@opengeni/config 0.7.10 → 0.7.13

package/dist/index.d.ts

@@ -116,7 +116,6 @@ declare const SettingsSchema: z.ZodObject<{
     delegationSecret: z.ZodOptional<z.ZodString>;
     streamTokenSecret: z.ZodOptional<z.ZodString>;
     streamControlEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
-    sessionTurnToolReplacementEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
     toolspaceEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
     toolspaceMaxCallsPerTurn: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     ogtoolPackageSpec: z.ZodOptional<z.ZodString>;
@@ -207,6 +206,7 @@ declare const SettingsSchema: z.ZodObject<{
     dockerImage: z.ZodDefault<z.ZodString>;
     dockerExposedPorts: z.ZodDefault<z.ZodString>;
     dockerNetwork: z.ZodOptional<z.ZodString>;
+    dockerWorkspaceBaseDir: z.ZodOptional<z.ZodString>;
     modalAppName: z.ZodDefault<z.ZodString>;
     modalImageRef: z.ZodOptional<z.ZodString>;
     modalImageRegistrySecret: z.ZodOptional<z.ZodString>;

package/dist/index.js

@@ -200,9 +200,6 @@ var SettingsSchema = z.object({
   // holder of stream:control gets 403 until this flips. Keeps stream:control a
   // declared-but-inert permission so later hardening is a flag flip.
   streamControlEnabled: EnvBoolean.default(false),
-  // Existing-session explicit tool replacement is gated until every API and
-  // worker instance understands durable tools_provided provenance.
-  sessionTurnToolReplacementEnabled: EnvBoolean.default(false),
   toolspaceEnabled: EnvBoolean.default(false),
   toolspaceMaxCallsPerTurn: z.coerce.number().int().positive().default(200),
   // Optional release-coherent bootstrap hint for custom rigs/connected machines
@@ -362,6 +359,11 @@ var SettingsSchema = z.object({
   dockerImage: z.string().default("opengeni-sandbox:local"),
   dockerExposedPorts: z.string().default(""),
   dockerNetwork: z.string().optional(),
+  // When the worker itself runs in a container and talks to a host Docker daemon,
+  // this directory must be bind-mounted at the exact same absolute path on both
+  // sides. The Agents SDK materializes the workspace here before bind-mounting it
+  // into the sandbox container.
+  dockerWorkspaceBaseDir: z.string().min(1).optional(),
   modalAppName: z.string().default("opengeni-sandbox"),
   modalImageRef: z.string().optional(),
   // Name of a Modal Secret (containing REGISTRY_USERNAME + REGISTRY_PASSWORD) used
@@ -1114,7 +1116,6 @@ function getSettings() {
     delegationSecret: optional("OPENGENI_DELEGATION_SECRET"),
     streamTokenSecret: optional("OPENGENI_STREAM_TOKEN_SECRET"),
     streamControlEnabled: optional("OPENGENI_STREAM_CONTROL_ENABLED"),
-    sessionTurnToolReplacementEnabled: optional("OPENGENI_SESSION_TURN_TOOL_REPLACEMENT_ENABLED"),
     toolspaceEnabled: optional("OPENGENI_TOOLSPACE_ENABLED"),
     toolspaceMaxCallsPerTurn: optional("OPENGENI_TOOLSPACE_MAX_CALLS_PER_TURN"),
     ogtoolPackageSpec: optional("OPENGENI_OGTOOL_PACKAGE_SPEC"),
@@ -1178,6 +1179,7 @@ function getSettings() {
     dockerImage: optional("OPENGENI_DOCKER_IMAGE"),
     dockerExposedPorts: optional("OPENGENI_DOCKER_EXPOSED_PORTS"),
     dockerNetwork: optional("OPENGENI_DOCKER_NETWORK"),
+    dockerWorkspaceBaseDir: optional("OPENGENI_DOCKER_WORKSPACE_BASE_DIR"),
     modalAppName: optional("OPENGENI_MODAL_APP_NAME"),
     modalImageRef: optional("OPENGENI_MODAL_IMAGE_REF"),
     modalImageRegistrySecret: optional("OPENGENI_MODAL_IMAGE_REGISTRY_SECRET"),
@@ -2133,7 +2135,7 @@ function stableSandboxEnvironmentForRun(settings, workspaceEnvironment = {}, opt
     ...workspaceEnvironment
   };
   const descriptor = CAPABILITY_DESCRIPTORS[settings.sandboxBackend];
-  if (settings.sandboxBackend !== "none" && settings.sandboxBackend !== "local") {
+  if (settings.sandboxBackend !== "none" && settings.sandboxBackend !== "local" && settings.sandboxBackend !== "selfhosted") {
     environment.HOME ??= descriptor.workspaceRoot;
   }
   const provisionedGitHelperBackend = settings.sandboxBackend !== "none" && settings.sandboxBackend !== "local" && settings.sandboxBackend !== "selfhosted";
@@ -2145,7 +2147,7 @@ function stableSandboxEnvironmentForRun(settings, workspaceEnvironment = {}, opt
     environment.PATH = prependPathEntry(environment.PATH, environment.OPENGENI_GIT_CLI_WRAPPER_DIR);
   }
   if (settings.toolspaceEnabled) {
-    environment.OPENGENI_TOOLSPACE_TOKEN_FILE ??= `${environment.HOME ?? descriptor.workspaceRoot}/.opengeni/toolspace-token`;
+    environment.OPENGENI_TOOLSPACE_TOKEN_FILE ??= settings.sandboxBackend === "selfhosted" ? "$HOME/.opengeni/toolspace-token" : `${environment.HOME ?? descriptor.workspaceRoot}/.opengeni/toolspace-token`;
     if (settings.ogtoolPackageSpec) {
       environment.OPENGENI_OGTOOL_PACKAGE_SPEC ??= settings.ogtoolPackageSpec;
     }
@@ -2445,6 +2447,7 @@ function positiveInt(value) {
 function ensureBuiltInMcpServers(settings) {
   const existing = settings.mcpServers.filter((server) => server.id !== "opengeni");
   const firstPartyMcpUrl = firstPartyMcpServerUrl(settings);
+  const firstPartyFilesMcpUrl = firstPartyFilesMcpServerUrl(firstPartyMcpUrl);
   const firstPartyDocsMcpUrl = firstPartyDocumentsMcpServerUrl(firstPartyMcpUrl);
   const hasFiles = existing.some((server) => server.id === "files");
   const hasDocs = existing.some((server) => server.id === "docs");
@@ -2470,7 +2473,7 @@ function ensureBuiltInMcpServers(settings) {
       {
         id: "files",
         name: "Files",
-        url: firstPartyMcpUrl,
+        url: firstPartyFilesMcpUrl,
         allowedTools: ["files_get_download_url"],
         cacheToolsList: true
       }
@@ -2515,6 +2518,9 @@ function firstPartyMcpServerUrl(settings) {
 function firstPartyDocumentsMcpServerUrl(mcpUrl) {
   return `${mcpUrl.replace(/\/+$/, "")}/docs`;
 }
+function firstPartyFilesMcpServerUrl(mcpUrl) {
+  return `${mcpUrl.replace(/\/+$/, "")}/files`;
+}
 function validateSettings(settings) {
   temporalConnectionOptions(settings);
   if (settings.toolspaceEnabled && !settings.delegationSecret) {