@opengeni/api-router 0.26.1 → 0.30.0

package/src/app.ts

@@ -3,7 +3,9 @@ import {
   configuredAllowedModels,
   configuredAllowedReasoningEfforts,
   configuredModels,
+  resolveFirstPartyMcpToolPolicy,
   withCodexCatalogProvider,
+  withXaiSubscriptionCatalogProvider,
 } from "@opengeni/config";
 import {
   ClientConfig,
@@ -13,6 +15,7 @@ import {
   OPENGENI_API_CONTRACT_REVISION,
   OPENGENI_CORRELATION_HEADER,
   resolveWorkspaceMemoryEnabled,
+  resolveWorkspaceMemoryPromptMode,
   VOICE_INPUT_ACCEPTED_MIME_TYPES,
   TRANSCRIPTION_RECORDING_PROVIDER_SEGMENT_SECONDS,
   type AccessGrant,
@@ -34,6 +37,7 @@ import {
   dbSql,
   getWorkspace,
   rlsContextForWorkspace,
+  withSessionRlsActorContext,
 } from "@opengeni/db";
 import { createObservability } from "@opengeni/observability";
 import { createObjectStorage } from "@opengeni/storage";
@@ -50,6 +54,7 @@ import {
   CodexCompactionV2ProviderLockedError,
   hasPermission,
   requireAccessGrant,
+  requireLiveAgentAttemptAuthorization,
   requirePermission,
   requireSessionAuthorization,
   SessionAuthorizationDeniedError,
@@ -67,11 +72,16 @@ import {
   submitAndDispatchCodemodeCall,
 } from "./codemode";
 import { boundedMcpRequest, McpPayloadTooLargeError } from "@opengeni/runtime/mcp-network";
+import {
+  BrowserControlProtocolError,
+  BrowserControlTransportError,
+} from "@opengeni/runtime/sandbox";
 import { requireAccessKey } from "./http/auth";
 import { allowedCorsOrigin } from "./http/cors";
 import { registerCapabilityRoutes } from "./routes/capabilities";
 import { registerCatalogAssetRoutes } from "./routes/catalog-assets";
 import { registerCodexRoutes } from "./routes/codex";
+import { registerSuperGrokRoutes } from "./routes/supergrok";
 import { registerConnectionRoutes } from "./routes/connections";
 import { registerDocumentRoutes } from "./routes/documents";
 import { registerEnrollmentRoutes } from "./routes/enrollments";
@@ -87,10 +97,12 @@ import { registerComputerSessionRoutes } from "./routes/computer-sessions";
 import { registerGitHubRoutes } from "./routes/github";
 import { registerInstallRoutes } from "./routes/install";
 import { registerApiIntegrationRoutes } from "./routes/api-integrations";
-import { registerIntegrationFeatureRoutes } from "./routes/integration-features";
+import { registerIntegrationFacetRoutes } from "./routes/integration-facets";
+import { registerInteractionResourceRoutes } from "./routes/interaction-resources";
 import { registerPackRoutes } from "./routes/packs";
 import { registerPluginRoutes } from "./routes/plugins";
 import { registerSkillRoutes } from "./routes/skills";
+import { registerChannelRoutes } from "./routes/channels";
 import { registerRigRoutes } from "./routes/rigs";
 import { registerScheduledTaskRoutes } from "./routes/scheduled-tasks";
 import { registerSessionRoutes } from "./routes/sessions";
@@ -98,6 +110,7 @@ import { registerSocialRoutes } from "./routes/social";
 import { registerWorkspaceRoutes } from "./routes/workspaces";
 import { registerWorkspaceInstructionPolicyRoutes } from "./routes/workspace-instruction-policies";
 import { registerCompanyProfileRoutes } from "./routes/company-profile";
+import { registerSlackTaskPolicyRoutes } from "./routes/slack-task-policy";
 import { registerWorkspaceStateRoutes } from "./routes/workspace-state";
 import { registerWorkspaceArtifactRoutes } from "./routes/workspace-artifacts";
 import { registerPreferenceRegistryRoutes } from "./routes/preference-registry";
@@ -105,6 +118,8 @@ import { registerInsightsRoutes } from "./routes/insights";
 import { registerTranscriptionRoutes } from "./routes/transcriptions";
 import { registerEditableArtifactRoutes } from "./routes/editable-artifacts";
 import { registerVideoGenerationRoutes } from "./routes/video-generation";
+import { registerCanonicalHumanIdentityRoutes } from "./routes/canonical-human-identities";
+import { registerOrganizationMembershipRoutes } from "./routes/organization-memberships";
 import { projectClientModel } from "./model-catalog";
 import { createTranscriptionService } from "./transcription/service";
 import { createFfmpegTranscriptionSegmenter } from "./transcription/segmenter";
@@ -133,7 +148,7 @@ export {
 export { workflowIdForSession } from "@opengeni/core";
 export { replaySessionEvents, sseSessionStream, sseWorkspaceControlStream } from "./http/sse";
 
-export const API_MAX_REQUEST_BODY_BYTES = 8 * 1024 * 1024;
+export const API_MAX_REQUEST_BODY_BYTES = 32 * 1024 * 1024;
 
 /** Effective Hono bodyLimit — API JSON ceiling or voice multipart + multipart overhead. */
 export function apiRequestBodyLimitBytes(settings: {
@@ -462,9 +477,12 @@ export function createAppComposition(deps: AppDependencies): {
 
   app.get("/v1/config/client", async (c) => {
     c.header("cache-control", "no-store");
-    const catalogSettings = deps.settings.codexSubscriptionEnabled
+    const codexCatalogSettings = deps.settings.codexSubscriptionEnabled
       ? withCodexCatalogProvider(deps.settings)
       : deps.settings;
+    const catalogSettings = deps.settings.supergrokSubscriptionEnabled
+      ? withXaiSubscriptionCatalogProvider(codexCatalogSettings)
+      : codexCatalogSettings;
     return c.json(
       ClientConfig.parse({
         deploymentRevision: deps.settings.deploymentRevision,
@@ -483,6 +501,7 @@ export function createAppComposition(deps: AppDependencies): {
           id: server.id,
           name: server.name ?? server.id,
         })),
+        firstPartyMcpTools: resolveFirstPartyMcpToolPolicy(deps.settings),
         fileUploads: {
           enabled: objectStorage !== null,
           maxSizeBytes: objectStorage?.maxSinglePutSizeBytes ?? 5_000_000_000,
@@ -522,6 +541,22 @@ export function createAppComposition(deps: AppDependencies): {
     );
   });
 
+  app.use("/v1/workspaces/:workspaceId/*", async (c, next) => {
+    const workspaceId = c.req.param("workspaceId");
+    if (workspaceRequestRequiresCodexAccountPrevalidation(c.req.raw)) {
+      const grant = await requireAccessGrant(c, routeDeps, workspaceId);
+      await validateCodexAccountTarget(c.req.raw);
+      await withAccessGrantSessionRlsContext(routeDeps, grant, next);
+      return;
+    }
+    if (workspaceActorContextExempt(c.req.method, new URL(c.req.url).pathname)) {
+      await next();
+      return;
+    }
+    const grant = await requireAccessGrant(c, routeDeps, workspaceId);
+    await withAccessGrantSessionRlsContext(routeDeps, grant, next);
+  });
+
   app.all("/v1/workspaces/:workspaceId/mcp", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     let boundedRequest: Request;
@@ -536,37 +571,41 @@ export function createAppComposition(deps: AppDependencies): {
       throw error;
     }
     const grant = await requireMcpAccessGrant(c, routeDeps, workspaceId);
-    const boundSessionId = grant.metadata?.sessionId;
-    if (typeof boundSessionId === "string") {
-      try {
-        await requireSessionAuthorization(routeDeps, grant, {
-          sessionId: boundSessionId,
-          operation: "session.first_party_mcp.call",
-          surface: "first_party_mcp",
-        });
-      } catch (error) {
-        if (error instanceof SessionAuthorizationDeniedError) {
-          throw new HTTPException(404, { message: "session not found" });
-        }
-        if (error instanceof SessionAuthorizationUnavailableError) {
-          throw new HTTPException(503, {
-            message: "session authorization is unavailable",
+    return await withAccessGrantSessionRlsContext(routeDeps, grant, async () => {
+      const boundSessionId = grant.metadata?.sessionId;
+      if (typeof boundSessionId === "string") {
+        try {
+          await requireSessionAuthorization(routeDeps, grant, {
+            sessionId: boundSessionId,
+            operation: "session.first_party_mcp.call",
+            surface: "first_party_mcp",
           });
+        } catch (error) {
+          if (error instanceof SessionAuthorizationDeniedError) {
+            throw new HTTPException(404, { message: "session not found" });
+          }
+          if (error instanceof SessionAuthorizationUnavailableError) {
+            throw new HTTPException(503, {
+              message: "session authorization is unavailable",
+            });
+          }
+          throw error;
         }
-        throw error;
       }
-    }
-    const workspace = await getWorkspace(routeDeps.db, workspaceId);
-    const workspaceMemoryEnabled = resolveWorkspaceMemoryEnabled(workspace?.settings);
-    const transport = new WebStandardStreamableHTTPServerTransport({
-      enableJsonResponse: true,
-    });
-    const mcp = buildOpenGeniMcpServer(routeDeps, grant, {
-      requestOrigin: new URL(c.req.url).origin,
-      workspaceMemoryEnabled,
+      const workspace = await getWorkspace(routeDeps.db, workspaceId);
+      const workspaceMemoryEnabled = resolveWorkspaceMemoryEnabled(workspace?.settings);
+      const workspaceMemoryPromptMode = resolveWorkspaceMemoryPromptMode(workspace?.settings);
+      const transport = new WebStandardStreamableHTTPServerTransport({
+        enableJsonResponse: true,
+      });
+      const mcp = buildOpenGeniMcpServer(routeDeps, grant, {
+        requestOrigin: new URL(c.req.url).origin,
+        workspaceMemoryEnabled,
+        workspaceMemoryPromptMode,
+      });
+      await mcp.connect(transport);
+      return await transport.handleRequest(boundedRequest);
     });
-    await mcp.connect(transport);
-    return await transport.handleRequest(boundedRequest);
   });
 
   app.get("/v1/workspaces/:workspaceId/codemode/catalog", async (c) => {
@@ -631,10 +670,12 @@ export function createAppComposition(deps: AppDependencies): {
   registerDocumentRoutes(app, routeDeps);
   registerGitHubRoutes(app, routeDeps);
   registerInstallRoutes(app, routeDeps);
+  registerInteractionResourceRoutes(app, routeDeps);
   registerWorkspaceRoutes(app, routeDeps);
   registerInsightsRoutes(app, routeDeps);
   registerWorkspaceInstructionPolicyRoutes(app, routeDeps);
   registerCompanyProfileRoutes(app, routeDeps);
+  registerSlackTaskPolicyRoutes(app, routeDeps);
   registerWorkspaceStateRoutes(app, routeDeps);
   registerMemorySlackPublicationRoutes(app, routeDeps);
   registerWorkspaceArtifactRoutes(app, routeDeps);
@@ -643,11 +684,12 @@ export function createAppComposition(deps: AppDependencies): {
   registerConnectionRoutes(app, routeDeps);
   registerCapabilityRoutes(app, routeDeps);
   registerApiIntegrationRoutes(app, routeDeps);
-  registerIntegrationFeatureRoutes(app, routeDeps);
+  registerIntegrationFacetRoutes(app, routeDeps);
   registerCatalogAssetRoutes(app, routeDeps);
   registerEnrollmentRoutes(app, routeDeps);
   registerMachineRoutes(app, routeDeps);
   registerEnvironmentRoutes(app, routeDeps);
+  registerChannelRoutes(app, routeDeps);
   registerRigRoutes(app, routeDeps);
   registerPackRoutes(app, routeDeps);
   registerPluginRoutes(app, routeDeps);
@@ -655,9 +697,12 @@ export function createAppComposition(deps: AppDependencies): {
   registerSessionRoutes(app, routeDeps);
   registerScheduledTaskRoutes(app, routeDeps);
   registerCodexRoutes(app, routeDeps);
+  registerSuperGrokRoutes(app, routeDeps);
   registerTranscriptionRoutes(app, routeDeps);
   registerEditableArtifactRoutes(app, routeDeps);
   registerVideoGenerationRoutes(app, routeDeps);
+  registerCanonicalHumanIdentityRoutes(app, routeDeps);
+  registerOrganizationMembershipRoutes(app, routeDeps);
   registerSlackInteractionRoutes(app, routeDeps);
 
   app.notFound((c) => {
@@ -699,6 +744,7 @@ export function createAppComposition(deps: AppDependencies): {
             ? (boundedPublicMessage(apiError.message) ?? "Request failed.")
             : publicErrorMessage(error, status),
         retryable: apiError?.retryable ?? retryableHttpStatus(status),
+        ...(mutationOutcomeUnknown(error, c.req.method) ? { outcomeUnknown: true } : {}),
         requestId,
         ...(apiError?.details ? { details: apiError.details } : {}),
       },
@@ -709,6 +755,14 @@ export function createAppComposition(deps: AppDependencies): {
   return { app, routeDeps };
 }
 
+function mutationOutcomeUnknown(error: unknown, method: string): boolean {
+  if (method === "GET" || method === "HEAD" || method === "OPTIONS") return false;
+  const cause = error instanceof HTTPException ? error.cause : error;
+  return (
+    cause instanceof BrowserControlTransportError || cause instanceof BrowserControlProtocolError
+  );
+}
+
 export function appendVary(current: string | null, value: string): string {
   const values = (current ?? "")
     .split(",")
@@ -720,6 +774,74 @@ export function appendVary(current: string | null, value: string): string {
   return values.join(", ");
 }
 
+const publicWorkspaceBrowserRoutePatterns = [
+  /^\/v1\/workspaces\/[^/]+\/github\/connect$/,
+  /^\/v1\/workspaces\/[^/]+\/github\/installations\/[^/]+\/configure$/,
+  /^\/v1\/workspaces\/[^/]+\/github\/installations\/select$/,
+] as const;
+
+export function workspaceActorContextExempt(method: string, pathname: string): boolean {
+  if (/^\/v1\/workspaces\/[^/]+\/mcp$/.test(pathname)) return true;
+  if (
+    method === "GET" &&
+    publicWorkspaceBrowserRoutePatterns.some((route) => route.test(pathname))
+  ) {
+    return true;
+  }
+  return method === "POST" && /^\/v1\/workspaces\/[^/]+\/github\/installations$/.test(pathname);
+}
+
+function workspaceRequestRequiresCodexAccountPrevalidation(request: Request): boolean {
+  return (
+    request.method === "POST" &&
+    /^\/v1\/workspaces\/[^/]+\/sessions\/[^/]+\/codex-account$/.test(new URL(request.url).pathname)
+  );
+}
+
+async function validateCodexAccountTarget(request: Request): Promise<void> {
+  const body = (await request
+    .clone()
+    .json()
+    .catch(() => null)) as { target?: unknown } | null;
+  if (typeof body?.target !== "string" || body.target.length === 0) {
+    throw new HTTPException(400, {
+      message: 'target is required ("auto" or an account id)',
+    });
+  }
+}
+
+async function withAccessGrantSessionRlsContext<T>(
+  deps: ApiRouteDeps,
+  grant: AccessGrant,
+  fn: () => Promise<T>,
+): Promise<T> {
+  if (grant.principalKind !== "agent_attempt") {
+    return await withSessionRlsActorContext({ subjectId: grant.subjectId }, fn);
+  }
+  const callerSessionId = grant.metadata?.sessionId;
+  if (typeof callerSessionId !== "string") {
+    throw new HTTPException(403, { message: "agent attempt authority is invalid" });
+  }
+  try {
+    const actor = await requireLiveAgentAttemptAuthorization(deps.db, grant, callerSessionId);
+    return await withSessionRlsActorContext(
+      {
+        subjectId: actor.subjectId,
+        initiatingHumanSubjectId: actor.initiatingHumanSubjectId,
+      },
+      fn,
+    );
+  } catch (error) {
+    if (error instanceof SessionAuthorizationDeniedError) {
+      throw new HTTPException(403, {
+        message: "agent attempt authority is invalid",
+        cause: error,
+      });
+    }
+    throw error;
+  }
+}
+
 async function requireMcpAccessGrant(
   c: Parameters<typeof requireAccessGrant>[0],
   deps: ApiRouteDeps,
@@ -989,7 +1111,10 @@ async function withTimeout<T>(promise: Promise<T>, timeoutMs: number): Promise<T
   }
 }
 
-const routeLabelPatterns: Array<{ pattern: RegExp; label: string }> = [
+const routeLabelPatterns: Array<{
+  pattern: RegExp;
+  label: string | ((match: RegExpMatchArray) => string);
+}> = [
   { pattern: /^\/healthz$/, label: "/healthz" },
   { pattern: /^\/readyz$/, label: "/readyz" },
   { pattern: /^\/traffic-readyz$/, label: "/traffic-readyz" },
@@ -1005,6 +1130,22 @@ const routeLabelPatterns: Array<{ pattern: RegExp; label: string }> = [
     pattern: /^\/v1\/workspaces\/[^/]+\/codex\/status$/,
     label: "/v1/workspaces/:workspaceId/codex/status",
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/supergrok\/connect\/(start|poll)$/,
+    label: (match) => `/v1/workspaces/:workspaceId/supergrok/connect/${match[1]}`,
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/supergrok\/(status|accounts|settings)$/,
+    label: (match) => `/v1/workspaces/:workspaceId/supergrok/${match[1]}`,
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/supergrok\/accounts\/[^/]+\/(activate|allocator)$/,
+    label: (match) => `/v1/workspaces/:workspaceId/supergrok/accounts/:accountId/${match[1]}`,
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/supergrok\/accounts\/[^/]+$/,
+    label: "/v1/workspaces/:workspaceId/supergrok/accounts/:accountId",
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/codex\/usage$/,
     label: "/v1/workspaces/:workspaceId/codex/usage",
@@ -1051,6 +1192,154 @@ const routeLabelPatterns: Array<{ pattern: RegExp; label: string }> = [
     pattern: /^\/v1\/workspaces\/[^/]+\/control-events\/stream$/,
     label: "/v1/workspaces/:workspaceId/control-events/stream",
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/live-events\/stream$/,
+    label: "/v1/workspaces/:workspaceId/live-events/stream",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/interaction-events\/stream$/,
+    label: "/v1/workspaces/:workspaceId/interaction-events/stream",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/attached-browsers\/[^/]+$/,
+    label: "/v1/workspaces/:workspaceId/attached-browsers/:deviceId",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/attached-browsers$/,
+    label: "/v1/workspaces/:workspaceId/attached-browsers",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/browser-identities\/[^/]+\/revisions$/,
+    label: "/v1/workspaces/:workspaceId/browser-identities/:identityId/revisions",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/browser-identities\/[^/]+$/,
+    label: "/v1/workspaces/:workspaceId/browser-identities/:identityId",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/browser-identities$/,
+    label: "/v1/workspaces/:workspaceId/browser-identities",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/browser-sessions\/[^/]+\/downloads\/[^/]+\/save$/,
+    label:
+      "/v1/workspaces/:workspaceId/browser-sessions/:browserSessionId/downloads/:downloadId/save",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/browser-sessions\/[^/]+\/downloads\/[^/]+$/,
+    label: "/v1/workspaces/:workspaceId/browser-sessions/:browserSessionId/downloads/:downloadId",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/browser-sessions\/[^/]+\/downloads$/,
+    label: "/v1/workspaces/:workspaceId/browser-sessions/:browserSessionId/downloads",
+  },
+  {
+    pattern:
+      /^\/v1\/workspaces\/[^/]+\/browser-sessions\/[^/]+\/auth-runs\/[^/]+\/external-auth\/interactive$/,
+    label:
+      "/v1/workspaces/:workspaceId/browser-sessions/:browserSessionId/auth-runs/:authRunId/external-auth/interactive",
+  },
+  {
+    pattern:
+      /^\/v1\/workspaces\/[^/]+\/browser-sessions\/[^/]+\/auth-runs\/[^/]+\/(external-auth|protected-fill|report|verify)$/,
+    label: (match) =>
+      `/v1/workspaces/:workspaceId/browser-sessions/:browserSessionId/auth-runs/:authRunId/${match[1]}`,
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/browser-sessions\/[^/]+\/auth-runs\/[^/]+$/,
+    label: "/v1/workspaces/:workspaceId/browser-sessions/:browserSessionId/auth-runs/:authRunId",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/browser-sessions\/[^/]+\/auth-runs$/,
+    label: "/v1/workspaces/:workspaceId/browser-sessions/:browserSessionId/auth-runs",
+  },
+  {
+    pattern:
+      /^\/v1\/workspaces\/[^/]+\/browser-sessions\/[^/]+\/targets\/[^/]+\/(diagnostics|observation|select)$/,
+    label: (match) =>
+      `/v1/workspaces/:workspaceId/browser-sessions/:browserSessionId/targets/:targetId/${match[1]}`,
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/browser-sessions\/[^/]+\/targets\/[^/]+$/,
+    label: "/v1/workspaces/:workspaceId/browser-sessions/:browserSessionId/targets/:targetId",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/browser-sessions\/[^/]+\/operations\/[^/]+$/,
+    label: "/v1/workspaces/:workspaceId/browser-sessions/:browserSessionId/operations/:operationId",
+  },
+  {
+    pattern:
+      /^\/v1\/workspaces\/[^/]+\/browser-sessions\/[^/]+\/(actions|attachments|clipboard|end|heartbeat|resume|revisions|suspend|targets)$/,
+    label: (match) => `/v1/workspaces/:workspaceId/browser-sessions/:browserSessionId/${match[1]}`,
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/browser-sessions\/[^/]+$/,
+    label: "/v1/workspaces/:workspaceId/browser-sessions/:browserSessionId",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/browser-sessions$/,
+    label: "/v1/workspaces/:workspaceId/browser-sessions",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/computer-sessions\/[^/]+\/targets\/[^/]+\/observation$/,
+    label:
+      "/v1/workspaces/:workspaceId/computer-sessions/:computerSessionId/targets/:targetId/observation",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/computer-sessions\/[^/]+\/operations\/[^/]+$/,
+    label:
+      "/v1/workspaces/:workspaceId/computer-sessions/:computerSessionId/operations/:operationId",
+  },
+  {
+    pattern:
+      /^\/v1\/workspaces\/[^/]+\/computer-sessions\/[^/]+\/(actions|attachments|clipboard|end|heartbeat|targets)$/,
+    label: (match) =>
+      `/v1/workspaces/:workspaceId/computer-sessions/:computerSessionId/${match[1]}`,
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/computer-sessions\/[^/]+$/,
+    label: "/v1/workspaces/:workspaceId/computer-sessions/:computerSessionId",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/computer-sessions$/,
+    label: "/v1/workspaces/:workspaceId/computer-sessions",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/network-routes\/[^/]+$/,
+    label: "/v1/workspaces/:workspaceId/network-routes/:networkRouteId",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/network-routes$/,
+    label: "/v1/workspaces/:workspaceId/network-routes",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/site-auth-connections\/[^/]+$/,
+    label: "/v1/workspaces/:workspaceId/site-auth-connections/:siteAuthConnectionId",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/site-auth-connections$/,
+    label: "/v1/workspaces/:workspaceId/site-auth-connections",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/auth-runs\/[^/]+$/,
+    label: "/v1/workspaces/:workspaceId/auth-runs/:authRunId",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/auth-runs$/,
+    label: "/v1/workspaces/:workspaceId/auth-runs",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/interaction-interventions\/[^/]+\/resolve$/,
+    label: "/v1/workspaces/:workspaceId/interaction-interventions/:interventionId/resolve",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/interaction-interventions\/[^/]+$/,
+    label: "/v1/workspaces/:workspaceId/interaction-interventions/:interventionId",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/interaction-interventions$/,
+    label: "/v1/workspaces/:workspaceId/interaction-interventions",
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/control-events$/,
     label: "/v1/workspaces/:workspaceId/control-events",
@@ -1281,8 +1570,8 @@ const routeLabelPatterns: Array<{ pattern: RegExp; label: string }> = [
     label: "/v1/workspaces/:workspaceId/integrations/install",
   },
   {
-    pattern: /^\/v1\/workspaces\/[^/]+\/integrations\/presets$/,
-    label: "/v1/workspaces/:workspaceId/integrations/presets",
+    pattern: /^\/v1\/workspaces\/[^/]+\/integrations\/definitions$/,
+    label: "/v1/workspaces/:workspaceId/integrations/definitions",
   },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/integrations\/[^/]+\/instances\/[^/]+\/uninstall-preview$/,
@@ -1291,36 +1580,36 @@ const routeLabelPatterns: Array<{ pattern: RegExp; label: string }> = [
   },
   {
     pattern:
-      /^\/v1\/workspaces\/[^/]+\/integrations\/[^/]+\/instances\/[^/]+\/features\/[^/]+\/browse$/,
+      /^\/v1\/workspaces\/[^/]+\/integrations\/[^/]+\/instances\/[^/]+\/facets\/[^/]+\/browse$/,
     label:
-      "/v1/workspaces/:workspaceId/integrations/:capabilityId/instances/:instanceKey/features/:featureKey/browse",
+      "/v1/workspaces/:workspaceId/integrations/:capabilityId/instances/:instanceKey/facets/:facetKey/browse",
   },
   {
     pattern:
-      /^\/v1\/workspaces\/[^/]+\/integrations\/[^/]+\/instances\/[^/]+\/features\/[^/]+\/source$/,
+      /^\/v1\/workspaces\/[^/]+\/integrations\/[^/]+\/instances\/[^/]+\/facets\/[^/]+\/source$/,
     label:
-      "/v1/workspaces/:workspaceId/integrations/:capabilityId/instances/:instanceKey/features/:featureKey/source",
+      "/v1/workspaces/:workspaceId/integrations/:capabilityId/instances/:instanceKey/facets/:facetKey/source",
   },
   {
     pattern:
-      /^\/v1\/workspaces\/[^/]+\/integrations\/[^/]+\/instances\/[^/]+\/features\/[^/]+\/pause$/,
+      /^\/v1\/workspaces\/[^/]+\/integrations\/[^/]+\/instances\/[^/]+\/facets\/[^/]+\/pause$/,
     label:
-      "/v1/workspaces/:workspaceId/integrations/:capabilityId/instances/:instanceKey/features/:featureKey/pause",
+      "/v1/workspaces/:workspaceId/integrations/:capabilityId/instances/:instanceKey/facets/:facetKey/pause",
   },
   {
     pattern:
-      /^\/v1\/workspaces\/[^/]+\/integrations\/[^/]+\/instances\/[^/]+\/features\/[^/]+\/resume$/,
+      /^\/v1\/workspaces\/[^/]+\/integrations\/[^/]+\/instances\/[^/]+\/facets\/[^/]+\/resume$/,
     label:
-      "/v1/workspaces/:workspaceId/integrations/:capabilityId/instances/:instanceKey/features/:featureKey/resume",
+      "/v1/workspaces/:workspaceId/integrations/:capabilityId/instances/:instanceKey/facets/:facetKey/resume",
   },
   {
-    pattern: /^\/v1\/workspaces\/[^/]+\/integrations\/[^/]+\/instances\/[^/]+\/features\/[^/]+$/,
+    pattern: /^\/v1\/workspaces\/[^/]+\/integrations\/[^/]+\/instances\/[^/]+\/facets\/[^/]+$/,
     label:
-      "/v1/workspaces/:workspaceId/integrations/:capabilityId/instances/:instanceKey/features/:featureKey",
+      "/v1/workspaces/:workspaceId/integrations/:capabilityId/instances/:instanceKey/facets/:facetKey",
   },
   {
-    pattern: /^\/v1\/workspaces\/[^/]+\/integrations\/[^/]+\/instances\/[^/]+\/features$/,
-    label: "/v1/workspaces/:workspaceId/integrations/:capabilityId/instances/:instanceKey/features",
+    pattern: /^\/v1\/workspaces\/[^/]+\/integrations\/[^/]+\/instances\/[^/]+\/facets$/,
+    label: "/v1/workspaces/:workspaceId/integrations/:capabilityId/instances/:instanceKey/facets",
   },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/integrations\/[^/]+\/instances\/[^/]+$/,
@@ -1422,6 +1711,18 @@ const routeLabelPatterns: Array<{ pattern: RegExp; label: string }> = [
     pattern: /^\/v1\/workspaces\/[^/]+\/connections\/slack-bot\/install$/,
     label: "/v1/workspaces/:workspaceId/connections/slack-bot/install",
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/connections\/fiken\/install$/,
+    label: "/v1/workspaces/:workspaceId/connections/fiken/install",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/connections\/fiken\/oauth\/start$/,
+    label: "/v1/workspaces/:workspaceId/connections/fiken/oauth/start",
+  },
+  {
+    pattern: /^\/v1\/integrations\/fiken\/callback$/,
+    label: "/v1/integrations/fiken/callback",
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/connections\/[^/]+$/,
     label: "/v1/workspaces/:workspaceId/connections/:connectionId",
@@ -1495,9 +1796,11 @@ const routeLabelPatterns: Array<{ pattern: RegExp; label: string }> = [
 ];
 
 export function routeLabel(pathname: string): string {
-  const match = routeLabelPatterns.find(({ pattern }) => pattern.test(pathname));
-  if (match) {
-    return match.label;
+  for (const candidate of routeLabelPatterns) {
+    const match = pathname.match(candidate.pattern);
+    if (match) {
+      return typeof candidate.label === "string" ? candidate.label : candidate.label(match);
+    }
   }
   return pathname.startsWith("/v1/") ? "/v1/unknown" : "/unknown";
 }