@opengeni/config 3.2.1 → 3.3.0-canary.37090756480001

package/dist/index.js

@@ -1,10 +1,11 @@
 // src/managed-user-admission.ts
 function managedUserEmailAllowed(allowedUserEmails, email) {
-  return allowedUserEmails === void 0 || typeof email === "string" && allowedUserEmails.some((allowed) => allowed.toLowerCase() === email.trim().toLowerCase());
+  return allowedUserEmails === void 0 || typeof email === "string" && allowedUserEmails.some((allowed2) => allowed2.toLowerCase() === email.trim().toLowerCase());
 }
 
 // src/index.ts
 import {
+  directModelConnectionSpec,
   BillingMode,
   CAPABILITY_DESCRIPTORS,
   agentConfigDeploymentLimitsFromAllowlist,
@@ -79,13 +80,45 @@ function epoch(value) {
 function status(value) {
   return value === "allowed" || value === "allowed_warning" || value === "rejected" ? value : null;
 }
-function parseClaudeUsageHeaders(headers, now = /* @__PURE__ */ new Date()) {
+function latestReset(left, right, observedAt) {
+  return new Date(
+    Math.max(
+      left ? Date.parse(left) : Date.parse(observedAt) + 6e4,
+      right ? Date.parse(right) : Date.parse(observedAt) + 6e4
+    )
+  ).toISOString();
+}
+function evidenceKey(item) {
+  return JSON.stringify([
+    item.upstreamModelId,
+    item.upstreamModelId ? null : item.representativeClaim,
+    item.source === "provider"
+  ]);
+}
+function tiedRequest(left, right) {
+  const denied = left.status === "rejected" ? left : right.status === "rejected" ? right : null;
+  return {
+    ...denied ?? left,
+    resetsAt: denied ? latestReset(
+      left.status === "rejected" ? left.resetsAt : denied.resetsAt,
+      right.status === "rejected" ? right.resetsAt : denied.resetsAt,
+      left.observedAt
+    ) : null,
+    representativeClaim: left.representativeClaim === right.representativeClaim ? left.representativeClaim : null,
+    status: denied ? "rejected" : null,
+    overageStatus: null,
+    overageResetsAt: null
+  };
+}
+function parseClaudeUsageHeaders(headers, now = /* @__PURE__ */ new Date(), upstreamModelId) {
   const observedAt = now.toISOString();
   const claim = ClaudeUsageWindowId.safeParse(
     headers.get("anthropic-ratelimit-unified-representative-claim")
   );
   const claimedStatus = status(headers.get("anthropic-ratelimit-unified-status"));
   const claimedReset = epoch(headers.get("anthropic-ratelimit-unified-reset"));
+  const overageStatus = status(headers.get("anthropic-ratelimit-unified-overage-status"));
+  const overageResetsAt = epoch(headers.get("anthropic-ratelimit-unified-overage-reset"));
   const windows = ClaudeUsageWindowId.options.flatMap((id) => {
     const header = (suffix) => prefixes[id].map(
       (prefix) => headers.get(`anthropic-ratelimit-unified-${prefix}-${suffix}`)
@@ -97,7 +130,20 @@ function parseClaudeUsageHeaders(headers, now = /* @__PURE__ */ new Date()) {
     if (usedPercent === null && resetsAt === null && windowStatus === null) return [];
     return [{ id, usedPercent, resetsAt, status: windowStatus, observedAt }];
   });
-  return windows.length ? { windows, observedAt, source: "response_headers" } : null;
+  return windows.length || claimedStatus || overageStatus ? {
+    windows,
+    observedAt,
+    source: "response_headers",
+    requestStatus: {
+      status: claimedStatus,
+      resetsAt: claimedReset,
+      representativeClaim: claim.success ? claim.data : null,
+      overageStatus,
+      overageResetsAt,
+      upstreamModelId: upstreamModelId ?? null,
+      observedAt
+    }
+  } : null;
 }
 function parseClaudeUsageResponse(value, now = /* @__PURE__ */ new Date()) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return null;
@@ -127,17 +173,130 @@ function emptyClaudeUsage(credentialVersion) {
 }
 function mergeClaudeUsage(current, observation) {
   const windows = new Map(current.windows.map((window) => [window.id, window]));
-  for (const window of observation.windows) {
+  for (const incomingWindow of observation.windows) {
+    const window = { ...incomingWindow, source: incomingWindow.source ?? observation.source };
     const previous = windows.get(window.id);
-    if (!previous || previous.observedAt <= window.observedAt) windows.set(window.id, window);
+    if (!previous || previous.observedAt < window.observedAt) windows.set(window.id, window);
+    else if (previous.observedAt === window.observedAt && JSON.stringify(previous) !== JSON.stringify(window)) {
+      const rejected = previous.status === "rejected" || window.status === "rejected";
+      const full = (previous.usedPercent ?? 0) >= 100 || (window.usedPercent ?? 0) >= 100;
+      windows.set(window.id, {
+        ...previous,
+        usedPercent: previous.usedPercent === null ? window.usedPercent : window.usedPercent === null ? previous.usedPercent : Math.max(previous.usedPercent, window.usedPercent),
+        status: rejected ? "rejected" : previous.status === window.status ? previous.status : null,
+        resetsAt: rejected || full ? latestReset(previous.resetsAt, window.resetsAt, window.observedAt) : previous.resetsAt === window.resetsAt ? previous.resetsAt : null,
+        source: previous.source === "response_headers" || window.source === "response_headers" ? "response_headers" : "provider"
+      });
+    }
+  }
+  const incoming = observation.requestStatus;
+  const restrictions = new Map(
+    (current.requestRestrictions ?? []).map((item) => [evidenceKey(item), item])
+  );
+  for (const item of [
+    current.requestStatus?.status ? current.requestStatus : null,
+    ...observation.requestRestrictions ?? [],
+    incoming?.status ? incoming : null
+  ]) {
+    if (!item) continue;
+    const key = evidenceKey(item);
+    const previous = restrictions.get(key);
+    const sanitized = {
+      ...item,
+      overageStatus: null,
+      overageResetsAt: null
+    };
+    if (!previous || item.observedAt > previous.observedAt) restrictions.set(key, sanitized);
+    else if (item.observedAt === previous.observedAt && JSON.stringify(previous) !== JSON.stringify(sanitized))
+      restrictions.set(key, tiedRequest(previous, sanitized));
+  }
+  const directWindows = [
+    ...current.windows.filter(
+      (window) => window.source === "provider" || !window.source && current.source === "provider" && current.observedAt === window.observedAt
+    ),
+    ...observation.windows.filter((window) => (window.source ?? observation.source) === "provider")
+  ];
+  for (const window of directWindows) {
+    if (window.usedPercent === null || window.usedPercent >= 100) continue;
+    const proof = {
+      status: null,
+      resetsAt: null,
+      representativeClaim: window.id,
+      upstreamModelId: null,
+      overageStatus: null,
+      overageResetsAt: null,
+      observedAt: window.observedAt,
+      source: "provider"
+    };
+    const key = evidenceKey(proof);
+    if (!restrictions.has(key) || restrictions.get(key).observedAt < proof.observedAt)
+      restrictions.set(key, proof);
+  }
+  for (const [key, item] of restrictions) {
+    if (item.status !== "rejected") continue;
+    const proof = [...restrictions.values()].find(
+      (candidate) => candidate.source === "provider" && candidate.representativeClaim === item.representativeClaim && candidate.observedAt > item.observedAt && candidate.representativeClaim !== "overage" && candidate.representativeClaim !== "seven_day_overage_included"
+    );
+    if (proof)
+      restrictions.set(key, {
+        ...item,
+        status: null,
+        resetsAt: null,
+        observedAt: proof.observedAt
+      });
+  }
+  let requestRestrictions = [...restrictions.values()];
+  const evidenceTime = requestRestrictions.reduce(
+    (value, item) => item.observedAt > value ? item.observedAt : value,
+    observation.observedAt
+  );
+  const liveDenials = requestRestrictions.filter(
+    (item) => item.status === "rejected" && (item.resetsAt ? Date.parse(item.resetsAt) : Date.parse(item.observedAt) + 6e4) > Date.parse(evidenceTime)
+  );
+  if (requestRestrictions.length > 64 && liveDenials.length === 0) {
+    requestRestrictions = requestRestrictions.sort((left, right) => right.observedAt.localeCompare(left.observedAt)).slice(0, 64);
+  } else if (requestRestrictions.length > 64) {
+    const observedAt = evidenceTime;
+    const resetsAt = new Date(
+      Math.max(
+        ...liveDenials.map(
+          (item) => item.resetsAt ? Date.parse(item.resetsAt) : Date.parse(item.observedAt) + 6e4
+        ),
+        Date.parse(observedAt) + 6e4
+      )
+    ).toISOString();
+    requestRestrictions = [
+      {
+        status: "rejected",
+        resetsAt,
+        representativeClaim: null,
+        overageStatus: null,
+        overageResetsAt: null,
+        upstreamModelId: null,
+        observedAt
+      }
+    ];
+  }
+  const newest = !current.observedAt || current.observedAt < observation.observedAt;
+  const tied = current.observedAt === observation.observedAt;
+  let requestStatus = current.requestStatus ?? null;
+  if (newest) requestStatus = incoming ?? null;
+  else if (tied && JSON.stringify(requestStatus) !== JSON.stringify(incoming ?? null)) {
+    requestStatus = incoming && requestStatus && evidenceKey(incoming) === evidenceKey(requestStatus) ? tiedRequest(requestStatus, incoming) : null;
   }
-  const newest = !current.observedAt || current.observedAt <= observation.observedAt;
   return {
     ...current,
+    requestRestrictions,
+    requestStatus,
     windows: ClaudeUsageWindowId.options.flatMap(
       (id) => windows.has(id) ? [windows.get(id)] : []
     ),
-    ...newest ? { observedAt: observation.observedAt, source: observation.source } : {}
+    ...newest ? {
+      observedAt: observation.observedAt,
+      source: observation.source
+      // A newer direct or partial observation cannot retain an older paid
+      // fallback authorization. Window readings remain independently merged.
+    } : {}
   };
 }
 
@@ -167,6 +326,90 @@ function claudeAuthorizationUrl(input) {
   return url.toString();
 }
 
+// src/subscription-account-selection.ts
+function subscriptionAccountShardIndex(sessionId, candidateCount) {
+  if (!Number.isSafeInteger(candidateCount) || candidateCount <= 0)
+    throw new Error("Subscription shard candidate count must be positive");
+  let hash = 2166136261;
+  for (let index = 0; index < sessionId.length; index += 1) {
+    hash ^= sessionId.charCodeAt(index);
+    hash = Math.imul(hash, 16777619);
+  }
+  return (hash >>> 0) % candidateCount;
+}
+function selectSubscriptionAccount(input) {
+  const pinned = input.eligible.find((account) => account.id === input.pinnedCredentialId);
+  if (input.pinnedCredentialId && input.pinSource !== "policy") return pinned ?? null;
+  if (!input.rotationEnabled)
+    return input.eligible.find((account) => account.id === input.activeCredentialId) ?? null;
+  return pinned ?? (input.eligible.length ? input.eligible[subscriptionAccountShardIndex(input.sessionId, input.eligible.length)] : null);
+}
+
+// src/claude-subscription-capacity.ts
+var UNKNOWN_RESET_RECHECK_MS = 6e4;
+var allowed = (status2) => status2 === "allowed" || status2 === "allowed_warning";
+function claudeSubscriptionCapacity(usage, upstreamModelId, now, options = {}) {
+  const available = { available: true, nextCheckAt: null, blockingWindows: [] };
+  if (!usage.connected || usage.refreshStatus === "reconnect")
+    return { ...available, available: false };
+  const relevant = (id) => {
+    if (id === "seven_day_opus") return /^claude-opus-/.test(upstreamModelId);
+    if (id === "seven_day_sonnet") return /^claude-sonnet-/.test(upstreamModelId);
+    return id === "five_hour" || id === "seven_day";
+  };
+  const applicable = usage.windows.filter((window) => relevant(window.id));
+  const relevantClaim = (id) => id === "seven_day_opus" || id === "seven_day_sonnet" ? relevant(id) : true;
+  const restrictions = (usage.requestRestrictions ?? []).filter(
+    (item) => item.status === "rejected" && (item.upstreamModelId === upstreamModelId || item.upstreamModelId === null && relevantClaim(item.representativeClaim)) && !applicable.some(
+      (window) => window.source === "provider" && window.usedPercent !== null && window.usedPercent < 100 && window.id === item.representativeClaim && window.observedAt > item.observedAt
+    ) && (item.resetsAt ? Date.parse(item.resetsAt) : Date.parse(item.observedAt) + UNKNOWN_RESET_RECHECK_MS) > now.getTime()
+  );
+  const blocking = applicable.filter((window) => {
+    if ((window.resetsAt ? Date.parse(window.resetsAt) : Date.parse(window.observedAt) + UNKNOWN_RESET_RECHECK_MS) <= now.getTime())
+      return false;
+    return window.status === "rejected" || window.status === null && (window.usedPercent ?? 0) >= 100;
+  });
+  const request = usage.requestStatus;
+  const exactModel = request?.upstreamModelId === upstreamModelId;
+  const relevantRequest = request && (exactModel || request.upstreamModelId === null && relevantClaim(request.representativeClaim));
+  const freshRequest = relevantRequest && applicable.every((window) => window.observedAt <= request.observedAt) && restrictions.every((item) => item.observedAt <= request.observedAt);
+  const planResetElapsed = request && (request.resetsAt ? Date.parse(request.resetsAt) : Date.parse(request.observedAt) + UNKNOWN_RESET_RECHECK_MS) <= now.getTime();
+  const exactAllowance = (usage.requestRestrictions ?? []).find(
+    (item) => item.upstreamModelId === upstreamModelId && allowed(item.status) && blocking.every((window) => window.observedAt < item.observedAt) && restrictions.every((restriction) => restriction.observedAt < item.observedAt)
+  );
+  if (exactAllowance) return available;
+  if (freshRequest && exactModel && allowed(request.status) && !planResetElapsed) return available;
+  const mayUseOverage = options.allowOverage !== false;
+  const overageResetElapsed = request?.overageResetsAt && Date.parse(request.overageResetsAt) <= now.getTime();
+  if (freshRequest && request.status === "rejected" && mayUseOverage && allowed(request.overageStatus) && !overageResetElapsed)
+    return available;
+  const rejectedRequest = freshRequest && request.status === "rejected" && !planResetElapsed;
+  if (blocking.length === 0 && !rejectedRequest && restrictions.length === 0) return available;
+  const resets = blocking.map(
+    (window) => window.resetsAt ? Date.parse(window.resetsAt) : Date.parse(window.observedAt) + UNKNOWN_RESET_RECHECK_MS
+  );
+  if (rejectedRequest)
+    resets.push(
+      request.resetsAt ? Date.parse(request.resetsAt) : Date.parse(request.observedAt) + UNKNOWN_RESET_RECHECK_MS
+    );
+  resets.push(
+    ...restrictions.map(
+      (item) => item.resetsAt ? Date.parse(item.resetsAt) : Date.parse(item.observedAt) + UNKNOWN_RESET_RECHECK_MS
+    )
+  );
+  let nextCheckAt = Math.max(...resets);
+  if (rejectedRequest && mayUseOverage && request.overageStatus === "rejected" && request.overageResetsAt) {
+    const overageReset = Date.parse(request.overageResetsAt);
+    if (overageReset <= now.getTime()) return available;
+    nextCheckAt = Math.min(nextCheckAt, overageReset);
+  }
+  return {
+    available: false,
+    nextCheckAt: new Date(nextCheckAt),
+    blockingWindows: blocking.map((window) => window.id)
+  };
+}
+
 // src/index.ts
 var envName = /^[A-Za-z_][A-Za-z0-9_]*$/;
 var registryId = /^[A-Za-z0-9_-]+$/;
@@ -195,6 +438,7 @@ var EnvBoolean = z2.preprocess((value) => {
   }
   return value;
 }, z2.boolean());
+var PublicHttpUrl = z2.string().url().max(2048).refine((value) => /^https?:\/\//iu.test(value), "must be an http(s) URL");
 var DEFAULT_GOAL_IDLE_BACKOFF_MS = [3e3, 3e4, 12e4, 3e5];
 var DEFAULT_GOAL_IDLE_BACKOFF_MAX_MS = 6e5;
 var EnvGoalIdleBackoffMs = z2.preprocess((value) => {
@@ -353,6 +597,15 @@ var SettingsSchema = z2.object({
   analyticsPosthogProjectKey: z2.string().min(1).max(256).optional(),
   analyticsPosthogHost: z2.string().url().max(2048).optional(),
   analyticsGa4MeasurementId: z2.string().max(32).regex(/^G-[A-Z0-9]+$/u).optional(),
+  // Optional operator-owned legal documents linked from the signed-out console.
+  // Unset by default, so a self-hosted deployment never shows another operator's
+  // policies; the managed service points these at its own published pages.
+  legalPrivacyPolicyUrl: PublicHttpUrl.optional(),
+  legalTermsOfServiceUrl: PublicHttpUrl.optional(),
+  // Optional operator support address, shown as a "Contact support" mailto link
+  // on the signed-out page and in the Help menu. Unset by default for the same
+  // reason as the legal links.
+  supportEmail: z2.string().trim().email().max(254).optional(),
   publicBaseUrl: z2.string().url().optional(),
   // Product documentation the web console links from its Help menu. Absent
   // means the public OpenGeni docs; `none` hides the link for deployments that
@@ -1134,6 +1387,28 @@ var SettingsSchema = z2.object({
   // getSettings caps the default at half a shorter configured Modal lifetime so
   // the entire reaper window always fits. Knob: OPENGENI_SANDBOX_IDLE_GRACE_MS.
   sandboxIdleGraceMs: z2.coerce.number().int().positive().default(9e5),
+  // Idle command containment. A legacy retained background command (a dev
+  // server, a command whose output is still draining, a stopped command the
+  // provider no longer answers for) keeps its box warm through a non-expiring
+  // process holder, so the zero-holder drain never runs and the box would stay
+  // up until the provider deadline kills it uncaptured. Once every session of
+  // the sandbox group has been unused this long - no open turn or pending
+  // request, no held wait_for_input, no other holder or writer, measured from
+  // durable turn/holder/admission facts - the reaper checkpoints the workspace,
+  // stops the box and settles those commands `lost` with reason
+  // `idle_containment`. Default 30min: twice the default
+  // idle grace, so a lease that is only waiting for a "glanced away" user is
+  // never contained earlier than an idle lease would drain, and well inside
+  // the 1h provider-deadline rotation lead, so an idle box is saved long before
+  // the deadline path has to act. Set 0 to disable new idle enrollments without
+  // disabling provider-deadline containment or cancelling an enrolled drain.
+  // A positive window must exceed OPENGENI_SANDBOX_IDLE_GRACE_MS;
+  // an explicit positive value must also stay below OPENGENI_SANDBOX_ROTATION_LEAD_MS,
+  // and with an explicit OPENGENI_MODAL_IDLE_TIMEOUT_SECONDS the reaper period
+  // plus this window plus the drain capture budget must fit before it.
+  // getSettings derives the unset default between those two for short-lived
+  // provider lifetimes. Knob: OPENGENI_SANDBOX_IDLE_COMMAND_CONTAINMENT_MS.
+  sandboxIdleCommandContainmentMs: z2.coerce.number().int().nonnegative().optional().transform((value) => value === 0 ? void 0 : value),
   // MID-SESSION /workspace snapshot cadence (sandbox-file-persistence). The
   // reaper's drain-persist only protects boxes the reaper itself kills; a box
   // that dies any other way (Modal's hard creation-time timeout on a session
@@ -1708,6 +1983,8 @@ var RegistryProviderKind = z2.enum([
   "vercel-gateway-managed",
   "vercel-gateway-workspace",
   "vercel-gateway-organization",
+  "direct-openai-workspace",
+  "direct-azure-workspace",
   "openrouter-workspace",
   "openrouter-organization",
   "anthropic-organization",
@@ -2005,7 +2282,10 @@ var CodexCatalogModelSchema = RegistryModelSchema.safeExtend({
       message: "Codex product id must match its upstream model slug"
     });
   }
-});
+}).transform((model) => ({
+  ...model,
+  capabilities: reviewedCodexCatalogCapabilities(model.upstreamModelId, model.capabilities)
+}));
 var ModelCatalogDocument = z2.object({
   schemaVersion: z2.literal(1),
   /** Canonical deployment default. Omission preserves the V1 first-built-in
@@ -2060,7 +2340,7 @@ var ModelCatalogDocument = z2.object({
     });
   }
   document.registryProviders.forEach((provider, providerIndex) => {
-    if (RESERVED_MODEL_PROVIDER_IDS.has(provider.id)) {
+    if (RESERVED_MODEL_PROVIDER_IDS.has(provider.id) || provider.id.startsWith("workspace-openai-") || provider.id.startsWith("workspace-azure-openai-")) {
       context.addIssue({
         code: "custom",
         path: ["registryProviders", providerIndex, "id"],
@@ -2576,6 +2856,7 @@ function optionalEnvironmentValue(name, source) {
   const value = source[name];
   return value && value.trim().length > 0 ? value : void 0;
 }
+var idleCommandContainmentDisabledWarned = false;
 function getSettings(source = process.env) {
   const optional = (name) => optionalEnvironmentValue(name, source);
   const modelCatalogSource = optional("OPENGENI_MODEL_CATALOG_SOURCE");
@@ -2625,6 +2906,9 @@ function getSettings(source = process.env) {
     analyticsPosthogProjectKey: optional("OPENGENI_ANALYTICS_POSTHOG_PROJECT_KEY"),
     analyticsPosthogHost: optional("OPENGENI_ANALYTICS_POSTHOG_HOST"),
     analyticsGa4MeasurementId: optional("OPENGENI_ANALYTICS_GA4_MEASUREMENT_ID"),
+    legalPrivacyPolicyUrl: optional("OPENGENI_LEGAL_PRIVACY_POLICY_URL"),
+    legalTermsOfServiceUrl: optional("OPENGENI_LEGAL_TERMS_OF_SERVICE_URL"),
+    supportEmail: optional("OPENGENI_SUPPORT_EMAIL"),
     publicBaseUrl: optional("OPENGENI_PUBLIC_BASE_URL"),
     documentationUrl: optional("OPENGENI_DOCUMENTATION_URL"),
     mcpOauthEnabled: optional("OPENGENI_MCP_OAUTH_ENABLED"),
@@ -2929,6 +3213,7 @@ function getSettings(source = process.env) {
     sandboxViewerHolderTtlMs: optional("OPENGENI_SANDBOX_VIEWER_HOLDER_TTL_MS"),
     sandboxInteractionHolderTtlMs: optional("OPENGENI_SANDBOX_INTERACTION_HOLDER_TTL_MS"),
     sandboxIdleGraceMs: optional("OPENGENI_SANDBOX_IDLE_GRACE_MS"),
+    sandboxIdleCommandContainmentMs: optional("OPENGENI_SANDBOX_IDLE_COMMAND_CONTAINMENT_MS"),
     sandboxSnapshotIntervalMs: optional("OPENGENI_SANDBOX_SNAPSHOT_INTERVAL_MS"),
     sandboxSnapshotTimeoutMs: optional("OPENGENI_SANDBOX_SNAPSHOT_TIMEOUT_MS"),
     sandboxDrainSnapshotTimeoutMs: optional("OPENGENI_SANDBOX_DRAIN_SNAPSHOT_TIMEOUT_MS"),
@@ -3048,6 +3333,27 @@ function getSettings(source = process.env) {
     ) : parsed.sandboxRotationLeadMs,
     mcpServers: ensureBuiltInMcpServers(parsed)
   };
+  if (raw.sandboxIdleCommandContainmentMs === void 0) {
+    const modalIdleCeilingMs = settings.sandboxBackend === "modal" && settings.modalIdleTimeoutSeconds !== void 0 ? settings.modalIdleTimeoutSeconds * 1e3 - settings.sandboxLeaseReaperPeriodMs - sandboxArchiveCaptureTimeoutMs({
+      sandboxSnapshotTimeoutMs: effectiveSandboxDrainSnapshotTimeoutMs(settings)
+    }) - 1 : Number.POSITIVE_INFINITY;
+    const derived = Math.min(
+      18e5,
+      Math.floor((settings.sandboxIdleGraceMs + settings.sandboxRotationLeadMs) / 2),
+      modalIdleCeilingMs
+    );
+    if (derived > settings.sandboxIdleGraceMs) {
+      settings.sandboxIdleCommandContainmentMs = derived;
+    } else {
+      settings.sandboxIdleCommandContainmentMs = void 0;
+      if (!idleCommandContainmentDisabledWarned) {
+        idleCommandContainmentDisabledWarned = true;
+        console.warn(
+          `[config] idle command containment disabled: no window fits between OPENGENI_SANDBOX_IDLE_GRACE_MS (${settings.sandboxIdleGraceMs}) and the Modal idle timeout / rotation lead ceiling; set OPENGENI_SANDBOX_IDLE_COMMAND_CONTAINMENT_MS to override.`
+        );
+      }
+    }
+  }
   validateSettings(settings, source);
   return settings;
 }
@@ -3062,24 +3368,24 @@ function resolveFirstPartyDelegationSecret(settings) {
   return settings.productAccessMode === "local" && (settings.environment === "local" || settings.environment === "test") ? LOCAL_FIRST_PARTY_DELEGATION_SECRET : void 0;
 }
 function resolveFirstPartyMcpToolPolicy(settings) {
-  const allowed = currentAgentLearningToolSelection(
+  const allowed2 = currentAgentLearningToolSelection(
     settings.allowedFirstPartyMcpTools ?? [...FIRST_PARTY_MCP_TOOL_NAMES]
   );
-  const allowedSet = new Set(allowed);
+  const allowedSet = new Set(allowed2);
   const defaults = currentAgentLearningToolSelection(
     settings.defaultFirstPartyMcpTools ?? [...DEFAULT_FIRST_PARTY_MCP_TOOLS]
   );
   return {
     default: defaults.filter((tool) => allowedSet.has(tool)),
-    allowed: [...allowed]
+    allowed: [...allowed2]
   };
 }
 function allowedFirstPartyMcpToolsForSession(settings, selected) {
   const policy = resolveFirstPartyMcpToolPolicy(settings);
-  const allowed = new Set(policy.allowed);
+  const allowed2 = new Set(policy.allowed);
   const tools = new Set(currentAgentLearningToolSelection(selected ?? policy.default));
   if (tools.has("goal_pause")) tools.add("goal_resume");
-  return [...tools].filter((tool) => allowed.has(tool));
+  return [...tools].filter((tool) => allowed2.has(tool));
 }
 function effectiveModalIdleTimeoutSeconds(settings) {
   return settings.modalIdleTimeoutSeconds ?? settings.modalTimeoutSeconds;
@@ -3578,6 +3884,37 @@ function configuredRegistryProviders(settings) {
   if (openrouter) injected.push(openrouter);
   return injected;
 }
+function withDirectModelProviders(settings, connections) {
+  const providers = parseModelProvidersJson(settings.modelProvidersJson).filter(
+    (provider) => !provider.id.startsWith("workspace-openai-") && !provider.id.startsWith("workspace-azure-openai-")
+  );
+  for (const connection of connections) {
+    const spec = directModelConnectionSpec(connection);
+    if (!spec) continue;
+    providers.push({
+      kind: spec.provider === "openai" ? "direct-openai-workspace" : "direct-azure-workspace",
+      id: spec.providerId,
+      label: spec.provider === "openai" ? "Your OpenAI" : "Your Azure OpenAI",
+      api: "responses",
+      wireProfile: spec.provider === "openai" ? "openai" : "azure-openai",
+      baseUrl: spec.baseUrl,
+      ...connection.apiKey ? { apiKey: connection.apiKey } : {},
+      models: [
+        {
+          id: spec.modelId,
+          upstreamModelId: spec.model,
+          label: spec.model,
+          capabilities: legacyModelCapabilities(settings, {
+            reasoningEffort: false,
+            hostedWebSearch: false
+          }),
+          toolOutputTruncationTokens: settings.modelToolOutputTruncationTokens
+        }
+      ]
+    });
+  }
+  return { ...settings, modelProvidersJson: JSON.stringify(providers) };
+}
 function withWorkspaceGatewayCatalogProvider(settings, customModels = []) {
   const providers = parseModelProvidersJson(settings.modelProvidersJson);
   const withoutWorkspace = providers.filter(
@@ -3723,7 +4060,7 @@ function builtinContextLimitsForModel(settings, modelId) {
   return { contextWindowTokens: settings.contextWindowTokens };
 }
 function builtinLatencyModesForModel(modelId) {
-  if (isBuiltinGpt56ModelId(modelId) || modelId.startsWith("gpt-6-") || modelId.startsWith("codex/gpt-5.6-") || modelId.startsWith("codex/gpt-6-")) {
+  if (isBuiltinGpt56ModelId(modelId) || /^gpt-6(?:\.\d+)?-/u.test(modelId) || modelId.startsWith("codex/gpt-5.6-") || /^codex\/gpt-6(?:\.\d+)?-/u.test(modelId)) {
     return [
       { id: "standard", upstream: "supported", runnable: true },
       {
@@ -3736,6 +4073,20 @@ function builtinLatencyModesForModel(modelId) {
   }
   return [{ id: "standard", upstream: "unknown", runnable: true }];
 }
+function isReviewedGptVisionModel(slug) {
+  return slug.startsWith("gpt-5.6-") || /^gpt-6(?:\.\d+)?-/u.test(slug);
+}
+function reviewedCodexCatalogCapabilities(slug, capabilities) {
+  if (!/^gpt-6(?:\.\d+)?-/u.test(slug)) return capabilities;
+  const fast = builtinLatencyModesForModel(`${CODEX_MODEL_ID_PREFIX}${slug}`).find(
+    (mode) => mode.id === "fast"
+  );
+  return normalizeCapabilities({
+    ...capabilities,
+    inputModalities: [.../* @__PURE__ */ new Set([...capabilities.inputModalities, "image"])],
+    latencyModes: fast && !capabilities.latencyModes.some((mode) => mode.id === "fast") ? [...capabilities.latencyModes, fast] : capabilities.latencyModes
+  });
+}
 function builtinPromptCachingForModel(modelId) {
   const slug = modelId.startsWith(CODEX_MODEL_ID_PREFIX) ? modelId.slice(CODEX_MODEL_ID_PREFIX.length) : modelId;
   return slug.startsWith("gpt-5.6-") || slug.startsWith("gpt-6-") ? { upstream: "supported", runnable: true, mode: "implicit" } : void 0;
@@ -3780,11 +4131,21 @@ function runnableLatencyModesForModel(settings, modelId) {
 function assertLatencyModeRunnable(settings, modelId, latencyMode) {
   const runnable = runnableLatencyModesForModel(settings, modelId);
   if (!runnable.includes(latencyMode)) {
-    throw new Error(
-      `latency mode ${latencyMode} is not runnable for model ${modelId} (allowed: ${runnable.join(", ")})`
-    );
+    throw new UnsupportedLatencyModeError(modelId, latencyMode, runnable);
   }
 }
+var UnsupportedLatencyModeError = class extends Error {
+  constructor(modelId, latencyMode, allowedLatencyModes) {
+    super(
+      `latency mode ${latencyMode} is not runnable for model ${modelId} (allowed: ${allowedLatencyModes.join(", ")})`
+    );
+    this.modelId = modelId;
+    this.latencyMode = latencyMode;
+    this.allowedLatencyModes = allowedLatencyModes;
+    this.name = "UnsupportedLatencyModeError";
+  }
+  code = "UNSUPPORTED_LATENCY_MODE";
+};
 function registryCredentialSource(provider) {
   switch (provider.kind) {
     case "anonymous":
@@ -3794,6 +4155,8 @@ function registryCredentialSource(provider) {
     case "xai-subscription":
       return { kind: "connected_subscription", provider: "xai" };
     case "vercel-gateway-workspace":
+    case "direct-openai-workspace":
+    case "direct-azure-workspace":
     case "openrouter-workspace":
     case "anthropic-workspace":
     case "claude-subscription-workspace":
@@ -3822,6 +4185,8 @@ function registryBilling(provider) {
     case "xai-subscription":
       return { upstreamPayer: "connected_subscription", metering: "external" };
     case "vercel-gateway-workspace":
+    case "direct-openai-workspace":
+    case "direct-azure-workspace":
     case "openrouter-workspace":
     case "anthropic-workspace":
     case "claude-subscription-workspace":
@@ -3934,6 +4299,31 @@ function legacyCodexAstraImplicitCachingDefinitionVersionFor(model, provider) {
   const { promptCaching: _promptCaching, ...capabilities } = model.capabilities;
   return definitionVersionFor({ ...modelWithoutVersion, capabilities }, provider);
 }
+function matchesAdditiveCapabilityDefinitionVersion(model, provider, policy) {
+  const { definitionVersion: _definitionVersion, ...modelWithoutVersion } = model;
+  const { latencyModes, inputModalities } = model.capabilities;
+  for (let latencyMask = 1; latencyMask < 1 << latencyModes.length; latencyMask += 1) {
+    const retainedModes = latencyModes.filter((_mode, index) => latencyMask & 1 << index);
+    if (!retainedModes.some((mode) => mode.id === policy.latencyMode && mode.runnable)) {
+      continue;
+    }
+    for (let inputMask = 1; inputMask < 1 << inputModalities.length; inputMask += 1) {
+      const retainedInputs = inputModalities.filter((_modality, index) => inputMask & 1 << index);
+      if (retainedModes.length === latencyModes.length && retainedInputs.length === inputModalities.length) {
+        continue;
+      }
+      const capabilities = {
+        ...model.capabilities,
+        latencyModes: retainedModes,
+        inputModalities: retainedInputs
+      };
+      if (policy.definitionVersion === definitionVersionFor({ ...modelWithoutVersion, capabilities }, provider)) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
 function builtinProviderId(settings) {
   return settings.openaiProvider === "azure" ? "azure" : "openai";
 }
@@ -4004,7 +4394,7 @@ function withCodexCatalogProvider(settings) {
         ...legacyModelCapabilities(settings, {
           reasoningEffort: true,
           hostedWebSearch: true,
-          vision: slug.startsWith("gpt-5.6-") || slug.startsWith("gpt-6-")
+          vision: isReviewedGptVisionModel(slug)
         }),
         ...builtinPromptCachingForModel(`${CODEX_MODEL_ID_PREFIX}${slug}`) ? {
           promptCaching: builtinPromptCachingForModel(`${CODEX_MODEL_ID_PREFIX}${slug}`)
@@ -4187,7 +4577,7 @@ function configuredModels(settings, source = process.env) {
         reasoningEffort: true,
         hostedWebSearch: settings.webSearchEnabled,
         hostedImageGeneration: builtinHostedImageGenerationForModel(settings, id),
-        vision: id.startsWith("gpt-5.6-") || id.startsWith("gpt-6-")
+        vision: isReviewedGptVisionModel(id)
       }),
       ...builtinPromptCachingForModel(id) ? { promptCaching: builtinPromptCachingForModel(id) } : {},
       latencyModes: builtinLatencyModesForModel(id)
@@ -4428,7 +4818,7 @@ function assertTurnExecutionPolicyMatchesConfigV1(settings, policy, expected) {
     resolved.model,
     resolved.provider
   );
-  const definitionVersionMatches = parsed.definitionVersion === resolved.model.definitionVersion || parsed.definitionVersion === legacyImplicitOpenAiDefinitionVersion || parsed.definitionVersion === legacyCodexAstraImplicitCachingDefinitionVersionFor(resolved.model, resolved.provider);
+  const definitionVersionMatches = parsed.definitionVersion === resolved.model.definitionVersion || parsed.definitionVersion === legacyImplicitOpenAiDefinitionVersion || parsed.definitionVersion === legacyCodexAstraImplicitCachingDefinitionVersionFor(resolved.model, resolved.provider) || matchesAdditiveCapabilityDefinitionVersion(resolved.model, resolved.provider, parsed);
   const identityMismatched = parsed.providerId !== resolved.provider.id || parsed.upstreamModelId !== resolved.model.upstreamModelId || parsed.wireApi !== resolved.model.api || canonicalJson(parsed.credentialSource) !== canonicalJson(resolved.model.credentialSource) || canonicalJson(parsed.billing) !== canonicalJson(resolved.model.billing);
   if (identityMismatched) {
     throw new Error("Turn execution policy does not match the current provider definition");
@@ -5686,6 +6076,17 @@ function validateSettings(settings, source = process.env) {
         `OPENGENI_SANDBOX_ROTATION_LEAD_MS (${rotationLeadMs}) must exceed the legacy command stop grace, largest durable snapshot or drain capture timeout, and two reaper periods (${requiredRotationLeadMs}), including for persisted Modal leases after a default-backend rollout.`
       );
     }
+    const containmentMs = settings.sandboxIdleCommandContainmentMs;
+    if (containmentMs !== void 0 && !(containmentMs > settings.sandboxIdleGraceMs)) {
+      throw new Error(
+        `OPENGENI_SANDBOX_IDLE_COMMAND_CONTAINMENT_MS (${containmentMs}) must exceed OPENGENI_SANDBOX_IDLE_GRACE_MS (${settings.sandboxIdleGraceMs}): a box kept warm only by retained commands must stay available at least as long as an idle box awaiting drain.`
+      );
+    }
+    if (containmentMs !== void 0 && optionalEnvironmentValue("OPENGENI_SANDBOX_IDLE_COMMAND_CONTAINMENT_MS", source) !== void 0 && !(containmentMs < rotationLeadMs)) {
+      throw new Error(
+        `OPENGENI_SANDBOX_IDLE_COMMAND_CONTAINMENT_MS (${containmentMs}) must be strictly less than OPENGENI_SANDBOX_ROTATION_LEAD_MS (${rotationLeadMs}): an idle box must be checkpointed and stopped well before its provider deadline.`
+      );
+    }
     if (settings.sandboxBackend === "modal") {
       const idleGraceMs = settings.sandboxIdleGraceMs;
       const lifecycle = effectiveSandboxLifecycle(settings, "modal");
@@ -5716,6 +6117,11 @@ function validateSettings(settings, source = process.env) {
           `OPENGENI_SANDBOX_LEASE_REAPER_PERIOD_MS + OPENGENI_SANDBOX_IDLE_GRACE_MS (${reaperPeriod} + ${idleGraceMs} = ${reaperPeriod + idleGraceMs}) must be strictly less than the effective box idle timeout (${idleTimeoutMs}): a drained box must SURVIVE its full warm window so the reaper can resume + snapshot /workspace + terminate it on the sweep AFTER the drain grace elapses \u2014 Modal's idle-reap must NOT fire first (or /workspace is lost). Raise OPENGENI_MODAL_IDLE_TIMEOUT_SECONDS (defaults to OPENGENI_MODAL_TIMEOUT_SECONDS) or lower OPENGENI_SANDBOX_IDLE_GRACE_MS.`
         );
       }
+      if (settings.modalIdleTimeoutSeconds !== void 0 && containmentMs !== void 0 && !(reaperPeriod + containmentMs + drainCaptureTimeoutMs < idleTimeoutMs)) {
+        throw new Error(
+          `OPENGENI_SANDBOX_LEASE_REAPER_PERIOD_MS + OPENGENI_SANDBOX_IDLE_COMMAND_CONTAINMENT_MS + drain capture timeout (${reaperPeriod} + ${containmentMs} + ${drainCaptureTimeoutMs}) must be strictly less than OPENGENI_MODAL_IDLE_TIMEOUT_SECONDS*1000 (${idleTimeoutMs}): idle command containment must checkpoint a box before Modal's own idle reaper stops it. Lower OPENGENI_SANDBOX_IDLE_COMMAND_CONTAINMENT_MS or raise the Modal idle timeout.`
+        );
+      }
     }
   }
   if (settings.sandboxDesktopEnabled && settings.sandboxBackend === "modal" && !["local", "test"].includes(settings.environment)) {
@@ -5743,7 +6149,7 @@ function validateModelCatalogSettings(settings, source = process.env) {
   const builtinId = builtinProviderId(settings);
   const providerIds = /* @__PURE__ */ new Set();
   for (const provider of registryProviders) {
-    if (provider.kind === "vercel-gateway-managed" || provider.kind === "vercel-gateway-workspace" || provider.kind === "vercel-gateway-organization" || provider.kind === "openrouter-workspace" || provider.kind === "openrouter-organization" || provider.kind === "anthropic-organization" || provider.kind === "anthropic-workspace" || provider.kind === "claude-subscription-workspace" || provider.kind === "claude-subscription-organization" || provider.kind === "xai-subscription") {
+    if (provider.kind === "vercel-gateway-managed" || provider.kind === "vercel-gateway-workspace" || provider.kind === "vercel-gateway-organization" || provider.kind === "direct-openai-workspace" || provider.kind === "direct-azure-workspace" || provider.kind === "openrouter-workspace" || provider.kind === "openrouter-organization" || provider.kind === "anthropic-organization" || provider.kind === "anthropic-workspace" || provider.kind === "claude-subscription-workspace" || provider.kind === "claude-subscription-organization" || provider.kind === "xai-subscription") {
       throw new Error(
         `OPENGENI_MODEL_PROVIDERS_JSON provider kind ${provider.kind} is reserved for a reviewed OpenGeni credential broker`
       );
@@ -5982,6 +6388,45 @@ function delay(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 var CLAUDE_CONNECTION_KINDS = ["anthropic", "claude_subscription"];
+var CLAUDE_NATIVE_MODEL_PROFILES = Object.fromEntries([
+  ...[
+    ["claude-opus-5-5", "medium"],
+    ["claude-sonnet-5-5", "medium"],
+    ["claude-opus-5", "high"],
+    ["claude-sonnet-5", "high"],
+    ["claude-opus-4-8", "high"],
+    ["claude-opus-4-7", "xhigh"]
+  ].map(([id, defaultEffort]) => [
+    id,
+    {
+      efforts: ["low", "medium", "high", "xhigh", "max"],
+      defaultEffort,
+      contextWindowTokens: 1e6,
+      maxOutputTokens: 128e3
+    }
+  ]),
+  ...["claude-opus-4-6", "claude-sonnet-4-6"].map((id) => [
+    id,
+    {
+      efforts: ["low", "medium", "high", "max"],
+      defaultEffort: "high",
+      contextWindowTokens: 1e6,
+      maxOutputTokens: 128e3
+    }
+  ]),
+  [
+    "claude-haiku-4-5-20251001",
+    {
+      efforts: [],
+      defaultEffort: null,
+      contextWindowTokens: 2e5,
+      maxOutputTokens: 64e3
+    }
+  ]
+]);
+function claudeNativeModelProfile(upstreamModelId) {
+  return Object.hasOwn(CLAUDE_NATIVE_MODEL_PROFILES, upstreamModelId) ? CLAUDE_NATIVE_MODEL_PROFILES[upstreamModelId] : void 0;
+}
 function claudeProviderId(kind, scope = "organization") {
   return `${scope}-${kind === "anthropic" ? "anthropic" : "claude-subscription"}`;
 }
@@ -6007,17 +6452,18 @@ function withClaudeConnectionCatalog(settings, connections, scope = "organizatio
       anthropic: {
         auth: kind === "anthropic" ? "api-key" : "oauth",
         cacheTtl: "5m",
-        maxOutputTokens: 32e3,
+        maxOutputTokens: 128e3,
         streamIdleTimeoutMs: 6e5
       },
       models: connection.models.map((model) => {
-        const adaptiveThinking = ["claude-opus-5-5", "claude-sonnet-5-5"].includes(
-          model.upstreamModelId
-        );
+        const profile = claudeNativeModelProfile(model.upstreamModelId);
+        const adaptiveThinking = Boolean(profile?.efforts.length);
+        const contextWindowTokens = profile?.contextWindowTokens ?? 2e5;
+        const outputReserve = profile?.maxOutputTokens ?? 32e3;
         return {
-          contextWindowTokens: 2e5,
-          effectiveContextWindowTokens: 168e3,
-          autoCompactTokenLimit: 15e4,
+          contextWindowTokens,
+          effectiveContextWindowTokens: contextWindowTokens - outputReserve,
+          autoCompactTokenLimit: contextWindowTokens === 1e6 ? 8e5 : Math.min(15e4, contextWindowTokens - outputReserve - 18e3),
           id: id + "/" + model.upstreamModelId,
           upstreamModelId: model.upstreamModelId,
           label: model.label ?? (model.upstreamModelId === "claude-opus-5-5" ? "Claude Opus 5.5" : model.upstreamModelId === "claude-sonnet-5-5" ? "Claude Sonnet 5.5" : model.upstreamModelId),
@@ -6033,8 +6479,8 @@ function withClaudeConnectionCatalog(settings, connections, scope = "organizatio
             reasoning: {
               upstream: adaptiveThinking ? "supported" : "unknown",
               runnable: adaptiveThinking,
-              efforts: adaptiveThinking ? ["low", "medium", "high"] : [],
-              defaultEffort: adaptiveThinking ? "high" : null,
+              efforts: [...profile?.efforts ?? []],
+              defaultEffort: profile?.defaultEffort ?? null,
               required: false
             },
             functionCalling: { upstream: "supported", runnable: true },
@@ -6129,6 +6575,7 @@ export {
   SUPERGROK_REALTIME_MODEL_ID,
   SocialOAuthClientConfigSchema,
   TurnExecutionPolicyDefinitionMismatchError,
+  UnsupportedLatencyModeError,
   VERCEL_AI_GATEWAY_AI_SDK_BASE_URL,
   VERCEL_AI_GATEWAY_BASE_URL,
   VERCEL_AI_GATEWAY_CONNECTION_DOMAIN,
@@ -6156,7 +6603,9 @@ export {
   canonicalPublicOrigin,
   canonicalizeConfiguredModelId,
   claudeAuthorizationUrl,
+  claudeNativeModelProfile,
   claudeProviderId,
+  claudeSubscriptionCapacity,
   codeSearchDeploymentPolicy,
   codemodeWorkspaceUrl,
   codexUpstreamModelSlugs,
@@ -6251,12 +6700,14 @@ export {
   sandboxPreparationProfiles,
   sandboxWarmRateMicrosPerSecond,
   selectModelPricing,
+  selectSubscriptionAccount,
   serviceTierForLatencyMode,
   settingsForAcceptedSubscriptionTurn,
   settingsWithResolvedModelContext,
   stableSandboxEnvironmentForRun,
   startupRetryOptions,
   streamTokenDegraded,
+  subscriptionAccountShardIndex,
   temporalConnectionOptions,
   trustedProxyCidrEntries,
   usableJevApiKey,
@@ -6265,6 +6716,7 @@ export {
   withClaudeConnectionCatalog,
   withClaudeConnectionCredential,
   withCodexCatalogProvider,
+  withDirectModelProviders,
   withOrganizationGatewayCatalogProvider,
   withOrganizationGatewayCredential,
   withOrganizationOpenRouterCatalogProvider,