@opengeni/api-router 0.21.14 → 0.23.1

package/src/routes/files.ts

@@ -8,6 +8,7 @@ import {
   RETAINED_OUTPUT_MAX_PAGE_BYTES,
   RetainedArtifactMetadataSchema,
   retainedArtifactReferenceFromFile,
+  retainedScreenshotReferenceFromFile,
   resolveRetainedOutputRange,
   type RetainedArtifactMetadata,
   type RetainedOutputUnavailableReason,
@@ -19,10 +20,12 @@ import {
   createFileUpload,
   getFileUpload,
   getRetainedFileArtifact,
+  getRetainedScreenshotArtifact,
   requireFile,
   type RetainedFileArtifact,
+  type RetainedScreenshotArtifact,
 } from "@opengeni/db";
-import type { Hono } from "hono";
+import type { Context, Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
 import { requireAccessGrant } from "@opengeni/core";
 import { recordWorkspaceUsage, requireLimit } from "@opengeni/core";
@@ -36,7 +39,9 @@ export function registerFileRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.all("/v1/workspaces/:workspaceId/mcp/files", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "files:read");
-    const transport = new WebStandardStreamableHTTPServerTransport({ enableJsonResponse: true });
+    const transport = new WebStandardStreamableHTTPServerTransport({
+      enableJsonResponse: true,
+    });
     const server = buildFilesMcpServer(deps, grant);
     await server.connect(transport);
     return await transport.handleRequest(c.req.raw);
@@ -46,7 +51,9 @@ export function registerFileRoutes(app: Hono, deps: ApiRouteDeps): void {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "files:upload");
     if (!objectStorage) {
-      throw new HTTPException(503, { message: "object storage is not configured" });
+      throw new HTTPException(503, {
+        message: "object storage is not configured",
+      });
     }
     const payload = CreateFileUploadRequest.parse(await c.req.json());
     await requireLimit(deps, {
@@ -98,7 +105,9 @@ export function registerFileRoutes(app: Hono, deps: ApiRouteDeps): void {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "files:upload");
     if (!objectStorage) {
-      throw new HTTPException(503, { message: "object storage is not configured" });
+      throw new HTTPException(503, {
+        message: "object storage is not configured",
+      });
     }
     const upload = await getFileUpload(db, workspaceId, c.req.param("uploadId"));
     if (!upload) {
@@ -186,7 +195,9 @@ export function registerFileRoutes(app: Hono, deps: ApiRouteDeps): void {
         terminalStatus,
       });
       if (!settled) {
-        throw new HTTPException(409, { message: "file upload cleanup claim was superseded" });
+        throw new HTTPException(409, {
+          message: "file upload cleanup claim was superseded",
+        });
       }
       throw new HTTPException(status, { message });
     };
@@ -275,75 +286,63 @@ export function registerFileRoutes(app: Hono, deps: ApiRouteDeps): void {
       return c.json(retainedArtifactUnavailable(artifactId, "deleted"), 404);
     }
 
-    const metadata = retainedArtifactMetadata(artifact);
-    if (!metadata.available) {
-      return c.json(metadata, retainedArtifactUnavailableStatus(metadata.reason));
-    }
-    if (!objectStorage) {
-      return c.json(retainedArtifactUnavailable(artifactId, "missing_storage"), 503);
-    }
+    return await serveRetainedArtifactContent(
+      c,
+      objectStorage,
+      artifactId,
+      artifact.file,
+      retainedArtifactMetadata(artifact),
+    );
+  });
 
-    const rangeHeader = c.req.header("range");
-    const range = resolveRetainedOutputRange(
-      rangeHeader,
-      metadata.originalBytes,
-      rangeHeader ? RETAINED_OUTPUT_MAX_PAGE_BYTES : RETAINED_OUTPUT_DEFAULT_PAGE_BYTES,
+  app.get("/v1/workspaces/:workspaceId/sessions/:sessionId/artifacts/:artifactId", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    await requireAccessGrant(c, deps, workspaceId, "files:read");
+    const artifactId = retainedArtifactId(c.req.param("artifactId"));
+    const artifact = await getRetainedScreenshotArtifact(
+      db,
+      workspaceId,
+      c.req.param("sessionId"),
+      artifactId,
     );
-    if (range.kind === "invalid") {
-      return c.json(
-        {
-          message: "invalid retained artifact byte range",
-          reason: range.reason,
-          maxRangeBytes: RETAINED_OUTPUT_MAX_PAGE_BYTES,
-        },
-        400,
-      );
-    }
-    if (range.kind === "unsatisfiable") {
-      return c.json(
-        { message: "retained artifact byte range is not satisfiable", reason: range.reason },
-        416,
-        {
-          "Accept-Ranges": "bytes",
-          "Content-Range": range.contentRange,
-          "Cache-Control": "private, no-store",
-        },
-      );
+    if (!artifact) {
+      return c.json(retainedArtifactUnavailable(artifactId, "deleted"), 404);
     }
+    return c.json(retainedScreenshotMetadata(artifact));
+  });
 
-    const headers = {
-      "Accept-Ranges": range.acceptRanges,
-      "Cache-Control": "private, no-store",
-      "Content-Length": String(range.length),
-      "Content-Type": metadata.contentType,
-      "X-Content-Type-Options": "nosniff",
-      ...(range.contentRange ? { "Content-Range": range.contentRange } : {}),
-    };
-    if (range.kind === "empty") {
-      if (!(await objectStorage.fileExists(artifact.file))) {
-        return c.json(retainedArtifactUnavailable(artifactId, "missing_storage"), 410);
+  app.get(
+    "/v1/workspaces/:workspaceId/sessions/:sessionId/artifacts/:artifactId/content",
+    async (c) => {
+      const workspaceId = c.req.param("workspaceId");
+      await requireAccessGrant(c, deps, workspaceId, "files:read");
+      const artifactId = retainedArtifactId(c.req.param("artifactId"));
+      const artifact = await getRetainedScreenshotArtifact(
+        db,
+        workspaceId,
+        c.req.param("sessionId"),
+        artifactId,
+      );
+      if (!artifact) {
+        return c.json(retainedArtifactUnavailable(artifactId, "deleted"), 404);
       }
-      return c.body(null, 200, headers);
-    }
-
-    const bytes = await objectStorage.getFileRange(artifact.file, {
-      start: range.start,
-      end: range.end,
-    });
-    if (!bytes) {
-      return c.json(retainedArtifactUnavailable(artifactId, "missing_storage"), 410);
-    }
-    if (bytes.byteLength !== range.length) {
-      throw new HTTPException(502, { message: "object storage returned an invalid byte range" });
-    }
-    return c.body(new Uint8Array(bytes), range.status, headers);
-  });
+      return await serveRetainedArtifactContent(
+        c,
+        objectStorage,
+        artifactId,
+        artifact.file,
+        retainedScreenshotMetadata(artifact),
+      );
+    },
+  );
 
   app.post("/v1/workspaces/:workspaceId/files/:fileId/download-url", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     await requireAccessGrant(c, deps, workspaceId, "files:read");
     if (!objectStorage) {
-      throw new HTTPException(503, { message: "object storage is not configured" });
+      throw new HTTPException(503, {
+        message: "object storage is not configured",
+      });
     }
     const file = await requireFile(db, workspaceId, c.req.param("fileId")).catch(() => null);
     if (!file) {
@@ -362,6 +361,81 @@ export function registerFileRoutes(app: Hono, deps: ApiRouteDeps): void {
   });
 }
 
+async function serveRetainedArtifactContent(
+  c: Context,
+  objectStorage: ApiRouteDeps["objectStorage"],
+  artifactId: string,
+  file: RetainedFileArtifact["file"],
+  metadata: RetainedArtifactMetadata,
+) {
+  if (!metadata.available) {
+    return c.json(metadata, retainedArtifactUnavailableStatus(metadata.reason));
+  }
+  if (!objectStorage) {
+    return c.json(retainedArtifactUnavailable(artifactId, "missing_storage"), 503);
+  }
+
+  const rangeHeader = c.req.header("range");
+  const range = resolveRetainedOutputRange(
+    rangeHeader,
+    metadata.originalBytes,
+    rangeHeader ? RETAINED_OUTPUT_MAX_PAGE_BYTES : RETAINED_OUTPUT_DEFAULT_PAGE_BYTES,
+  );
+  if (range.kind === "invalid") {
+    return c.json(
+      {
+        message: "invalid retained artifact byte range",
+        reason: range.reason,
+        maxRangeBytes: RETAINED_OUTPUT_MAX_PAGE_BYTES,
+      },
+      400,
+    );
+  }
+  if (range.kind === "unsatisfiable") {
+    return c.json(
+      {
+        message: "retained artifact byte range is not satisfiable",
+        reason: range.reason,
+      },
+      416,
+      {
+        "Accept-Ranges": "bytes",
+        "Content-Range": range.contentRange,
+        "Cache-Control": "private, no-store",
+      },
+    );
+  }
+
+  const headers = {
+    "Accept-Ranges": range.acceptRanges,
+    "Cache-Control": "private, no-store",
+    "Content-Length": String(range.length),
+    "Content-Type": metadata.contentType,
+    "X-Content-Type-Options": "nosniff",
+    ...(range.contentRange ? { "Content-Range": range.contentRange } : {}),
+  };
+  if (range.kind === "empty") {
+    if (!(await objectStorage.fileExists(file))) {
+      return c.json(retainedArtifactUnavailable(artifactId, "missing_storage"), 410);
+    }
+    return c.body(null, 200, headers);
+  }
+
+  const bytes = await objectStorage.getFileRange(file, {
+    start: range.start,
+    end: range.end,
+  });
+  if (!bytes) {
+    return c.json(retainedArtifactUnavailable(artifactId, "missing_storage"), 410);
+  }
+  if (bytes.byteLength !== range.length) {
+    throw new HTTPException(502, {
+      message: "object storage returned an invalid byte range",
+    });
+  }
+  return c.body(new Uint8Array(bytes), range.status, headers);
+}
+
 export function sanitizeFilename(filename: string): string {
   const trimmed = filename.trim().replace(/[/\\]/g, "_");
   const safe = trimmed
@@ -388,7 +462,11 @@ function retainedArtifactUnavailable(
   artifactId: string,
   reason: RetainedOutputUnavailableReason,
 ): RetainedArtifactMetadata {
-  return RetainedArtifactMetadataSchema.parse({ available: false, artifactId, reason });
+  return RetainedArtifactMetadataSchema.parse({
+    available: false,
+    artifactId,
+    reason,
+  });
 }
 
 function retainedArtifactMetadata(artifact: RetainedFileArtifact): RetainedArtifactMetadata {
@@ -417,6 +495,35 @@ function retainedArtifactMetadata(artifact: RetainedFileArtifact): RetainedArtif
   return retainedArtifactUnavailable(file.id, "unsupported");
 }
 
+function retainedScreenshotMetadata(
+  artifact: RetainedScreenshotArtifact,
+): RetainedArtifactMetadata {
+  if (
+    artifact.status === "ready" &&
+    artifact.sessionId &&
+    artifact.retentionExpiresAt.getTime() > Date.now()
+  ) {
+    const reference = retainedScreenshotReferenceFromFile({
+      ...artifact.file,
+      sessionId: artifact.sessionId,
+      width: artifact.width,
+      height: artifact.height,
+      expiresAt: artifact.retentionExpiresAt.toISOString(),
+    });
+    if (reference) return reference;
+  }
+  if (artifact.status === "deleted") {
+    return retainedArtifactUnavailable(artifact.artifactId, "deleted");
+  }
+  if (artifact.status === "expired" || artifact.retentionExpiresAt.getTime() <= Date.now()) {
+    return retainedArtifactUnavailable(artifact.artifactId, "expired");
+  }
+  if (artifact.status === "pending" || artifact.status === "reconciling") {
+    return retainedArtifactUnavailable(artifact.artifactId, "pending");
+  }
+  return retainedArtifactUnavailable(artifact.artifactId, "failed");
+}
+
 function retainedArtifactUnavailableStatus(
   reason: RetainedOutputUnavailableReason,
 ): 404 | 409 | 410 | 422 {
@@ -429,6 +536,9 @@ function retainedArtifactUnavailableStatus(
     case "unsupported":
     case "not_retained":
     case "storage_write_failed":
+    case "quota_exceeded":
+    case "invalid_content":
+    case "oversized":
       return 422;
     case "pending":
     case "failed":

package/src/routes/install.ts

@@ -200,6 +200,31 @@ export function registerInstallRoutes(app: Hono, deps: ApiRouteDeps): void {
     return serveAsset(asset, `${releasesBase}/download/${stableAgentTag}/${asset}`);
   });
 
+  // Signed self-update channel manifests. Each deployment exposes its own
+  // immutable promotion pointer, so an enrolled machine never depends on the
+  // public get.opengeni.ai hostname. The manifest and signature are ordinary
+  // assets on the selected immutable agent release.
+  for (const [channel, version] of [
+    ["stable", deps.settings.agentStableVersion],
+    ["beta", deps.settings.agentBetaVersion],
+  ] as const) {
+    app.get(`/agent/${channel}/:manifestAsset`, (c) => {
+      const manifestAsset = c.req.param("manifestAsset");
+      if (manifestAsset !== "manifest.json" && manifestAsset !== "manifest.json.minisig") {
+        throw new HTTPException(404, { message: "update manifest asset not found" });
+      }
+      if (!version) {
+        throw new HTTPException(404, { message: `${channel} agent channel is not configured` });
+      }
+      return new Response(null, {
+        status: 302,
+        headers: {
+          location: `${releasesBase}/download/agent-v${version}/${manifestAsset}`,
+        },
+      });
+    });
+  }
+
   // The version segment is the literal `v<ver>` (e.g. `v1.2.3`) — Hono cannot bind
   // a param glued to a literal prefix, so the whole segment is the param and the
   // `v` prefix is validated/stripped here. The release tag is `agent-v<ver>`.
@@ -220,5 +245,10 @@ export function registerInstallRoutes(app: Hono, deps: ApiRouteDeps): void {
 export const installExactPaths: ReadonlySet<string> = new Set(Object.keys(TEXT_ASSETS));
 
 export function isInstallRedirectPath(path: string): boolean {
-  return path.startsWith("/agent/latest/") || path.startsWith("/agent/v");
+  return (
+    path.startsWith("/agent/latest/") ||
+    path.startsWith("/agent/v") ||
+    path.startsWith("/agent/stable/") ||
+    path.startsWith("/agent/beta/")
+  );
 }

package/src/routes/machines.ts

@@ -73,7 +73,7 @@ export function registerMachineRoutes(app: Hono, deps: ApiRouteDeps): void {
     // Validate the machine belongs to this workspace (RLS already scopes the read,
     // but a clear 404 beats an empty series for an unknown/cross-workspace id).
     const enrollment = await getEnrollment(db, workspaceId, enrollmentId);
-    if (!enrollment) {
+    if (!enrollment || enrollment.status !== "active") {
       throw new HTTPException(404, { message: "machine not found in this workspace" });
     }
     const windowMs = SERIES_WINDOWS_MS[c.req.query("window") ?? ""] ?? DEFAULT_SERIES_WINDOW_MS;

package/src/routes/scheduled-tasks.ts

@@ -19,10 +19,13 @@ import {
   manualScheduledTaskTriggerUsageKey,
   manualScheduledTaskTriggerWorkflowId,
   scheduledTaskToolsProvided,
+  scheduledTaskForGrant,
+  scheduledTaskRunForGrant,
   scheduledTaskTriggerToken,
   requireScheduledTaskForApi,
   syncCreatedScheduledTask,
   syncUpdatedScheduledTask,
+  validateScheduledTaskTarget,
   validatedScheduledTaskUpdate,
 } from "@opengeni/core";
 import { boundedLimit } from "../http/common";
@@ -48,21 +51,25 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
       grant,
       payload,
       toolsProvided: scheduledTaskToolsProvided(rawPayload),
+      sessionAuthorization: deps.sessionAuthorization,
+      authorizationSurface: "http",
     });
     await syncCreatedScheduledTask({ db, workflowClient, task });
-    return c.json(task, 201);
+    return c.json(scheduledTaskForGrant(task, grant), 201);
   });
 
   app.get("/v1/workspaces/:workspaceId/scheduled-tasks", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "scheduled_tasks:run");
-    return c.json(await listScheduledTasks(db, workspaceId, boundedLimit(c.req.query("limit"))));
+    const grant = await requireAccessGrant(c, deps, workspaceId, "scheduled_tasks:run");
+    const tasks = await listScheduledTasks(db, workspaceId, boundedLimit(c.req.query("limit")));
+    return c.json(tasks.map((task) => scheduledTaskForGrant(task, grant)));
   });
 
   app.get("/v1/workspaces/:workspaceId/scheduled-tasks/:taskId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "scheduled_tasks:run");
-    return c.json(await requireScheduledTaskForApi(db, workspaceId, c.req.param("taskId")));
+    const grant = await requireAccessGrant(c, deps, workspaceId, "scheduled_tasks:run");
+    const task = await requireScheduledTaskForApi(db, workspaceId, c.req.param("taskId"));
+    return c.json(scheduledTaskForGrant(task, grant));
   });
 
   app.patch("/v1/workspaces/:workspaceId/scheduled-tasks/:taskId", async (c) => {
@@ -81,30 +88,32 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
       existing,
       payload,
       toolsProvided: scheduledTaskToolsProvided(rawPayload),
+      sessionAuthorization: deps.sessionAuthorization,
+      authorizationSurface: "http",
     });
     const task = await updateScheduledTask(db, workspaceId, taskId, update);
     await syncUpdatedScheduledTask({ db, workflowClient, previous, task });
-    return c.json(task);
+    return c.json(scheduledTaskForGrant(task, grant));
   });
 
   app.post("/v1/workspaces/:workspaceId/scheduled-tasks/:taskId/pause", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "scheduled_tasks:manage");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "scheduled_tasks:manage");
     const existing = await requireScheduledTaskForApi(db, workspaceId, c.req.param("taskId"));
     const previous = await captureScheduledTaskRestoreState(db, existing);
     const task = await updateScheduledTask(db, workspaceId, existing.id, { status: "paused" });
     await syncUpdatedScheduledTask({ db, workflowClient, previous, task });
-    return c.json(task);
+    return c.json(scheduledTaskForGrant(task, grant));
   });
 
   app.post("/v1/workspaces/:workspaceId/scheduled-tasks/:taskId/resume", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "scheduled_tasks:manage");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "scheduled_tasks:manage");
     const existing = await requireScheduledTaskForApi(db, workspaceId, c.req.param("taskId"));
     const previous = await captureScheduledTaskRestoreState(db, existing);
     const task = await updateScheduledTask(db, workspaceId, existing.id, { status: "active" });
     await syncUpdatedScheduledTask({ db, workflowClient, previous, task });
-    return c.json(task);
+    return c.json(scheduledTaskForGrant(task, grant));
   });
 
   app.post("/v1/workspaces/:workspaceId/scheduled-tasks/:taskId/trigger", async (c) => {
@@ -113,6 +122,18 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
     // Load the task before the gate so a codex-model scheduled task can be
     // recognised as codex-billed and skip the credit/cost gates at the edge.
     const task = await requireScheduledTaskForApi(db, workspaceId, c.req.param("taskId"));
+    await validateScheduledTaskTarget({
+      db,
+      sessionAuthorization: deps.sessionAuthorization,
+      authorizationSurface: "http",
+      grant,
+      targetSessionId: task.targetSessionId,
+      runMode: task.runMode,
+      variableSetId: task.variableSetId,
+      rigId: task.rigId,
+      agentConfig: task.agentConfig,
+      missingTargetStatus: 404,
+    });
     await requireLimit(deps, {
       accountId: grant.accountId,
       workspaceId,
@@ -148,7 +169,7 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
       sourceResourceId: task.id,
       idempotencyKey: agentRunUsageIdempotencyKey,
     });
-    return c.json(task, 202);
+    return c.json(scheduledTaskForGrant(task, grant), 202);
   });
 
   app.delete("/v1/workspaces/:workspaceId/scheduled-tasks/:taskId", async (c) => {
@@ -164,10 +185,14 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
 
   app.get("/v1/workspaces/:workspaceId/scheduled-tasks/:taskId/runs", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "scheduled_tasks:run");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "scheduled_tasks:run");
     const task = await requireScheduledTaskForApi(db, workspaceId, c.req.param("taskId"));
-    return c.json(
-      await listScheduledTaskRuns(db, workspaceId, task.id, boundedLimit(c.req.query("limit"))),
+    const taskRuns = await listScheduledTaskRuns(
+      db,
+      workspaceId,
+      task.id,
+      boundedLimit(c.req.query("limit")),
     );
+    return c.json(taskRuns.map((run) => scheduledTaskRunForGrant(run, grant)));
   });
 }