@opengeni/config 0.7.22 → 0.8.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/config",
-  "version": "0.7.22",
+  "version": "0.8.1",
   "description": "OpenGeni runtime configuration: settings resolution, deployment knobs, and config validation shared across the server packages.",
   "license": "Apache-2.0",
   "repository": {
@@ -34,7 +34,7 @@
   },
   "dependencies": {
     "@opengeni/codex": "^0.2.9",
-    "@opengeni/contracts": "^0.26.1",
+    "@opengeni/contracts": "^0.27.0",
     "zod": "^4.2.1"
   },
   "engines": {

package/src/index.ts

@@ -269,6 +269,7 @@ const SettingsSchema = z.object({
   integrationsOauthClientsJson: z.string().default("{}"),
   slackClientId: z.string().optional(),
   slackClientSecret: z.string().optional(),
+  slackSigningSecret: z.string().optional(),
   googleDriveClientId: z.string().optional(),
   googleDriveClientSecret: z.string().optional(),
   // Undefined is meaningful: the migration boundary persists the product
@@ -328,6 +329,9 @@ const SettingsSchema = z.object({
   apiPort: z.coerce.number().int().positive().default(8000),
   workerHttpPort: z.coerce.number().int().positive().default(8001),
   opengeniMcpUrl: z.string().url().optional(),
+  // Origins allowed to send browser cookies cross-origin. Other origins may
+  // call the public API with bearer credentials, but never receive credentialed
+  // CORS responses.
   corsAllowOriginRegex: z.string().default(String.raw`^https?://(localhost|127\.0\.0\.1)(:\d+)?$`),
   openaiProvider: z.enum(["openai", "azure"]).default("openai"),
   openaiApiKey: z.string().optional(),
@@ -1016,7 +1020,11 @@ export function resolveVoiceInputProviderRegistry(settings: Settings): VoiceInpu
       // subscription turns. VOICE_INPUT_CODEX_EXPERIMENTAL is retained for
       // back-compat docs/env but no longer gates inclusion.
       if (!settings.codexSubscriptionEnabled) continue;
-      providers.push({ id: "codex-subscription", kind: "codex-subscription", experimental: true });
+      providers.push({
+        id: "codex-subscription",
+        kind: "codex-subscription",
+        experimental: true,
+      });
     }
   }
   return providers;
@@ -1588,6 +1596,7 @@ export function getSettings(): Settings {
     integrationsOauthClientsJson: optional("OPENGENI_INTEGRATIONS_OAUTH_CLIENTS_JSON"),
     slackClientId: optional("OPENGENI_SLACK_CLIENT_ID"),
     slackClientSecret: optional("OPENGENI_SLACK_CLIENT_SECRET"),
+    slackSigningSecret: optional("OPENGENI_SLACK_SIGNING_SECRET"),
     googleDriveClientId: optional("OPENGENI_GOOGLE_DRIVE_CLIENT_ID"),
     googleDriveClientSecret: optional("OPENGENI_GOOGLE_DRIVE_CLIENT_SECRET"),
     maxNestedAgentDepth: optional("OPENGENI_MAX_NESTED_AGENT_DEPTH"),
@@ -1820,6 +1829,23 @@ export function getSettings(): Settings {
   return settings;
 }
 
+const LOCAL_FIRST_PARTY_DELEGATION_SECRET = "opengeni-local-first-party-delegation-secret-v1";
+
+/**
+ * First-party session tools need a shared HMAC identity even in the unauthenticated
+ * local product mode. A fixed local-only value is no broader than that mode's
+ * existing access boundary, while configured and managed deployments continue to
+ * require an operator-provided secret.
+ */
+export function resolveFirstPartyDelegationSecret(settings: Settings): string | undefined {
+  const explicit = settings.delegationSecret?.trim();
+  if (explicit) return explicit;
+  return settings.productAccessMode === "local" &&
+    (settings.environment === "local" || settings.environment === "test")
+    ? LOCAL_FIRST_PARTY_DELEGATION_SECRET
+    : undefined;
+}
+
 /**
  * The Modal sandbox idle timeout (seconds) the provider actually passes as
  * idleTimeoutMs (sandbox-file-persistence). When the operator did not pin
@@ -2271,8 +2297,16 @@ function builtinCredentialSource(settings: Settings): CredentialSourceV1 {
 }
 
 function staticRequestMetadataForDigest(provider: ResolvedModelProvider): {
-  headers: Array<{ name: string; classification: "public" | "secret"; value?: string }>;
-  query: Array<{ name: string; classification: "public" | "secret"; value?: string }>;
+  headers: Array<{
+    name: string;
+    classification: "public" | "secret";
+    value?: string;
+  }>;
+  query: Array<{
+    name: string;
+    classification: "public" | "secret";
+    value?: string;
+  }>;
 } {
   const publicHeaders = new Set(provider.publicDefaultHeaderNames ?? []);
   const publicQuery = new Set(provider.publicDefaultQueryNames ?? []);
@@ -2450,7 +2484,10 @@ export function withCodexCatalogProvider(settings: Settings): Settings {
       };
     }),
   };
-  return { ...settings, modelProvidersJson: JSON.stringify([...providers, provider]) };
+  return {
+    ...settings,
+    modelProvidersJson: JSON.stringify([...providers, provider]),
+  };
 }
 
 /**
@@ -2656,7 +2693,9 @@ export function configuredModels(settings: Settings): ConfiguredModel[] {
             : { contextWindowTokens: model.contextWindowTokens }),
           ...(model.effectiveContextWindowTokens === undefined
             ? {}
-            : { effectiveContextWindowTokens: model.effectiveContextWindowTokens }),
+            : {
+                effectiveContextWindowTokens: model.effectiveContextWindowTokens,
+              }),
           ...(model.autoCompactTokenLimit === undefined
             ? {}
             : { autoCompactTokenLimit: model.autoCompactTokenLimit }),
@@ -3435,7 +3474,9 @@ export function parseMcpServers(raw: string | undefined): unknown[] | undefined
     return parsed;
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
-    throw new Error(`OPENGENI_MCP_SERVERS must be a JSON array: ${message}`, { cause: error });
+    throw new Error(`OPENGENI_MCP_SERVERS must be a JSON array: ${message}`, {
+      cause: error,
+    });
   }
 }
 
@@ -3821,6 +3862,11 @@ function validateSettings(settings: Settings): void {
     );
   }
   if (settings.slackClientId) {
+    if (!settings.slackSigningSecret) {
+      throw new Error(
+        "OPENGENI_SLACK_SIGNING_SECRET is required when the OpenGeni Slack app is configured",
+      );
+    }
     if (!settings.publicBaseUrl) {
       throw new Error(
         "OPENGENI_PUBLIC_BASE_URL is required when the OpenGeni Slack app is configured",