@opengeni/config 0.7.13 → 0.7.22

package/dist/index.js

@@ -4,6 +4,7 @@ import {
   CAPABILITY_DESCRIPTORS,
   Entitlements,
   EntitlementsMode,
+  LatencyMode,
   MAX_NESTED_AGENT_DEPTH,
   ProductAccessMode,
   ReasoningEffort,
@@ -175,6 +176,9 @@ var SettingsSchema = z.object({
   observabilityOtlpEndpoint: z.string().url().optional(),
   observabilityOtlpHeaders: z.string().default(""),
   publicBaseUrl: z.string().url().optional(),
+  // Browser origin when the web app and API use separate origins in local
+  // development. Production normally leaves this unset and uses publicBaseUrl.
+  webBaseUrl: z.string().url().optional(),
   // Base URL for the bring-your-own-compute agent release assets the get.<domain>
   // install routes redirect to. Defaults to this repo's GitHub Releases. The route
   // appends `/download/agent-v<ver>/<asset>`.
@@ -213,6 +217,8 @@ var SettingsSchema = z.object({
   integrationsOauthClientsJson: z.string().default("{}"),
   slackClientId: z.string().optional(),
   slackClientSecret: z.string().optional(),
+  googleDriveClientId: z.string().optional(),
+  googleDriveClientSecret: z.string().optional(),
   // Undefined is meaningful: the migration boundary persists the product
   // default of 3 when no deployment override is supplied.
   maxNestedAgentDepth: z.coerce.number().int().nonnegative().max(MAX_NESTED_AGENT_DEPTH).optional(),
@@ -273,6 +279,36 @@ var SettingsSchema = z.object({
   openaiBaseUrl: z.string().optional(),
   openaiModel: z.string().default("gpt-5.6-sol"),
   openaiAllowedModels: z.string().default("gpt-5.6-sol,gpt-5.6-terra,gpt-5.6-luna"),
+  // Native composer voice input (browser MediaRecorder → API transcription).
+  // Provider credentials stay server-side; ClientConfig only projects availability
+  // and hard ceilings. Selection happens once before audio is sent — never retry
+  // the same clip across vendors after an upstream request may have started.
+  voiceInputMaxDurationSeconds: z.coerce.number().int().positive().max(600).default(60),
+  voiceInputMaxSizeBytes: z.coerce.number().int().positive().max(100 * 1024 * 1024).default(25 * 1024 * 1024),
+  // Preferred provider order (comma-separated ids). First configured+ready wins.
+  // Codex subscription STT is preferred by default when subscription routing is
+  // enabled; operators can put openai/azure-openai first explicitly.
+  // Supported: openai, azure-openai, codex-subscription.
+  voiceInputProviderOrder: z.string().default("codex-subscription,openai,azure-openai"),
+  // OpenAI public /v1/audio/transcriptions path. Reuses OPENGENI_OPENAI_API_KEY
+  // when voiceInputOpenaiApiKey is unset. Default model is gpt-transcribe.
+  voiceInputOpenaiEnabled: EnvBoolean.default(true),
+  voiceInputOpenaiApiKey: z.string().optional(),
+  voiceInputOpenaiBaseUrl: z.string().optional(),
+  voiceInputOpenaiModel: z.string().default("gpt-transcribe"),
+  // Azure OpenAI deployment-scoped audio transcriptions. Reuses the turn-model
+  // Azure endpoint/key/AD token when voice-specific overrides are unset.
+  voiceInputAzureEnabled: EnvBoolean.default(true),
+  voiceInputAzureEndpoint: z.string().optional(),
+  voiceInputAzureDeployment: z.string().optional(),
+  voiceInputAzureApiVersion: z.string().optional(),
+  voiceInputAzureApiKey: z.string().optional(),
+  voiceInputAzureAdToken: z.string().optional(),
+  // Legacy opt-in for undocumented ChatGPT /backend-api/transcribe. When
+  // OPENGENI_CODEX_SUBSCRIPTION_ENABLED is true, Codex STT is included without
+  // this flag. Set false and omit codex-subscription from PROVIDER_ORDER to
+  // keep subscription model routing while disabling Codex voice input.
+  voiceInputCodexExperimentalEnabled: EnvBoolean.default(false),
   modelPricingJson: z.string().default("{}"),
   // Extra (non-built-in) model providers, declared by the host as a JSON
   // provider registry. Each entry carries its own base URL, API key, wire API
@@ -375,17 +411,17 @@ var SettingsSchema = z.object({
   // the named Secret and builds the image via `fromRegistry(tag, secret)` before the
   // first sandbox is created. Knob: OPENGENI_MODAL_IMAGE_REGISTRY_SECRET.
   modalImageRegistrySecret: z.string().optional(),
-  // Modal's hard sandbox lifetime (timeoutMs = this * 1000), counted from each
-  // create/resume — it is the BACKSTOP that reclaims a box if the reaper/worker is
-  // down, NOT the warm-window controller (that's sandboxIdleGraceMs). It must
-  // comfortably exceed reaperPeriod + idleGrace so the reaper terminates a
-  // genuinely-idle box FIRST; the boot invariant below enforces that. Default 1h
-  // (was 900s/15min): the 15-min drain grace counts from the user's LAST release,
-  // but Modal's clock starts at the preceding turn's resume — so a 15-min grace on
-  // top of a 900s lifetime would let Modal kill the box mid-warm-window. 3600s
-  // leaves ~45min of headroom for the active turn before the warm window opens.
+  // Modal's hard sandbox lifetime (timeoutMs = this * 1000), counted from box
+  // creation. A resume-by-id does NOT reset that provider clock. It is the
+  // BACKSTOP that reclaims a box if the reaper/worker is down, NOT the warm-window
+  // controller (that's sandboxIdleGraceMs). It must comfortably exceed
+  // reaperPeriod + idleGrace so the reaper terminates a genuinely-idle box FIRST;
+  // the boot invariant below enforces that. Default 24h, Modal's documented
+  // maximum, to reduce premature active-box loss and leave headroom for the
+  // deadline-aware snapshot/rematerialization transition. The transition—not a
+  // larger timeout—is what lets a session outlive one finite provider box.
   // Knob: OPENGENI_MODAL_TIMEOUT_SECONDS.
-  modalTimeoutSeconds: z.coerce.number().int().positive().default(3600),
+  modalTimeoutSeconds: z.coerce.number().int().positive().max(86400).default(86400),
   modalTokenId: z.string().optional(),
   modalTokenSecret: z.string().optional(),
   modalEnvironment: z.string().optional(),
@@ -416,13 +452,6 @@ var SettingsSchema = z.object({
   // OPENGENI_MODAL_WORKSPACE_PERSISTENCE=tar to opt back out (no native snapshot;
   // the reaper persists a tar archive — same store+hydrate plumbing, slower).
   modalWorkspacePersistence: z.enum(["tar", "snapshot_filesystem", "snapshot_directory"]).default("snapshot_filesystem"),
-  // Snapshot GC backstop (sandbox-file-persistence): the reaper keeps ONE latest
-  // filesystem snapshot per lease (delete-prior-on-supersede + delete-on-teardown).
-  // This is the TTL retention floor for the periodic orphan sweep — a snapshot
-  // whose lease is cold and older than this is best-effort deleted so a crashed
-  // persist-then-no-restore never leaks a Modal image. 0 disables the TTL sweep
-  // (delete-on-supersede/teardown still run). Default 7 days.
-  modalSnapshotRetentionSeconds: z.coerce.number().int().nonnegative().default(604800),
   // Shared desktop toggle: this module reads it for the 6080 port-merge; the
   // owner module (P4.x) acts on it to launch the display stack.
   sandboxDesktopEnabled: EnvBoolean.default(false),
@@ -644,8 +673,9 @@ var SettingsSchema = z.object({
   // this whole window so a "glanced away then came back" re-arms the SAME warm box
   // (acquireLease re-arms draining->warm; the reaper's BEFORE-terminate re-read
   // skips a re-armed box). Default 15min so a brief detour never cold-creates a
-  // fresh EMPTY box; lower it to trade warm cost for a snappier reclaim. Knob:
-  // OPENGENI_SANDBOX_IDLE_GRACE_MS.
+  // fresh EMPTY box; lower it to trade warm cost for a snappier reclaim.
+  // getSettings caps the default at half a shorter configured Modal lifetime so
+  // the entire reaper window always fits. Knob: OPENGENI_SANDBOX_IDLE_GRACE_MS.
   sandboxIdleGraceMs: z.coerce.number().int().positive().default(9e5),
   // MID-SESSION /workspace snapshot cadence (sandbox-file-persistence). The
   // reaper's drain-persist only protects boxes the reaper itself kills; a box
@@ -663,6 +693,22 @@ var SettingsSchema = z.object({
   // treated exactly like a failed best-effort snapshot. Knob:
   // OPENGENI_SANDBOX_SNAPSHOT_TIMEOUT_MS. Default 60s.
   sandboxSnapshotTimeoutMs: z.coerce.number().int().positive().default(6e4),
+  // Begin a controlled snapshot/quiesce/drain/rematerialize transition this far
+  // ahead of a finite provider deadline. Modal's 24h creation clock cannot be
+  // extended; the logical sandbox outlives it by moving to one successor box.
+  // getSettings derives the actual default as min(1h, half the configured
+  // provider lifetime) so short-lived test/canary boxes remain bootable without
+  // an extra coupled environment override. An explicit value may be larger when
+  // an operator deliberately wants more rotation headroom; the boot invariant
+  // still requires it to remain below the provider lifetime.
+  sandboxRotationLeadMs: z.coerce.number().int().positive().default(36e5),
+  // Bound each global reaper pass so a rollout that discovers many legacy boxes
+  // with unknown creation clocks cannot create a provider/API thundering herd.
+  // One is the safe admission default: the reaper services provider transitions
+  // sequentially, so claiming a wider batch would fence boxes before the same
+  // sweep can service them. Larger fleets may raise this only as an explicit,
+  // observed deployment choice.
+  sandboxRotationBatchSize: z.coerce.number().int().positive().max(500).default(1),
   // expires_at refresh window for a held lease (>> the turn 10s heartbeat so a
   // single missed heartbeat never TTL-reaps a live turn). The warming TTL is the
   // window a cold->warming spawner has to commit warm before a reaper resets it.
@@ -691,6 +737,7 @@ var SettingsSchema = z.object({
   sandboxPreparationProfiles: z.string().default("none"),
   sandboxEnvAllowlist: z.string().default(""),
   objectStorageEndpoint: z.string().url().optional(),
+  objectStorageInternalEndpoint: z.string().url().optional(),
   objectStorageSandboxEndpoint: z.string().url().optional(),
   objectStorageBackend: z.enum(["s3-compatible", "aws-s3", "azure-blob", "gcs"]).default("s3-compatible"),
   objectStorageBucket: z.string().min(1).default("opengeni-files"),
@@ -762,6 +809,77 @@ var SettingsSchema = z.object({
     })
   ).default([])
 });
+function isUsableVoiceInputSecret(value) {
+  if (value == null) return false;
+  const trimmed = value.trim();
+  if (!trimmed) return false;
+  const normalized = trimmed.toLowerCase();
+  if (normalized === "your-key" || normalized === "your_key" || normalized === "changeme" || normalized === "replace-me" || normalized === "xxx" || normalized.startsWith("your-") || normalized.startsWith("your_")) {
+    return false;
+  }
+  return true;
+}
+function resolveVoiceInputProviderRegistry(settings) {
+  const order = settings.voiceInputProviderOrder.split(",").map((part) => part.trim()).filter(
+    (part) => part === "openai" || part === "azure-openai" || part === "codex-subscription"
+  );
+  const seen = /* @__PURE__ */ new Set();
+  const providers = [];
+  for (const id of order) {
+    if (seen.has(id)) continue;
+    seen.add(id);
+    if (id === "openai") {
+      if (!settings.voiceInputOpenaiEnabled) continue;
+      const apiKey = settings.voiceInputOpenaiApiKey ?? settings.openaiApiKey;
+      if (!isUsableVoiceInputSecret(apiKey)) continue;
+      if (settings.openaiProvider === "azure" && !settings.voiceInputOpenaiApiKey && !settings.voiceInputOpenaiBaseUrl) {
+        continue;
+      }
+      providers.push({
+        id: "openai",
+        kind: "openai",
+        apiKey,
+        baseUrl: (settings.voiceInputOpenaiBaseUrl ?? settings.openaiBaseUrl ?? "https://api.openai.com/v1").replace(/\/+$/, ""),
+        model: settings.voiceInputOpenaiModel
+      });
+      continue;
+    }
+    if (id === "azure-openai") {
+      if (!settings.voiceInputAzureEnabled) continue;
+      const endpoint = (settings.voiceInputAzureEndpoint ?? settings.azureOpenaiEndpoint ?? "").replace(/\/+$/, "");
+      const deployment = settings.voiceInputAzureDeployment ?? settings.azureOpenaiDeployment ?? "";
+      const apiVersion = settings.voiceInputAzureApiVersion ?? settings.azureOpenaiApiVersion ?? "2025-04-01-preview";
+      const apiKey = settings.voiceInputAzureApiKey ?? settings.azureOpenaiApiKey ?? null;
+      const adToken = settings.voiceInputAzureAdToken ?? settings.azureOpenaiAdToken ?? null;
+      if (!endpoint || !deployment || !isUsableVoiceInputSecret(apiKey) && !isUsableVoiceInputSecret(adToken)) {
+        continue;
+      }
+      if (settings.openaiProvider !== "azure" && !settings.voiceInputAzureEndpoint && !settings.voiceInputAzureDeployment && !settings.voiceInputAzureApiKey && !settings.voiceInputAzureAdToken) {
+        continue;
+      }
+      providers.push({
+        id: "azure-openai",
+        kind: "azure-openai",
+        endpoint,
+        deployment,
+        apiVersion,
+        apiKey: isUsableVoiceInputSecret(apiKey) ? apiKey : null,
+        adToken: isUsableVoiceInputSecret(adToken) ? adToken : null
+      });
+      continue;
+    }
+    if (id === "codex-subscription") {
+      if (!settings.codexSubscriptionEnabled) continue;
+      providers.push({ id: "codex-subscription", kind: "codex-subscription", experimental: true });
+    }
+  }
+  return providers;
+}
+function voiceInputDeploymentConfigured(settings) {
+  return resolveVoiceInputProviderRegistry(settings).some(
+    (provider) => provider.kind !== "codex-subscription"
+  );
+}
 var ModelPricingSchema = z.object({
   inputMicrosPerMillionTokens: z.number().int().nonnegative(),
   cachedInputMicrosPerMillionTokens: z.number().int().nonnegative().optional(),
@@ -955,86 +1073,74 @@ var IntegrationOAuthClientConfigSchema = z.object({
 });
 var defaultModelPricing = {
   "gpt-5.6-sol": {
-    inputMicrosPerMillionTokens: 5e6,
-    cachedInputMicrosPerMillionTokens: 5e5,
-    outputMicrosPerMillionTokens: 3e7,
-    marginBps: 2500
+    default: {
+      inputMicrosPerMillionTokens: 5e6,
+      cachedInputMicrosPerMillionTokens: 5e5,
+      outputMicrosPerMillionTokens: 3e7,
+      marginBps: 2500
+    },
+    inputTokenTiers: [
+      {
+        // OpenAI: prompts with >272K input tokens use the long-context rate.
+        minimumInputTokens: 272001,
+        pricing: {
+          inputMicrosPerMillionTokens: 1e7,
+          cachedInputMicrosPerMillionTokens: 1e6,
+          outputMicrosPerMillionTokens: 45e6,
+          marginBps: 2500
+        }
+      }
+    ]
   },
   "gpt-5.6-terra": {
-    inputMicrosPerMillionTokens: 25e5,
-    cachedInputMicrosPerMillionTokens: 25e4,
-    outputMicrosPerMillionTokens: 15e6,
-    marginBps: 2500
+    default: {
+      inputMicrosPerMillionTokens: 2e6,
+      cachedInputMicrosPerMillionTokens: 2e5,
+      outputMicrosPerMillionTokens: 12e6,
+      marginBps: 2500
+    },
+    inputTokenTiers: [
+      {
+        minimumInputTokens: 272001,
+        pricing: {
+          inputMicrosPerMillionTokens: 4e6,
+          cachedInputMicrosPerMillionTokens: 4e5,
+          outputMicrosPerMillionTokens: 18e6,
+          marginBps: 2500
+        }
+      }
+    ]
   },
   "gpt-5.6-luna": {
-    inputMicrosPerMillionTokens: 1e6,
-    cachedInputMicrosPerMillionTokens: 1e5,
-    outputMicrosPerMillionTokens: 6e6,
-    marginBps: 2500
-  },
-  "gpt-5.4": {
-    inputMicrosPerMillionTokens: 25e5,
-    cachedInputMicrosPerMillionTokens: 25e4,
-    outputMicrosPerMillionTokens: 15e6,
-    marginBps: 2500
-  },
-  "gpt-5.4-mini": {
-    inputMicrosPerMillionTokens: 75e4,
-    cachedInputMicrosPerMillionTokens: 75e3,
-    outputMicrosPerMillionTokens: 45e5,
-    marginBps: 2500
-  },
-  "gpt-5.2": {
-    inputMicrosPerMillionTokens: 175e4,
-    cachedInputMicrosPerMillionTokens: 175e3,
-    outputMicrosPerMillionTokens: 14e6,
-    marginBps: 2500
-  },
-  "gpt-5.2-chat-latest": {
-    inputMicrosPerMillionTokens: 175e4,
-    cachedInputMicrosPerMillionTokens: 175e3,
-    outputMicrosPerMillionTokens: 14e6,
-    marginBps: 2500
-  },
-  "gpt-5.2-codex": {
-    inputMicrosPerMillionTokens: 175e4,
-    cachedInputMicrosPerMillionTokens: 175e3,
-    outputMicrosPerMillionTokens: 14e6,
-    marginBps: 2500
-  },
-  "gpt-5.1": {
-    inputMicrosPerMillionTokens: 125e4,
-    cachedInputMicrosPerMillionTokens: 125e3,
-    outputMicrosPerMillionTokens: 1e7,
-    marginBps: 2500
-  },
-  "gpt-5": {
-    inputMicrosPerMillionTokens: 125e4,
-    cachedInputMicrosPerMillionTokens: 125e3,
-    outputMicrosPerMillionTokens: 1e7,
-    marginBps: 2500
-  },
-  "gpt-5-mini": {
-    inputMicrosPerMillionTokens: 25e4,
-    cachedInputMicrosPerMillionTokens: 25e3,
-    outputMicrosPerMillionTokens: 2e6,
-    marginBps: 2500
-  },
-  "gpt-5-nano": {
-    inputMicrosPerMillionTokens: 5e4,
-    cachedInputMicrosPerMillionTokens: 5e3,
-    outputMicrosPerMillionTokens: 4e5,
-    marginBps: 2500
+    default: {
+      inputMicrosPerMillionTokens: 2e5,
+      cachedInputMicrosPerMillionTokens: 2e4,
+      outputMicrosPerMillionTokens: 12e5,
+      marginBps: 2500
+    },
+    inputTokenTiers: [
+      {
+        minimumInputTokens: 272001,
+        pricing: {
+          inputMicrosPerMillionTokens: 4e5,
+          cachedInputMicrosPerMillionTokens: 4e4,
+          outputMicrosPerMillionTokens: 18e5,
+          marginBps: 2500
+        }
+      }
+    ]
   },
   // Fireworks AI / GLM 5.2 — the first shipped non-OpenAI registry model. A
   // built-in default pricing entry makes managed billing work out of the box
   // for hosts that expose this model via OPENGENI_MODEL_PROVIDERS_JSON without
   // also setting OPENGENI_MODEL_PRICING_JSON.
   "accounts/fireworks/models/glm-5p2": {
-    inputMicrosPerMillionTokens: 14e5,
-    cachedInputMicrosPerMillionTokens: 26e4,
-    outputMicrosPerMillionTokens: 44e5,
-    marginBps: 2500
+    default: {
+      inputMicrosPerMillionTokens: 14e5,
+      cachedInputMicrosPerMillionTokens: 14e4,
+      outputMicrosPerMillionTokens: 44e5,
+      marginBps: 2500
+    }
   }
 };
 var SANDBOX_REQUIRED_ENV = {
@@ -1105,6 +1211,7 @@ function getSettings() {
     observabilityOtlpEndpoint: optional("OPENGENI_OTEL_EXPORTER_OTLP_ENDPOINT") ?? optional("OTEL_EXPORTER_OTLP_ENDPOINT"),
     observabilityOtlpHeaders: optional("OPENGENI_OTEL_EXPORTER_OTLP_HEADERS") ?? optional("OTEL_EXPORTER_OTLP_HEADERS"),
     publicBaseUrl: optional("OPENGENI_PUBLIC_BASE_URL"),
+    webBaseUrl: optional("OPENGENI_WEB_BASE_URL"),
     agentReleasesBaseUrl: optional("OPENGENI_AGENT_RELEASES_BASE_URL"),
     agentStableVersion: optional("OPENGENI_AGENT_STABLE_VERSION"),
     productAccessMode: optional("OPENGENI_PRODUCT_ACCESS_MODE"),
@@ -1128,6 +1235,8 @@ function getSettings() {
     integrationsOauthClientsJson: optional("OPENGENI_INTEGRATIONS_OAUTH_CLIENTS_JSON"),
     slackClientId: optional("OPENGENI_SLACK_CLIENT_ID"),
     slackClientSecret: optional("OPENGENI_SLACK_CLIENT_SECRET"),
+    googleDriveClientId: optional("OPENGENI_GOOGLE_DRIVE_CLIENT_ID"),
+    googleDriveClientSecret: optional("OPENGENI_GOOGLE_DRIVE_CLIENT_SECRET"),
     maxNestedAgentDepth: optional("OPENGENI_MAX_NESTED_AGENT_DEPTH"),
     goalMaxAutoContinuations: optional("OPENGENI_GOAL_MAX_AUTO_CONTINUATIONS"),
     goalNoProgressLimit: optional("OPENGENI_GOAL_NO_PROGRESS_LIMIT"),
@@ -1152,6 +1261,20 @@ function getSettings() {
     openaiBaseUrl: optional("OPENGENI_OPENAI_BASE_URL") ?? optional("OPENAI_BASE_URL"),
     openaiModel: optional("OPENGENI_OPENAI_MODEL"),
     openaiAllowedModels: optional("OPENGENI_OPENAI_ALLOWED_MODELS"),
+    voiceInputMaxDurationSeconds: optional("OPENGENI_VOICE_INPUT_MAX_DURATION_SECONDS"),
+    voiceInputMaxSizeBytes: optional("OPENGENI_VOICE_INPUT_MAX_SIZE_BYTES"),
+    voiceInputProviderOrder: optional("OPENGENI_VOICE_INPUT_PROVIDER_ORDER"),
+    voiceInputOpenaiEnabled: optional("OPENGENI_VOICE_INPUT_OPENAI_ENABLED"),
+    voiceInputOpenaiApiKey: optional("OPENGENI_VOICE_INPUT_OPENAI_API_KEY"),
+    voiceInputOpenaiBaseUrl: optional("OPENGENI_VOICE_INPUT_OPENAI_BASE_URL"),
+    voiceInputOpenaiModel: optional("OPENGENI_VOICE_INPUT_OPENAI_MODEL"),
+    voiceInputAzureEnabled: optional("OPENGENI_VOICE_INPUT_AZURE_ENABLED"),
+    voiceInputAzureEndpoint: optional("OPENGENI_VOICE_INPUT_AZURE_ENDPOINT"),
+    voiceInputAzureDeployment: optional("OPENGENI_VOICE_INPUT_AZURE_DEPLOYMENT"),
+    voiceInputAzureApiVersion: optional("OPENGENI_VOICE_INPUT_AZURE_API_VERSION"),
+    voiceInputAzureApiKey: optional("OPENGENI_VOICE_INPUT_AZURE_API_KEY"),
+    voiceInputAzureAdToken: optional("OPENGENI_VOICE_INPUT_AZURE_AD_TOKEN"),
+    voiceInputCodexExperimentalEnabled: optional("OPENGENI_VOICE_INPUT_CODEX_EXPERIMENTAL"),
     modelPricingJson: optional("OPENGENI_MODEL_PRICING_JSON"),
     modelProvidersJson: optional("OPENGENI_MODEL_PROVIDERS_JSON"),
     codexSubscriptionEnabled: optional("OPENGENI_CODEX_SUBSCRIPTION_ENABLED"),
@@ -1189,7 +1312,6 @@ function getSettings() {
     modalEnvironment: optional("OPENGENI_MODAL_ENVIRONMENT"),
     modalIdleTimeoutSeconds: optional("OPENGENI_MODAL_IDLE_TIMEOUT_SECONDS"),
     modalWorkspacePersistence: optional("OPENGENI_MODAL_WORKSPACE_PERSISTENCE"),
-    modalSnapshotRetentionSeconds: optional("OPENGENI_MODAL_SNAPSHOT_RETENTION_SECONDS"),
     sandboxDesktopEnabled: optional("OPENGENI_SANDBOX_DESKTOP_ENABLED"),
     sandboxDesktopInteractive: optional("OPENGENI_SANDBOX_DESKTOP_INTERACTIVE"),
     sandboxTerminalEnabled: optional("OPENGENI_SANDBOX_TERMINAL_ENABLED"),
@@ -1262,6 +1384,8 @@ function getSettings() {
     sandboxIdleGraceMs: optional("OPENGENI_SANDBOX_IDLE_GRACE_MS"),
     sandboxSnapshotIntervalMs: optional("OPENGENI_SANDBOX_SNAPSHOT_INTERVAL_MS"),
     sandboxSnapshotTimeoutMs: optional("OPENGENI_SANDBOX_SNAPSHOT_TIMEOUT_MS"),
+    sandboxRotationLeadMs: optional("OPENGENI_SANDBOX_ROTATION_LEAD_MS"),
+    sandboxRotationBatchSize: optional("OPENGENI_SANDBOX_ROTATION_BATCH_SIZE"),
     sandboxLeaseTtlMs: optional("OPENGENI_SANDBOX_LEASE_TTL_MS"),
     sandboxLeaseWarmingTtlMs: optional("OPENGENI_SANDBOX_LEASE_WARMING_TTL_MS"),
     sandboxWarmingTimeoutMs: optional("OPENGENI_SANDBOX_WARMING_TIMEOUT_MS"),
@@ -1273,6 +1397,7 @@ function getSettings() {
     sandboxPreparationProfiles: optional("OPENGENI_SANDBOX_PREPARATION_PROFILES"),
     sandboxEnvAllowlist: optional("OPENGENI_SANDBOX_ENV_ALLOWLIST"),
     objectStorageEndpoint: optional("OPENGENI_OBJECT_STORAGE_ENDPOINT"),
+    objectStorageInternalEndpoint: optional("OPENGENI_OBJECT_STORAGE_INTERNAL_ENDPOINT"),
     objectStorageSandboxEndpoint: optional("OPENGENI_OBJECT_STORAGE_SANDBOX_ENDPOINT"),
     objectStorageBackend: optional("OPENGENI_OBJECT_STORAGE_BACKEND"),
     objectStorageBucket: optional("OPENGENI_OBJECT_STORAGE_BUCKET"),
@@ -1328,6 +1453,8 @@ function getSettings() {
   const parsed = SettingsSchema.parse(raw);
   const settings = {
     ...parsed,
+    sandboxIdleGraceMs: raw.sandboxIdleGraceMs === void 0 ? Math.min(9e5, Math.floor(parsed.modalTimeoutSeconds * 1e3 / 2)) : parsed.sandboxIdleGraceMs,
+    sandboxRotationLeadMs: raw.sandboxRotationLeadMs === void 0 ? Math.min(36e5, Math.floor(parsed.modalTimeoutSeconds * 1e3 / 2)) : parsed.sandboxRotationLeadMs,
     mcpServers: ensureBuiltInMcpServers(parsed)
   };
   validateSettings(settings);
@@ -1336,6 +1463,12 @@ function getSettings() {
 function effectiveModalIdleTimeoutSeconds(settings) {
   return settings.modalIdleTimeoutSeconds ?? settings.modalTimeoutSeconds;
 }
+function sandboxArchiveCaptureTimeoutMs(settings) {
+  return Math.min(
+    60 * 6e4,
+    Math.max(settings.sandboxSnapshotTimeoutMs + 3e4, settings.sandboxSnapshotTimeoutMs * 2)
+  );
+}
 function collectSandboxEnvironment(settings, source = process.env) {
   const out = {};
   for (const name of sandboxEnvironmentVariableNames(settings)) {
@@ -1572,6 +1705,68 @@ function legacyModelCapabilities(settings, input) {
     latencyModes: [{ id: "standard", upstream: "unknown", runnable: true }]
   });
 }
+var GPT56_FAST_BILLING_MULTIPLIER_BPS = 2e4;
+function productLabelForModelId(modelId) {
+  const slug = modelId.startsWith(CODEX_MODEL_ID_PREFIX) ? modelId.slice(CODEX_MODEL_ID_PREFIX.length) : modelId;
+  const match = /^(gpt-\d+(?:\.\d+)?)(?:-(.+))?$/i.exec(slug);
+  if (!match) {
+    return slug;
+  }
+  const family = match[1].replace(/^gpt/i, "GPT");
+  const rest = match[2];
+  if (!rest) {
+    return family;
+  }
+  const suffix = rest.split("-").filter((part) => part.length > 0).map((part) => part.charAt(0).toUpperCase() + part.slice(1).toLowerCase()).join(" ");
+  return suffix.length > 0 ? `${family} ${suffix}` : family;
+}
+function builtinLatencyModesForModel(modelId) {
+  if (modelId === "gpt-5.6-sol" || modelId === "gpt-5.6-terra" || modelId === "gpt-5.6-luna" || modelId.startsWith("codex/gpt-5.6-")) {
+    return [
+      { id: "standard", upstream: "supported", runnable: true },
+      {
+        id: "fast",
+        upstream: "supported",
+        runnable: true,
+        billingMultiplierBps: GPT56_FAST_BILLING_MULTIPLIER_BPS
+      }
+    ];
+  }
+  return [{ id: "standard", upstream: "unknown", runnable: true }];
+}
+function serviceTierForLatencyMode(providerId, latencyMode) {
+  if (latencyMode === "standard") {
+    return void 0;
+  }
+  if (providerId === "azure" || providerId === CODEX_PROVIDER_ID) {
+    return "priority";
+  }
+  return "fast";
+}
+function responseSatisfiesLatencyMode(requested, responseServiceTier) {
+  if (requested === "standard") {
+    return true;
+  }
+  return responseServiceTier === "priority" || responseServiceTier === "fast";
+}
+function runnableLatencyModesForModel(settings, modelId) {
+  const resolved = resolveModelProvider(
+    settingsForTurnExecutionPolicy(settings, modelId),
+    canonicalizeConfiguredModelId(settings, modelId)
+  );
+  if (!resolved) {
+    return ["standard"];
+  }
+  return resolved.model.capabilities.latencyModes.filter((mode) => mode.runnable).map((mode) => LatencyMode.parse(mode.id));
+}
+function assertLatencyModeRunnable(settings, modelId, latencyMode) {
+  const runnable = runnableLatencyModesForModel(settings, modelId);
+  if (!runnable.includes(latencyMode)) {
+    throw new Error(
+      `latency mode ${latencyMode} is not runnable for model ${modelId} (allowed: ${runnable.join(", ")})`
+    );
+  }
+}
 function registryCredentialSource(provider) {
   return provider.kind === "codex-subscription" ? { kind: "connected_subscription", provider: "codex" } : { kind: "deployment", mechanism: "api_key" };
 }
@@ -1692,21 +1887,31 @@ function withCodexCatalogProvider(settings) {
     label: "Codex (ChatGPT subscription)",
     api: "responses",
     baseUrl: CODEX_PROVIDER_BASE_URL,
-    models: CODEX_FALLBACK_MODEL_SLUGS.map((slug) => ({
-      id: `${CODEX_MODEL_ID_PREFIX}${slug}`,
-      upstreamModelId: slug,
-      label: slug,
-      reasoningEffort: true,
-      // The ChatGPT/Codex Responses backend accepts the native web_search
-      // hosted tool (unlike hosted apply_patch/computer transports). Declaring
-      // this here makes provider resolution truthful; the worker still applies
-      // the durable session/turn policy gate before attaching it.
-      hostedWebSearch: true,
-      contextWindowTokens: CODEX_MODEL_CONTEXT_WINDOW_TOKENS,
-      effectiveContextWindowTokens: CODEX_MODEL_EFFECTIVE_CONTEXT_WINDOW_TOKENS,
-      autoCompactTokenLimit: CODEX_MODEL_AUTO_COMPACT_TOKEN_LIMIT,
-      toolOutputTruncationTokens: CODEX_MODEL_TOOL_OUTPUT_TRUNCATION_TOKENS
-    }))
+    models: CODEX_FALLBACK_MODEL_SLUGS.map((slug) => {
+      const capabilities = {
+        ...legacyModelCapabilities(settings, {
+          reasoningEffort: true,
+          hostedWebSearch: true
+        }),
+        latencyModes: builtinLatencyModesForModel(`${CODEX_MODEL_ID_PREFIX}${slug}`)
+      };
+      return {
+        id: `${CODEX_MODEL_ID_PREFIX}${slug}`,
+        upstreamModelId: slug,
+        label: productLabelForModelId(slug),
+        reasoningEffort: true,
+        // The ChatGPT/Codex Responses backend accepts the native web_search
+        // hosted tool (unlike hosted apply_patch/computer transports). Declaring
+        // this here makes provider resolution truthful; the worker still applies
+        // the durable session/turn policy gate before attaching it.
+        hostedWebSearch: true,
+        capabilities,
+        contextWindowTokens: CODEX_MODEL_CONTEXT_WINDOW_TOKENS,
+        effectiveContextWindowTokens: CODEX_MODEL_EFFECTIVE_CONTEXT_WINDOW_TOKENS,
+        autoCompactTokenLimit: CODEX_MODEL_AUTO_COMPACT_TOKEN_LIMIT,
+        toolOutputTruncationTokens: CODEX_MODEL_TOOL_OUTPUT_TRUNCATION_TOKENS
+      };
+    })
   };
   return { ...settings, modelProvidersJson: JSON.stringify([...providers, provider]) };
 }
@@ -1790,14 +1995,17 @@ function configuredModels(settings) {
     settings.openaiModel,
     ...splitCsv(settings.openaiAllowedModels)
   ]).filter((id) => !isRegistryNamespaced(id)).map((id) => {
-    const capabilities = legacyModelCapabilities(settings, {
-      reasoningEffort: true,
-      hostedWebSearch: settings.webSearchEnabled
-    });
+    const capabilities = {
+      ...legacyModelCapabilities(settings, {
+        reasoningEffort: true,
+        hostedWebSearch: settings.webSearchEnabled
+      }),
+      latencyModes: builtinLatencyModesForModel(id)
+    };
     return finalizeConfiguredModel(settings, builtinProvider, {
       id,
       aliases: [],
-      label: id,
+      label: productLabelForModelId(id),
       providerId: builtinId,
       providerLabel: builtinLabel,
       api: "responses",
@@ -1829,7 +2037,7 @@ function configuredModels(settings) {
         finalizeConfiguredModel(settings, resolvedProvider, {
           id: model.id,
           aliases: [...model.aliases ?? []],
-          label: model.label ?? model.id,
+          label: model.label ?? productLabelForModelId(model.id),
           providerId: provider.id,
           providerLabel,
           api: provider.api,
@@ -1890,6 +2098,9 @@ function resolveTurnExecutionPolicyV1(settings, input) {
   if (input.requestedModelId !== null && canonicalizeConfiguredModelId(catalogSettings, input.requestedModelId) !== productModelId) {
     throw new Error("Turn execution policy requested model does not canonicalize to its product");
   }
+  const latencyMode = LatencyMode.parse(input.latencyMode ?? "standard");
+  const latencyModeSource = input.latencyModeSource ?? "deployment";
+  assertLatencyModeRunnable(catalogSettings, productModelId, latencyMode);
   return TurnExecutionPolicyV1.parse({
     schemaVersion: 1,
     productModelId,
@@ -1897,6 +2108,8 @@ function resolveTurnExecutionPolicyV1(settings, input) {
     modelSource: input.modelSource,
     reasoningEffort: input.reasoningEffort,
     reasoningSource: input.reasoningSource,
+    latencyMode,
+    latencyModeSource,
     providerId: resolved.provider.id,
     upstreamModelId: resolved.model.upstreamModelId,
     wireApi: resolved.model.api,
@@ -1909,9 +2122,13 @@ function assertTurnExecutionPolicyMatchesConfigV1(settings, policy, expected) {
   const parsed = TurnExecutionPolicyV1.parse(policy);
   const catalogSettings = settingsForTurnExecutionPolicy(settings, parsed.productModelId);
   const canonicalExpectedModel = canonicalizeConfiguredModelId(catalogSettings, expected.modelId);
-  if (parsed.productModelId !== canonicalExpectedModel || parsed.reasoningEffort !== expected.reasoningEffort) {
-    throw new Error("Turn execution policy does not match the accepted turn model/reasoning");
+  const expectedLatencyMode = expected.latencyMode ?? parsed.latencyMode;
+  if (parsed.productModelId !== canonicalExpectedModel || parsed.reasoningEffort !== expected.reasoningEffort || parsed.latencyMode !== expectedLatencyMode) {
+    throw new Error(
+      "Turn execution policy does not match the accepted turn model/reasoning/latency"
+    );
   }
+  assertLatencyModeRunnable(catalogSettings, parsed.productModelId, parsed.latencyMode);
   if (parsed.requestedModelId !== null && canonicalizeConfiguredModelId(catalogSettings, parsed.requestedModelId) !== parsed.productModelId) {
     throw new Error("Turn execution policy requested model does not match its product model");
   }
@@ -1927,7 +2144,10 @@ function assertTurnExecutionPolicyMatchesConfigV1(settings, policy, expected) {
 }
 function configuredModelPricingSchedules(settings) {
   const defaults = Object.fromEntries(
-    Object.entries(defaultModelPricing).map(([model, pricing]) => [model, { default: pricing }])
+    Object.entries(defaultModelPricing).map(([model, pricing]) => [
+      model,
+      normalizeModelPricingSchedule(pricing)
+    ])
   );
   const registry = {};
   for (const provider of parseModelProvidersJson(settings.modelProvidersJson)) {
@@ -2009,7 +2229,7 @@ function configuredEntitlements(settings) {
     ...configured
   };
 }
-function calculateModelUsageCostMicros(settings, model, usage) {
+function calculateModelUsageCostMicros(settings, model, usage, options) {
   const schedule = configuredModelPricingSchedules(settings)[model];
   if (!schedule) {
     throw new Error(`Missing model pricing for ${model}`);
@@ -2028,6 +2248,20 @@ function calculateModelUsageCostMicros(settings, model, usage) {
     const marginBps = pricing.marginBps ?? 0;
     total += Math.ceil(rawCost * (1e4 + marginBps) / 1e4);
   }
+  const latencyMode = options?.latencyMode ?? "standard";
+  if (latencyMode !== "standard") {
+    const catalogSettings = settingsForTurnExecutionPolicy(settings, model);
+    const resolved = resolveModelProvider(
+      catalogSettings,
+      canonicalizeConfiguredModelId(catalogSettings, model)
+    );
+    const multiplierBps = resolved?.model.capabilities.latencyModes.find(
+      (mode) => mode.id === latencyMode && mode.runnable
+    )?.billingMultiplierBps;
+    if (multiplierBps && multiplierBps > 0) {
+      total = Math.ceil(total * multiplierBps / 1e4);
+    }
+  }
   return total;
 }
 function configuredAllowedReasoningEfforts(settings) {
@@ -2591,6 +2825,28 @@ function validateSettings(settings) {
       );
     }
   }
+  if (Boolean(settings.googleDriveClientId) !== Boolean(settings.googleDriveClientSecret)) {
+    throw new Error(
+      "OPENGENI_GOOGLE_DRIVE_CLIENT_ID and OPENGENI_GOOGLE_DRIVE_CLIENT_SECRET must be configured together"
+    );
+  }
+  if (settings.googleDriveClientId) {
+    if (!settings.publicBaseUrl) {
+      throw new Error(
+        "OPENGENI_PUBLIC_BASE_URL is required when the Google Drive integration is configured"
+      );
+    }
+    if (!settings.publicBaseUrl.startsWith("https://") && !["local", "test"].includes(settings.environment)) {
+      throw new Error(
+        "OPENGENI_PUBLIC_BASE_URL must use https when the Google Drive integration is configured outside local/test"
+      );
+    }
+    if (!settings.integrationsStateSecret) {
+      throw new Error(
+        "OPENGENI_INTEGRATIONS_STATE_SECRET is required when the Google Drive integration is configured"
+      );
+    }
+  }
   parseIntegrationsOauthClientsJson(settings.integrationsOauthClientsJson);
   if (settings.productAccessMode === "configured" && !["local", "test"].includes(settings.environment) && !settings.delegationSecret && !settings.authRequired) {
     throw new Error(
@@ -2674,7 +2930,7 @@ function validateSettings(settings) {
         "OPENGENI_OBJECT_STORAGE_ACCESS_KEY_ID and OPENGENI_OBJECT_STORAGE_SECRET_ACCESS_KEY must both be set or both omitted"
       );
     }
-    if (settings.objectStorageBackend === "s3-compatible" && (settings.objectStorageEndpoint || settings.objectStorageSandboxEndpoint) && (!settings.objectStorageAccessKeyId || !settings.objectStorageSecretAccessKey)) {
+    if (settings.objectStorageBackend === "s3-compatible" && (settings.objectStorageEndpoint || settings.objectStorageInternalEndpoint || settings.objectStorageSandboxEndpoint) && (!settings.objectStorageAccessKeyId || !settings.objectStorageSecretAccessKey)) {
       throw new Error(
         "S3-compatible object storage endpoints require OPENGENI_OBJECT_STORAGE_ACCESS_KEY_ID and OPENGENI_OBJECT_STORAGE_SECRET_ACCESS_KEY"
       );
@@ -2690,7 +2946,7 @@ function validateSettings(settings) {
       );
     }
   } else if (settings.objectStorageBackend === "azure-blob") {
-    if (settings.objectStorageEndpoint || settings.objectStorageSandboxEndpoint || settings.objectStorageAccessKeyId || settings.objectStorageSecretAccessKey) {
+    if (settings.objectStorageEndpoint || settings.objectStorageInternalEndpoint || settings.objectStorageSandboxEndpoint || settings.objectStorageAccessKeyId || settings.objectStorageSecretAccessKey) {
       throw new Error(
         "Azure Blob storage uses OPENGENI_OBJECT_STORAGE_AZURE_* settings, not S3-compatible object storage settings"
       );
@@ -2708,7 +2964,7 @@ function validateSettings(settings) {
       );
     }
   } else {
-    if (settings.objectStorageEndpoint || settings.objectStorageSandboxEndpoint || settings.objectStorageAccessKeyId || settings.objectStorageSecretAccessKey) {
+    if (settings.objectStorageEndpoint || settings.objectStorageInternalEndpoint || settings.objectStorageSandboxEndpoint || settings.objectStorageAccessKeyId || settings.objectStorageSecretAccessKey) {
       throw new Error(
         "GCS object storage uses OPENGENI_OBJECT_STORAGE_GCS_* settings, not S3-compatible object storage settings"
       );
@@ -2743,6 +2999,7 @@ function validateSettings(settings) {
     const viewerTtl = settings.sandboxViewerHolderTtlMs;
     const idleGraceMs = settings.sandboxIdleGraceMs;
     const providerLifetimeMs = settings.modalTimeoutSeconds * 1e3;
+    const rotationLeadMs = settings.sandboxRotationLeadMs;
     const idleTimeoutMs = effectiveModalIdleTimeoutSeconds(settings) * 1e3;
     if (!(reaperPeriod < viewerTtl)) {
       throw new Error(
@@ -2754,6 +3011,16 @@ function validateSettings(settings) {
         `OPENGENI_MODAL_IDLE_TIMEOUT_SECONDS*1000 (${idleTimeoutMs}) must not exceed the hard provider lifetime (OPENGENI_MODAL_TIMEOUT_SECONDS*1000 = ${providerLifetimeMs}): the idle timeout is a floor under the hard lifetime, not above it.`
       );
     }
+    if (!(rotationLeadMs < providerLifetimeMs)) {
+      throw new Error(
+        `OPENGENI_SANDBOX_ROTATION_LEAD_MS (${rotationLeadMs}) must be strictly less than OPENGENI_MODAL_TIMEOUT_SECONDS*1000 (${providerLifetimeMs}).`
+      );
+    }
+    if (!(rotationLeadMs > settings.sandboxSnapshotTimeoutMs + 2 * reaperPeriod)) {
+      throw new Error(
+        `OPENGENI_SANDBOX_ROTATION_LEAD_MS (${rotationLeadMs}) must exceed the snapshot timeout plus two reaper periods (${settings.sandboxSnapshotTimeoutMs + 2 * reaperPeriod}).`
+      );
+    }
     if (!(viewerTtl < idleTimeoutMs)) {
       throw new Error(
         `OPENGENI_SANDBOX_VIEWER_HOLDER_TTL_MS (${viewerTtl}) must be strictly less than the effective box idle timeout (${idleTimeoutMs}): a viewer holder must be reapable before the box idles out from under it (the provider idle-timeout is the backstop).`
@@ -2911,6 +3178,7 @@ export {
   getSettings,
   hasGitCredentialRepositorySelection,
   hasGitHubRepositorySelection,
+  isUsableVoiceInputSecret,
   parseExposedPorts,
   parseIntegrationsOauthClientsJson,
   parseMcpServers,
@@ -2920,6 +3188,7 @@ export {
   parseStaticEntitlementsJson,
   parseStaticUsageLimitsJson,
   policyProviderIdForModel,
+  productLabelForModelId,
   requiredSandboxEnvForBackend,
   resolveEnrollmentSigningSecret,
   resolveModelProvider,
@@ -2929,17 +3198,23 @@ export {
   resolveRelayTokenSecret,
   resolveStreamTokenSecret,
   resolveTurnExecutionPolicyV1,
+  resolveVoiceInputProviderRegistry,
+  responseSatisfiesLatencyMode,
   retryStartupDependency,
+  runnableLatencyModesForModel,
+  sandboxArchiveCaptureTimeoutMs,
   sandboxEnvironmentVariableNames,
   sandboxLifecycleHookIds,
   sandboxPreparationProfiles,
   sandboxWarmRateMicrosPerSecond,
   selectModelPricing,
+  serviceTierForLatencyMode,
   settingsWithResolvedModelContext,
   stableSandboxEnvironmentForRun,
   startupRetryOptions,
   streamTokenDegraded,
   temporalConnectionOptions,
+  voiceInputDeploymentConfigured,
   withCodexCatalogProvider
 };
 //# sourceMappingURL=index.js.map