@opengeni/config 1.2.2 → 2.0.0

package/dist/index.d.ts

@@ -45,6 +45,7 @@ export declare const AGENT_INSTRUCTIONS_CORE_PLACEHOLDER = "{{core}}";
 export declare const DEFAULT_AGENT_INSTRUCTIONS: string;
 export declare const McpServerConnectionRefSchema: z.ZodObject<{
     connectionId: z.ZodOptional<z.ZodString>;
+    accountSelection: z.ZodOptional<z.ZodLiteral<"all_eligible">>;
     authoritySource: z.ZodOptional<z.ZodLiteral<"host">>;
     hostBinding: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
         bindingId: z.ZodString;
@@ -117,6 +118,8 @@ declare const SettingsSchema: z.ZodObject<{
     observabilityMetricsEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
     observabilityOtlpEndpoint: z.ZodOptional<z.ZodString>;
     observabilityOtlpHeaders: z.ZodDefault<z.ZodString>;
+    observabilityDiagnosticsEndpoint: z.ZodOptional<z.ZodString>;
+    observabilityDiagnosticsHeaders: z.ZodDefault<z.ZodString>;
     analyticsEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
     analyticsConsentRequired: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
     analyticsReoClientId: z.ZodOptional<z.ZodString>;
@@ -225,6 +228,7 @@ declare const SettingsSchema: z.ZodObject<{
         knowledge_browse: "knowledge_browse";
         knowledge_correct: "knowledge_correct";
         knowledge_get: "knowledge_get";
+        knowledge_prepare_save: "knowledge_prepare_save";
         knowledge_propose: "knowledge_propose";
         knowledge_retain_file: "knowledge_retain_file";
         knowledge_retain_message: "knowledge_retain_message";
@@ -393,6 +397,7 @@ declare const SettingsSchema: z.ZodObject<{
         knowledge_browse: "knowledge_browse";
         knowledge_correct: "knowledge_correct";
         knowledge_get: "knowledge_get";
+        knowledge_prepare_save: "knowledge_prepare_save";
         knowledge_propose: "knowledge_propose";
         knowledge_retain_file: "knowledge_retain_file";
         knowledge_retain_message: "knowledge_retain_message";
@@ -533,8 +538,6 @@ declare const SettingsSchema: z.ZodObject<{
     goalIdleBackoffMs: z.ZodDefault<z.ZodPreprocess<z.ZodReadonly<z.ZodArray<z.ZodNumber>>>>;
     goalIdleBackoffMaxMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     childLifecycleNoticesEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
-    hostMcpAuthoritySourceAdmissionEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
-    hostMcpCredentialResolversJson: z.ZodOptional<z.ZodString>;
     slackWorkspaceRoutingEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
     agentMaxModelCallsPerTurn: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     contextWindowTokens: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
@@ -612,6 +615,7 @@ declare const SettingsSchema: z.ZodObject<{
     lazyToolSearchEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
     codexFleetPolicyShadowEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
     codexRotationNearExhaustionPct: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    reasoningConfigurationUpdatesEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
     openaiReasoningEffort: z.ZodDefault<z.ZodEnum<{
         high: "high";
         low: "low";
@@ -662,6 +666,7 @@ declare const SettingsSchema: z.ZodObject<{
     dockerWorkspaceBaseDir: z.ZodOptional<z.ZodString>;
     modalAppName: z.ZodDefault<z.ZodString>;
     modalImageRef: z.ZodOptional<z.ZodString>;
+    modalCommandSupervisionEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
     modalImageId: z.ZodOptional<z.ZodString>;
     modalImageRegistrySecret: z.ZodOptional<z.ZodString>;
     modalTimeoutSeconds: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
@@ -881,6 +886,7 @@ declare const SettingsSchema: z.ZodObject<{
         headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         connectionRef: z.ZodOptional<z.ZodObject<{
             connectionId: z.ZodOptional<z.ZodString>;
+            accountSelection: z.ZodOptional<z.ZodLiteral<"all_eligible">>;
             authoritySource: z.ZodOptional<z.ZodLiteral<"host">>;
             hostBinding: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
                 bindingId: z.ZodString;
@@ -913,6 +919,88 @@ declare const SettingsSchema: z.ZodObject<{
     }, z.core.$strip>>>;
 }, z.core.$strip>;
 export type Settings = z.infer<typeof SettingsSchema>;
+declare const ArtifactOutboxSettingsSchema: z.ZodObject<{
+    serviceName: z.ZodDefault<z.ZodString>;
+    environment: z.ZodDefault<z.ZodString>;
+    deploymentRevision: z.ZodDefault<z.ZodString>;
+    dbSchema: z.ZodDefault<z.ZodString>;
+    rlsStrategy: z.ZodDefault<z.ZodEnum<{
+        force: "force";
+        scoped: "scoped";
+    }>>;
+    observabilityStructuredLogs: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
+    observabilityMetricsEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
+    observabilityOtlpEndpoint: z.ZodOptional<z.ZodString>;
+    observabilityOtlpHeaders: z.ZodDefault<z.ZodString>;
+    natsUrl: z.ZodDefault<z.ZodString>;
+    selfhostedNatsControlUser: z.ZodOptional<z.ZodString>;
+    selfhostedNatsControlPassword: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+declare const ObjectStorageSettingsSchema: z.ZodObject<{
+    objectStorageEndpoint: z.ZodOptional<z.ZodString>;
+    objectStorageInternalEndpoint: z.ZodOptional<z.ZodString>;
+    objectStorageSandboxEndpoint: z.ZodOptional<z.ZodString>;
+    objectStorageBackend: z.ZodDefault<z.ZodEnum<{
+        "aws-s3": "aws-s3";
+        "azure-blob": "azure-blob";
+        gcs: "gcs";
+        "s3-compatible": "s3-compatible";
+    }>>;
+    objectStorageBucket: z.ZodDefault<z.ZodString>;
+    objectStorageRegion: z.ZodDefault<z.ZodString>;
+    objectStorageAccessKeyId: z.ZodOptional<z.ZodString>;
+    objectStorageSecretAccessKey: z.ZodOptional<z.ZodString>;
+    objectStorageForcePathStyle: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
+    objectStorageAzureConnectionString: z.ZodOptional<z.ZodString>;
+    objectStorageAzureAccountName: z.ZodOptional<z.ZodString>;
+    objectStorageAzureAccountKey: z.ZodOptional<z.ZodString>;
+    objectStorageAzureEndpoint: z.ZodOptional<z.ZodString>;
+    objectStorageGcsProjectId: z.ZodOptional<z.ZodString>;
+    objectStorageGcsCredentialsJson: z.ZodOptional<z.ZodString>;
+    objectStorageGcsKeyFilename: z.ZodOptional<z.ZodString>;
+    objectStorageGcsApiEndpoint: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+declare const ArtifactMaterializerSettingsSchema: z.ZodObject<{
+    serviceName: z.ZodDefault<z.ZodString>;
+    environment: z.ZodDefault<z.ZodString>;
+    deploymentRevision: z.ZodDefault<z.ZodString>;
+    dbSchema: z.ZodDefault<z.ZodString>;
+    rlsStrategy: z.ZodDefault<z.ZodEnum<{
+        force: "force";
+        scoped: "scoped";
+    }>>;
+    observabilityStructuredLogs: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
+    observabilityMetricsEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
+    observabilityOtlpEndpoint: z.ZodOptional<z.ZodString>;
+    observabilityOtlpHeaders: z.ZodDefault<z.ZodString>;
+    objectStorageEndpoint: z.ZodOptional<z.ZodString>;
+    objectStorageInternalEndpoint: z.ZodOptional<z.ZodString>;
+    objectStorageSandboxEndpoint: z.ZodOptional<z.ZodString>;
+    objectStorageBackend: z.ZodDefault<z.ZodEnum<{
+        "aws-s3": "aws-s3";
+        "azure-blob": "azure-blob";
+        gcs: "gcs";
+        "s3-compatible": "s3-compatible";
+    }>>;
+    objectStorageBucket: z.ZodDefault<z.ZodString>;
+    objectStorageRegion: z.ZodDefault<z.ZodString>;
+    objectStorageAccessKeyId: z.ZodOptional<z.ZodString>;
+    objectStorageSecretAccessKey: z.ZodOptional<z.ZodString>;
+    objectStorageForcePathStyle: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
+    objectStorageAzureConnectionString: z.ZodOptional<z.ZodString>;
+    objectStorageAzureAccountName: z.ZodOptional<z.ZodString>;
+    objectStorageAzureAccountKey: z.ZodOptional<z.ZodString>;
+    objectStorageAzureEndpoint: z.ZodOptional<z.ZodString>;
+    objectStorageGcsProjectId: z.ZodOptional<z.ZodString>;
+    objectStorageGcsCredentialsJson: z.ZodOptional<z.ZodString>;
+    objectStorageGcsKeyFilename: z.ZodOptional<z.ZodString>;
+    objectStorageGcsApiEndpoint: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type ArtifactOutboxSettings = z.infer<typeof ArtifactOutboxSettingsSchema>;
+export type ObjectStorageSettings = z.infer<typeof ObjectStorageSettingsSchema>;
+export type ArtifactMaterializerSettings = z.infer<typeof ArtifactMaterializerSettingsSchema>;
+export declare function getArtifactOutboxSettings(source?: NodeJS.ProcessEnv): ArtifactOutboxSettings;
+export declare function getArtifactMaterializerSettings(source?: NodeJS.ProcessEnv): ArtifactMaterializerSettings;
 export type McpServerConfig = Settings["mcpServers"][number];
 export type GoogleDriveProviderRetryOptions = {
     requestTimeoutMs: number;
@@ -2616,6 +2704,7 @@ export declare function applyGitAuthPointerEnvironment(environment: Record<strin
     email: string;
 } | null): Record<string, string>;
 export type StartupRetryOptions = {
+    shouldRetry?: (error: unknown) => boolean;
     attempts?: number;
     initialDelayMs?: number;
     maxDelayMs?: number;
@@ -2627,7 +2716,7 @@ export type StartupRetryOptions = {
         error: unknown;
     }) => void;
 };
-export declare function startupRetryOptions(settings: Settings): Required<Omit<StartupRetryOptions, "onRetry">>;
+export declare function startupRetryOptions(settings: Settings): Required<Omit<StartupRetryOptions, "onRetry" | "shouldRetry">>;
 export declare function retryStartupDependency<T>(label: string, operation: () => Promise<T>, options?: StartupRetryOptions): Promise<T>;
 export declare function sandboxEnvironmentVariableNames(settings: Settings): string[];
 export declare function sandboxLifecycleHookIds(settings: Settings): string[];
@@ -2740,4 +2829,4 @@ export interface NatsControlPlaneAuth {
     user: string;
     password: string;
 }
-export declare function resolveNatsControlPlaneAuth(settings: Settings): NatsControlPlaneAuth | null;
+export declare function resolveNatsControlPlaneAuth(settings: Pick<Settings, "selfhostedNatsControlUser" | "selfhostedNatsControlPassword">): NatsControlPlaneAuth | null;

package/dist/index.js

@@ -144,7 +144,7 @@ var sandboxPreparationProfiles = {
 var AGENT_INSTRUCTIONS_CORE_PLACEHOLDER = "{{core}}";
 var DEFAULT_AGENT_INSTRUCTIONS = [
   "You are an OpenGeni workspace agent.",
-  "Follow the user's task and any enabled pack or skill instructions for the current role.",
+  "Follow the user's task and the applicable Skill instructions for the current role.",
   "Work inside the sandbox workspace and use filesystem and shell tools when useful.",
   "Repository resources are mounted under repos/<host>/<owner>/<repo> unless the session specifies another collision-free mount path.",
   "File resources are mounted under .opengeni/files/<file-id>/ unless the session specifies another mount path.",
@@ -221,6 +221,8 @@ var SettingsSchema = z.object({
   observabilityMetricsEnabled: EnvBoolean.default(true),
   observabilityOtlpEndpoint: z.string().url().optional(),
   observabilityOtlpHeaders: z.string().default(""),
+  observabilityDiagnosticsEndpoint: z.string().url().optional(),
+  observabilityDiagnosticsHeaders: z.string().default(""),
   analyticsEnabled: EnvBoolean.default(false),
   analyticsConsentRequired: EnvBoolean.default(true),
   analyticsReoClientId: z.string().max(128).regex(/^[A-Za-z0-9_-]+$/u).optional(),
@@ -367,16 +369,6 @@ var SettingsSchema = z.object({
   // into @opengeni/db once at boot.
   // Env: OPENGENI_CHILD_LIFECYCLE_NOTICES_ENABLED.
   childLifecycleNoticesEnabled: EnvBoolean.default(false),
-  // Explicit host-owned MCP connection authority is a rolling protocol
-  // activation. Keep it off while any API, worker, or browser bundle predates
-  // the authority discriminator; enable it only after the whole fleet runs an
-  // image that understands host refs. Legacy markerless non-UUID refs remain a
-  // separate compatibility lane for already-persisted embedding integrations.
-  // Env: OPENGENI_HOST_MCP_AUTHORITY_SOURCE_ADMISSION_ENABLED.
-  hostMcpAuthoritySourceAdmissionEnabled: EnvBoolean.default(false),
-  // Server-owned per-organization remote MCP resolver configuration. Optional;
-  // inline credentials and native provider OAuth do not require this service.
-  hostMcpCredentialResolversJson: z.string().optional(),
   // Per-channel and per-DM Slack workspace routing. Default ON. A channel does
   // not count a personal workspace as a candidate, so an organization with one
   // shared workspace resolves it as the sole candidate and never asks; the
@@ -571,6 +563,7 @@ var SettingsSchema = z.object({
   // rotated TO — when EITHER usage window (5h/weekly) is at/over this percent. Default 90 to
   // match the UI danger flip (UsageBar danger at pct >= 90). OPENGENI_CODEX_ROTATION_NEAR_EXHAUSTION_PCT.
   codexRotationNearExhaustionPct: z.coerce.number().int().min(1).max(100).default(90),
+  reasoningConfigurationUpdatesEnabled: EnvBoolean.default(false),
   openaiReasoningEffort: ReasoningEffort.default("low"),
   openaiAllowedReasoningEfforts: z.string().default("low,medium,high,xhigh,max"),
   openaiResponsesTransport: z.enum(["http", "websocket"]).default("http"),
@@ -619,7 +612,6 @@ var SettingsSchema = z.object({
   // the verified, self-contained native artifact runtime at its fixed image
   // paths. Disabled by default so arbitrary/custom provider images never make
   // document/spreadsheet/presentation skills appear when their runtime is
-  // absent. Per-pack/per-rig image overrides fail closed in the worker even
   // when this base-image contract is enabled.
   sandboxArtifactRuntimeEnabled: EnvBoolean.default(false),
   dockerExposedPorts: z.string().default(""),
@@ -631,6 +623,9 @@ var SettingsSchema = z.object({
   dockerWorkspaceBaseDir: z.string().min(1).optional(),
   modalAppName: z.string().default("opengeni-sandbox"),
   modalImageRef: z.string().optional(),
+  // Activate only after descriptor-aware readers, DB fences and the exact
+  // native image have passed the supervised-command rollout canary.
+  modalCommandSupervisionEnabled: EnvBoolean.default(false),
   // Provider-native immutable Modal image ID for the exact logical
   // `modalImageRef`. When set, the runtime uses ModalImageSelector.fromId and
   // never asks Modal to parse or import the registry ref. The logical ref is
@@ -1123,6 +1118,103 @@ var SettingsSchema = z.object({
     })
   ).default([])
 });
+var ArtifactServiceSettingsSchema = SettingsSchema.pick({
+  serviceName: true,
+  environment: true,
+  deploymentRevision: true,
+  dbSchema: true,
+  rlsStrategy: true,
+  observabilityStructuredLogs: true,
+  observabilityMetricsEnabled: true,
+  observabilityOtlpEndpoint: true,
+  observabilityOtlpHeaders: true
+});
+var ArtifactOutboxSettingsSchema = ArtifactServiceSettingsSchema.extend({
+  natsUrl: SettingsSchema.shape.natsUrl,
+  selfhostedNatsControlUser: SettingsSchema.shape.selfhostedNatsControlUser,
+  selfhostedNatsControlPassword: SettingsSchema.shape.selfhostedNatsControlPassword
+});
+var ObjectStorageSettingsSchema = SettingsSchema.pick({
+  objectStorageBackend: true,
+  objectStorageEndpoint: true,
+  objectStorageInternalEndpoint: true,
+  objectStorageSandboxEndpoint: true,
+  objectStorageBucket: true,
+  objectStorageRegion: true,
+  objectStorageAccessKeyId: true,
+  objectStorageSecretAccessKey: true,
+  objectStorageForcePathStyle: true,
+  objectStorageAzureConnectionString: true,
+  objectStorageAzureAccountName: true,
+  objectStorageAzureAccountKey: true,
+  objectStorageAzureEndpoint: true,
+  objectStorageGcsProjectId: true,
+  objectStorageGcsCredentialsJson: true,
+  objectStorageGcsKeyFilename: true,
+  objectStorageGcsApiEndpoint: true
+});
+var ArtifactMaterializerSettingsSchema = ArtifactServiceSettingsSchema.extend(
+  ObjectStorageSettingsSchema.shape
+);
+function artifactServiceEnvironment(source) {
+  const optional = (name) => optionalEnvironmentValue(name, source);
+  return {
+    serviceName: optional("OPENGENI_SERVICE_NAME"),
+    environment: optional("OPENGENI_ENVIRONMENT"),
+    deploymentRevision: optional("OPENGENI_DEPLOYMENT_REVISION") ?? optional("SOURCE_VERSION") ?? optional("GITHUB_SHA"),
+    dbSchema: optional("OPENGENI_DB_SCHEMA"),
+    rlsStrategy: optional("OPENGENI_RLS_STRATEGY"),
+    observabilityStructuredLogs: optional("OPENGENI_OBSERVABILITY_STRUCTURED_LOGS"),
+    observabilityMetricsEnabled: optional("OPENGENI_OBSERVABILITY_METRICS_ENABLED"),
+    observabilityOtlpEndpoint: optional("OPENGENI_OTEL_EXPORTER_OTLP_ENDPOINT") ?? optional("OTEL_EXPORTER_OTLP_ENDPOINT"),
+    observabilityOtlpHeaders: optional("OPENGENI_OTEL_EXPORTER_OTLP_HEADERS") ?? optional("OTEL_EXPORTER_OTLP_HEADERS")
+  };
+}
+function getArtifactOutboxSettings(source = process.env) {
+  const settings = ArtifactOutboxSettingsSchema.parse({
+    ...artifactServiceEnvironment(source),
+    natsUrl: optionalEnvironmentValue("OPENGENI_NATS_URL", source),
+    selfhostedNatsControlUser: optionalEnvironmentValue(
+      "OPENGENI_SELFHOSTED_NATS_CONTROL_USER",
+      source
+    ),
+    selfhostedNatsControlPassword: optionalEnvironmentValue(
+      "OPENGENI_SELFHOSTED_NATS_CONTROL_PASSWORD",
+      source
+    )
+  });
+  dbSearchPath(settings);
+  if (Boolean(settings.selfhostedNatsControlUser) !== Boolean(settings.selfhostedNatsControlPassword)) {
+    throw new Error("Artifact outbox NATS control user and password must be configured together");
+  }
+  return settings;
+}
+function getArtifactMaterializerSettings(source = process.env) {
+  const optional = (name) => optionalEnvironmentValue(name, source);
+  const settings = ArtifactMaterializerSettingsSchema.parse({
+    ...artifactServiceEnvironment(source),
+    objectStorageEndpoint: optional("OPENGENI_OBJECT_STORAGE_ENDPOINT"),
+    objectStorageInternalEndpoint: optional("OPENGENI_OBJECT_STORAGE_INTERNAL_ENDPOINT"),
+    objectStorageSandboxEndpoint: optional("OPENGENI_OBJECT_STORAGE_SANDBOX_ENDPOINT"),
+    objectStorageBackend: optional("OPENGENI_OBJECT_STORAGE_BACKEND"),
+    objectStorageBucket: optional("OPENGENI_OBJECT_STORAGE_BUCKET"),
+    objectStorageRegion: optional("OPENGENI_OBJECT_STORAGE_REGION"),
+    objectStorageAccessKeyId: optional("OPENGENI_OBJECT_STORAGE_ACCESS_KEY_ID"),
+    objectStorageSecretAccessKey: optional("OPENGENI_OBJECT_STORAGE_SECRET_ACCESS_KEY"),
+    objectStorageForcePathStyle: optional("OPENGENI_OBJECT_STORAGE_FORCE_PATH_STYLE"),
+    objectStorageAzureConnectionString: optional("OPENGENI_OBJECT_STORAGE_AZURE_CONNECTION_STRING"),
+    objectStorageAzureAccountName: optional("OPENGENI_OBJECT_STORAGE_AZURE_ACCOUNT_NAME"),
+    objectStorageAzureAccountKey: optional("OPENGENI_OBJECT_STORAGE_AZURE_ACCOUNT_KEY"),
+    objectStorageAzureEndpoint: optional("OPENGENI_OBJECT_STORAGE_AZURE_ENDPOINT"),
+    objectStorageGcsProjectId: optional("OPENGENI_OBJECT_STORAGE_GCS_PROJECT_ID"),
+    objectStorageGcsCredentialsJson: optional("OPENGENI_OBJECT_STORAGE_GCS_CREDENTIALS_JSON"),
+    objectStorageGcsKeyFilename: optional("OPENGENI_OBJECT_STORAGE_GCS_KEY_FILENAME"),
+    objectStorageGcsApiEndpoint: optional("OPENGENI_OBJECT_STORAGE_GCS_API_ENDPOINT")
+  });
+  dbSearchPath(settings);
+  validateObjectStorageSettings(settings);
+  return settings;
+}
 function configuredGoogleDriveSyncLimits(settings) {
   return KnowledgeSourceSyncLimits.parse({
     maxItems: settings.googleDriveSyncMaxItems,
@@ -2160,6 +2252,8 @@ function getSettings(source = process.env) {
     observabilityMetricsEnabled: optional("OPENGENI_OBSERVABILITY_METRICS_ENABLED"),
     observabilityOtlpEndpoint: optional("OPENGENI_OTEL_EXPORTER_OTLP_ENDPOINT") ?? optional("OTEL_EXPORTER_OTLP_ENDPOINT"),
     observabilityOtlpHeaders: optional("OPENGENI_OTEL_EXPORTER_OTLP_HEADERS") ?? optional("OTEL_EXPORTER_OTLP_HEADERS"),
+    observabilityDiagnosticsEndpoint: optional("OPENGENI_OBSERVABILITY_DIAGNOSTICS_ENDPOINT"),
+    observabilityDiagnosticsHeaders: optional("OPENGENI_OBSERVABILITY_DIAGNOSTICS_HEADERS"),
     analyticsEnabled: optional("OPENGENI_ANALYTICS_ENABLED"),
     analyticsConsentRequired: optional("OPENGENI_ANALYTICS_CONSENT_REQUIRED"),
     analyticsReoClientId: optional("OPENGENI_ANALYTICS_REO_CLIENT_ID"),
@@ -2240,10 +2334,6 @@ function getSettings(source = process.env) {
     goalIdleBackoffMs: optional("OPENGENI_GOAL_IDLE_BACKOFF_MS"),
     goalIdleBackoffMaxMs: optional("OPENGENI_GOAL_IDLE_BACKOFF_MAX_MS"),
     childLifecycleNoticesEnabled: optional("OPENGENI_CHILD_LIFECYCLE_NOTICES_ENABLED"),
-    hostMcpAuthoritySourceAdmissionEnabled: optional(
-      "OPENGENI_HOST_MCP_AUTHORITY_SOURCE_ADMISSION_ENABLED"
-    ),
-    hostMcpCredentialResolversJson: optional("OPENGENI_HOST_MCP_CREDENTIAL_RESOLVERS_JSON"),
     slackWorkspaceRoutingEnabled: optional("OPENGENI_SLACK_WORKSPACE_ROUTING_ENABLED"),
     agentMaxModelCallsPerTurn: optional("OPENGENI_AGENT_MAX_MODEL_CALLS_PER_TURN"),
     contextWindowTokens: optional("OPENGENI_CONTEXT_WINDOW_TOKENS"),
@@ -2328,6 +2418,9 @@ function getSettings(source = process.env) {
     lazyToolSearchEnabled: optional("OPENGENI_LAZY_TOOL_SEARCH_ENABLED"),
     codexFleetPolicyShadowEnabled: optional("OPENGENI_CODEX_FLEET_POLICY_SHADOW_ENABLED"),
     codexProductSku: optional("OPENGENI_CODEX_PRODUCT_SKU"),
+    reasoningConfigurationUpdatesEnabled: optional(
+      "OPENGENI_REASONING_CONFIGURATION_UPDATES_ENABLED"
+    ),
     openaiReasoningEffort: optional("OPENGENI_OPENAI_REASONING_EFFORT"),
     openaiAllowedReasoningEfforts: optional("OPENGENI_OPENAI_ALLOWED_REASONING_EFFORTS"),
     openaiResponsesTransport: optional("OPENGENI_OPENAI_RESPONSES_TRANSPORT"),
@@ -2351,6 +2444,7 @@ function getSettings(source = process.env) {
     dockerWorkspaceBaseDir: optional("OPENGENI_DOCKER_WORKSPACE_BASE_DIR"),
     modalAppName: optional("OPENGENI_MODAL_APP_NAME"),
     modalImageRef: optional("OPENGENI_MODAL_IMAGE_REF") ?? DEFAULT_MODAL_IMAGE_REF,
+    modalCommandSupervisionEnabled: optional("OPENGENI_MODAL_COMMAND_SUPERVISION_ENABLED"),
     modalImageId: optional("OPENGENI_MODAL_IMAGE_ID"),
     modalImageRegistrySecret: optional("OPENGENI_MODAL_IMAGE_REGISTRY_SECRET"),
     modalTimeoutSeconds: optional("OPENGENI_MODAL_TIMEOUT_SECONDS"),
@@ -4192,7 +4286,7 @@ async function retryStartupDependency(label, operation, options = {}) {
     try {
       return await operation();
     } catch (error) {
-      if (attempt >= attempts) {
+      if (attempt >= attempts || options.shouldRetry?.(error) === false) {
         throw error;
       }
       const delayMs = Math.min(maxDelayMs, initialDelayMs * 2 ** (attempt - 1));
@@ -4936,60 +5030,7 @@ function validateSettings(settings, source = process.env) {
       );
     }
   }
-  if (settings.objectStorageBackend === "s3-compatible" || settings.objectStorageBackend === "aws-s3") {
-    if (Boolean(settings.objectStorageAccessKeyId) !== Boolean(settings.objectStorageSecretAccessKey)) {
-      throw new Error(
-        "OPENGENI_OBJECT_STORAGE_ACCESS_KEY_ID and OPENGENI_OBJECT_STORAGE_SECRET_ACCESS_KEY must both be set or both omitted"
-      );
-    }
-    if (settings.objectStorageBackend === "s3-compatible" && (settings.objectStorageEndpoint || settings.objectStorageInternalEndpoint || settings.objectStorageSandboxEndpoint) && (!settings.objectStorageAccessKeyId || !settings.objectStorageSecretAccessKey)) {
-      throw new Error(
-        "S3-compatible object storage endpoints require OPENGENI_OBJECT_STORAGE_ACCESS_KEY_ID and OPENGENI_OBJECT_STORAGE_SECRET_ACCESS_KEY"
-      );
-    }
-    if (settings.objectStorageAzureConnectionString || settings.objectStorageAzureAccountName || settings.objectStorageAzureAccountKey || settings.objectStorageAzureEndpoint) {
-      throw new Error(
-        "S3 object storage uses OPENGENI_OBJECT_STORAGE_* S3 settings, not OPENGENI_OBJECT_STORAGE_AZURE_* settings"
-      );
-    }
-    if (settings.objectStorageGcsProjectId || settings.objectStorageGcsCredentialsJson || settings.objectStorageGcsKeyFilename || settings.objectStorageGcsApiEndpoint) {
-      throw new Error(
-        "S3 object storage uses OPENGENI_OBJECT_STORAGE_* S3 settings, not OPENGENI_OBJECT_STORAGE_GCS_* settings"
-      );
-    }
-  } else if (settings.objectStorageBackend === "azure-blob") {
-    if (settings.objectStorageEndpoint || settings.objectStorageInternalEndpoint || settings.objectStorageSandboxEndpoint || settings.objectStorageAccessKeyId || settings.objectStorageSecretAccessKey) {
-      throw new Error(
-        "Azure Blob storage uses OPENGENI_OBJECT_STORAGE_AZURE_* settings, not S3-compatible object storage settings"
-      );
-    }
-    if (settings.objectStorageGcsProjectId || settings.objectStorageGcsCredentialsJson || settings.objectStorageGcsKeyFilename || settings.objectStorageGcsApiEndpoint) {
-      throw new Error(
-        "Azure Blob storage uses OPENGENI_OBJECT_STORAGE_AZURE_* settings, not OPENGENI_OBJECT_STORAGE_GCS_* settings"
-      );
-    }
-    const hasConnectionString = Boolean(settings.objectStorageAzureConnectionString);
-    const hasSharedKey = Boolean(settings.objectStorageAzureAccountName) && Boolean(settings.objectStorageAzureAccountKey);
-    if (!hasConnectionString && !hasSharedKey) {
-      throw new Error(
-        "Azure Blob storage requires OPENGENI_OBJECT_STORAGE_AZURE_CONNECTION_STRING or OPENGENI_OBJECT_STORAGE_AZURE_ACCOUNT_NAME plus OPENGENI_OBJECT_STORAGE_AZURE_ACCOUNT_KEY"
-      );
-    }
-  } else {
-    if (settings.objectStorageEndpoint || settings.objectStorageInternalEndpoint || settings.objectStorageSandboxEndpoint || settings.objectStorageAccessKeyId || settings.objectStorageSecretAccessKey) {
-      throw new Error(
-        "GCS object storage uses OPENGENI_OBJECT_STORAGE_GCS_* settings, not S3-compatible object storage settings"
-      );
-    }
-    if (settings.objectStorageAzureConnectionString || settings.objectStorageAzureAccountName || settings.objectStorageAzureAccountKey || settings.objectStorageAzureEndpoint) {
-      throw new Error(
-        "GCS object storage uses OPENGENI_OBJECT_STORAGE_GCS_* settings, not OPENGENI_OBJECT_STORAGE_AZURE_* settings"
-      );
-    }
-    if (settings.objectStorageGcsCredentialsJson) {
-      parseGcsCredentialsJson(settings.objectStorageGcsCredentialsJson);
-    }
-  }
+  validateObjectStorageSettings(settings);
   if (settings.documentChunkOverlap >= settings.documentChunkSize) {
     throw new Error(
       "OPENGENI_DOCUMENT_CHUNK_OVERLAP must be smaller than OPENGENI_DOCUMENT_CHUNK_SIZE"
@@ -5017,9 +5058,9 @@ function validateSettings(settings, source = process.env) {
       throw new Error(`OPENGENI_MCP_SERVERS contains duplicate id ${server.id}`);
     }
     serverIds.add(server.id);
-    if (server.connectionRef?.authoritySource === "host" && !settings.hostMcpAuthoritySourceAdmissionEnabled) {
+    if (server.connectionRef?.authoritySource === "host") {
       throw new Error(
-        "OPENGENI_MCP_SERVERS host-owned connection refs require OPENGENI_HOST_MCP_AUTHORITY_SOURCE_ADMISSION_ENABLED=true after the whole API/worker fleet is upgraded"
+        "OPENGENI_MCP_SERVERS host-owned connection refs are no longer supported; select ordinary native connections"
       );
     }
   }
@@ -5242,6 +5283,62 @@ function resolveNatsCalloutConfig(settings) {
   }
   return { accountSeed, accountName, user, password };
 }
+function validateObjectStorageSettings(settings) {
+  if (settings.objectStorageBackend === "s3-compatible" || settings.objectStorageBackend === "aws-s3") {
+    if (Boolean(settings.objectStorageAccessKeyId) !== Boolean(settings.objectStorageSecretAccessKey)) {
+      throw new Error(
+        "OPENGENI_OBJECT_STORAGE_ACCESS_KEY_ID and OPENGENI_OBJECT_STORAGE_SECRET_ACCESS_KEY must both be set or both omitted"
+      );
+    }
+    if (settings.objectStorageBackend === "s3-compatible" && (settings.objectStorageEndpoint || settings.objectStorageInternalEndpoint || settings.objectStorageSandboxEndpoint) && (!settings.objectStorageAccessKeyId || !settings.objectStorageSecretAccessKey)) {
+      throw new Error(
+        "S3-compatible object storage endpoints require OPENGENI_OBJECT_STORAGE_ACCESS_KEY_ID and OPENGENI_OBJECT_STORAGE_SECRET_ACCESS_KEY"
+      );
+    }
+    if (settings.objectStorageAzureConnectionString || settings.objectStorageAzureAccountName || settings.objectStorageAzureAccountKey || settings.objectStorageAzureEndpoint) {
+      throw new Error(
+        "S3 object storage uses OPENGENI_OBJECT_STORAGE_* S3 settings, not OPENGENI_OBJECT_STORAGE_AZURE_* settings"
+      );
+    }
+    if (settings.objectStorageGcsProjectId || settings.objectStorageGcsCredentialsJson || settings.objectStorageGcsKeyFilename || settings.objectStorageGcsApiEndpoint) {
+      throw new Error(
+        "S3 object storage uses OPENGENI_OBJECT_STORAGE_* S3 settings, not OPENGENI_OBJECT_STORAGE_GCS_* settings"
+      );
+    }
+  } else if (settings.objectStorageBackend === "azure-blob") {
+    if (settings.objectStorageEndpoint || settings.objectStorageInternalEndpoint || settings.objectStorageSandboxEndpoint || settings.objectStorageAccessKeyId || settings.objectStorageSecretAccessKey) {
+      throw new Error(
+        "Azure Blob storage uses OPENGENI_OBJECT_STORAGE_AZURE_* settings, not S3-compatible object storage settings"
+      );
+    }
+    if (settings.objectStorageGcsProjectId || settings.objectStorageGcsCredentialsJson || settings.objectStorageGcsKeyFilename || settings.objectStorageGcsApiEndpoint) {
+      throw new Error(
+        "Azure Blob storage uses OPENGENI_OBJECT_STORAGE_AZURE_* settings, not OPENGENI_OBJECT_STORAGE_GCS_* settings"
+      );
+    }
+    const hasConnectionString = Boolean(settings.objectStorageAzureConnectionString);
+    const hasSharedKey = Boolean(settings.objectStorageAzureAccountName) && Boolean(settings.objectStorageAzureAccountKey);
+    if (!hasConnectionString && !hasSharedKey) {
+      throw new Error(
+        "Azure Blob storage requires OPENGENI_OBJECT_STORAGE_AZURE_CONNECTION_STRING or OPENGENI_OBJECT_STORAGE_AZURE_ACCOUNT_NAME plus OPENGENI_OBJECT_STORAGE_AZURE_ACCOUNT_KEY"
+      );
+    }
+  } else {
+    if (settings.objectStorageEndpoint || settings.objectStorageInternalEndpoint || settings.objectStorageSandboxEndpoint || settings.objectStorageAccessKeyId || settings.objectStorageSecretAccessKey) {
+      throw new Error(
+        "GCS object storage uses OPENGENI_OBJECT_STORAGE_GCS_* settings, not S3-compatible object storage settings"
+      );
+    }
+    if (settings.objectStorageAzureConnectionString || settings.objectStorageAzureAccountName || settings.objectStorageAzureAccountKey || settings.objectStorageAzureEndpoint) {
+      throw new Error(
+        "GCS object storage uses OPENGENI_OBJECT_STORAGE_GCS_* settings, not OPENGENI_OBJECT_STORAGE_AZURE_* settings"
+      );
+    }
+    if (settings.objectStorageGcsCredentialsJson) {
+      parseGcsCredentialsJson(settings.objectStorageGcsCredentialsJson);
+    }
+  }
+}
 function resolveNatsControlPlaneAuth(settings) {
   const user = settings.selfhostedNatsControlUser?.trim();
   const password = settings.selfhostedNatsControlPassword?.trim();
@@ -5385,6 +5482,8 @@ export {
   firstPartyMcpInternalWorkspaceUrl,
   firstPartyMcpWorkspaceUrl,
   gatewayRequestPolicyForUpstreamModel,
+  getArtifactMaterializerSettings,
+  getArtifactOutboxSettings,
   getSettings,
   googleDriveOAuthCallbackUrl,
   googleDriveProviderRetryOptions,