@opengeni/api-router 0.12.12 → 0.14.4

package/src/mcp/server.ts

@@ -36,6 +36,8 @@ import {
   getSessionGoal,
   getSessionQueueSnapshot,
   getSessionTurn,
+  getOrCreatePreferenceRegistrySnapshot,
+  getPreferenceRegistryFullContent,
   getVariableSet,
   getVariableSetByName,
   areGitHubRepositoriesAllowedForWorkspace,
@@ -186,6 +188,8 @@ const FIRST_PARTY_TOOL_AUTHORIZATION = {
   memory_search: { sessionRequired: true, allOf: ["documents:search"] },
   memory_save: { sessionRequired: true, allOf: ["documents:search"] },
   memory_correct: { sessionRequired: true, allOf: ["documents:search"] },
+  preference_registry_summary: { sessionRequired: true, allOf: ["workspace:read"] },
+  preference_registry_get: { sessionRequired: true, allOf: ["workspace:read"] },
   sandboxes_list: { sessionRequired: true, allOf: ["sessions:read"] },
   sandbox_attach: { sessionRequired: true, allOf: ["sessions:control"] },
   sandbox_swap: { sessionRequired: true, allOf: ["sessions:control"] },
@@ -226,8 +230,13 @@ const FIRST_PARTY_TOOL_AUTHORIZATION = {
   scheduled_task_runs_list: { anyOf: ["scheduled_tasks:manage", "scheduled_tasks:run"] },
   slack_bot_list_channels: { allOf: ["connections:read"] },
   slack_bot_channel_history: { allOf: ["connections:read"] },
+  slack_bot_thread_replies: { allOf: ["connections:read"] },
   slack_bot_list_users: { allOf: ["connections:read"] },
+  slack_bot_list_files: { allOf: ["connections:read"] },
+  slack_bot_file_info: { allOf: ["connections:read"] },
+  slack_bot_file_content: { allOf: ["connections:read"] },
   slack_bot_post_message: { allOf: ["connections:read"] },
+  slack_bot_delete_message: { allOf: ["connections:read"] },
 } satisfies Record<FirstPartyMcpToolName, FirstPartyToolAuthorization>;
 
 const FIRST_PARTY_MCP_TOOL_NAME_SET = new Set<string>(FIRST_PARTY_MCP_TOOL_NAMES);
@@ -366,6 +375,9 @@ export function buildOpenGeniMcpServer(
   if (!toolspaceMode && sessionId !== null && options.workspaceMemoryEnabled === true) {
     registerMemoryTools(server, deps, grant, sessionId, json);
   }
+  if (!toolspaceMode && sessionId !== null && preferenceAttemptClaims(grant) !== null) {
+    registerPreferenceRegistryTools(server, deps, grant, json);
+  }
 
   // Fleet tools (M7 bring-your-own-compute): list / attach / swap / run_on /
   // provision over the session's Modal box + the workspace's enrolled machines.
@@ -838,6 +850,32 @@ function registerSlackBotTools(
       ),
   );
 
+  server.registerTool(
+    "slack_bot_thread_replies",
+    {
+      description:
+        "Read a Slack thread as the workspace-shared OpenGeni bot. Pass the channel ID and the parent message timestamp returned by channel history. The result includes the parent followed by its replies.",
+      inputSchema: {
+        connectionId: z4.string().uuid().optional(),
+        channelId: z4.string().min(1).max(64),
+        threadTimestamp: z4.string().min(1).max(64),
+        cursor: z4.string().max(1024).optional(),
+        limit: z4.number().int().min(1).max(100).optional(),
+      },
+    },
+    async ({ connectionId, channelId, threadTimestamp, cursor, limit }) =>
+      json(
+        await (
+          await clientFor(connectionId)
+        ).threadReplies({
+          channelId,
+          threadTimestamp,
+          ...(cursor ? { cursor } : {}),
+          ...(limit !== undefined ? { limit } : {}),
+        }),
+      ),
+  );
+
   server.registerTool(
     "slack_bot_list_users",
     {
@@ -859,20 +897,95 @@ function registerSlackBotTools(
       ),
   );
 
+  server.registerTool(
+    "slack_bot_list_files",
+    {
+      description:
+        "List Slack files and canvases shared with a channel where the workspace-shared OpenGeni bot is already a member.",
+      inputSchema: {
+        connectionId: z4.string().uuid().optional(),
+        channelId: z4.string().min(1).max(64),
+        cursor: z4.string().max(1024).optional(),
+        limit: z4.number().int().min(1).max(200).optional(),
+      },
+    },
+    async ({ connectionId, channelId, cursor, limit }) =>
+      json(
+        await (
+          await clientFor(connectionId)
+        ).listFiles({
+          channelId,
+          ...(cursor ? { cursor } : {}),
+          ...(limit !== undefined ? { limit } : {}),
+        }),
+      ),
+  );
+
+  server.registerTool(
+    "slack_bot_file_info",
+    {
+      description:
+        "Read safe metadata for a Slack file or canvas shared with a channel where the workspace-shared OpenGeni bot is already a member. For an embedded huddle transcript, also pass the shared canvas file ID as parentFileId so OpenGeni can verify the indirect share.",
+      inputSchema: {
+        connectionId: z4.string().uuid().optional(),
+        channelId: z4.string().min(1).max(64),
+        fileId: z4.string().min(1).max(64),
+        parentFileId: z4.string().min(1).max(64).optional(),
+      },
+    },
+    async ({ connectionId, channelId, fileId, parentFileId }) =>
+      json(
+        await (
+          await clientFor(connectionId)
+        ).fileInfo({
+          channelId,
+          fileId,
+          ...(parentFileId ? { parentFileId } : {}),
+        }),
+      ),
+  );
+
+  server.registerTool(
+    "slack_bot_file_content",
+    {
+      description:
+        "Read a bounded page of UTF-8 text from a Slack file or canvas shared with a channel where the workspace-shared OpenGeni bot is already a member. For an embedded huddle transcript, also pass the shared canvas file ID as parentFileId so OpenGeni can verify the channel-to-canvas-to-transcript chain. Slack may still restrict a huddle transcript body to participants; that returns huddle_transcript_requires_participant_access. Private Slack URLs and credentials are never returned. Continue with nextOffset when truncated is true.",
+      inputSchema: {
+        connectionId: z4.string().uuid().optional(),
+        channelId: z4.string().min(1).max(64),
+        fileId: z4.string().min(1).max(64),
+        parentFileId: z4.string().min(1).max(64).optional(),
+        offset: z4.number().int().min(0).max(4_000_000).optional(),
+      },
+    },
+    async ({ connectionId, channelId, fileId, parentFileId, offset }) =>
+      json(
+        await (
+          await clientFor(connectionId)
+        ).fileContent({
+          channelId,
+          fileId,
+          ...(parentFileId ? { parentFileId } : {}),
+          ...(offset !== undefined ? { offset } : {}),
+        }),
+      ),
+  );
+
   server.registerTool(
     "slack_bot_post_message",
     {
       description:
-        "Post as the workspace-shared OpenGeni bot. Pass channelId for a channel where the bot is already a member, or userId to open/post a DM; pass exactly one. Generate one operationId UUID per intended message and reuse that same UUID on every retry.",
+        "Post as the workspace-shared OpenGeni bot. Pass channelId for a channel where the bot is already a member, or userId to open/post a DM; pass exactly one. To reply in a thread, also pass its parent message timestamp as threadTimestamp. Generate one operationId UUID per intended message and reuse that same UUID on every retry.",
       inputSchema: {
         connectionId: z4.string().uuid().optional(),
         operationId: z4.string().uuid(),
         channelId: z4.string().min(1).max(64).optional(),
         userId: z4.string().min(1).max(64).optional(),
+        threadTimestamp: z4.string().min(1).max(64).optional(),
         text: z4.string().min(1).max(40_000),
       },
     },
-    async ({ connectionId, operationId, channelId, userId, text }) => {
+    async ({ connectionId, operationId, channelId, userId, threadTimestamp, text }) => {
       if (Boolean(channelId) === Boolean(userId)) {
         throw new Error("exactly one of channelId or userId is required");
       }
@@ -883,11 +996,30 @@ function registerSlackBotTools(
           operationId,
           ...(channelId ? { channelId } : {}),
           ...(userId ? { userId } : {}),
+          ...(threadTimestamp ? { threadTimestamp } : {}),
           text,
         }),
       );
     },
   );
+
+  server.registerTool(
+    "slack_bot_delete_message",
+    {
+      description:
+        "Delete a message authored by the workspace-shared OpenGeni bot. Pass the channel ID and exact message timestamp returned by a prior post or channel/thread read. Generate one operationId UUID per intended deletion and reuse it on every retry, including after an unknown outcome. Slack refuses deletion of messages not authored by this bot.",
+      inputSchema: {
+        connectionId: z4.string().uuid().optional(),
+        operationId: z4.string().uuid(),
+        channelId: z4.string().min(1).max(64),
+        timestamp: z4.string().min(1).max(64),
+      },
+    },
+    async ({ connectionId, operationId, channelId, timestamp }) =>
+      json(
+        await (await clientFor(connectionId)).deleteMessage({ operationId, channelId, timestamp }),
+      ),
+  );
 }
 
 function registerToolspaceProxyTools(server: McpServer, surface: ToolspaceMcpSurface | null): void {
@@ -1150,6 +1282,70 @@ async function authorizeFirstPartySession(
   });
 }
 
+function preferenceAttemptClaims(grant: AccessGrant): {
+  sessionId: string;
+  turnId: string;
+  attemptId: string;
+  executionGeneration: number;
+} | null {
+  const metadata = grant.metadata ?? {};
+  if (
+    typeof metadata["sessionId"] !== "string" ||
+    typeof metadata["turnId"] !== "string" ||
+    typeof metadata["attemptId"] !== "string" ||
+    typeof metadata["executionGeneration"] !== "number" ||
+    !Number.isSafeInteger(metadata["executionGeneration"]) ||
+    metadata["executionGeneration"] < 1 ||
+    metadata["executionGeneration"] > 2_147_483_647
+  ) {
+    return null;
+  }
+  return {
+    sessionId: metadata["sessionId"],
+    turnId: metadata["turnId"],
+    attemptId: metadata["attemptId"],
+    executionGeneration: metadata["executionGeneration"],
+  };
+}
+
+function registerPreferenceRegistryTools(
+  server: McpServer,
+  deps: ApiRouteDeps,
+  grant: AccessGrant,
+  json: JsonResult,
+): void {
+  const attemptClaims = () => {
+    const resolved = preferenceAttemptClaims(grant);
+    if (!resolved) throw new Error("Exact signed preference attempt authority is required.");
+    return {
+      accountId: grant.accountId,
+      workspaceId: grant.workspaceId,
+      ...resolved,
+    };
+  };
+
+  server.registerTool(
+    "preference_registry_summary",
+    {
+      description:
+        "List bounded deterministic descriptors for organization, workspace, and immutable initiating-human preferences frozen to this exact attempt. Full content is omitted; retrieve only a relevant returned handle.",
+      inputSchema: {},
+    },
+    async () => json(await getOrCreatePreferenceRegistrySnapshot(deps.db, attemptClaims())),
+  );
+
+  server.registerTool(
+    "preference_registry_get",
+    {
+      description:
+        "Retrieve full content for one preference in this exact attempt snapshot. Handles from another account, workspace, human, or attempt are rejected.",
+      inputSchema: { retrievalHandle: z4.string().min(1).max(512) },
+    },
+    async ({ retrievalHandle }) =>
+      json(await getPreferenceRegistryFullContent(deps.db, attemptClaims(), retrievalHandle)),
+  );
+}
+
 const MemoryKindSchema = z4.enum(["preference", "semantic", "procedural", "decision", "episodic"]);
 
 function memoryPreview(text: string): string {
@@ -1349,7 +1545,7 @@ function registerFleetTools(
     "run_on",
     {
       description:
-        "Run a ONE-OFF op on a SPECIFIC enrolled selfhosted machine WITHOUT changing this session's active sandbox (a side-channel to another machine). Ops: exec (run a command), read (read a file), write (write a file). `target` = a selfhosted sandboxes_list `id`. To make a machine the active sandbox instead, use sandbox_swap.",
+        "Run a ONE-OFF op on a SPECIFIC enrolled selfhosted machine WITHOUT changing this session's active sandbox (a side-channel to another machine). Ops: exec (run a command), read (read a file), write (write a file). Exec returns exact exitCode plus typed timedOut and the effective deadlineMs; a deadline kill or missing exit proof is never ok:true, and an ambiguous transport loss is not replayed. `target` = a selfhosted sandboxes_list `id`. To make a machine the active sandbox instead, use sandbox_swap.",
       inputSchema: {
         target: z4.string().min(1),
         op: z4.discriminatedUnion("kind", [
@@ -1825,6 +2021,7 @@ function registerWorkspaceOrchestrationTools(
           rigId: z4.string().uuid().optional(),
           model: z4.string().min(1).optional(),
           reasoningEffort: z4.string().optional(),
+          latencyMode: z4.enum(["standard", "priority", "fast"]).optional(),
           sandboxBackend: z4.string().optional(),
           // Create-time machine targeting: an enrolled sandbox id (from
           // sandboxes_list) to run the spawned session on. Seeds the active-sandbox

package/src/mcp/session-view.ts

@@ -564,6 +564,7 @@ export function boundSessionDetailMcp(
     lastSequence: session.lastSequence,
     codexPinnedCredentialId: session.codexPinnedCredentialId,
     codexLastCredentialId: session.codexLastCredentialId,
+    codexCompactionMode: session.codexCompactionMode,
     pinned: session.pinned,
     pinnedAt: session.pinnedAt,
     pinVersion: session.pinVersion,

package/src/mcp/toolspace.ts

@@ -76,9 +76,12 @@ type McpTool = {
 };
 
 const APPROVAL_REQUIRED_MESSAGE = "requires approval - invoke via the agent";
-const TOOLSPACE_AUTH_NEEDED_ERROR_CODE = -32001;
-const TOOLSPACE_AUTH_NEEDED_MESSAGE =
-  "Authentication required - a connection link was posted to the session.";
+const TOOLSPACE_AUTH_NEEDED_ERROR = {
+  // OpenGeni application-defined JSON-RPC code. Keep this positive so it cannot
+  // collide with MCP SDK transport errors such as RequestTimeout (-32001).
+  code: 40_101,
+  message: "Authentication required - a connection link was posted to the session.",
+} as const;
 const TOOLSPACE_NO_ACTIVE_TURN_MESSAGE =
   "no active turn - toolspace calls require an in-flight turn";
 // First-party OpenGeni MCP proxies (files/docs) route back through the same
@@ -721,7 +724,7 @@ async function callRemoteTool(
       return mcpError("upstream tool result exceeded the safety limit");
     }
     if (isToolspaceAuthNeededError(error)) {
-      return mcpError(TOOLSPACE_AUTH_NEEDED_MESSAGE);
+      return mcpError(TOOLSPACE_AUTH_NEEDED_ERROR.message);
     }
     // The raw upstream error can carry provider-specific detail; log it
     // server-side and return only a generic result to the sandbox so no header
@@ -1037,8 +1040,8 @@ async function authNeededFetchResponse(
         jsonrpc: "2.0",
         id: request.id ?? null,
         error: {
-          code: TOOLSPACE_AUTH_NEEDED_ERROR_CODE,
-          message: TOOLSPACE_AUTH_NEEDED_MESSAGE,
+          code: TOOLSPACE_AUTH_NEEDED_ERROR.code,
+          message: TOOLSPACE_AUTH_NEEDED_ERROR.message,
         },
       }),
       {
@@ -1110,9 +1113,14 @@ function fetchInputForAttempt(input: string | URL | Request): string | URL | Req
 }
 
 function isToolspaceAuthNeededError(error: unknown): boolean {
+  if (!(error instanceof Error)) {
+    return false;
+  }
+  const code = (error as { code?: unknown }).code;
   return (
-    error instanceof Error &&
-    ((error as { code?: unknown }).code === TOOLSPACE_AUTH_NEEDED_ERROR_CODE ||
-      error.message.includes(TOOLSPACE_AUTH_NEEDED_MESSAGE))
+    code === TOOLSPACE_AUTH_NEEDED_ERROR.code &&
+    (error.message === TOOLSPACE_AUTH_NEEDED_ERROR.message ||
+      error.message ===
+        `MCP error ${TOOLSPACE_AUTH_NEEDED_ERROR.code}: ${TOOLSPACE_AUTH_NEEDED_ERROR.message}`)
   );
 }

package/src/routes/connections.ts

@@ -10,6 +10,12 @@ import {
   OAuthStartResponse,
   UpdateConnectionRequest,
 } from "@opengeni/contracts";
+import {
+  GOOGLE_DRIVE_PROVIDER_DOMAIN,
+  GoogleDriveConnectionMetadata,
+  GoogleDriveOAuthStartRequest,
+  GoogleDriveOAuthStartResponse,
+} from "@opengeni/contracts/google-drive";
 import {
   hasPermission,
   hasReservedOpenGeniSlackBotMetadata,
@@ -38,6 +44,12 @@ import {
 import type { ApiRouteDeps } from "@opengeni/core";
 import type { Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
+import {
+  browseGoogleDrive,
+  completeGoogleDriveOAuthCallback,
+  saveGoogleDriveSource,
+  startGoogleDriveOAuth,
+} from "../integrations/google-drive";
 import {
   completeMcpOAuthCallback,
   integrationBaseUrl,
@@ -96,6 +108,7 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
     const subjectId = writableSubjectId(payload.subjectId, grant.subjectId);
     const providerDomain = canonicalProviderDomain(payload.providerDomain);
     assertNotDirectPersonalSlackOAuth(providerDomain, payload.kind);
+    assertNotDirectGoogleDriveOAuth(providerDomain, payload.kind, payload.metadata);
     const connection = await createConnection(db, {
       accountId: grant.accountId,
       workspaceId,
@@ -243,6 +256,72 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
     }
   });
 
+  app.post("/v1/workspaces/:workspaceId/connections/google-drive/install", async (c) => {
+    assertIntegrationsEnabled();
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "connections:write");
+    const parsed = GoogleDriveOAuthStartRequest.safeParse(await c.req.json());
+    if (!parsed.success) {
+      throw new HTTPException(400, { message: "invalid Google Drive install request" });
+    }
+    return c.json(
+      GoogleDriveOAuthStartResponse.parse(
+        await startGoogleDriveOAuth(deps, {
+          accountId: grant.accountId,
+          workspaceId,
+          subjectId: grant.subjectId,
+          requestUrl: c.req.url,
+          payload: parsed.data,
+        }),
+      ),
+    );
+  });
+
+  app.get("/v1/integrations/google-drive/callback", async (c) => {
+    assertIntegrationsEnabled();
+    const result = await completeGoogleDriveOAuthCallback(deps, {
+      ...(c.req.query("code") ? { code: c.req.query("code") } : {}),
+      ...(c.req.query("state") ? { state: c.req.query("state") } : {}),
+      ...(c.req.query("error") ? { error: c.req.query("error") } : {}),
+      requestUrl: c.req.url,
+    });
+    return c.redirect(result.redirectTo, 302);
+  });
+
+  app.get(
+    "/v1/workspaces/:workspaceId/connections/google-drive/:connectionId/browse",
+    async (c) => {
+      assertIntegrationsEnabled();
+      const workspaceId = c.req.param("workspaceId");
+      const grant = await requireAccessGrant(c, deps, workspaceId, "connections:read");
+      return c.json(
+        await browseGoogleDrive(deps, {
+          workspaceId,
+          subjectId: grant.subjectId,
+          connectionId: c.req.param("connectionId"),
+          parentId: c.req.query("parentId") ?? "root",
+          ...(c.req.query("pageToken") ? { pageToken: c.req.query("pageToken") } : {}),
+        }),
+      );
+    },
+  );
+
+  app.post(
+    "/v1/workspaces/:workspaceId/connections/google-drive/:connectionId/source",
+    async (c) => {
+      assertIntegrationsEnabled();
+      const workspaceId = c.req.param("workspaceId");
+      const grant = await requireAccessGrant(c, deps, workspaceId, "connections:write");
+      const connection = await saveGoogleDriveSource(deps, {
+        workspaceId,
+        subjectId: grant.subjectId,
+        connectionId: c.req.param("connectionId"),
+        payload: await c.req.json(),
+      });
+      return c.json(ConnectionResponse.parse({ connection }));
+    },
+  );
+
   app.get("/v1/workspaces/:workspaceId/connections/:connectionId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "connections:read");
@@ -274,11 +353,18 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
         message: "use the dedicated OpenGeni Slack bot reinstall flow to update this connection",
       });
     }
+    if (existing && GoogleDriveConnectionMetadata.safeParse(existing.metadata).success) {
+      throw new HTTPException(422, {
+        message: "use the dedicated Google Drive reconnect or source-selection flow",
+      });
+    }
     if (existing) {
-      assertNotDirectPersonalSlackOAuth(
-        canonicalProviderDomain(payload.providerDomain ?? existing.providerDomain),
-        payload.kind ?? existing.kind,
+      const providerDomain = canonicalProviderDomain(
+        payload.providerDomain ?? existing.providerDomain,
       );
+      const kind = payload.kind ?? existing.kind;
+      assertNotDirectPersonalSlackOAuth(providerDomain, kind);
+      assertNotDirectGoogleDriveOAuth(providerDomain, kind, payload.metadata ?? existing.metadata);
     }
     // Status is not a free-form field: revocation goes through DELETE, and the
     // broker owns needs_reauth/error. Reactivating a connection is only
@@ -415,7 +501,7 @@ async function persistOpenGeniSlackBotConnection(input: {
   const { db, settings } = input.deps;
   const key = requireEnvironmentEncryption(settings);
   const credentialEncrypted = encryptCredentialBundle(key, slackBotCredentialBundle(input.token));
-  const existing = input.state.connectionId
+  const requestedExisting = input.state.connectionId
     ? await getConnectionMetadata(
         db,
         input.state.workspaceId,
@@ -423,7 +509,7 @@ async function persistOpenGeniSlackBotConnection(input: {
         input.state.subjectId,
       )
     : null;
-  if (input.state.connectionId && !existing) {
+  if (input.state.connectionId && !requestedExisting) {
     throw new SlackInstallCallbackError(
       404,
       "connection_conflict",
@@ -431,7 +517,7 @@ async function persistOpenGeniSlackBotConnection(input: {
       "principal_validation",
     );
   }
-  if (existing && !isOpenGeniSlackBotConnection(existing)) {
+  if (requestedExisting && !isOpenGeniSlackBotConnection(requestedExisting)) {
     throw new SlackInstallCallbackError(
       422,
       "connection_conflict",
@@ -439,7 +525,7 @@ async function persistOpenGeniSlackBotConnection(input: {
       "principal_validation",
     );
   }
-  if (existing?.version !== input.state.connectionVersion) {
+  if (requestedExisting && requestedExisting.version !== input.state.connectionVersion) {
     throw new SlackInstallCallbackError(
       409,
       "connection_conflict",
@@ -447,6 +533,13 @@ async function persistOpenGeniSlackBotConnection(input: {
       "principal_validation",
     );
   }
+  const existing =
+    requestedExisting ??
+    (await findMatchingOpenGeniSlackBotConnection(
+      db,
+      input.state.workspaceId,
+      input.verified.metadata,
+    ));
   const existingMetadata = existing ? openGeniSlackBotMetadata(existing.metadata) : null;
   if (existingMetadata && existingMetadata.slackTeamId !== input.verified.metadata.slackTeamId) {
     throw new SlackInstallCallbackError(
@@ -526,6 +619,28 @@ async function persistOpenGeniSlackBotConnection(input: {
   return connection;
 }
 
+async function findMatchingOpenGeniSlackBotConnection(
+  db: ApiRouteDeps["db"],
+  workspaceId: string,
+  verified: Awaited<ReturnType<typeof verifyOpenGeniSlackBotCredential>>["metadata"],
+) {
+  const connections = await listConnectionsMetadata(db, workspaceId, null);
+  return (
+    connections.find((connection) => {
+      const metadata = openGeniSlackBotMetadata(connection.metadata);
+      return (
+        connection.subjectId === null &&
+        connection.providerDomain === "slack.com" &&
+        connection.kind === "app_install" &&
+        metadata?.credentialRole === OPENGENI_SLACK_BOT_CREDENTIAL_ROLE &&
+        metadata.slackTeamId === verified.slackTeamId &&
+        metadata.botId === verified.botId &&
+        metadata.botUserId === verified.botUserId
+      );
+    }) ?? null
+  );
+}
+
 function requireOpenGeniSlackOAuthSettings(settings: ApiRouteDeps["settings"]): {
   clientId: string;
   clientSecret: string;
@@ -685,6 +800,21 @@ function assertNotDirectPersonalSlackOAuth(providerDomain: string, kind: string)
   }
 }
 
+function assertNotDirectGoogleDriveOAuth(
+  providerDomain: string,
+  kind: string,
+  metadata: Record<string, unknown> | undefined,
+): void {
+  if (
+    (providerDomain === GOOGLE_DRIVE_PROVIDER_DOMAIN && kind === "oauth2") ||
+    GoogleDriveConnectionMetadata.safeParse(metadata).success
+  ) {
+    throw new HTTPException(422, {
+      message: "Google Drive credentials must use the dedicated OAuth connection flow",
+    });
+  }
+}
+
 function assertNotReservedSlackBotMetadata(metadata: Record<string, unknown> | undefined): void {
   if (hasReservedOpenGeniSlackBotMetadata(metadata)) {
     throw new HTTPException(422, {

package/src/routes/documents.ts

@@ -37,7 +37,7 @@ import {
   searchDocuments,
 } from "@opengeni/documents";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
-import type { Hono } from "hono";
+import type { Context, Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
 import { requireAccessGrant } from "@opengeni/core";
 import { recordWorkspaceUsage, requireLimit } from "@opengeni/core";
@@ -252,7 +252,7 @@ export function registerDocumentRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.post("/v1/workspaces/:workspaceId/knowledge/search", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "documents:search");
-    const payload = DocumentSearchRequest.parse(await c.req.json());
+    const payload = await parseDocumentSearchRequest(c, "invalid knowledge search request");
     return c.json({
       results: await searchDocuments(
         db,
@@ -567,6 +567,17 @@ export function registerDocumentRoutes(app: Hono, deps: ApiRouteDeps): void {
   });
 }
 
+async function parseDocumentSearchRequest(
+  context: Context,
+  message: string,
+): Promise<DocumentSearchRequest> {
+  const parsed = DocumentSearchRequest.safeParse(await context.req.json().catch(() => null));
+  if (!parsed.success) {
+    throw new HTTPException(422, { message });
+  }
+  return parsed.data;
+}
+
 /** Derive a .txt filename for a raw-text drop from its optional title/filename. */
 function dropFilename(preferred: string | undefined): string {
   const stem = (preferred ?? "").trim() || `note-${new Date().toISOString().slice(0, 10)}`;

package/src/routes/github.ts

@@ -522,10 +522,12 @@ export function registerGitHubRoutes(app: Hono, deps: ApiRouteDeps): void {
     );
   });
 
-  app.post("/v1/workspaces/:workspaceId/github/installations/select", async (c) => {
+  // This is browser navigation, like /github/connect and the OAuth callbacks.
+  // Keep it GET: a native HTML form cannot attach the API contract header that
+  // protects product mutations, and no durable binding is written here.
+  app.get("/v1/workspaces/:workspaceId/github/installations/select", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const form = new URLSearchParams(await c.req.text());
-    const state = form.get("state");
+    const state = c.req.query("state");
     if (!state) {
       throw new HTTPException(400, { message: "missing GitHub installation selection state" });
     }
@@ -549,7 +551,7 @@ export function registerGitHubRoutes(app: Hono, deps: ApiRouteDeps): void {
         message: "GitHub installation state does not match this workspace",
       });
     }
-    const selected = form.get("installation_id");
+    const selected = c.req.query("installation_id");
     if (selected === "new") {
       return redirectToGitHubInstallation(c, deps, state);
     }
@@ -781,7 +783,7 @@ function githubInstallationChooserHtml(
       return `<label class="option"><input type="radio" name="installation_id" value="${installation.installationId}" required><span><strong>${account}</strong><small>${label}</small></span></label>`;
     })
     .join("");
-  return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Choose GitHub installation</title><style>body{font-family:system-ui,sans-serif;margin:0;min-height:100vh;display:grid;place-items:center;background:#0b0b0d;color:#f4f4f5}main{width:min(640px,calc(100vw - 32px));border:1px solid #27272a;border-radius:12px;padding:28px;background:#111114}h1{margin:0 0 10px;font-size:24px}p{margin:0 0 18px;color:#d4d4d8}.options{display:grid;gap:8px;margin-bottom:18px}.option{display:flex;align-items:center;gap:12px;border:1px solid #3f3f46;border-radius:8px;padding:12px;cursor:pointer}.option span{display:grid;gap:2px}.option small{color:#a1a1aa}button{min-height:38px;border-radius:7px;border:1px solid #3f3f46;padding:0 14px;background:#f4f4f5;color:#09090b;font:600 14px system-ui,sans-serif;cursor:pointer}.secondary{margin-left:8px;background:transparent;color:#f4f4f5}</style></head><body><main><h1>Choose a GitHub account</h1><p>Only installations where GitHub proved you are the personal owner or an active organization owner are shown.</p><form method="post" action="${escapeHtml(action)}"><input type="hidden" name="state" value="${escapeHtml(state)}"><div class="options">${options}</div><button type="submit">Connect selected</button><button class="secondary" type="submit" name="installation_id" value="new" formnovalidate>Install on another account</button></form></main></body></html>`;
+  return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Choose GitHub installation</title><style>body{font-family:system-ui,sans-serif;margin:0;min-height:100vh;display:grid;place-items:center;background:#0b0b0d;color:#f4f4f5}main{width:min(640px,calc(100vw - 32px));border:1px solid #27272a;border-radius:12px;padding:28px;background:#111114}h1{margin:0 0 10px;font-size:24px}p{margin:0 0 18px;color:#d4d4d8}.options{display:grid;gap:8px;margin-bottom:18px}.option{display:flex;align-items:center;gap:12px;border:1px solid #3f3f46;border-radius:8px;padding:12px;cursor:pointer}.option span{display:grid;gap:2px}.option small{color:#a1a1aa}button{min-height:38px;border-radius:7px;border:1px solid #3f3f46;padding:0 14px;background:#f4f4f5;color:#09090b;font:600 14px system-ui,sans-serif;cursor:pointer}.secondary{margin-left:8px;background:transparent;color:#f4f4f5}</style></head><body><main><h1>Choose a GitHub account</h1><p>Only installations where GitHub proved you are the personal owner or an active organization owner are shown.</p><form method="get" action="${escapeHtml(action)}"><input type="hidden" name="state" value="${escapeHtml(state)}"><div class="options">${options}</div><button type="submit">Connect selected</button><button class="secondary" type="submit" name="installation_id" value="new" formnovalidate>Install on another account</button></form></main></body></html>`;
 }
 
 function githubSetupPendingHtml(): string {