@yeaft/webchat-agent 1.0.421 → 1.0.423

package/local-runtime/server/.env.example

@@ -44,9 +44,9 @@ EMAIL_CODE_EXPIRES_IN=300000
 # Agents must provide this secret to connect
 AGENT_SECRET=agent-shared-secret
 
-# Browser Runtime (disabled by default)
+# Browser Runtime routes are enabled by default; set false to disable them globally.
 # Production deployments should configure endpoint-scoped TURN credentials.
-# BROWSER_RUNTIME_ENABLED=false
+# BROWSER_RUNTIME_ENABLED=true
 # BROWSER_STUN_URLS=stun:stun.example.com:3478
 # BROWSER_TURN_URLS=turn:turn.example.com:3478,turns:turn.example.com:443?transport=tcp
 # BROWSER_TURN_SECRET=replace-with-coturn-rest-api-secret

package/local-runtime/server/config.js

@@ -119,11 +119,13 @@ export const CONFIG = {
   // Agent authentication (global fallback — per-user agent_secret is preferred)
   agentSecret: process.env.AGENT_SECRET || DEFAULT_AGENT_SECRET,
 
-  // Browser Runtime stays fail-closed until the Server rollout gate is enabled.
+  // Browser setup/viewer routes are available by default; an administrator can
+  // still disable the entire surface explicitly. Downloads remain opt-in in the
+  // Workbench and all lifecycle/signaling routes stay owner-scoped.
   // TURN credentials use the standard time-limited HMAC username scheme; Web and
   // Agent endpoints receive separately scoped usernames from the route ledger.
   browserRuntime: {
-    enabled: process.env.BROWSER_RUNTIME_ENABLED === 'true',
+    enabled: process.env.BROWSER_RUNTIME_ENABLED !== 'false',
     iceTransportPolicy: process.env.BROWSER_ICE_TRANSPORT_POLICY === 'relay' ? 'relay' : 'all',
     stunUrls: commaList(process.env.BROWSER_STUN_URLS),
     turnUrls: commaList(process.env.BROWSER_TURN_URLS),

package/local-runtime/version.json

@@ -1 +1 @@
-{"version":"1.0.421"}
+{"version":"1.0.423"}