export declare const DEFAULT_MODAL_IMAGE_REF = "opengenipublicneuacr.azurecr.io/opengeni-desktop@sha256:c3bd17b8841de1bff9bb2777aad422cf8c75de78e2c30f9ac81d0cd6810a1b78";
 declare const SettingsSchema: z.ZodObject<{
     serviceName: z.ZodDefault<z.ZodString>;
     environment: z.ZodDefault<z.ZodString>;
@@ -112,6 +114,8 @@ declare const SettingsSchema: z.ZodObject<{
     analyticsPosthogHost: z.ZodOptional<z.ZodString>;
     analyticsGa4MeasurementId: z.ZodOptional<z.ZodString>;
     publicBaseUrl: z.ZodOptional<z.ZodString>;
+    mcpOauthEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
+    mcpOauthTrustedProxyHops: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     webBaseUrl: z.ZodOptional<z.ZodString>;
     agentReleasesBaseUrl: z.ZodDefault<z.ZodString>;
     agentStableVersion: z.ZodDefault<z.ZodString>;
@@ -140,10 +144,13 @@ declare const SettingsSchema: z.ZodObject<{
     staticUsageLimitsJson: z.ZodDefault<z.ZodString>;
     delegationSecret: z.ZodOptional<z.ZodString>;
     defaultFirstPartyMcpTools: z.ZodPreprocess<z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        artifacts_archive: "artifacts_archive";
         artifacts_create: "artifacts_create";
         artifacts_get_source: "artifacts_get_source";
         artifacts_list: "artifacts_list";
+        artifacts_prepare_upload: "artifacts_prepare_upload";
         artifacts_publish: "artifacts_publish";
+        artifacts_restore: "artifacts_restore";
         artifacts_rollback: "artifacts_rollback";
         atlassian_get: "atlassian_get";
         atlassian_search: "atlassian_search";
@@ -160,6 +167,8 @@ declare const SettingsSchema: z.ZodObject<{
         browser_tabs: "browser_tabs";
         capability_authorization_request: "capability_authorization_request";
         capability_catalog_search: "capability_catalog_search";
+        command_read: "command_read";
+        command_wait: "command_wait";
         company_profile_confirm: "company_profile_confirm";
         company_profile_propose: "company_profile_propose";
         computer_act: "computer_act";
@@ -194,9 +203,9 @@ declare const SettingsSchema: z.ZodObject<{
         goal_complete: "goal_complete";
         goal_pause: "goal_pause";
         goal_progress: "goal_progress";
+        goal_resume: "goal_resume";
         goal_set: "goal_set";
         goal_update: "goal_update";
-        goal_wait: "goal_wait";
         instruction_policy_propose: "instruction_policy_propose";
         interaction_discover: "interaction_discover";
         interaction_request_human: "interaction_request_human";
@@ -276,6 +285,7 @@ declare const SettingsSchema: z.ZodObject<{
         variable_set_get_variable: "variable_set_get_variable";
         variable_set_list: "variable_set_list";
         variable_set_set_variable: "variable_set_set_variable";
+        wait_for_input: "wait_for_input";
         work_claim_release: "work_claim_release";
         work_claim_upsert: "work_claim_upsert";
         x_accounts_list: "x_accounts_list";
@@ -286,10 +296,13 @@ declare const SettingsSchema: z.ZodObject<{
         x_thread_fetch: "x_thread_fetch";
     }>>>>;
     allowedFirstPartyMcpTools: z.ZodPreprocess<z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        artifacts_archive: "artifacts_archive";
         artifacts_create: "artifacts_create";
         artifacts_get_source: "artifacts_get_source";
         artifacts_list: "artifacts_list";
+        artifacts_prepare_upload: "artifacts_prepare_upload";
         artifacts_publish: "artifacts_publish";
+        artifacts_restore: "artifacts_restore";
         artifacts_rollback: "artifacts_rollback";
         atlassian_get: "atlassian_get";
         atlassian_search: "atlassian_search";
@@ -306,6 +319,8 @@ declare const SettingsSchema: z.ZodObject<{
         browser_tabs: "browser_tabs";
         capability_authorization_request: "capability_authorization_request";
         capability_catalog_search: "capability_catalog_search";
+        command_read: "command_read";
+        command_wait: "command_wait";
         company_profile_confirm: "company_profile_confirm";
         company_profile_propose: "company_profile_propose";
         computer_act: "computer_act";
@@ -340,9 +355,9 @@ declare const SettingsSchema: z.ZodObject<{
         goal_complete: "goal_complete";
         goal_pause: "goal_pause";
         goal_progress: "goal_progress";
+        goal_resume: "goal_resume";
         goal_set: "goal_set";
         goal_update: "goal_update";
-        goal_wait: "goal_wait";
         instruction_policy_propose: "instruction_policy_propose";
         interaction_discover: "interaction_discover";
         interaction_request_human: "interaction_request_human";
@@ -422,6 +437,7 @@ declare const SettingsSchema: z.ZodObject<{
         variable_set_get_variable: "variable_set_get_variable";
         variable_set_list: "variable_set_list";
         variable_set_set_variable: "variable_set_set_variable";
+        wait_for_input: "wait_for_input";
         work_claim_release: "work_claim_release";
         work_claim_upsert: "work_claim_upsert";
         x_accounts_list: "x_accounts_list";
@@ -551,7 +567,6 @@ declare const SettingsSchema: z.ZodObject<{
     codexProductSku: z.ZodOptional<z.ZodString>;
     codexToolSearchEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
     lazyToolSearchEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
-    codexCredentialLeasingEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
     codexFleetPolicyShadowEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
     codexRotationNearExhaustionPct: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     openaiReasoningEffort: z.ZodDefault<z.ZodEnum<{
@@ -801,6 +816,11 @@ declare const SettingsSchema: z.ZodObject<{
         dual: "dual";
         legacy: "legacy";
     }>>;
+    organizationUserSetupEmailTokenTransport: z.ZodDefault<z.ZodEnum<{
+        fragment: "fragment";
+        query: "query";
+    }>>;
+    organizationUserSetupQueryEdgeSanitizationConfirmed: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
     resendApiKey: z.ZodOptional<z.ZodString>;
     emailFrom: z.ZodDefault<z.ZodString>;
     stripeSecretKey: z.ZodOptional<z.ZodString>;

package/dist/index.js

@@ -207,6 +207,7 @@ var McpServerConnectionRefSchema = z.object({
     });
   }
 });
+var DEFAULT_MODAL_IMAGE_REF = "opengenipublicneuacr.azurecr.io/opengeni-desktop@sha256:c3bd17b8841de1bff9bb2777aad422cf8c75de78e2c30f9ac81d0cd6810a1b78";
 var SettingsSchema = z.object({
   serviceName: z.string().default("opengeni"),
   environment: z.string().default("local"),
@@ -263,6 +264,12 @@ var SettingsSchema = z.object({
   analyticsPosthogHost: z.string().url().max(2048).optional(),
   analyticsGa4MeasurementId: z.string().max(32).regex(/^G-[A-Z0-9]+$/u).optional(),
   publicBaseUrl: z.string().url().optional(),
+  // Standards-based OAuth authorization server for external workspace MCP
+  // clients. Opt-in because it creates a new public authentication surface.
+  mcpOauthEnabled: EnvBoolean.default(false),
+  // Forwarded client addresses are ignored by default. Operators may trust an
+  // exact number of proxy hops only when direct access to the API is blocked.
+  mcpOauthTrustedProxyHops: z.coerce.number().int().min(0).max(16).default(0),
   // Browser origin when the web app and API use separate origins in local
   // development. Production normally leaves this unset and uses publicBaseUrl.
   webBaseUrl: z.string().url().optional(),
@@ -589,11 +596,6 @@ var SettingsSchema = z.object({
   // the Codex rollout so an emergency Codex opt-out cannot disable every model.
   // OPENGENI_LAZY_TOOL_SEARCH_ENABLED
   lazyToolSearchEnabled: EnvBoolean.default(true),
-  // credential allocator atomic, workspace-local credential allocation. Default OFF is a
-  // deliberate rolling-deploy fence: migrate + roll every worker first, then
-  // enable. Turning it off restores the legacy sticky selector without a schema
-  // rollback; the additive lease table/cursor columns become inert.
-  codexCredentialLeasingEnabled: EnvBoolean.default(false),
   // Decision-observability fence. When enabled, the worker emits one
   // bounded, metadata-only adaptive-policy replay record alongside the unchanged
   // sticky-sharded decision. It never changes placement/admission/failover.
@@ -1117,6 +1119,15 @@ var SettingsSchema = z.object({
   // Rolling browser login-slot compatibility. Repository/deployment default is
   // deliberately legacy; changing to broker is an operator-authorized rollout.
   managedAuthSessionSetMode: z.enum(["legacy", "dual", "broker"]).default("legacy"),
+  // Query transport is an explicit second-stage rollout. A pre-compatibility
+  // web image understands only fragment bearers, so API replicas must keep
+  // generating fragment links until the compatible web fleet has converged.
+  organizationUserSetupEmailTokenTransport: z.enum(["fragment", "query"]).default("fragment"),
+  // Query-bearing setup links may appear in controller/edge error logs even
+  // when access logs and request tracing are disabled. This explicit operator
+  // confirmation keeps query transport fail closed until that separate sink is
+  // proven sanitized.
+  organizationUserSetupQueryEdgeSanitizationConfirmed: EnvBoolean.default(false),
   resendApiKey: z.string().optional(),
   emailFrom: z.string().default("OpenGeni <auth@mail.opengeni.ai>"),
   stripeSecretKey: z.string().optional(),
@@ -2190,6 +2201,8 @@ function getSettings(source = process.env) {
     analyticsPosthogHost: optional("OPENGENI_ANALYTICS_POSTHOG_HOST"),
     analyticsGa4MeasurementId: optional("OPENGENI_ANALYTICS_GA4_MEASUREMENT_ID"),
     publicBaseUrl: optional("OPENGENI_PUBLIC_BASE_URL"),
+    mcpOauthEnabled: optional("OPENGENI_MCP_OAUTH_ENABLED"),
+    mcpOauthTrustedProxyHops: optional("OPENGENI_MCP_OAUTH_TRUSTED_PROXY_HOPS"),
     webBaseUrl: optional("OPENGENI_WEB_BASE_URL"),
     agentReleasesBaseUrl: optional("OPENGENI_AGENT_RELEASES_BASE_URL"),
     agentStableVersion: optional("OPENGENI_AGENT_STABLE_VERSION"),
@@ -2346,7 +2359,6 @@ function getSettings(source = process.env) {
     codexConnectedAppsEnabled: optional("OPENGENI_CODEX_CONNECTED_APPS_ENABLED"),
     codexToolSearchEnabled: optional("OPENGENI_CODEX_TOOL_SEARCH_ENABLED"),
     lazyToolSearchEnabled: optional("OPENGENI_LAZY_TOOL_SEARCH_ENABLED"),
-    codexCredentialLeasingEnabled: optional("OPENGENI_CODEX_CREDENTIAL_LEASING_ENABLED"),
     codexFleetPolicyShadowEnabled: optional("OPENGENI_CODEX_FLEET_POLICY_SHADOW_ENABLED"),
     codexProductSku: optional("OPENGENI_CODEX_PRODUCT_SKU"),
     openaiReasoningEffort: optional("OPENGENI_OPENAI_REASONING_EFFORT"),
@@ -2371,7 +2383,7 @@ function getSettings(source = process.env) {
     dockerNetwork: optional("OPENGENI_DOCKER_NETWORK"),
     dockerWorkspaceBaseDir: optional("OPENGENI_DOCKER_WORKSPACE_BASE_DIR"),
     modalAppName: optional("OPENGENI_MODAL_APP_NAME"),
-    modalImageRef: optional("OPENGENI_MODAL_IMAGE_REF"),
+    modalImageRef: optional("OPENGENI_MODAL_IMAGE_REF") ?? DEFAULT_MODAL_IMAGE_REF,
     modalImageId: optional("OPENGENI_MODAL_IMAGE_ID"),
     modalImageRegistrySecret: optional("OPENGENI_MODAL_IMAGE_REGISTRY_SECRET"),
     modalTimeoutSeconds: optional("OPENGENI_MODAL_TIMEOUT_SECONDS"),
@@ -2548,6 +2560,12 @@ function getSettings(source = process.env) {
     managedAuthGithubClientId: optional("OPENGENI_MANAGED_AUTH_GITHUB_CLIENT_ID"),
     managedAuthGithubClientSecret: optional("OPENGENI_MANAGED_AUTH_GITHUB_CLIENT_SECRET"),
     managedAuthSessionSetMode: optional("OPENGENI_MANAGED_AUTH_SESSION_SET_MODE"),
+    organizationUserSetupEmailTokenTransport: optional(
+      "OPENGENI_ORGANIZATION_USER_SETUP_EMAIL_TOKEN_TRANSPORT"
+    ),
+    organizationUserSetupQueryEdgeSanitizationConfirmed: optional(
+      "OPENGENI_ORGANIZATION_USER_SETUP_QUERY_EDGE_SANITIZATION_CONFIRMED"
+    ),
     resendApiKey: optional("OPENGENI_RESEND_API_KEY"),
     emailFrom: optional("OPENGENI_EMAIL_FROM"),
     stripeSecretKey: optional("OPENGENI_STRIPE_SECRET_KEY"),
@@ -2588,7 +2606,9 @@ function resolveFirstPartyMcpToolPolicy(settings) {
 function allowedFirstPartyMcpToolsForSession(settings, selected) {
   const policy = resolveFirstPartyMcpToolPolicy(settings);
   const allowed = new Set(policy.allowed);
-  return [...selected ?? policy.default].filter((tool) => allowed.has(tool));
+  const tools = new Set(selected ?? policy.default);
+  if (tools.has("goal_pause")) tools.add("goal_resume");
+  return [...tools].filter((tool) => allowed.has(tool));
 }
 function effectiveModalIdleTimeoutSeconds(settings) {
   return settings.modalIdleTimeoutSeconds ?? settings.modalTimeoutSeconds;
@@ -3205,6 +3225,8 @@ function productShortLabelForModelId(modelId) {
       return "5.6 Terra";
     case "gpt-5.6-luna":
       return "5.6 Luna";
+    case "gpt-6-astra":
+      return "6 Astra";
     default:
       return null;
   }
@@ -3224,7 +3246,7 @@ function builtinContextLimitsForModel(settings, modelId) {
   return { contextWindowTokens: settings.contextWindowTokens };
 }
 function builtinLatencyModesForModel(modelId) {
-  if (isBuiltinGpt56ModelId(modelId) || modelId.startsWith("codex/gpt-5.6-")) {
+  if (isBuiltinGpt56ModelId(modelId) || modelId.startsWith("codex/gpt-5.6-") || modelId === "codex/gpt-6-astra") {
     return [
       { id: "standard", upstream: "supported", runnable: true },
       {
@@ -3478,7 +3500,7 @@ function withCodexCatalogProvider(settings) {
         ...legacyModelCapabilities(settings, {
           reasoningEffort: true,
           hostedWebSearch: true,
-          vision: slug.startsWith("gpt-5.6-")
+          vision: slug.startsWith("gpt-5.6-") || slug === "gpt-6-astra"
         }),
         ...builtinPromptCachingForModel(`${CODEX_MODEL_ID_PREFIX}${slug}`) ? {
           promptCaching: builtinPromptCachingForModel(`${CODEX_MODEL_ID_PREFIX}${slug}`)
@@ -4612,6 +4634,11 @@ function isDigestPinnedModalDesktopImage(settings) {
 }
 function validateSettings(settings, source = process.env) {
   temporalConnectionOptions(settings);
+  if (settings.organizationUserSetupEmailTokenTransport === "query" && !settings.organizationUserSetupQueryEdgeSanitizationConfirmed) {
+    throw new Error(
+      "OPENGENI_ORGANIZATION_USER_SETUP_QUERY_EDGE_SANITIZATION_CONFIRMED=true is required when OPENGENI_ORGANIZATION_USER_SETUP_EMAIL_TOKEN_TRANSPORT=query"
+    );
+  }
   if (settings.goalIdleBackoffMs.some((delayMs) => delayMs > settings.goalIdleBackoffMaxMs)) {
     throw new Error(
       `OPENGENI_GOAL_IDLE_BACKOFF_MS entries must not exceed OPENGENI_GOAL_IDLE_BACKOFF_MAX_MS (${settings.goalIdleBackoffMaxMs})`
@@ -4689,6 +4716,24 @@ function validateSettings(settings, source = process.env) {
       );
     }
   }
+  if (settings.mcpOauthEnabled) {
+    if (settings.productAccessMode === "configured") {
+      throw new Error(
+        "OPENGENI_MCP_OAUTH_ENABLED=true requires managed or local product access mode"
+      );
+    }
+    const publicOrigin = canonicalPublicOrigin(settings.publicBaseUrl);
+    if (!publicOrigin) {
+      throw new Error(
+        "OPENGENI_PUBLIC_BASE_URL must be a credential-free HTTP(S) origin when OPENGENI_MCP_OAUTH_ENABLED=true"
+      );
+    }
+    if (!publicOrigin.startsWith("https://") && !["local", "test"].includes(settings.environment)) {
+      throw new Error(
+        "OPENGENI_PUBLIC_BASE_URL must use https when OPENGENI_MCP_OAUTH_ENABLED=true outside local/test"
+      );
+    }
+  }
   environmentsEncryptionKeyBytes(settings);
   if (settings.integrationsEnabled) {
     if (settings.productAccessMode === "managed" && !settings.publicBaseUrl) {
@@ -5288,6 +5333,7 @@ export {
   DEFAULT_AGENT_INSTRUCTIONS,
   DEFAULT_GOAL_IDLE_BACKOFF_MAX_MS,
   DEFAULT_GOAL_IDLE_BACKOFF_MS,
+  DEFAULT_MODAL_IMAGE_REF,
   DEFAULT_MODEL_COST_POLICY_JSON,
   DEFAULT_OPENROUTER_MODEL_ID,
   GOOGLE_DRIVE_PROVIDER_REQUEST_TIMEOUT_MAX_MS,