@opengeni/config 0.4.0 → 0.5.1

package/dist/index.d.ts

@@ -25,10 +25,10 @@ declare const AGENT_INSTRUCTIONS_CORE_PLACEHOLDER = "{{core}}";
  * baked into this overridable string.
  *
  * INVARIANT: with no per-workspace override and an empty environment, the
- * runtime's composed instructions are BYTE-IDENTICAL to the historical
- * hardcoded preamble. The template below is exactly the historical lines 1–11
- * joined by " ", followed by " " + the placeholder. Changing a single
- * character here changes that default; a runtime test pins it.
+ * runtime's composed instructions are byte-for-byte pinned by a runtime test.
+ * The template below is joined by " ", followed by " " + the placeholder.
+ * Changing a single character here changes that default; update the pin
+ * intentionally.
  */
 declare const DEFAULT_AGENT_INSTRUCTIONS: string;
 declare const McpServerConnectionRefSchema: z.ZodObject<{
@@ -106,24 +106,11 @@ declare const SettingsSchema: z.ZodObject<{
     goalMaxAutoContinuations: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
     goalNoProgressLimit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     agentMaxModelCallsPerTurn: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
-    sessionHistorySource: z.ZodDefault<z.ZodEnum<{
-        run_state: "run_state";
-        items: "items";
-    }>>;
-    contextCompactionMode: z.ZodDefault<z.ZodEnum<{
-        auto: "auto";
-        server: "server";
-        client: "client";
-        off: "off";
-    }>>;
     contextWindowTokens: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    contextEffectiveWindowTokens: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
     contextCompactionThresholdRatio: z.ZodPipe<z.ZodDefault<z.ZodCoercedNumber<unknown>>, z.ZodTransform<number, number>>;
     contextReservedOutputTokens: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
-    contextServerCompactThresholdTokens: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
-    contextCompactSoftFraction: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
-    contextCompactHardFraction: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
-    contextKeepRecentTokens: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
-    contextSummaryMaxTokens: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    contextAutoCompactThresholdTokens: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
     authRequired: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
     accessKey: z.ZodOptional<z.ZodString>;
     authAllowHealth: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
@@ -146,6 +133,7 @@ declare const SettingsSchema: z.ZodObject<{
     codexSubscriptionEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
     codexProductSku: z.ZodOptional<z.ZodString>;
     codexToolSearchEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
+    codexCredentialLeasingEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
     codexRotationNearExhaustionPct: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     openaiReasoningEffort: z.ZodDefault<z.ZodEnum<{
         none: "none";
@@ -217,6 +205,7 @@ declare const SettingsSchema: z.ZodObject<{
         "h264-mp4": "h264-mp4";
         "vp9-webm": "vp9-webm";
     }>>;
+    workspaceCaptureEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
     recordingFramerate: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     recordingMaxSeconds: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     recordingMaxBytes: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
@@ -261,7 +250,9 @@ declare const SettingsSchema: z.ZodObject<{
     vercelTeamId: z.ZodOptional<z.ZodString>;
     vercelRuntime: z.ZodOptional<z.ZodString>;
     sandboxOwnershipEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
+    sandboxLazyProvisionEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
     sandboxSelfhostedEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
+    agentOpStreamEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
     enrollmentSigningSecret: z.ZodOptional<z.ZodString>;
     selfhostedNatsUrl: z.ZodOptional<z.ZodString>;
     selfhostedRelayUrl: z.ZodOptional<z.ZodString>;
@@ -273,12 +264,17 @@ declare const SettingsSchema: z.ZodObject<{
     selfhostedNatsCalloutPassword: z.ZodOptional<z.ZodString>;
     selfhostedNatsControlUser: z.ZodOptional<z.ZodString>;
     selfhostedNatsControlPassword: z.ZodOptional<z.ZodString>;
+    sandboxSelfhostedExecTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    sandboxSelfhostedControlTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     sandboxLeaseReaperPeriodMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     sandboxViewerHolderTtlMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     sandboxIdleGraceMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    sandboxSnapshotIntervalMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    sandboxSnapshotTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     sandboxLeaseTtlMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     sandboxLeaseWarmingTtlMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     sandboxWarmingTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    rigSetupTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     sandboxWarmRateMicrosPerSecondJson: z.ZodDefault<z.ZodString>;
     sandboxMaxWarmSecondsPerWorkspace: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     sandboxPreparationProfiles: z.ZodDefault<z.ZodString>;
@@ -425,6 +421,8 @@ declare const RegistryProviderSchema: z.ZodObject<{
         id: z.ZodString;
         label: z.ZodOptional<z.ZodString>;
         contextWindowTokens: z.ZodOptional<z.ZodNumber>;
+        effectiveContextWindowTokens: z.ZodOptional<z.ZodNumber>;
+        autoCompactTokenLimit: z.ZodOptional<z.ZodNumber>;
         reasoningEffort: z.ZodOptional<z.ZodBoolean>;
         hostedWebSearch: z.ZodOptional<z.ZodBoolean>;
         pricing: z.ZodOptional<z.ZodObject<{
@@ -449,9 +447,9 @@ type IntegrationOAuthClientConfig = z.infer<typeof IntegrationOAuthClientConfigS
 /**
  * Runtime-resolved provider (built-in or registry), client-construction-ready.
  * The built-in OpenAI/Azure provider is always present and always "responses";
- * registry providers carry their own base URL / key / wire API. compactionMode
- * is "server" only for the built-in OpenAI platform provider (its Responses API
- * honors server-side context_management) and "client" for everything else.
+ * registry providers carry their own base URL / key / wire API. Compaction is
+ * not a provider capability: all providers use the same durable plaintext
+ * replacement.
  */
 interface ResolvedModelProvider {
     id: string;
@@ -463,7 +461,6 @@ interface ResolvedModelProvider {
     apiKey?: string | undefined;
     defaultQuery?: Record<string, string> | undefined;
     defaultHeaders?: Record<string, string> | undefined;
-    compactionMode: ContextCompactionMode;
 }
 /** A single exposed model + the provider that serves it. */
 interface ConfiguredModel {
@@ -473,6 +470,8 @@ interface ConfiguredModel {
     providerLabel: string;
     api: ModelProviderApi;
     contextWindowTokens?: number | undefined;
+    effectiveContextWindowTokens?: number | undefined;
+    autoCompactTokenLimit?: number | undefined;
     reasoningEffort: boolean;
     hostedWebSearch: boolean;
 }
@@ -506,16 +505,37 @@ declare function collectSandboxEnvironment(settings: Settings, source?: NodeJS.P
  * explicit environment in tests.
  */
 declare function resolveProviderApiKey(provider: Pick<RegistryProvider, "apiKey" | "apiKeyEnv">, source?: NodeJS.ProcessEnv): string | undefined;
+/**
+ * The built-in provider's stable id: "openai" on the OpenAI platform, "azure"
+ * on Azure. Exported because the workspace model-policy gate must attribute
+ * the legacy resolveTurnModel-null fallback (which routes to this built-in
+ * client) to the SAME identity the router uses — otherwise a policy blocking
+ * the built-in could be bypassed through the null-resolution path.
+ */
+declare function builtinProviderId(settings: Pick<Settings, "openaiProvider">): string;
 /**
  * Every provider a client may route to: the built-in OpenAI/Azure provider
- * first (id "openai"/"azure", always "responses", compactionMode from
- * resolveContextCompactionMode), then each registry provider in declaration
- * order (compactionMode "client"). Client-construction inputs are filled from
+ * first (id "openai"/"azure", always "responses"), then each registry provider
+ * in declaration order. Client-construction inputs are filled from
  * the existing flat openai/azure settings for the built-in, and from the
  * registry entry for the rest. Registry ids may not collide with the built-in
  * id — validateSettings rejects that at boot.
  */
 declare function configuredProviders(settings: Settings): ResolvedModelProvider[];
+/**
+ * The provider identity a model id resolves to, for workspace model-policy
+ * evaluation — MUST agree with the real router (resolveTurnModel /
+ * MultiProviderModelProvider) on every case:
+ *   - `codex/<slug>` → the codex-subscription provider id, ALWAYS. With no
+ *     active subscription the router fails loud (CodexSubscriptionUnavailableError),
+ *     never the built-in — so attributing by prefix is exact even against BASE
+ *     settings where the overlay provider is not injected.
+ *   - a configured model id → its configuredModels providerId (registry or built-in).
+ *   - anything else → the built-in id: an unknown id is the legacy
+ *     resolveTurnModel-null fallback, which the built-in OpenAI/Azure client
+ *     serves. A policy blocking the built-in must block this path too.
+ */
+declare function policyProviderIdForModel(settings: Settings, modelId: string): string;
 /**
  * Every model a client may use, the built-in provider's models first
  * (configuredAllowedModels-from-openai, mapped to "responses" with
@@ -550,28 +570,16 @@ declare function resolveModelProvider(settings: Settings, modelId: string): {
  */
 declare function configuredModelPricing(settings: Settings): Record<string, ModelPricing>;
 /**
- * Resolved conversation-context compaction path for a run.
- *  - "server": let the OpenAI platform Responses API compact server-side (the
- *    SDK emits context_management; we pass the correct gpt-5.5 threshold).
- *  - "client": run OpenGeni's own client-side compaction (Azure and any other
- *    backend that rejects/ignores context_management).
- *  - "off": neither (legacy unbounded growth; escape hatch).
- *
- * "auto" maps to "server" on the OpenAI platform provider and "client"
- * otherwise — Azure's Responses API returns 400 unsupported_parameter for
- * context_management, so it must never take the server path.
+ * Usable input-token budget: an explicit model-catalog effective window when
+ * available, otherwise the deployment window minus its output reserve.
  */
-type ContextCompactionMode = "server" | "client" | "off";
-declare function resolveContextCompactionMode(settings: Pick<Settings, "contextCompactionMode" | "openaiProvider">): ContextCompactionMode;
-/** Usable input-token budget B = window - reserved output. */
-declare function contextInputBudgetTokens(settings: Pick<Settings, "contextWindowTokens" | "contextReservedOutputTokens">): number;
+declare function contextInputBudgetTokens(settings: Pick<Settings, "contextWindowTokens" | "contextEffectiveWindowTokens" | "contextReservedOutputTokens">): number;
 /**
- * Server-path compact_threshold (tokens) handed to the SDK's
- * StaticCompactionPolicy: the explicit override when set, else
- * floor(B * softFraction). This is what sidesteps the SDK's wrong 240k
- * fallback for gpt-5.5 (which is absent from its hardcoded window map).
+ * Apply the resolved provider/model's context policy to one turn. Registry
+ * metadata is authoritative when present; deployment defaults remain the
+ * fallback for models that do not declare their own limits.
  */
-declare function contextServerCompactThreshold(settings: Pick<Settings, "contextWindowTokens" | "contextReservedOutputTokens" | "contextServerCompactThresholdTokens" | "contextCompactSoftFraction" | "contextCompactionThresholdRatio">): number;
+declare function settingsWithResolvedModelContext(settings: Settings, model: Pick<ConfiguredModel, "contextWindowTokens" | "effectiveContextWindowTokens" | "autoCompactTokenLimit">): Settings;
 declare function configuredStaticUsageLimits(settings: Settings): StaticUsageLimitsConfig;
 declare function configuredEntitlements(settings: Settings): EntitlementsConfig;
 declare function calculateModelUsageCostMicros(settings: Settings, model: string, usage: ModelUsageInput): number;
@@ -609,20 +617,22 @@ declare function collectGitIdentityEnvironment(settings: Settings): Record<strin
  * workspace environment < the backend-aware HOME default. Reserved-name validation
  * at write time keeps workspace values from colliding with platform entries.
  *
- * DELIBERATELY EXCLUDES the per-run, ROTATING GitHub App installation token
- * VALUE that `sandboxEnvironmentForRun` mints when a repository resource is
+ * DELIBERATELY EXCLUDES the per-run, ROTATING git provider token VALUES that
+ * `sandboxEnvironmentForRun` mints when a repository resource is
  * attached: that token is minted FRESH per call, so it is not a stable, attach-
  * reproducible value and must not be part of the shared base. Under the token-
- * broker (B1) the token VALUE never rides the manifest at all — it is seeded to a
- * FILE inside the box (agent-managed, refreshable mid-turn via the `github_token`
- * MCP tool) and git auth flows through GIT_ASKPASS -> that file. What IS stable and
- * lives here is the token FILE PATH (`OPENGENI_GIT_TOKEN_FILE`): a constant derived
- * from HOME, so it appears IDENTICALLY on BOTH the turn AND every attach manifest
- * (the SDK's per-turn provided-session env delta stays empty even as the token
- * rotates). The attach surfaces have only the `Session` (no repo resources) and so
- * never seed a token, but the file-path pointer is harmless (an unwritten file
- * simply yields no auth); the BLOCKING attach-vs-turn error this helper fixes is
- * for the common (no-repo) and workspace-environment-attached cases.
+ * broker (B1) token VALUES never ride the manifest at all — they are seeded to
+ * FILES inside the box and git/provider CLI auth reads those files. What IS stable
+ * and lives here for provisioned boxes are the token directory / GitHub alias
+ * FILE PATH and wrapper PATH entries: constants derived from HOME, so they
+ * appear IDENTICALLY on BOTH the turn AND every attach manifest (the SDK's
+ * per-turn provided-session env delta stays empty even as tokens rotate). These
+ * helper pointers are deliberately not added for selfhosted/local/none because
+ * the platform never mints or seeds git provider tokens there. The attach
+ * surfaces have only the `Session` (no repo resources) and so never seed a token,
+ * but unwritten files simply yield no auth; the BLOCKING attach-vs-turn error
+ * this helper fixes is for the common (no-repo) and workspace-environment-attached
+ * provisioned-box cases.
  */
 declare function stableSandboxEnvironmentForRun(settings: Settings, workspaceEnvironment?: Record<string, string>, options?: {
     workspaceId?: string;
@@ -636,6 +646,15 @@ declare function stableSandboxEnvironmentForRun(settings: Settings, workspaceEnv
  */
 declare function hasGitHubRepositorySelection(resources: ReadonlyArray<{
     kind: string;
+    provider?: unknown;
+    installationId?: unknown;
+    repositoryId?: unknown;
+    githubInstallationId?: unknown;
+    githubRepositoryId?: unknown;
+}>): boolean;
+declare function hasGitCredentialRepositorySelection(resources: ReadonlyArray<{
+    kind: string;
+    provider?: unknown;
     githubInstallationId?: unknown;
     githubRepositoryId?: unknown;
 }>): boolean;
@@ -777,4 +796,4 @@ interface NatsControlPlaneAuth {
 }
 declare function resolveNatsControlPlaneAuth(settings: Settings): NatsControlPlaneAuth | null;
 
-export { AGENT_INSTRUCTIONS_CORE_PLACEHOLDER, type ConfiguredModel, type ContextCompactionMode, DEFAULT_AGENT_INSTRUCTIONS, type EntitlementsConfig, type IntegrationOAuthClientConfig, IntegrationOAuthClientConfigSchema, type McpServerConfig, type McpServerConnectionRef, McpServerConnectionRefSchema, type ModelPricing, ModelProviderApi, type ModelUsageInput, type NatsCalloutConfig, type NatsControlPlaneAuth, type RegistryProvider, RegistryProviderKind, type ResolvedModelProvider, SANDBOX_REQUIRED_ENV, type SandboxRequiredEnv, type Settings, type StartupRetryOptions, type StaticUsageLimitsConfig, applyGitAuthPointerEnvironment, calculateModelUsageCostMicros, collectGitIdentityEnvironment, collectSandboxEnvironment, configuredAllowedModels, configuredAllowedReasoningEfforts, configuredEntitlements, configuredModelPricing, configuredModels, configuredProviders, configuredStaticUsageLimits, contextInputBudgetTokens, contextServerCompactThreshold, dbSearchPath, defaultModelPricing, effectiveModalIdleTimeoutSeconds, environmentsEncryptionKeyBytes, firstPartyMcpBaseUrl, firstPartyMcpWorkspaceUrl, getSettings, hasGitHubRepositorySelection, parseExposedPorts, parseIntegrationsOauthClientsJson, parseMcpServers, parseModelPricingJson, parseModelProvidersJson, parseSandboxWarmRateJson, parseStaticEntitlementsJson, parseStaticUsageLimitsJson, requiredSandboxEnvForBackend, resolveContextCompactionMode, resolveEnrollmentSigningSecret, resolveModelProvider, resolveNatsCalloutConfig, resolveNatsControlPlaneAuth, resolveProviderApiKey, resolveRelayTokenSecret, resolveStreamTokenSecret, retryStartupDependency, sandboxEnvironmentVariableNames, sandboxLifecycleHookIds, sandboxPreparationProfiles, sandboxWarmRateMicrosPerSecond, stableSandboxEnvironmentForRun, startupRetryOptions, streamTokenDegraded };
+export { AGENT_INSTRUCTIONS_CORE_PLACEHOLDER, type ConfiguredModel, DEFAULT_AGENT_INSTRUCTIONS, type EntitlementsConfig, type IntegrationOAuthClientConfig, IntegrationOAuthClientConfigSchema, type McpServerConfig, type McpServerConnectionRef, McpServerConnectionRefSchema, type ModelPricing, ModelProviderApi, type ModelUsageInput, type NatsCalloutConfig, type NatsControlPlaneAuth, type RegistryProvider, RegistryProviderKind, type ResolvedModelProvider, SANDBOX_REQUIRED_ENV, type SandboxRequiredEnv, type Settings, type StartupRetryOptions, type StaticUsageLimitsConfig, applyGitAuthPointerEnvironment, builtinProviderId, calculateModelUsageCostMicros, collectGitIdentityEnvironment, collectSandboxEnvironment, configuredAllowedModels, configuredAllowedReasoningEfforts, configuredEntitlements, configuredModelPricing, configuredModels, configuredProviders, configuredStaticUsageLimits, contextInputBudgetTokens, dbSearchPath, defaultModelPricing, effectiveModalIdleTimeoutSeconds, environmentsEncryptionKeyBytes, firstPartyMcpBaseUrl, firstPartyMcpWorkspaceUrl, getSettings, hasGitCredentialRepositorySelection, hasGitHubRepositorySelection, parseExposedPorts, parseIntegrationsOauthClientsJson, parseMcpServers, parseModelPricingJson, parseModelProvidersJson, parseSandboxWarmRateJson, parseStaticEntitlementsJson, parseStaticUsageLimitsJson, policyProviderIdForModel, requiredSandboxEnvForBackend, resolveEnrollmentSigningSecret, resolveModelProvider, resolveNatsCalloutConfig, resolveNatsControlPlaneAuth, resolveProviderApiKey, resolveRelayTokenSecret, resolveStreamTokenSecret, retryStartupDependency, sandboxEnvironmentVariableNames, sandboxLifecycleHookIds, sandboxPreparationProfiles, sandboxWarmRateMicrosPerSecond, settingsWithResolvedModelContext, stableSandboxEnvironmentForRun, startupRetryOptions, streamTokenDegraded };