@opengeni/api-router 0.21.11 → 0.21.14

package/dist/app.js

@@ -22,7 +22,7 @@ import {
   validateToolRefs,
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession
-} from "./chunk-J4JS2F7L.js";
+} from "./chunk-R5PDSH2A.js";
 export {
   API_MAX_REQUEST_BODY_BYTES,
   allowedCorsOrigin,

package/dist/{chunk-J4JS2F7L.js → chunk-R5PDSH2A.js}

@@ -347,7 +347,6 @@ import {
   getPreferenceRegistryFullContent,
   getVariableSet,
   getVariableSetByName,
-  areGitHubRepositoriesAllowedForWorkspace,
   listScheduledTaskRuns,
   listScheduledTasks,
   listSessionEventPage,
@@ -386,7 +385,6 @@ import {
 import { appendAndPublishEvents as appendAndPublishEvents2, publishDurableSessionEvents } from "@opengeni/events";
 import {
   createSignedState as createSignedState3,
-  createGitHubAppInstallationToken,
   GitHubAppConfigurationError,
   githubAppMissingSettings
 } from "@opengeni/github";
@@ -6253,7 +6251,6 @@ var FIRST_PARTY_TOOL_AUTHORIZATION = {
   variable_set_set_variable: { allOf: ["variable-sets:manage"] },
   environment_set_variable: { allOf: ["variable-sets:manage"] },
   github_connect_link: { allOf: ["github:use"] },
-  github_token: { sessionRequired: true, allOf: ["github:use"] },
   github_repositories_list: { allOf: ["github:use"] },
   social_connections_list: { allOf: ["connections:read"] },
   social_posts_recent: { allOf: ["connections:read"] },
@@ -6411,9 +6408,6 @@ function buildOpenGeniMcpServer(deps, grant, options = {}) {
   registerVariableSetTools(server, deps, grant, can, json);
   if (can("github:use")) {
     registerGitHubConnectTool(server, deps, grant, options, json);
-    if (sessionId !== null) {
-      registerGitHubTokenTool(server, deps, grant, sessionId, json);
-    }
   }
   if (!toolspaceMode || can("github:use")) {
     server.registerTool(
@@ -8508,50 +8502,6 @@ function registerGitHubConnectTool(server, deps, grant, options, json) {
     }
   );
 }
-function registerGitHubTokenTool(server, deps, grant, sessionId, json) {
-  server.registerTool(
-    "github_token",
-    {
-      description: "Mint a fresh short-lived GitHub token for this session's repositories. Write it to $OPENGENI_GIT_TOKEN_FILE (default $HOME/.opengeni/git-token) to refresh git auth before the current token expires.",
-      inputSchema: {}
-    },
-    async () => {
-      const session = await requireSession(deps.db, grant.workspaceId, sessionId);
-      const selected = (session.resources ?? []).flatMap((resource) => {
-        if (resource.kind !== "repository") {
-          return [];
-        }
-        const installationId2 = resource.githubInstallationId;
-        const repositoryId = resource.githubRepositoryId;
-        return typeof installationId2 === "number" && installationId2 > 0 && typeof repositoryId === "number" && repositoryId > 0 ? [{ installationId: installationId2, repositoryId }] : [];
-      });
-      if (selected.length === 0) {
-        throw new Error("this session has no GitHub App repository resources to mint a token for");
-      }
-      const installationId = selected[0].installationId;
-      if (selected.some((item) => item.installationId !== installationId)) {
-        throw new Error("GitHub App repository resources must belong to one installation");
-      }
-      const repositoryIds = selected.map((item) => item.repositoryId);
-      if (!await areGitHubRepositoriesAllowedForWorkspace(
-        deps.db,
-        grant.workspaceId,
-        installationId,
-        repositoryIds
-      )) {
-        throw new Error("this workspace no longer authorizes the session's GitHub repositories");
-      }
-      const token = await createGitHubAppInstallationToken(deps.settings, {
-        installationId,
-        repositoryIds
-      });
-      return json({
-        token,
-        tokenFile: "$OPENGENI_GIT_TOKEN_FILE (default $HOME/.opengeni/git-token)"
-      });
-    }
-  );
-}
 function requireVariableSetsUseForMcpAttachment(grant, variableSetId) {
   if (variableSetId !== void 0 && !hasPermission4(grant.permissions, "variable-sets:use")) {
     throw new Error("missing permission: variable-sets:use");
@@ -8937,6 +8887,8 @@ import {
   boundedParallelMap,
   cancelMcpResponseBody,
   guardedMcpFetch,
+  mcpJsonRpcErrorPayloadForRequest,
+  mcpRequestReplayInfo,
   mcpSerializedSizeBytes
 } from "@opengeni/runtime/mcp-network";
 import { Buffer as Buffer4 } from "buffer";
@@ -8948,8 +8900,12 @@ var TOOLSPACE_AUTH_NEEDED_ERROR = {
   code: 40101,
   message: "Authentication required - a connection link was posted to the session."
 };
+var TOOLSPACE_TOOL_OUTCOME_UNCERTAIN_ERROR = {
+  code: 40102,
+  message: "Tool outcome uncertain: the provider returned 401 after receiving the request. OpenGeni did not replay this call. Do not retry automatically; verify provider state before any new attempt."
+};
 var TOOLSPACE_NO_ACTIVE_TURN_MESSAGE = "no active turn - toolspace calls require an in-flight turn";
-var FIRST_PARTY_PROXY_IDS = /* @__PURE__ */ new Set(["files", "docs"]);
+var FIRST_PARTY_PROXY_IDS = /* @__PURE__ */ new Set(["files", "docs", "codex_apps"]);
 var TOOLSPACE_TOOL_LIST_TTL_MS = 3e4;
 var TOOLSPACE_TOOL_LIST_CACHE_MAX_ENTRIES = 2e3;
 var TOOLSPACE_TOOL_LIST_CACHE_MAX_BYTES = 64 * 1024 * 1024;
@@ -9462,6 +9418,9 @@ async function callRemoteTool(deps, server, toolName, args) {
     if (isToolspaceAuthNeededError(error)) {
       return mcpError(TOOLSPACE_AUTH_NEEDED_ERROR.message);
     }
+    if (isToolspaceOutcomeUncertainError(error)) {
+      return mcpError(TOOLSPACE_TOOL_OUTCOME_UNCERTAIN_ERROR.message);
+    }
     deps.observability?.warn("toolspace upstream tool call failed", {
       serverId: server.config.id,
       toolName,
@@ -9588,7 +9547,7 @@ function connectionBrokerFetch(baseFetch, input) {
     ownerHasWorkspaceMembership: delegatedOwnerHasMembership
   });
   return async (requestInput, init) => {
-    const request = await mcpRequestInfo(requestInput, init);
+    const request = await mcpRequestReplayInfo(requestInput, init);
     const destinationUrl = mcpRequestDestinationUrl(requestInput);
     const resolverSubjectId = connectionRef.subjectScope !== "subject" && hostCredentialPort ? input.grant.subjectId : void 0;
     const resolve = async (forceRefresh) => {
@@ -9613,10 +9572,22 @@ function connectionBrokerFetch(baseFetch, input) {
     );
     if (response.status === 401) {
       await cancelMcpResponseBody(response);
-      const refreshed = await resolve(true);
+      let refreshed;
+      try {
+        refreshed = await resolve(true);
+      } catch {
+        refreshed = authNeededFromStatus(input.config, first, "refresh_failed");
+      }
       if (refreshed.status === "auth_needed") {
+        if (!request.replaySafeAfter401) {
+          await publishToolspaceAuthNeeded(input, request, refreshed);
+          return toolspaceMcpOutcomeUncertainResponse(request);
+        }
         return await authNeededFetchResponse(input, request, refreshed);
       }
+      if (!request.replaySafeAfter401) {
+        return toolspaceMcpOutcomeUncertainResponse(request);
+      }
       const retry = await baseFetch(
         fetchInputForAttempt(requestInput),
         withConnectionHeaders(requestInput, init, refreshed.headers)
@@ -9664,6 +9635,13 @@ function authNeededFromStatus(config, first, reason) {
   };
 }
 async function authNeededFetchResponse(input, request, auth) {
+  await publishToolspaceAuthNeeded(input, request, auth);
+  if (request.method === "tools/call") {
+    return toolspaceMcpErrorResponse(request.id, TOOLSPACE_AUTH_NEEDED_ERROR);
+  }
+  return new Response("Authentication required for MCP server connection", { status: 401 });
+}
+async function publishToolspaceAuthNeeded(input, request, auth) {
   await appendAndPublishEvents3(
     input.deps.db,
     input.deps.bus,
@@ -9689,42 +9667,30 @@ async function authNeededFetchResponse(input, request, auth) {
       }
     ]
   ).catch(() => void 0);
-  if (request.method === "tools/call") {
-    return new Response(
-      JSON.stringify({
-        jsonrpc: "2.0",
-        id: request.id ?? null,
-        error: {
-          code: TOOLSPACE_AUTH_NEEDED_ERROR.code,
-          message: TOOLSPACE_AUTH_NEEDED_ERROR.message
-        }
-      }),
-      {
-        status: 200,
-        headers: { "content-type": "application/json" }
-      }
-    );
-  }
-  return new Response("Authentication required for MCP server connection", { status: 401 });
 }
-async function mcpRequestInfo(input, init) {
-  const body2 = typeof init?.body === "string" ? init.body : input instanceof Request && (init?.method ?? input.method).toUpperCase() === "POST" ? await input.clone().text().catch(() => "") : "";
-  if (!body2) {
-    return {};
-  }
-  try {
-    const parsed = JSON.parse(body2);
-    const method = typeof parsed.method === "string" ? parsed.method : void 0;
-    const id = typeof parsed.id === "string" || typeof parsed.id === "number" || parsed.id === null ? parsed.id : void 0;
-    const toolName = method === "tools/call" && typeof parsed.params?.name === "string" ? parsed.params.name : void 0;
-    return {
-      ...method ? { method } : {},
-      ...id !== void 0 ? { id } : {},
-      ...toolName ? { toolName } : {}
-    };
-  } catch {
-    return {};
-  }
+function toolspaceMcpErrorResponse(id, error) {
+  return new Response(
+    JSON.stringify({
+      jsonrpc: "2.0",
+      id: id ?? null,
+      error
+    }),
+    {
+      status: 200,
+      headers: { "content-type": "application/json" }
+    }
+  );
+}
+function toolspaceMcpOutcomeUncertainResponse(request) {
+  return new Response(
+    JSON.stringify(
+      mcpJsonRpcErrorPayloadForRequest(request, TOOLSPACE_TOOL_OUTCOME_UNCERTAIN_ERROR)
+    ),
+    {
+      status: 200,
+      headers: { "content-type": "application/json" }
+    }
+  );
 }
 function withConnectionHeaders(input, init, authHeaders) {
   const headers = new Headers(
@@ -9745,6 +9711,13 @@ function isToolspaceAuthNeededError(error) {
   const code = error.code;
   return code === TOOLSPACE_AUTH_NEEDED_ERROR.code && (error.message === TOOLSPACE_AUTH_NEEDED_ERROR.message || error.message === `MCP error ${TOOLSPACE_AUTH_NEEDED_ERROR.code}: ${TOOLSPACE_AUTH_NEEDED_ERROR.message}`);
 }
+function isToolspaceOutcomeUncertainError(error) {
+  if (!(error instanceof Error)) {
+    return false;
+  }
+  const code = error.code;
+  return code === TOOLSPACE_TOOL_OUTCOME_UNCERTAIN_ERROR.code && (error.message === TOOLSPACE_TOOL_OUTCOME_UNCERTAIN_ERROR.message || error.message === `MCP error ${TOOLSPACE_TOOL_OUTCOME_UNCERTAIN_ERROR.code}: ${TOOLSPACE_TOOL_OUTCOME_UNCERTAIN_ERROR.message}`);
+}
 
 // src/app.ts
 import { boundedMcpRequest, McpPayloadTooLargeError as McpPayloadTooLargeError2 } from "@opengeni/runtime/mcp-network";
@@ -10166,6 +10139,8 @@ import {
   buildCodexTokenResolver,
   claimCodexResetRedemption,
   completeCodexResetRedemption,
+  clearCodexAppsCredential,
+  designateCodexAppsCredential,
   disconnectAllCodexAccounts,
   disconnectCodexAccount,
   encryptEnvironmentValue as encryptEnvironmentValue3,
@@ -10175,6 +10150,7 @@ import {
   fenceCodexResetRedemptionSend,
   getCodexResetRedemptionAttempt,
   getCodexCredentialStatus,
+  getCodexAppsSettings,
   getCodexRotationSettings,
   listPendingCodexCapacityWakeTargets,
   listCodexAccountStatuses,
@@ -10255,7 +10231,7 @@ async function verifyCodexRedemptionConfirmation(secret, token, now = Date.now()
 
 // src/routes/codex.ts
 var CODEX_PROVIDER_LABEL = "Codex subscription \xB7 no credits";
-function codexAccountJson(row) {
+function codexAccountJson(row, options = {}) {
   return {
     id: row.id,
     chatgptAccountId: row.chatgptAccountId,
@@ -10284,7 +10260,9 @@ function codexAccountJson(row) {
     resetCreditAvailableCount: row.resetCreditAvailableCount,
     resetCreditsCheckedAt: row.resetCreditsCheckedAt,
     // P3 rotation cooldown: when set and in the future, this account is cooling-down.
-    exhaustedUntil: row.exhaustedUntil
+    exhaustedUntil: row.exhaustedUntil,
+    appsDesignated: options.appsCredentialId === row.id,
+    canEnableApps: options.appsCredentialId === null && options.canManageApps === true && options.humanSubjectId !== null && options.humanSubjectId !== void 0 && row.connectedBySubjectId === options.humanSubjectId && row.status === "active"
   };
 }
 function codexUsageJson(payload) {
@@ -10378,6 +10356,23 @@ async function requireRedemptionHuman(c, deps, workspaceId) {
   }
   return { human, accountId: grant.accountId };
 }
+async function requireCodexAppsHuman(c, deps, workspaceId) {
+  if (c.req.header("authorization")) {
+    throw new HTTPException10(403, {
+      message: "authorization bearer is not allowed for Codex Apps designation"
+    });
+  }
+  requireSameOriginBrowserMutation(c, deps);
+  const human = await managedCookieHuman(c, deps);
+  if (!human) {
+    throw new HTTPException10(401, { message: "managed browser session required" });
+  }
+  const grant = await requireAccessGrant2(c, deps, workspaceId, "connections:write");
+  if (grant.subjectId !== human.subjectId) {
+    throw new HTTPException10(403, { message: "managed browser identity mismatch" });
+  }
+  return { human, accountId: grant.accountId };
+}
 function cachedUsage(row) {
   const fiveHour = buildCodexUsageWindowFromCache(
     row.primaryUsedPercent,
@@ -10733,15 +10728,32 @@ function registerCodexRoutes(app, deps) {
   });
   app.get("/v1/workspaces/:workspaceId/codex/accounts", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant2(c, deps, workspaceId, "workspace:read");
-    const [accounts, rotation] = await Promise.all([
+    const grant = await requireAccessGrant2(c, deps, workspaceId, "workspace:read");
+    const [accounts, rotation, apps, human] = await Promise.all([
       listCodexAccountStatuses(db, workspaceId),
-      getCodexRotationSettings(db, workspaceId)
+      getCodexRotationSettings(db, workspaceId),
+      getCodexAppsSettings(db, workspaceId),
+      managedCookieHuman(c, deps)
     ]);
     const activeAccountId = rotation?.activeCredentialId ?? null;
+    const humanSubjectId = human?.subjectId === grant.subjectId ? human.subjectId : null;
+    const canManageApps = humanSubjectId !== null && hasPermission6(grant.permissions, "connections:write");
     return c.json({
-      accounts: accounts.map(codexAccountJson),
+      accounts: accounts.map(
+        (account) => codexAccountJson(account, {
+          appsCredentialId: apps.credentialId,
+          canManageApps: settings.codexConnectedAppsEnabled && canManageApps,
+          humanSubjectId
+        })
+      ),
       activeAccountId,
+      apps: {
+        available: settings.codexConnectedAppsEnabled,
+        credentialId: apps.credentialId,
+        version: apps.version,
+        designatedAt: apps.designatedAt,
+        canDisable: canManageApps && apps.credentialId !== null
+      },
       settings: {
         rotationEnabled: rotation?.rotationEnabled ?? false,
         // sharded-rotation policy: rotation-enabled always behaves as sticky-sharded; report the
@@ -10751,6 +10763,72 @@ function registerCodexRoutes(app, deps) {
       }
     });
   });
+  app.post("/v1/workspaces/:workspaceId/codex/apps", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    if (!settings.codexConnectedAppsEnabled) {
+      throw new HTTPException10(409, { message: "Codex Apps is disabled for this deployment" });
+    }
+    const { human, accountId } = await requireCodexAppsHuman(c, deps, workspaceId);
+    const parsed = z.object({
+      accountId: z.string().uuid(),
+      expectedVersion: z.number().int().nonnegative()
+    }).safeParse(await c.req.json().catch(() => null));
+    if (!parsed.success) {
+      throw new HTTPException10(400, { message: "accountId and expectedVersion are required" });
+    }
+    const result = await designateCodexAppsCredential(db, {
+      accountId,
+      workspaceId,
+      credentialId: parsed.data.accountId,
+      subjectId: human.subjectId,
+      expectedVersion: parsed.data.expectedVersion
+    });
+    if (result.kind === "not_found") {
+      throw new HTTPException10(404, { message: "codex account not found" });
+    }
+    if (result.kind === "not_owner") {
+      throw new HTTPException10(403, {
+        message: "only the managed human who connected this subscription may designate it"
+      });
+    }
+    if (result.kind === "forbidden") {
+      throw new HTTPException10(403, { message: "missing permission: connections:write" });
+    }
+    if (result.kind === "unavailable") {
+      throw new HTTPException10(409, { message: "codex account requires relogin" });
+    }
+    const response = {
+      credentialId: result.credentialId,
+      version: result.version,
+      designatedAt: result.designatedAt,
+      changed: result.kind === "updated"
+    };
+    return result.kind === "updated" ? c.json(response) : c.json(response, 409);
+  });
+  app.delete("/v1/workspaces/:workspaceId/codex/apps", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const { human, accountId } = await requireCodexAppsHuman(c, deps, workspaceId);
+    const parsed = z.object({ expectedVersion: z.number().int().nonnegative() }).safeParse(await c.req.json().catch(() => null));
+    if (!parsed.success) {
+      throw new HTTPException10(400, { message: "expectedVersion is required" });
+    }
+    const result = await clearCodexAppsCredential(db, {
+      accountId,
+      workspaceId,
+      subjectId: human.subjectId,
+      expectedVersion: parsed.data.expectedVersion
+    });
+    if (result.kind === "forbidden") {
+      throw new HTTPException10(403, { message: "missing permission: connections:write" });
+    }
+    const response = {
+      credentialId: result.credentialId,
+      version: result.version,
+      designatedAt: result.designatedAt,
+      changed: result.kind === "updated"
+    };
+    return result.kind === "conflict" ? c.json(response, 409) : c.json(response);
+  });
   app.post("/v1/workspaces/:workspaceId/codex/accounts/:accountId/activate", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     await requireAccessGrant2(c, deps, workspaceId, "workspace:admin");
@@ -10859,13 +10937,13 @@ function registerCodexRoutes(app, deps) {
   });
   app.delete("/v1/workspaces/:workspaceId/codex/accounts/:accountId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant2(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant2(c, deps, workspaceId, "workspace:admin");
     const accountId = c.req.param("accountId");
     const mutation = await withCodexCapacityMutation(
       db,
       { workspaceId, reason: "codex_credential_disconnected" },
       async (tx) => {
-        const result2 = await disconnectCodexAccount(tx, workspaceId, accountId);
+        const result2 = await disconnectCodexAccount(tx, workspaceId, accountId, grant.subjectId);
         return { result: result2, changed: result2.removed };
       }
     );
@@ -10880,12 +10958,12 @@ function registerCodexRoutes(app, deps) {
   });
   app.delete("/v1/workspaces/:workspaceId/codex", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant2(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant2(c, deps, workspaceId, "workspace:admin");
     const mutation = await withCodexCapacityMutation(
       db,
       { workspaceId, reason: "codex_credentials_disconnected" },
       async (tx) => {
-        const result2 = await disconnectAllCodexAccounts(tx, workspaceId);
+        const result2 = await disconnectAllCodexAccounts(tx, workspaceId, grant.subjectId);
         return { result: result2, changed: result2.removed > 0 };
       }
     );
@@ -26617,4 +26695,4 @@ export {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession2 as workflowIdForSession
 };
-//# sourceMappingURL=chunk-J4JS2F7L.js.map
+//# sourceMappingURL=chunk-R5PDSH2A.js.map