@opengeni/config 4.6.1 → 4.6.2-canary.39853438886001

package/dist/{chunk-KW4MS4FH.js → chunk-C3GVPDPY.js}

@@ -5,6 +5,8 @@ var DEFAULT_MODEL_COST_POLICY_JSON = JSON.stringify({
 });
 var DEFAULT_GOAL_IDLE_BACKOFF_MS = [3e3, 3e4, 12e4, 3e5];
 var DEFAULT_GOAL_IDLE_BACKOFF_MAX_MS = 6e5;
+var DEFAULT_TURN_WORKER_SHUTDOWN_GRACE_MS = 9e4;
+var DEFAULT_TURN_WORKER_SHUTDOWN_FORCE_MS = 105e3;
 var AGENT_INSTRUCTIONS_CORE_PLACEHOLDER = "{{core}}";
 var DEFAULT_AGENT_INSTRUCTIONS = [
   "You are an Opengeni workspace agent: a general assistant for questions, writing, research, analysis, and technical work.",
@@ -26,7 +28,9 @@ export {
   DEFAULT_MODEL_COST_POLICY_JSON,
   DEFAULT_GOAL_IDLE_BACKOFF_MS,
   DEFAULT_GOAL_IDLE_BACKOFF_MAX_MS,
+  DEFAULT_TURN_WORKER_SHUTDOWN_GRACE_MS,
+  DEFAULT_TURN_WORKER_SHUTDOWN_FORCE_MS,
   AGENT_INSTRUCTIONS_CORE_PLACEHOLDER,
   DEFAULT_AGENT_INSTRUCTIONS
 };
-//# sourceMappingURL=chunk-KW4MS4FH.js.map
+//# sourceMappingURL=chunk-C3GVPDPY.js.map

package/dist/chunk-C3GVPDPY.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/defaults.ts"],"sourcesContent":["// Immutable configuration defaults, independent of settings validation and provider adapters.\nexport const DEFAULT_OPENROUTER_MODEL_ID =\n  \"openrouter/nvidia/nemotron-3-super-120b-a12b:free\" as const;\n\nexport const DEFAULT_MODEL_COST_POLICY_JSON = JSON.stringify({\n  [DEFAULT_OPENROUTER_MODEL_ID]: \"free\",\n});\n\n/** Default pacing between consecutive no-input goal continuations. */\nexport const DEFAULT_GOAL_IDLE_BACKOFF_MS: readonly number[] = [3_000, 30_000, 120_000, 300_000];\n\nexport const DEFAULT_GOAL_IDLE_BACKOFF_MAX_MS = 600_000;\n\n/**\n * Turn-worker graceful shutdown. A draining turn worker lets in-flight turns\n * finish naturally for the grace, then cancels the rest with WORKER_SHUTDOWN\n * (recoverable checkpoint), and the Temporal SDK force-stops at the force time.\n * With the standalone process exit ten seconds after the force time, these fit\n * inside the 120-second Kubernetes termination grace used by the Helm chart.\n */\nexport const DEFAULT_TURN_WORKER_SHUTDOWN_GRACE_MS = 90_000;\nexport const DEFAULT_TURN_WORKER_SHUTDOWN_FORCE_MS = 105_000;\n\n/**\n * Placeholder token inside an agent-instructions persona template. The runtime\n * substitutes the non-bypassable CORE (goal-loop ownership + the dynamic\n * workspace-environment block) at this marker. A template that omits the\n * marker still gets the CORE appended after it (a non-bypassable fail-safe),\n * so a white-labelled persona can never drop the goal-loop contract or the\n * environment metadata the agent depends on.\n */\nexport const AGENT_INSTRUCTIONS_CORE_PLACEHOLDER = \"{{core}}\";\n\n/**\n * Default per-workspace agent persona template. This is the BRAND + tool-usage\n * opinion (the white-labellable surface): the general-assistant identity line,\n * the framing/opinion lines, and the mount-path facts. Domain-specific tooling\n * guidance (for example Terraform or Checkov) belongs in opt-in Skills.\n *\n * The CORE that MUST survive any override — the goal-loop ownership line (which\n * names the opengeni__goal_* tools) and the dynamic workspace-environment block\n * — is injected at AGENT_INSTRUCTIONS_CORE_PLACEHOLDER by the runtime, never\n * baked into this overridable string.\n *\n * INVARIANT: with no per-workspace override and an empty environment, the\n * runtime's composed instructions are byte-for-byte pinned by a runtime test.\n * The template below is joined by \" \", followed by \" \" + the placeholder.\n * Changing a single character here changes that default; update the pin\n * intentionally.\n */\nexport const DEFAULT_AGENT_INSTRUCTIONS = [\n  \"You are an Opengeni workspace agent: a general assistant for questions, writing, research, analysis, and technical work.\",\n  \"Follow the user's task and the applicable Skill instructions for the current role.\",\n  \"When a task needs files or commands, work inside the sandbox workspace with the filesystem and shell tools.\",\n  \"Repository resources are mounted under repos/<host>/<owner>/<repo> unless the session specifies another collision-free mount path.\",\n  \"File resources are mounted under .opengeni/files/<file-id>/ unless the session specifies another mount path.\",\n  \"Attached files are mounted read-only; copy them before modifying.\",\n  \"Installed and selected Skills appear in the session Skill index; follow its reading instructions and any role-specific guidance.\",\n  \"Provider CLIs such as gh, glab, and az may be pre-authenticated by the host through brokered git credentials or a sandbox preparation profile; try them before asking for credentials.\",\n  \"When the Git repository you change has a remote and git provider credentials are available, work on a focused branch and open a pull request.\",\n  \"Otherwise leave changes in the working tree and do not create or mention branches, commits, or pull requests unless the user asks; if the repository has a remote, say the changes are not pushed, and if the user asks for something you cannot make, say what blocks it.\",\n  \"Answer questions directly and briefly; after making changes, say what changed, how you checked it, and anything still blocked.\",\n  AGENT_INSTRUCTIONS_CORE_PLACEHOLDER,\n].join(\" \");\n"],"mappings":";AACO,IAAM,8BACX;AAEK,IAAM,iCAAiC,KAAK,UAAU;AAAA,EAC3D,CAAC,2BAA2B,GAAG;AACjC,CAAC;AAGM,IAAM,+BAAkD,CAAC,KAAO,KAAQ,MAAS,GAAO;AAExF,IAAM,mCAAmC;AASzC,IAAM,wCAAwC;AAC9C,IAAM,wCAAwC;AAU9C,IAAM,sCAAsC;AAmB5C,IAAM,6BAA6B;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,EAAE,KAAK,GAAG;","names":[]}

package/dist/defaults.d.ts

@@ -3,6 +3,15 @@ export declare const DEFAULT_MODEL_COST_POLICY_JSON: string;
 /** Default pacing between consecutive no-input goal continuations. */
 export declare const DEFAULT_GOAL_IDLE_BACKOFF_MS: readonly number[];
 export declare const DEFAULT_GOAL_IDLE_BACKOFF_MAX_MS = 600000;
+/**
+ * Turn-worker graceful shutdown. A draining turn worker lets in-flight turns
+ * finish naturally for the grace, then cancels the rest with WORKER_SHUTDOWN
+ * (recoverable checkpoint), and the Temporal SDK force-stops at the force time.
+ * With the standalone process exit ten seconds after the force time, these fit
+ * inside the 120-second Kubernetes termination grace used by the Helm chart.
+ */
+export declare const DEFAULT_TURN_WORKER_SHUTDOWN_GRACE_MS = 90000;
+export declare const DEFAULT_TURN_WORKER_SHUTDOWN_FORCE_MS = 105000;
 /**
  * Placeholder token inside an agent-instructions persona template. The runtime
  * substitutes the non-bypassable CORE (goal-loop ownership + the dynamic

package/dist/defaults.js

@@ -4,14 +4,18 @@ import {
   DEFAULT_GOAL_IDLE_BACKOFF_MAX_MS,
   DEFAULT_GOAL_IDLE_BACKOFF_MS,
   DEFAULT_MODEL_COST_POLICY_JSON,
-  DEFAULT_OPENROUTER_MODEL_ID
-} from "./chunk-KW4MS4FH.js";
+  DEFAULT_OPENROUTER_MODEL_ID,
+  DEFAULT_TURN_WORKER_SHUTDOWN_FORCE_MS,
+  DEFAULT_TURN_WORKER_SHUTDOWN_GRACE_MS
+} from "./chunk-C3GVPDPY.js";
 export {
   AGENT_INSTRUCTIONS_CORE_PLACEHOLDER,
   DEFAULT_AGENT_INSTRUCTIONS,
   DEFAULT_GOAL_IDLE_BACKOFF_MAX_MS,
   DEFAULT_GOAL_IDLE_BACKOFF_MS,
   DEFAULT_MODEL_COST_POLICY_JSON,
-  DEFAULT_OPENROUTER_MODEL_ID
+  DEFAULT_OPENROUTER_MODEL_ID,
+  DEFAULT_TURN_WORKER_SHUTDOWN_FORCE_MS,
+  DEFAULT_TURN_WORKER_SHUTDOWN_GRACE_MS
 };
 //# sourceMappingURL=defaults.js.map

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { DEFAULT_OPENROUTER_MODEL_ID, DEFAULT_MODEL_COST_POLICY_JSON, DEFAULT_GOAL_IDLE_BACKOFF_MS, DEFAULT_GOAL_IDLE_BACKOFF_MAX_MS, AGENT_INSTRUCTIONS_CORE_PLACEHOLDER, DEFAULT_AGENT_INSTRUCTIONS, } from "./defaults.js";
+export { DEFAULT_OPENROUTER_MODEL_ID, DEFAULT_MODEL_COST_POLICY_JSON, DEFAULT_GOAL_IDLE_BACKOFF_MS, DEFAULT_GOAL_IDLE_BACKOFF_MAX_MS, AGENT_INSTRUCTIONS_CORE_PLACEHOLDER, DEFAULT_AGENT_INSTRUCTIONS, DEFAULT_TURN_WORKER_SHUTDOWN_GRACE_MS, DEFAULT_TURN_WORKER_SHUTDOWN_FORCE_MS, } from "./defaults.js";
 export { managedUserEmailAllowed } from "./managed-user-admission.js";
 export * from "./realtime-voice-pricing.js";
 export * from "./web-search.js";
@@ -112,6 +112,8 @@ declare const SettingsSchema: z.ZodObject<{
     turnWorkerEmergencyMemoryUsage: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     turnWorkerMemoryGuardIntervalMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     turnWorkerMemoryGuardSustainMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    turnWorkerShutdownGraceMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    turnWorkerShutdownForceMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     observabilityStructuredLogs: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
     observabilityMetricsEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
     observabilityOtlpEndpoint: z.ZodOptional<z.ZodString>;
@@ -626,6 +628,8 @@ declare const SettingsSchema: z.ZodObject<{
     onePasswordFakeTokens: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
     protonPassCliPath: z.ZodOptional<z.ZodString>;
     integrationsEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
+    googleConnectorSetupEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
+    googleDriveMcpEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
     integrationsStateSecret: z.ZodOptional<z.ZodString>;
     integrationsAllowPrivateNetworkTargets: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
     privacyOnlyMeAllowed: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;

package/dist/index.js

@@ -4,8 +4,10 @@ import {
   DEFAULT_GOAL_IDLE_BACKOFF_MAX_MS,
   DEFAULT_GOAL_IDLE_BACKOFF_MS,
   DEFAULT_MODEL_COST_POLICY_JSON,
-  DEFAULT_OPENROUTER_MODEL_ID
-} from "./chunk-KW4MS4FH.js";
+  DEFAULT_OPENROUTER_MODEL_ID,
+  DEFAULT_TURN_WORKER_SHUTDOWN_FORCE_MS,
+  DEFAULT_TURN_WORKER_SHUTDOWN_GRACE_MS
+} from "./chunk-C3GVPDPY.js";
 
 // src/managed-user-admission.ts
 function managedUserEmailAllowed(allowedUserEmails, email) {
@@ -1094,6 +1096,15 @@ var SettingsSchema = z5.object({
   turnWorkerEmergencyMemoryUsage: z5.coerce.number().min(0.85).max(0.95).default(0.9),
   turnWorkerMemoryGuardIntervalMs: z5.coerce.number().int().min(1e3).max(6e4).default(5e3),
   turnWorkerMemoryGuardSustainMs: z5.coerce.number().int().min(5e3).max(3e5).default(3e4),
+  // Graceful turn-worker shutdown (rolling deploy, scale-down, memory guard).
+  // After the worker stops polling, in-flight turns may finish naturally for
+  // the grace; the rest are cancelled with WORKER_SHUTDOWN (recoverable
+  // checkpoint) and the SDK force-stops at the force time. Keep the force time
+  // inside the pod's termination grace; the standalone process exits at most
+  // ten seconds after it. The worker keeps at least a ten-second checkpoint
+  // window between grace and force, shortening the grace when needed.
+  turnWorkerShutdownGraceMs: z5.coerce.number().int().min(0).max(36e5).default(DEFAULT_TURN_WORKER_SHUTDOWN_GRACE_MS),
+  turnWorkerShutdownForceMs: z5.coerce.number().int().min(1e4).max(36e5).default(DEFAULT_TURN_WORKER_SHUTDOWN_FORCE_MS),
   observabilityStructuredLogs: EnvBoolean.default(false),
   observabilityMetricsEnabled: EnvBoolean.default(true),
   observabilityOtlpEndpoint: z5.string().url().optional(),
@@ -1233,6 +1244,9 @@ var SettingsSchema = z5.object({
     "Proton Pass CLI path must be absolute"
   ).optional(),
   integrationsEnabled: EnvBoolean.default(false),
+  // Operator gate for unverified Gmail/Drive OAuth acquisition; sign-in and refresh are independent.
+  googleConnectorSetupEnabled: EnvBoolean.default(true),
+  googleDriveMcpEnabled: EnvBoolean.default(false),
   integrationsStateSecret: z5.string().optional(),
   integrationsAllowPrivateNetworkTargets: EnvBoolean.default(false),
   // Privacy limits a deployment (for example a product that embeds Opengeni)
@@ -4524,6 +4538,8 @@ function getSettings(source = process.env) {
     turnWorkerEmergencyMemoryUsage: optional("OPENGENI_TURN_WORKER_EMERGENCY_MEMORY_USAGE"),
     turnWorkerMemoryGuardIntervalMs: optional("OPENGENI_TURN_WORKER_MEMORY_GUARD_INTERVAL_MS"),
     turnWorkerMemoryGuardSustainMs: optional("OPENGENI_TURN_WORKER_MEMORY_GUARD_SUSTAIN_MS"),
+    turnWorkerShutdownGraceMs: optional("OPENGENI_TURN_WORKER_SHUTDOWN_GRACE_MS"),
+    turnWorkerShutdownForceMs: optional("OPENGENI_TURN_WORKER_SHUTDOWN_FORCE_MS"),
     observabilityStructuredLogs: optional("OPENGENI_OBSERVABILITY_STRUCTURED_LOGS"),
     observabilityMetricsEnabled: optional("OPENGENI_OBSERVABILITY_METRICS_ENABLED"),
     observabilityOtlpEndpoint: optional("OPENGENI_OTEL_EXPORTER_OTLP_ENDPOINT") ?? optional("OTEL_EXPORTER_OTLP_ENDPOINT"),
@@ -4582,6 +4598,8 @@ function getSettings(source = process.env) {
     onePasswordFakeTokens: optional("OPENGENI_ONEPASSWORD_FAKE_TOKENS"),
     protonPassCliPath: optional("OPENGENI_PROTON_PASS_CLI_PATH"),
     integrationsEnabled: optional("OPENGENI_INTEGRATIONS_ENABLED"),
+    googleConnectorSetupEnabled: optional("OPENGENI_GOOGLE_CONNECTOR_SETUP_ENABLED"),
+    googleDriveMcpEnabled: optional("OPENGENI_GOOGLE_DRIVE_MCP_ENABLED"),
     integrationsStateSecret: optional("OPENGENI_INTEGRATIONS_STATE_SECRET"),
     integrationsAllowPrivateNetworkTargets: optional(
       "OPENGENI_INTEGRATIONS_ALLOW_PRIVATE_NETWORK_TARGETS"
@@ -9344,6 +9362,8 @@ export {
   DEFAULT_MODEL_STREAM_IDLE_TIMEOUT_MS,
   DEFAULT_MODEL_STREAM_PROGRESS_TIMEOUT_MS,
   DEFAULT_OPENROUTER_MODEL_ID,
+  DEFAULT_TURN_WORKER_SHUTDOWN_FORCE_MS,
+  DEFAULT_TURN_WORKER_SHUTDOWN_GRACE_MS,
   DEFAULT_WEB_SEARCH_PROVIDER,
   ELEVENLABS_REALTIME_LANGUAGES,
   ELEVENLABS_REALTIME_MODELS,