@opengeni/api-router 0.12.7 → 0.12.12

package/dist/{chunk-SD5GJTZ4.js → chunk-5TULDPWX.js}

@@ -421,6 +421,7 @@ async function listWorkspaceGitHubInstallationBindings(deps, workspaceId) {
     ),
     repositoryScope: installation.repositoryScope,
     repositoryCount: installation.repositoryIds.length,
+    configureUrl: null,
     createdAt: installation.createdAt,
     updatedAt: installation.updatedAt
   }));
@@ -3732,7 +3733,7 @@ function registerRigTools(server, deps, grant, can, sessionId, json) {
     );
   }
 }
-function exactAgentCommandContext(grant, callerSessionId) {
+function exactAgentCommandContext(grant, callerSessionId, authorizationSurface) {
   const turnId = grant.metadata?.["turnId"];
   const attemptId = grant.metadata?.["attemptId"];
   const executionGeneration = grant.metadata?.["executionGeneration"];
@@ -3746,7 +3747,8 @@ function exactAgentCommandContext(grant, callerSessionId) {
     callerSessionId,
     callerTurnId: turnId,
     callerAttemptId: attemptId,
-    callerExecutionGeneration: executionGeneration
+    callerExecutionGeneration: executionGeneration,
+    ...authorizationSurface ? { authorizationSurface } : {}
   };
 }
 function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSessionId, toolspaceMode, json) {
@@ -4064,7 +4066,6 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
           targetSessionId,
           {
             text,
-            toolsProvided: false,
             delivery: "send",
             origin: "operator",
             clientEventId: idempotencyKey,
@@ -4087,16 +4088,10 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
         }
       },
       async ({ sessionId, idempotencyKey, reason }) => {
-        const authorization = await authorizeFirstPartySession(
-          deps,
-          grant,
-          sessionId,
-          "session.control"
-        );
         if (callerSessionId !== null) {
           const controlled2 = await controlAgentSessionWorkstream(
             deps,
-            exactAgentCommandContext(grant, callerSessionId),
+            exactAgentCommandContext(grant, callerSessionId, "first_party_mcp"),
             {
               targetSessionId: sessionId,
               action: "pause",
@@ -4109,7 +4104,7 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
             effectiveControl: projectEffectiveControlForRelatedAccess(
               serializeEffectiveSessionControl(controlled2.control),
               sessionId,
-              authorization?.relatedSessionAccess ?? "root"
+              controlled2.authorization?.relatedSessionAccess ?? "root"
             ),
             interruptionCount: controlled2.interruptionCount,
             replay: controlled2.replay
@@ -4121,7 +4116,8 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
             accountId: grant.accountId,
             workspaceId: grant.workspaceId,
             sessionId,
-            subjectId: grant.subjectId
+            subjectId: grant.subjectId,
+            authorizationSurface: "first_party_mcp"
           },
           {
             action: "pause",
@@ -4129,14 +4125,7 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
             ...reason ? { reason } : {}
           }
         );
-        return json({
-          ...controlled,
-          effectiveControl: projectEffectiveControlForRelatedAccess(
-            controlled.effectiveControl,
-            sessionId,
-            authorization?.relatedSessionAccess ?? "root"
-          )
-        });
+        return json(controlled);
       }
     );
     server.registerTool(
@@ -4150,16 +4139,10 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
         }
       },
       async ({ sessionId, idempotencyKey, reason }) => {
-        const authorization = await authorizeFirstPartySession(
-          deps,
-          grant,
-          sessionId,
-          "session.control"
-        );
         if (callerSessionId !== null) {
           const controlled2 = await controlAgentSessionWorkstream(
             deps,
-            exactAgentCommandContext(grant, callerSessionId),
+            exactAgentCommandContext(grant, callerSessionId, "first_party_mcp"),
             {
               targetSessionId: sessionId,
               action: "resume",
@@ -4172,7 +4155,7 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
             effectiveControl: projectEffectiveControlForRelatedAccess(
               serializeEffectiveSessionControl(controlled2.control),
               sessionId,
-              authorization?.relatedSessionAccess ?? "root"
+              controlled2.authorization?.relatedSessionAccess ?? "root"
             ),
             interruptionCount: controlled2.interruptionCount,
             replay: controlled2.replay
@@ -4184,7 +4167,8 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
             accountId: grant.accountId,
             workspaceId: grant.workspaceId,
             sessionId,
-            subjectId: grant.subjectId
+            subjectId: grant.subjectId,
+            authorizationSurface: "first_party_mcp"
           },
           {
             action: "resume",
@@ -4192,14 +4176,7 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
             ...reason ? { reason } : {}
           }
         );
-        return json({
-          ...controlled,
-          effectiveControl: projectEffectiveControlForRelatedAccess(
-            controlled.effectiveControl,
-            sessionId,
-            authorization?.relatedSessionAccess ?? "root"
-          )
-        });
+        return json(controlled);
       }
     );
     if (callerSessionId !== null) {
@@ -4214,10 +4191,9 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
           }
         },
         async ({ sessionId, instruction, idempotencyKey }) => {
-          await authorizeFirstPartySession(deps, grant, sessionId, "session.steer");
           const result = await steerAgentSession(
             deps,
-            exactAgentCommandContext(grant, callerSessionId),
+            exactAgentCommandContext(grant, callerSessionId, "first_party_mcp"),
             { targetSessionId: sessionId, instruction, idempotencyKey }
           );
           return json({
@@ -4391,14 +4367,16 @@ function registerGitHubConnectTool(server, deps, grant, options, json) {
       const { settings } = deps;
       const missing = githubAppMissingSettings(settings);
       const slug = settings.githubAppSlug?.trim() || null;
+      const setupMode = settings.productAccessMode === "managed" ? "platform" : "operator";
       if (missing.length > 0 || !slug) {
         return json({
           configured: false,
           status: "disabled",
-          appSlug: slug,
+          setupMode,
+          appSlug: setupMode === "operator" ? slug : null,
           installUrl: null,
           linkUrl: null,
-          missing
+          missing: setupMode === "operator" ? missing : []
         });
       }
       const installations = await listWorkspaceGitHubInstallationBindings(deps, grant.workspaceId);
@@ -4411,13 +4389,18 @@ function registerGitHubConnectTool(server, deps, grant, options, json) {
         ...githubBrowserGrantClaims(settings, grant)
       }) : null;
       const connectUrl = state ? `${baseUrl}/v1/workspaces/${grant.workspaceId}/github/connect?state=${encodeURIComponent(state)}` : null;
+      const installationViews = installations.map((installation) => ({
+        ...installation,
+        configureUrl: state && baseUrl ? `${baseUrl}/v1/workspaces/${grant.workspaceId}/github/installations/${installation.installationId}/configure?state=${encodeURIComponent(state)}` : null
+      }));
       return json({
         configured: true,
         status,
-        appSlug: slug,
+        setupMode,
+        appSlug: setupMode === "operator" ? slug : null,
         installUrl: connectUrl,
         linkUrl: connectUrl,
-        installations,
+        installations: installationViews,
         missing: []
       });
     }
@@ -11812,6 +11795,7 @@ import {
   buildGitHubAppManifest,
   convertGitHubAppManifest,
   createSignedState as createSignedState5,
+  discoverGitHubInstallationBindingCandidates,
   envLinesFromGitHubManifestConversion,
   GitHubAppApiError,
   GitHubAppConfigurationError as GitHubAppConfigurationError2,
@@ -11839,6 +11823,7 @@ function registerGitHubRoutes(app, deps) {
     const slug = settings.githubAppSlug?.trim() || null;
     const installations = missing.length === 0 ? await listWorkspaceGitHubInstallationBindings(deps, grant.workspaceId) : [];
     const status = githubBindingStatus(missing.length === 0, installations);
+    const setupMode = settings.productAccessMode === "managed" ? "platform" : "operator";
     const canManage = hasPermission8(grant.permissions, "github:manage");
     const connectState = missing.length === 0 && slug && canManage ? createSignedState5(githubStateSecret, {
       accountId: grant.accountId,
@@ -11847,16 +11832,21 @@ function registerGitHubRoutes(app, deps) {
       ...githubBrowserGrantClaims(settings, grant)
     }) : null;
     const connectUrl = connectState ? `${openGeniBaseUrl(settings, c)}/v1/workspaces/${grant.workspaceId}/github/connect?state=${encodeURIComponent(connectState)}` : null;
+    const installationViews = installations.map((installation) => ({
+      ...installation,
+      configureUrl: connectState ? `${openGeniBaseUrl(settings, c)}/v1/workspaces/${grant.workspaceId}/github/installations/${installation.installationId}/configure?state=${encodeURIComponent(connectState)}` : null
+    }));
     return c.json({
       configured: missing.length === 0,
       status,
-      appId: settings.githubAppId ?? null,
-      clientId: settings.githubClientId ?? null,
-      appSlug: slug,
+      setupMode,
+      appId: setupMode === "operator" ? settings.githubAppId ?? null : null,
+      clientId: setupMode === "operator" ? settings.githubClientId ?? null : null,
+      appSlug: setupMode === "operator" ? slug : null,
       installUrl: connectUrl,
       linkUrl: connectUrl,
-      installations,
-      missing
+      installations: installationViews,
+      missing: setupMode === "operator" ? missing : []
     });
   });
   app.get("/v1/workspaces/:workspaceId/github/connect", async (c) => {
@@ -11869,8 +11859,8 @@ function registerGitHubRoutes(app, deps) {
     if (!statePayload || statePayload.intent !== "installation_authority" || statePayload.workspaceId !== workspaceId || typeof statePayload.accountId !== "string" || !isFreshGitHubBindingState(statePayload)) {
       throw new HTTPException17(400, { message: "invalid or expired GitHub installation state" });
     }
-    const slug = settings.githubAppSlug?.trim();
-    if (!slug || githubAppMissingSettings2(settings).length > 0) {
+    const clientId = settings.githubClientId?.trim();
+    if (!clientId || githubAppMissingSettings2(settings).length > 0) {
       throw new HTTPException17(409, {
         message: JSON.stringify({
           message: "GitHub App is not configured",
@@ -11878,9 +11868,19 @@ function registerGitHubRoutes(app, deps) {
         })
       });
     }
-    setGitHubStateCookie(c, deps, state);
+    const discoveryState = createSignedState5(githubStateSecret, {
+      accountId: statePayload.accountId,
+      workspaceId,
+      intent: "installation_authority_discovery",
+      ...continuedGitHubBrowserGrantClaims(statePayload)
+    });
+    setGitHubStateCookie(c, deps, discoveryState);
     return c.redirect(
-      `https://github.com/apps/${slug}/installations/new?state=${encodeURIComponent(state)}`
+      githubOAuthAuthorizeUrl({
+        clientId,
+        state: discoveryState,
+        redirectUri: `${openGeniBaseUrl(settings, c)}/v1/github/oauth/callback`
+      })
     );
   });
   app.get("/v1/workspaces/:workspaceId/github/repositories", async (c) => {
@@ -11932,7 +11932,46 @@ function registerGitHubRoutes(app, deps) {
     }
     return c.body(null, 204);
   });
+  app.get(
+    "/v1/workspaces/:workspaceId/github/installations/:installationId/configure",
+    async (c) => {
+      const workspaceId = c.req.param("workspaceId");
+      const installationId = parsePositiveInteger(c.req.param("installationId"));
+      const state = c.req.query("state");
+      if (installationId === null || !state) {
+        throw new HTTPException17(400, { message: "invalid GitHub installation configuration" });
+      }
+      const statePayload = readSignedState4(state, githubStateSecret);
+      if (!statePayload || statePayload.intent !== "installation_authority" || statePayload.workspaceId !== workspaceId || typeof statePayload.accountId !== "string" || !isFreshGitHubBindingState(statePayload)) {
+        throw new HTTPException17(400, {
+          message: "invalid or expired GitHub installation configuration state"
+        });
+      }
+      const grant = await requireGitHubManageGrant(c, deps, workspaceId, statePayload);
+      if (grant.accountId !== statePayload.accountId) {
+        throw new HTTPException17(403, {
+          message: "GitHub installation state does not match this workspace"
+        });
+      }
+      const installation = (await listWorkspaceGitHubInstallationBindings(deps, grant.workspaceId)).find((candidate) => candidate.installationId === installationId);
+      if (!installation) {
+        throw new HTTPException17(404, { message: "GitHub installation binding not found" });
+      }
+      const configureState = createSignedState5(githubStateSecret, {
+        accountId: grant.accountId,
+        workspaceId: grant.workspaceId,
+        expectedInstallationId: installationId,
+        intent: "installation_authority_install",
+        ...continuedGitHubBrowserGrantClaims(statePayload)
+      });
+      setGitHubStateCookie(c, deps, configureState);
+      const configureUrl = githubInstallationSettingsUrl(installation);
+      configureUrl.searchParams.set("state", configureState);
+      return c.redirect(configureUrl.toString());
+    }
+  );
   app.post("/v1/workspaces/:workspaceId/github/app-manifest", async (c) => {
+    assertOperatorGitHubAppSetup(settings);
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant10(c, deps, workspaceId, "github:manage");
     const payload = GitHubAppManifestCreate.parse(await c.req.json());
@@ -11961,6 +12000,7 @@ function registerGitHubRoutes(app, deps) {
     });
   });
   app.get("/v1/github/app-manifest/callback", async (c) => {
+    assertOperatorGitHubAppSetup(settings);
     const code = c.req.query("code");
     const state = c.req.query("state");
     if (!code) {
@@ -11980,12 +12020,15 @@ function registerGitHubRoutes(app, deps) {
     }
   });
   const handleGitHubInstallCallback = async (c) => {
-    const state = c.req.query("state");
+    const state = c.req.query("state") ?? allCookieValues(c, githubStateCookie).find((candidate) => {
+      const payload = readSignedState4(candidate, githubStateSecret);
+      return payload?.intent === "installation_authority_install" && isFreshGitHubBindingState(payload);
+    });
     if (!state) {
       throw new HTTPException17(400, { message: "missing GitHub installation state" });
     }
     const statePayload = readSignedState4(state, githubStateSecret);
-    if (!statePayload || statePayload.intent !== "installation_authority" || typeof statePayload.accountId !== "string" || typeof statePayload.workspaceId !== "string" || !isFreshGitHubBindingState(statePayload)) {
+    if (!statePayload || statePayload.intent !== "installation_authority_install" || typeof statePayload.accountId !== "string" || typeof statePayload.workspaceId !== "string" || !isFreshGitHubBindingState(statePayload)) {
       throw new HTTPException17(400, { message: "invalid or expired GitHub installation state" });
     }
     requireGitHubStateCookie(c, state);
@@ -12006,6 +12049,11 @@ function registerGitHubRoutes(app, deps) {
     if (installationId === null) {
       throw new HTTPException17(400, { message: "missing or invalid GitHub installation_id" });
     }
+    if (statePayload.expectedInstallationId !== void 0 && statePayload.expectedInstallationId !== installationId) {
+      throw new HTTPException17(409, {
+        message: "GitHub returned a different installation than the one being configured"
+      });
+    }
     const clientId = settings.githubClientId?.trim();
     if (!clientId) {
       throw new HTTPException17(409, {
@@ -12043,7 +12091,62 @@ function registerGitHubRoutes(app, deps) {
       throw new HTTPException17(400, { message: "missing GitHub OAuth state" });
     }
     const statePayload = readSignedState4(state, githubStateSecret);
-    if (!statePayload || statePayload.intent !== "installation_authority_oauth" || typeof statePayload.accountId !== "string" || typeof statePayload.workspaceId !== "string" || !isFreshGitHubBindingState(statePayload)) {
+    if (!statePayload || typeof statePayload.accountId !== "string" || typeof statePayload.workspaceId !== "string" || !isFreshGitHubBindingState(statePayload)) {
+      throw new HTTPException17(400, { message: "invalid or expired GitHub OAuth state" });
+    }
+    if (statePayload.intent === "installation_authority_discovery") {
+      requireGitHubStateCookie(c, state);
+      const grant2 = await requireGitHubManageGrant(c, deps, statePayload.workspaceId, statePayload);
+      if (grant2.accountId !== statePayload.accountId) {
+        throw new HTTPException17(403, {
+          message: "GitHub OAuth state does not match this workspace"
+        });
+      }
+      let candidates;
+      try {
+        candidates = deps.githubAppApi?.discoverInstallationBindingCandidates ? await deps.githubAppApi.discoverInstallationBindingCandidates({ code }) : deps.githubAppApi ? null : await discoverGitHubInstallationBindingCandidates(settings, { code });
+      } catch (error) {
+        throw githubAuthorityHttpError(error);
+      }
+      if (!candidates) {
+        throw new HTTPException17(409, {
+          message: "The configured GitHub provider cannot discover owner-authorized installations"
+        });
+      }
+      if (!isConsistentGitHubBindingCandidates(candidates)) {
+        throw new HTTPException17(409, {
+          message: "GitHub installation discovery proof is stale or invalid"
+        });
+      }
+      const selectionState = createSignedState5(githubStateSecret, {
+        accountId: grant2.accountId,
+        workspaceId: grant2.workspaceId,
+        intent: "installation_authority_selection",
+        allowedInstallationIds: candidates.map(({ installation }) => installation.installationId),
+        ...continuedGitHubBrowserGrantClaims(statePayload)
+      });
+      if (candidates.length === 0) {
+        return redirectToGitHubInstallation(c, deps, selectionState);
+      }
+      if (candidates.length === 1) {
+        return redirectToExactGitHubAuthorization(
+          c,
+          deps,
+          selectionState,
+          candidates[0].installation.installationId
+        );
+      }
+      setGitHubStateCookie(c, deps, selectionState);
+      return c.html(
+        githubInstallationChooserHtml(
+          candidates,
+          selectionState,
+          grant2.workspaceId,
+          openGeniBaseUrl(settings, c)
+        )
+      );
+    }
+    if (statePayload.intent !== "installation_authority_oauth") {
       throw new HTTPException17(400, { message: "invalid or expired GitHub OAuth state" });
     }
     const installationId = parsePositiveInteger(String(statePayload.installationId ?? ""));
@@ -12114,6 +12217,41 @@ function registerGitHubRoutes(app, deps) {
       )
     );
   });
+  app.post("/v1/workspaces/:workspaceId/github/installations/select", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const form = new URLSearchParams(await c.req.text());
+    const state = form.get("state");
+    if (!state) {
+      throw new HTTPException17(400, { message: "missing GitHub installation selection state" });
+    }
+    const statePayload = readSignedState4(state, githubStateSecret);
+    if (!statePayload || statePayload.intent !== "installation_authority_selection" || typeof statePayload.accountId !== "string" || statePayload.accountId.length === 0 || statePayload.workspaceId !== workspaceId || !isFreshGitHubBindingState(statePayload)) {
+      throw new HTTPException17(400, {
+        message: "invalid or expired GitHub installation selection state"
+      });
+    }
+    requireGitHubStateCookie(c, state);
+    const grant = await requireGitHubManageGrant(c, deps, workspaceId, statePayload);
+    if (grant.accountId !== statePayload.accountId) {
+      throw new HTTPException17(403, {
+        message: "GitHub installation state does not match this workspace"
+      });
+    }
+    const selected = form.get("installation_id");
+    if (selected === "new") {
+      return redirectToGitHubInstallation(c, deps, state);
+    }
+    const installationId = parsePositiveInteger(selected);
+    if (installationId === null) {
+      throw new HTTPException17(400, { message: "invalid GitHub installation selection" });
+    }
+    if (!Array.isArray(statePayload.allowedInstallationIds) || !statePayload.allowedInstallationIds.includes(installationId)) {
+      throw new HTTPException17(403, {
+        message: "GitHub installation was not in the owner-authorized selection"
+      });
+    }
+    return redirectToExactGitHubAuthorization(c, deps, state, installationId);
+  });
   app.post("/v1/workspaces/:workspaceId/github/installations", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const form = new URLSearchParams(await c.req.text());
@@ -12125,11 +12263,62 @@ function registerGitHubRoutes(app, deps) {
     if (!statePayload || typeof statePayload.accountId !== "string" || statePayload.accountId.length === 0 || statePayload.workspaceId !== workspaceId) {
       throw new HTTPException17(400, { message: "invalid or expired GitHub OAuth state" });
     }
-    throw legacyInstallationChooserDisabled();
+    throw new HTTPException17(410, { message: legacyInstallationChooserDisabledMessage });
+  });
+}
+function assertOperatorGitHubAppSetup(settings) {
+  if (settings.productAccessMode === "managed") {
+    throw new HTTPException17(404, {
+      message: "GitHub App creation is unavailable in platform-managed deployments"
+    });
+  }
+}
+function redirectToGitHubInstallation(c, deps, sourceState) {
+  const payload = readSignedState4(sourceState, deps.githubStateSecret);
+  const slug = deps.settings.githubAppSlug?.trim();
+  if (!payload || typeof payload.accountId !== "string" || typeof payload.workspaceId !== "string" || !slug) {
+    throw new HTTPException17(409, { message: "GitHub App installation is unavailable" });
+  }
+  const installState = createSignedState5(deps.githubStateSecret, {
+    accountId: payload.accountId,
+    workspaceId: payload.workspaceId,
+    intent: "installation_authority_install",
+    ...continuedGitHubBrowserGrantClaims(payload)
   });
+  setGitHubStateCookie(c, deps, installState);
+  return c.redirect(
+    `https://github.com/apps/${encodeURIComponent(slug)}/installations/new?state=${encodeURIComponent(installState)}`
+  );
 }
-function legacyInstallationChooserDisabled() {
-  return new HTTPException17(410, { message: legacyInstallationChooserDisabledMessage });
+function githubInstallationSettingsUrl(installation) {
+  if (installation.accountType === "Organization" && installation.accountLogin) {
+    return new URL(
+      `https://github.com/organizations/${encodeURIComponent(installation.accountLogin)}/settings/installations/${installation.installationId}`
+    );
+  }
+  return new URL(`https://github.com/settings/installations/${installation.installationId}`);
+}
+function redirectToExactGitHubAuthorization(c, deps, sourceState, installationId) {
+  const payload = readSignedState4(sourceState, deps.githubStateSecret);
+  const clientId = deps.settings.githubClientId?.trim();
+  if (!payload || typeof payload.accountId !== "string" || typeof payload.workspaceId !== "string" || !clientId) {
+    throw new HTTPException17(409, { message: "GitHub user authorization is unavailable" });
+  }
+  const oauthState = createSignedState5(deps.githubStateSecret, {
+    accountId: payload.accountId,
+    workspaceId: payload.workspaceId,
+    installationId,
+    intent: "installation_authority_oauth",
+    ...continuedGitHubBrowserGrantClaims(payload)
+  });
+  setGitHubStateCookie(c, deps, oauthState);
+  return c.redirect(
+    githubOAuthAuthorizeUrl({
+      clientId,
+      state: oauthState,
+      redirectUri: `${openGeniBaseUrl(deps.settings, c)}/v1/github/oauth/callback`
+    })
+  );
 }
 function setGitHubStateCookie(c, deps, state) {
   setCookie(c, githubStateCookie, state, {
@@ -12206,9 +12395,30 @@ function githubSuccessHtml(envLines) {
 function githubSetupSuccessHtml(account, returnUrl) {
   return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>GitHub App Connected</title><style>body{font-family:system-ui,sans-serif;margin:0;min-height:100vh;display:grid;place-items:center;background:#0b0b0d;color:#f4f4f5}main{width:min(640px,calc(100vw - 32px));border:1px solid #27272a;border-radius:8px;padding:28px;background:#111114}h1{margin:0 0 10px;font-size:24px;line-height:1.2}p{margin:0 0 18px;color:#d4d4d8}.button{display:inline-flex;align-items:center;justify-content:center;min-height:36px;border-radius:6px;border:1px solid #3f3f46;padding:0 12px;background:#f4f4f5;color:#09090b;font:600 14px system-ui,sans-serif;text-decoration:none}</style></head><body><main><h1>GitHub App connected</h1><p>${escapeHtml2(account)} is now available to this OpenGeni workspace through an explicit repository allowlist.</p><a class="button" href="${escapeHtml2(returnUrl)}">Back to OpenGeni</a></main></body></html>`;
 }
+function githubInstallationChooserHtml(candidates, state, workspaceId, baseUrl) {
+  const action = `${baseUrl}/v1/workspaces/${encodeURIComponent(workspaceId)}/github/installations/select`;
+  const options = candidates.map(({ installation, authorityKind }) => {
+    const account = escapeHtml2(
+      installation.accountLogin ?? `installation ${installation.installationId}`
+    );
+    const label = authorityKind === "personal_owner" ? "Personal account" : "Organization owner";
+    return `<label class="option"><input type="radio" name="installation_id" value="${installation.installationId}" required><span><strong>${account}</strong><small>${label}</small></span></label>`;
+  }).join("");
+  return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Choose GitHub installation</title><style>body{font-family:system-ui,sans-serif;margin:0;min-height:100vh;display:grid;place-items:center;background:#0b0b0d;color:#f4f4f5}main{width:min(640px,calc(100vw - 32px));border:1px solid #27272a;border-radius:12px;padding:28px;background:#111114}h1{margin:0 0 10px;font-size:24px}p{margin:0 0 18px;color:#d4d4d8}.options{display:grid;gap:8px;margin-bottom:18px}.option{display:flex;align-items:center;gap:12px;border:1px solid #3f3f46;border-radius:8px;padding:12px;cursor:pointer}.option span{display:grid;gap:2px}.option small{color:#a1a1aa}button{min-height:38px;border-radius:7px;border:1px solid #3f3f46;padding:0 14px;background:#f4f4f5;color:#09090b;font:600 14px system-ui,sans-serif;cursor:pointer}.secondary{margin-left:8px;background:transparent;color:#f4f4f5}</style></head><body><main><h1>Choose a GitHub account</h1><p>Only installations where GitHub proved you are the personal owner or an active organization owner are shown.</p><form method="post" action="${escapeHtml2(action)}"><input type="hidden" name="state" value="${escapeHtml2(state)}"><div class="options">${options}</div><button type="submit">Connect selected</button><button class="secondary" type="submit" name="installation_id" value="new" formnovalidate>Install on another account</button></form></main></body></html>`;
+}
 function githubSetupPendingHtml() {
   return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>GitHub App Requested</title><style>body{font-family:system-ui,sans-serif;margin:0;min-height:100vh;display:grid;place-items:center;background:#0b0b0d;color:#f4f4f5}main{width:min(640px,calc(100vw - 32px));border:1px solid #27272a;border-radius:8px;padding:28px;background:#111114}h1{margin:0 0 10px;font-size:24px;line-height:1.2}p{margin:0;color:#d4d4d8}</style></head><body><main><h1>GitHub App request sent</h1><p>A GitHub organization owner must approve the installation. OpenGeni has not created a workspace binding.</p></main></body></html>`;
 }
+function isConsistentGitHubBindingCandidates(candidates) {
+  const ids = /* @__PURE__ */ new Set();
+  return candidates.every(({ installation, authorityKind }) => {
+    if (!Number.isSafeInteger(installation.installationId) || installation.installationId <= 0 || !Number.isSafeInteger(installation.accountId) || installation.accountId <= 0 || !installation.accountLogin?.trim() || installation.suspended || ids.has(installation.installationId)) {
+      return false;
+    }
+    ids.add(installation.installationId);
+    return authorityKind === "personal_owner" ? installation.accountType === "User" : installation.accountType === "Organization";
+  });
+}
 function parsePositiveInteger(value) {
   if (!value || !/^\d+$/.test(value)) {
     return null;
@@ -12910,6 +13120,7 @@ import {
   SessionContextBusyError,
   HumanInputResponseValidationError,
   latestWorkspaceCapture,
+  sessionLatestWorkspaceCapture,
   workspaceCaptureAtRevision
 } from "@opengeni/db";
 import {
@@ -13720,11 +13931,69 @@ import { HTTPException as HTTPException21 } from "hono/http-exception";
 var CAPTURE_INLINE_MANIFEST_MAX_BYTES = 2 * 1024 * 1024;
 var CAPTURE_INLINE_FILE_MAX_BYTES = 256 * 1024;
 var CAPTURE_SIGNED_URL_TTL_SECONDS = 300;
+var WorkspaceCaptureManifestCache = class {
+  constructor(maxEntries = 64, maxBytes = 16 * 1024 * 1024) {
+    this.maxEntries = maxEntries;
+    this.maxBytes = maxBytes;
+  }
+  #entries = /* @__PURE__ */ new Map();
+  #retainedBytes = 0;
+  get(row) {
+    const key = row.manifestKey;
+    if (!key) return null;
+    const entry = this.#entries.get(key);
+    if (!entry || entry.identity !== manifestIdentity(row)) return null;
+    this.#entries.delete(key);
+    this.#entries.set(key, entry);
+    return entry;
+  }
+  getInlineResponse(row) {
+    const key = row.manifestKey;
+    if (!key) return null;
+    const entry = this.#entries.get(key);
+    if (!entry || entry.identity !== manifestIdentity(row) || !entry.inlineResponse) return null;
+    this.#entries.delete(key);
+    this.#entries.set(key, entry);
+    return entry.inlineResponse;
+  }
+  setInlineResponse(row, response) {
+    const key = row.manifestKey;
+    if (!key) return;
+    const entry = this.#entries.get(key);
+    if (!entry || entry.identity !== manifestIdentity(row)) return;
+    entry.inlineResponse = response;
+  }
+  set(row, loaded) {
+    const key = row.manifestKey;
+    if (!key || this.maxEntries <= 0 || this.maxBytes <= 0 || loaded.byteLength > CAPTURE_INLINE_MANIFEST_MAX_BYTES || loaded.byteLength > this.maxBytes) {
+      return;
+    }
+    const previous = this.#entries.get(key);
+    if (previous) {
+      this.#retainedBytes -= previous.byteLength;
+      this.#entries.delete(key);
+    }
+    this.#entries.set(key, { ...loaded, identity: manifestIdentity(row) });
+    this.#retainedBytes += loaded.byteLength;
+    while (this.#entries.size > this.maxEntries || this.#retainedBytes > this.maxBytes) {
+      const oldestKey = this.#entries.keys().next().value;
+      if (oldestKey === void 0) break;
+      const oldest = this.#entries.get(oldestKey);
+      this.#entries.delete(oldestKey);
+      if (oldest) this.#retainedBytes -= oldest.byteLength;
+    }
+  }
+};
+function manifestIdentity(row) {
+  return `${row.sessionId}\0${row.turnId}\0${row.revision}\0${row.leaseEpoch}\0${row.capturedAt}`;
+}
 function signedUrl(signed) {
   return { url: signed.url, expiresAt: signed.expiresAt.toISOString() };
 }
-async function loadManifest(row, storage) {
+async function loadManifest(row, storage, cache) {
   if (!row.manifestKey) return null;
+  const cached = cache?.get(row);
+  if (cached) return cached;
   const stats = WorkspaceCaptureStats.safeParse(row.stats);
   if (!stats.success) {
     console.warn(
@@ -13759,9 +14028,11 @@ async function loadManifest(row, storage) {
     );
     return null;
   }
-  return { manifest, byteLength: blob.bytes.byteLength, stats: servedStats };
+  const loaded = { manifest, byteLength: blob.bytes.byteLength, stats: servedStats };
+  cache?.set(row, loaded);
+  return loaded;
 }
-async function serveWorkspaceCapture(row, storage) {
+async function serveWorkspaceCapture(row, storage, cache) {
   if (!row) {
     return { available: false };
   }
@@ -13780,7 +14051,9 @@ async function serveWorkspaceCapture(row, storage) {
     });
   }
   if (row.state !== "available" || !row.manifestKey) return { available: false };
-  const loaded = await loadManifest(row, storage);
+  const cachedResponse = cache?.getInlineResponse(row);
+  if (cachedResponse) return cachedResponse;
+  const loaded = await loadManifest(row, storage, cache);
   if (!loaded) return { available: false };
   const meta = {
     available: true,
@@ -13792,11 +14065,16 @@ async function serveWorkspaceCapture(row, storage) {
     stats: loaded.stats
   };
   if (loaded.byteLength <= CAPTURE_INLINE_MANIFEST_MAX_BYTES) {
-    return GetWorkspaceCaptureResponse.parse({
+    const response = GetWorkspaceCaptureResponse.parse({
       ...meta,
       manifest: loaded.manifest,
       manifestUrl: null
     });
+    if (!response.available) {
+      throw new Error("validated inline capture response lost its available discriminator");
+    }
+    cache?.setInlineResponse(row, response);
+    return response;
   }
   const signed = await storage.createGetUrl({
     key: row.manifestKey,
@@ -13868,6 +14146,7 @@ async function serveWorkspaceCaptureFile(row, path, storage) {
 // src/routes/sessions.ts
 function registerSessionRoutes(app, deps) {
   const { settings, db, bus, workflowClient, objectStorage } = deps;
+  const workspaceCaptureManifestCache = new WorkspaceCaptureManifestCache();
   const ptyIdentity = (pty) => ({
     leaseId: pty.leaseId,
     sandboxGroupId: pty.sandboxGroupId,
@@ -14831,8 +15110,6 @@ function registerSessionRoutes(app, deps) {
       text: payload.text,
       turnInstructions: payload.turnInstructions ?? null,
       resources: payload.resources,
-      tools: payload.tools,
-      toolsProvided: userMessagePayloadHasOwnProperty({ payload: raw }, "tools"),
       model: payload.model ?? null,
       reasoningEffort: payload.reasoningEffort ?? null,
       mcpCredentialUpdates: payload.mcpCredentialUpdates ?? [],
@@ -14867,8 +15144,6 @@ function registerSessionRoutes(app, deps) {
         text: event.payload.text,
         turnInstructions: event.payload.turnInstructions ?? null,
         resources: event.payload.resources ?? [],
-        tools: event.payload.tools ?? [],
-        toolsProvided: userMessagePayloadHasOwnProperty(rawEvent, "tools"),
         model: event.payload.model ?? null,
         reasoningEffort: event.payload.reasoningEffort ?? null,
         mcpCredentialUpdates: event.payload.mcpCredentialUpdates ?? [],
@@ -15465,15 +15740,16 @@ function registerSessionRoutes(app, deps) {
     const workspaceId = c.req.param("workspaceId") ?? "";
     await requireAccessGrant14(c, deps, workspaceId, "files:read");
     const sessionId = c.req.param("sessionId") ?? "";
-    const session = await getSession5(db, workspaceId, sessionId);
-    if (!session) {
+    const lookup = await sessionLatestWorkspaceCapture(db, workspaceId, sessionId);
+    if (!lookup.sessionExists) {
       throw new HTTPException22(404, { message: "session not found" });
     }
     if (!objectStorage) {
       return c.json({ available: false });
     }
-    const row = await latestWorkspaceCapture(db, workspaceId, sessionId);
-    return c.json(await serveWorkspaceCapture(row, objectStorage));
+    return c.json(
+      await serveWorkspaceCapture(lookup.capture, objectStorage, workspaceCaptureManifestCache)
+    );
   });
   app.get("/v1/workspaces/:workspaceId/sessions/:sessionId/workspace/capture/file", async (c) => {
     const workspaceId = c.req.param("workspaceId") ?? "";
@@ -15897,18 +16173,6 @@ function optionalEventSequence(raw) {
   }
   return Math.floor(sequence);
 }
-function hasOwnProperty(value, key) {
-  return Boolean(
-    value && typeof value === "object" && Object.prototype.hasOwnProperty.call(value, key)
-  );
-}
-function userMessagePayloadHasOwnProperty(value, key) {
-  if (!value || typeof value !== "object") {
-    return false;
-  }
-  const payload = value.payload;
-  return hasOwnProperty(payload, key);
-}
 function sessionCreateErrorResponse(c, error) {
   if (error instanceof SessionSpawnDeniedError2) {
     return c.json(
@@ -17624,6 +17888,14 @@ var routeLabelPatterns = [
     pattern: /^\/v1\/workspaces\/[^/]+\/github\/connect$/,
     label: "/v1/workspaces/:workspaceId/github/connect"
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/github\/installations\/select$/,
+    label: "/v1/workspaces/:workspaceId/github/installations/select"
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/github\/installations\/[^/]+\/configure$/,
+    label: "/v1/workspaces/:workspaceId/github/installations/:installationId/configure"
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/github\/installations$/,
     label: "/v1/workspaces/:workspaceId/github/installations"
@@ -17805,4 +18077,4 @@ export {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession2 as workflowIdForSession
 };
-//# sourceMappingURL=chunk-SD5GJTZ4.js.map
+//# sourceMappingURL=chunk-5TULDPWX.js.map