@opengeni/api-router 0.30.1 → 2.1.0-canary.0

package/dist/sandbox/viewer.d.ts

@@ -51,7 +51,10 @@ export type ViewerAttachResult = {
  * cannot change manifest environment variables" whenever a viewer attach (an open
  * session page) won the cold-create race against the first turn.
  */
-export declare function sessionAttachEnvironment(services: ViewerServices, workspaceId: string, session: Session): Promise<Record<string, string>>;
+export declare function sessionAttachEnvironment(services: ViewerServices, workspaceId: string, session: Session, 
+/** The authenticated route subject driving this attach (0282); recorded on
+ *  the materialization audit fact. Null records the legacy service sentinel. */
+attachSubjectId: string | null): Promise<Record<string, string>>;
 /**
  * Acquire a `viewer` holder on the group lease, spinning up the box IN-PROCESS
  * when cold. Mirrors the worker's resumeBoxForTurn spawner/attached branches,
@@ -65,6 +68,9 @@ export declare function attachViewer(services: ViewerServices, input: {
     workspaceId: string;
     session: Session;
     viewerId?: string;
+    /** The authenticated subject attaching this viewer (0281): recorded on
+     *  the holder row together with the live session authority epoch. */
+    viewerSubjectId?: string;
     /** Cancel lifecycle waiting when the originating HTTP request disconnects. */
     waitSignal?: AbortSignal;
 }): Promise<ViewerAttachResult>;
@@ -84,6 +90,10 @@ export declare function ensureSessionGroupReady(services: ViewerServices, input:
     accountId: string;
     workspaceId: string;
     session: Session;
+    /** The authenticated subject driving the fleet attach/swap (0282): recorded
+     *  on the viewer holder and the materialization audit fact. Omitting it
+     *  records the explicit service sentinel, so forward the route subject. */
+    subjectId?: string | null;
 }): Promise<SessionGroupReadinessHold>;
 /**
  * Refresh a viewer holder's TTL (the app-level viewer heartbeat). Epoch-fenced:
@@ -148,6 +158,11 @@ export type DesktopStreamMint = {
 export type MintDesktopStreamInput = {
     accountId: string;
     workspaceId: string;
+    resourceSubjectId?: string;
+    /** True when the route grant is a signed delegated token (metadata.delegated):
+     *  its authority is the token, not membership rows, so the mint-time
+     *  live-authority recheck does not apply. */
+    resourceSubjectDelegated?: boolean;
     session: Session;
     /** The viewer holder id the scoped token is minted for. */
     viewerId: string;
@@ -197,6 +212,9 @@ type SelfhostedStreamMint = Omit<TerminalStreamMint, "transport">;
 export type MintTerminalStreamInput = {
     accountId: string;
     workspaceId: string;
+    resourceSubjectId?: string;
+    /** See MintDesktopStreamInput.resourceSubjectDelegated. */
+    resourceSubjectDelegated?: boolean;
     session: Session;
     /** The viewer holder / principal id the scoped token is minted for. */
     viewerId: string;
@@ -233,6 +251,11 @@ export type MintSelfhostedStreamInput = {
      *  THIS as its leaseEpoch claim so the relay rejects a stale-epoch (swapped-away)
      *  viewer. */
     activeEpoch: number;
+    /** 0281 viewer authority claims stamped into the relay stream token. */
+    viewerAuthority?: {
+        subjectId?: string;
+        authorityEpoch: number;
+    };
     /** The exposed stream port (6080 desktop / 7681 terminal). */
     port: number;
     /** The resolvable selfhosted session (the routing proxy resolves the active

package/dist/sandbox-file-artifacts.d.ts

@@ -0,0 +1,11 @@
+import { SandboxFileArtifactReceipt, type AccessGrant, type Session } from "@opengeni/contracts";
+import { type ApiRouteDeps } from "@opengeni/core";
+export declare function publishSandboxFileArtifact(deps: ApiRouteDeps, input: {
+    grant: AccessGrant;
+    session: Session;
+    path: string;
+    signal?: AbortSignal | undefined;
+}): Promise<SandboxFileArtifactReceipt>;
+export declare function sandboxArtifactRelativePath(value: string): string;
+export declare function sandboxArtifactSafeFilename(filename: string): string;
+export declare function sandboxFileContentType(filename: string): string;

package/dist/scheduled-task-deletion.d.ts

@@ -0,0 +1,14 @@
+import type { ScheduledTask as ScheduledTaskValue } from "@opengeni/contracts";
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { TemporalScheduleCleanupClaim } from "@opengeni/db";
+/** Execute one exact connector obligation frozen into the tombstone outbox row. */
+export declare function cleanupScheduledTaskConnectorAuthorization(deps: ApiRouteDeps, claim: TemporalScheduleCleanupClaim): Promise<void>;
+/** Shared HTTP/MCP domain operation: authorize, tombstone, persist, then accelerate cleanup. */
+export declare function deleteScheduledTaskWithDurableCleanup(deps: ApiRouteDeps, input: {
+    workspaceId: string;
+    taskId: string;
+    subjectId: string;
+}): Promise<{
+    task: ScheduledTaskValue;
+    changed: boolean;
+}>;

package/dist/slack-reaction-files.d.ts

@@ -1,6 +1,6 @@
 import type { FileResourceRef } from "@opengeni/contracts";
 import { completeFileUpload, prepareGeneratedWorkspaceFile, type Database } from "@opengeni/db";
-import type { ObjectStorage } from "@opengeni/storage";
+import { type ObjectStorage } from "@opengeni/storage";
 import type { DownloadedSlackReactionImage } from "./integrations/slack-bot.js";
 export type SlackReactionImageImportSource = Readonly<{
     accountId: string;

package/dist/temporal-schedule-cleanup.d.ts

@@ -2,6 +2,7 @@ import { type Database, type TemporalScheduleCleanupClaim } from "@opengeni/db";
 import type { Observability } from "@opengeni/observability";
 type TemporalScheduleCleanupDependencies = {
     db: Database;
+    cleanupConnectorAuthorization?: (claim: TemporalScheduleCleanupClaim) => Promise<void>;
     deleteSchedule: (temporalScheduleId: string) => Promise<void>;
     observability?: Pick<Observability, "info" | "warn" | "error">;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/api-router",
-  "version": "0.30.1",
+  "version": "2.1.0-canary.0",
   "description": "OpenGeni HTTP surface: the Hono adapter/router (createApp), routes, MCP HTTP transport, and HTTP access adapters over @opengeni/core. An engine-distribution surface — its runtime closure includes engine-internal packages.",
   "license": "Apache-2.0",
   "repository": {
@@ -43,30 +43,32 @@
     "@hono/zod-validator": "^0.7.6",
     "@llamaindex/liteparse": "^1.5.3",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/agent-proto": "^0.5.0",
-    "@opengeni/artifact-tool": "^0.2.8",
-    "@opengeni/capabilities": "^0.2.0",
-    "@opengeni/codemode": "^0.4.2",
-    "@opengeni/codex": "^0.2.17",
-    "@opengeni/config": "^0.16.2",
-    "@opengeni/contracts": "^0.50.0",
-    "@opengeni/core": "^0.28.1",
-    "@opengeni/db": "^0.36.1",
-    "@opengeni/documents": "^0.5.39",
-    "@opengeni/events": "^0.3.110",
-    "@opengeni/github": "^0.4.57",
-    "@opengeni/network": "^0.2.2",
-    "@opengeni/observability": "^0.7.5",
-    "@opengeni/runtime": "^0.23.1",
-    "@opengeni/storage": "^0.2.94",
-    "@opengeni/xai-subscription": "^0.1.0",
+    "@opengeni/agent-proto": "^0.5.1-canary.0",
+    "@opengeni/artifact-tool": "^0.3.4-canary.0",
+    "@opengeni/capabilities": "^0.3.0-canary.0",
+    "@opengeni/codemode": "^0.4.12-canary.0",
+    "@opengeni/codex": "^0.2.18-canary.0",
+    "@opengeni/config": "^0.19.0-canary.0",
+    "@opengeni/contracts": "^2.2.0-canary.0",
+    "@opengeni/core": "^2.1.0-canary.0",
+    "@opengeni/db": "^3.1.0-canary.0",
+    "@opengeni/documents": "^0.6.9-canary.0",
+    "@opengeni/events": "^0.3.123-canary.0",
+    "@opengeni/github": "^0.5.2-canary.0",
+    "@opengeni/network": "^0.2.2-canary.0",
+    "@opengeni/observability": "^0.8.3-canary.0",
+    "@opengeni/runtime": "^1.3.0-canary.0",
+    "@opengeni/storage": "^0.2.105-canary.0",
+    "@opengeni/xai-subscription": "^0.1.1-canary.0",
     "@temporalio/client": "^1.17.0",
     "better-auth": "^1.6.14",
     "hono": "^4.12.18",
+    "json-bigint": "^1.0.0",
     "pg": "^8.21.0",
     "resend": "^6.12.4",
     "sharp": "^0.34.5",
     "stripe": "^22.2.0",
+    "ws": "8.21.1",
     "zod": "^4.2.1"
   },
   "engines": {

package/src/api-websocket.ts

@@ -0,0 +1,23 @@
+export type ApiWebSocketConnection = Readonly<{
+  attach(socket: ApiWebSocketLike): void;
+  receive(message: string | Uint8Array | ArrayBuffer): void;
+  transportClosed(): void;
+}>;
+
+export type ApiWebSocketLike = Readonly<{
+  data: ApiWebSocketConnection;
+  send(data: Uint8Array, compress?: boolean): number;
+  close(code?: number, reason?: string): void;
+  readonly bufferedAmount?: number;
+  getBufferedAmount?(): number;
+}>;
+
+export type ApiWebSocketUpgradeServer = Readonly<{
+  upgrade(
+    request: Request,
+    options: Readonly<{
+      data: ApiWebSocketConnection;
+      headers: HeadersInit;
+    }>,
+  ): boolean;
+}>;

package/src/app.ts

@@ -23,17 +23,18 @@ import {
 } from "@opengeni/contracts";
 import {
   createDocumentServices,
-  getDocument,
+  getDocumentForIndexing,
   indexDocumentNow,
   type DocumentServices,
 } from "@opengeni/documents";
 import {
-  CodemodeCallBudgetExceededError,
   CodemodeOperationConflictError,
   CodemodeOperationNotExecutableError,
   CodemodePayloadTooLargeError,
   CodemodeToolApprovalRequiredError,
   CodemodeToolNotInCatalogError,
+  configureChildLifecycleNotices,
+  configureWorkspaceControlRequestLockTimeoutMs,
   dbSql,
   getWorkspace,
   rlsContextForWorkspace,
@@ -42,12 +43,13 @@ import {
 import { createObservability } from "@opengeni/observability";
 import { createObjectStorage } from "@opengeni/storage";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
+import { handleMcpRequestWithClientAbort } from "./mcp/request-abort";
 import { Hono } from "hono";
 import { bodyLimit } from "hono/body-limit";
 import { compress } from "hono/compress";
 import { cors } from "hono/cors";
 import { HTTPException } from "hono/http-exception";
-import { ApiHttpError } from "./http/api-error";
+import { ApiHttpError, workspaceControlBusyHttpError } from "./http/api-error";
 import type { ContentfulStatusCode } from "hono/utils/http-status";
 import type { ApiRouteDeps, AppDependencies } from "@opengeni/core";
 import {
@@ -66,6 +68,7 @@ import { requireLimit } from "@opengeni/core";
 import { buildOpenGeniMcpServer } from "./mcp/server";
 import {
   CodemodeAuthorityError,
+  CodemodeCatalogNotReadyError,
   isCodemodeGrant,
   readCodemodeOperation,
   requireActiveCodemodeCatalog,
@@ -95,11 +98,18 @@ import { registerBrowserIdentityRoutes } from "./routes/browser-identities";
 import { registerBrowserSessionRoutes } from "./routes/browser-sessions";
 import { registerComputerSessionRoutes } from "./routes/computer-sessions";
 import { registerGitHubRoutes } from "./routes/github";
+import { registerPersonalGitHubRoutes } from "./routes/personal-github";
+import {
+  isPersonalGitHubGitBrokerRequest,
+  registerPersonalGitHubGitBrokerRoutes,
+} from "./routes/personal-github-git-broker";
 import { registerInstallRoutes } from "./routes/install";
 import { registerApiIntegrationRoutes } from "./routes/api-integrations";
 import { registerIntegrationFacetRoutes } from "./routes/integration-facets";
 import { registerInteractionResourceRoutes } from "./routes/interaction-resources";
+import { registerPrReviewRoutes } from "./routes/pr-review";
 import { registerPackRoutes } from "./routes/packs";
+import { registerAutomationRoutes } from "./routes/automations";
 import { registerPluginRoutes } from "./routes/plugins";
 import { registerSkillRoutes } from "./routes/skills";
 import { registerChannelRoutes } from "./routes/channels";
@@ -109,7 +119,9 @@ import { registerSessionRoutes } from "./routes/sessions";
 import { registerSocialRoutes } from "./routes/social";
 import { registerWorkspaceRoutes } from "./routes/workspaces";
 import { registerWorkspaceInstructionPolicyRoutes } from "./routes/workspace-instruction-policies";
+import { registerWorkspaceLearningRoutes } from "./routes/workspace-learning";
 import { registerCompanyProfileRoutes } from "./routes/company-profile";
+import { registerCompanyBrainRoutes } from "./routes/company-brain";
 import { registerSlackTaskPolicyRoutes } from "./routes/slack-task-policy";
 import { registerWorkspaceStateRoutes } from "./routes/workspace-state";
 import { registerWorkspaceArtifactRoutes } from "./routes/workspace-artifacts";
@@ -120,6 +132,8 @@ import { registerEditableArtifactRoutes } from "./routes/editable-artifacts";
 import { registerVideoGenerationRoutes } from "./routes/video-generation";
 import { registerCanonicalHumanIdentityRoutes } from "./routes/canonical-human-identities";
 import { registerOrganizationMembershipRoutes } from "./routes/organization-memberships";
+import { registerUserResourceAuthorityRoutes } from "./routes/user-resource-authorities";
+import { registerConnectionAuthorityRoutes } from "./routes/connection-authorities";
 import { projectClientModel } from "./model-catalog";
 import { createTranscriptionService } from "./transcription/service";
 import { createFfmpegTranscriptionSegmenter } from "./transcription/segmenter";
@@ -171,6 +185,14 @@ export function createAppComposition(deps: AppDependencies): {
   app: Hono;
   routeDeps: ApiRouteDeps;
 } {
+  // The request-scoped workspace control-prefix budget is validated once by
+  // @opengeni/config at boot; install it for every request-scoped db command
+  // (Send/Steer/control/queue/settings/delete) built by this app.
+  configureWorkspaceControlRequestLockTimeoutMs(deps.settings.workspaceControlLockTimeoutMs);
+  // Child lifecycle notice producers (human-input/approval resolutions, direct
+  // Pause) run inside API-originated db commands; install the boot-validated
+  // rollout flag once for this process.
+  configureChildLifecycleNotices({ enabled: deps.settings.childLifecycleNoticesEnabled });
   const managedAuth = deps.managedAuth ?? createManagedAuth(deps.settings, deps.db);
   const objectStorage =
     deps.objectStorage === undefined ? createObjectStorage(deps.settings) : deps.objectStorage;
@@ -204,9 +226,12 @@ export function createAppComposition(deps: AppDependencies): {
       if (context.accountId !== accountId) {
         throw new Error("document account/workspace authority mismatch");
       }
-      const claimedDocument = await getDocument(deps.db, workspaceId, documentId, {
-        viewerSubjectId: authoritySubjectId,
-      });
+      // This is a metadata-only authority-tuple fence. Workspace and
+      // organization documents intentionally have no authority subject, so a
+      // viewer-scoped public read cannot supply the immutable human needed for
+      // Drive ACL evaluation. The byte boundary below reconstructs that
+      // subject from the stored document through indexDocumentNow.
+      const claimedDocument = await getDocumentForIndexing(deps.db, workspaceId, documentId);
       if (
         !claimedDocument ||
         claimedDocument.authorityKind !== authorityKind ||
@@ -329,14 +354,21 @@ export function createAppComposition(deps: AppDependencies): {
     return middleware(c, next);
   });
 
-  app.use(
-    "*",
-    bodyLimit({
-      maxSize: apiRequestBodyLimitBytes(deps.settings),
-      onError: (c) =>
-        c.json({ code: "PAYLOAD_TOO_LARGE", message: "Request body is too large." }, 413),
-    }),
-  );
+  const standardRequestBodyLimit = bodyLimit({
+    maxSize: apiRequestBodyLimitBytes(deps.settings),
+    onError: (c) =>
+      c.json({ code: "PAYLOAD_TOO_LARGE", message: "Request body is too large." }, 413),
+  });
+  app.use("*", async (c, next) => {
+    // Git packfiles must stay streaming and can legitimately exceed the JSON
+    // request ceiling. The exact closed broker routes apply their own method,
+    // content-type, authority, and idle-deadline checks.
+    if (isPersonalGitHubGitBrokerRequest(c.req.method, new URL(c.req.url).pathname)) {
+      await next();
+      return;
+    }
+    return await standardRequestBodyLimit(c, next);
+  });
 
   // Large catalog, capture, and session-list responses are on the browser's
   // critical path. Compress JSON at the API boundary while leaving SSE and
@@ -423,7 +455,17 @@ export function createAppComposition(deps: AppDependencies): {
     }
   });
 
-  app.use("*", requireAccessKey(deps.settings));
+  const accessKeyBoundary = requireAccessKey(deps.settings);
+  app.use("*", async (c, next) => {
+    // Git's credential helper supplies the exact encrypted broker bearer in
+    // Authorization. It cannot also supply the deployment access key, and the
+    // route performs its own attempt-bound authorization before every use.
+    if (isPersonalGitHubGitBrokerRequest(c.req.method, new URL(c.req.url).pathname)) {
+      await next();
+      return;
+    }
+    return await accessKeyBoundary(c, next);
+  });
 
   app.use("/v1/*", async (c, next) => {
     c.header(OPENGENI_API_CONTRACT_HEADER, OPENGENI_API_CONTRACT_REVISION);
@@ -594,7 +636,7 @@ export function createAppComposition(deps: AppDependencies): {
       }
       const workspace = await getWorkspace(routeDeps.db, workspaceId);
       const workspaceMemoryEnabled = resolveWorkspaceMemoryEnabled(workspace?.settings);
-      const workspaceMemoryPromptMode = resolveWorkspaceMemoryPromptMode(workspace?.settings);
+      const workspaceMemoryPromptMode = resolveWorkspaceMemoryPromptMode();
       const transport = new WebStandardStreamableHTTPServerTransport({
         enableJsonResponse: true,
       });
@@ -604,7 +646,9 @@ export function createAppComposition(deps: AppDependencies): {
         workspaceMemoryPromptMode,
       });
       await mcp.connect(transport);
-      return await transport.handleRequest(boundedRequest);
+      // Bind tool handlers' `extra.signal` to the HTTP client's connection: a
+      // worker that drops the call (Steer/Pause) aborts a blocking tool here.
+      return await handleMcpRequestWithClientAbort(transport, boundedRequest, c.req.raw.signal);
     });
   });
 
@@ -674,13 +718,17 @@ export function createAppComposition(deps: AppDependencies): {
   registerWorkspaceRoutes(app, routeDeps);
   registerInsightsRoutes(app, routeDeps);
   registerWorkspaceInstructionPolicyRoutes(app, routeDeps);
+  registerWorkspaceLearningRoutes(app, routeDeps);
   registerCompanyProfileRoutes(app, routeDeps);
+  registerCompanyBrainRoutes(app, routeDeps);
   registerSlackTaskPolicyRoutes(app, routeDeps);
   registerWorkspaceStateRoutes(app, routeDeps);
   registerMemorySlackPublicationRoutes(app, routeDeps);
   registerWorkspaceArtifactRoutes(app, routeDeps);
   registerPreferenceRegistryRoutes(app, routeDeps);
   registerSocialRoutes(app, routeDeps);
+  registerPersonalGitHubRoutes(app, routeDeps);
+  registerPersonalGitHubGitBrokerRoutes(app, routeDeps);
   registerConnectionRoutes(app, routeDeps);
   registerCapabilityRoutes(app, routeDeps);
   registerApiIntegrationRoutes(app, routeDeps);
@@ -692,6 +740,8 @@ export function createAppComposition(deps: AppDependencies): {
   registerChannelRoutes(app, routeDeps);
   registerRigRoutes(app, routeDeps);
   registerPackRoutes(app, routeDeps);
+  registerAutomationRoutes(app, routeDeps);
+  registerPrReviewRoutes(app, routeDeps);
   registerPluginRoutes(app, routeDeps);
   registerSkillRoutes(app, routeDeps);
   registerSessionRoutes(app, routeDeps);
@@ -703,6 +753,8 @@ export function createAppComposition(deps: AppDependencies): {
   registerVideoGenerationRoutes(app, routeDeps);
   registerCanonicalHumanIdentityRoutes(app, routeDeps);
   registerOrganizationMembershipRoutes(app, routeDeps);
+  registerUserResourceAuthorityRoutes(app, routeDeps);
+  registerConnectionAuthorityRoutes(app, routeDeps);
   registerSlackInteractionRoutes(app, routeDeps);
 
   app.notFound((c) => {
@@ -722,7 +774,10 @@ export function createAppComposition(deps: AppDependencies): {
     );
   });
 
-  app.onError((error, c) => {
+  app.onError((rawError, c) => {
+    // One central mapping for every Send/Steer/control route: a bounded
+    // control-prefix wait that expired is a known, retryable, not-applied 503.
+    const error = workspaceControlBusyHttpError(rawError) ?? rawError;
     const compactionLock = codexCompactionV2ProviderLockedError(error);
     const apiError = error instanceof ApiHttpError ? error : null;
     const status = compactionLock ? 422 : httpStatusForError(error);
@@ -744,7 +799,9 @@ export function createAppComposition(deps: AppDependencies): {
             ? (boundedPublicMessage(apiError.message) ?? "Request failed.")
             : publicErrorMessage(error, status),
         retryable: apiError?.retryable ?? retryableHttpStatus(status),
-        ...(mutationOutcomeUnknown(error, c.req.method) ? { outcomeUnknown: true } : {}),
+        ...((apiError?.outcomeUnknown ?? mutationOutcomeUnknown(error, c.req.method))
+          ? { outcomeUnknown: true }
+          : {}),
         requestId,
         ...(apiError?.details ? { details: apiError.details } : {}),
       },
@@ -867,7 +924,11 @@ async function requireMcpAccessGrant(
 
 function clientAuthConfig(settings: AppDependencies["settings"]) {
   if (settings.productAccessMode === "managed") {
-    return { mode: "managedSession" as const, session: "cookie" as const };
+    return {
+      mode: "managedSession" as const,
+      session: "cookie" as const,
+      emailVerificationRequired: settings.environment !== "local",
+    };
   }
   if (settings.productAccessMode === "configured") {
     return {
@@ -898,18 +959,30 @@ function codemodeHttpError(error: unknown): HTTPException {
       cause: error,
     });
   }
-  if (
-    error instanceof CodemodeAuthorityError ||
-    error instanceof CodemodeOperationNotExecutableError
-  ) {
+  if (error instanceof CodemodeCatalogNotReadyError) {
+    return new ApiHttpError(409, {
+      code: "conflict",
+      message: error.message,
+      retryable: true,
+      outcomeUnknown: false,
+      details: { code: error.code },
+    });
+  }
+  if (error instanceof CodemodeAuthorityError) {
+    return new ApiHttpError(error.reason === "invalid_grant" ? 403 : 409, {
+      code: error.reason === "invalid_grant" ? "forbidden" : "conflict",
+      message: error.message,
+      retryable: false,
+      outcomeUnknown: false,
+      details: { code: error.code },
+    });
+  }
+  if (error instanceof CodemodeOperationNotExecutableError) {
     return new HTTPException(409, { message: error.message, cause: error });
   }
   if (error instanceof CodemodeOperationConflictError) {
     return new HTTPException(409, { message: error.message, cause: error });
   }
-  if (error instanceof CodemodeCallBudgetExceededError) {
-    return new HTTPException(429, { message: error.message, cause: error });
-  }
   if (error instanceof CodemodeToolNotInCatalogError) {
     return new HTTPException(404, { message: error.message, cause: error });
   }
@@ -978,6 +1051,9 @@ export function httpStatusForError(error: unknown): number {
   if (codexCompactionV2ProviderLockedError(error)) {
     return 422;
   }
+  if (workspaceControlBusyHttpError(error)) {
+    return 503;
+  }
   if (error instanceof HTTPException) {
     return error.status;
   }
@@ -1168,6 +1244,10 @@ const routeLabelPatterns: Array<{
     label: "/v1/billing/entitlements",
   },
   { pattern: /^\/v1\/webhooks\/stripe$/, label: "/v1/webhooks/stripe" },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/pr-review\/(registrations|repositories)(?:\/[^/]+)?$/,
+    label: (match) => `/v1/workspaces/:workspaceId/pr-review/${match[1]}`,
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/mcp$/,
     label: "/v1/workspaces/:workspaceId/mcp",
@@ -1369,6 +1449,10 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/workspaces\/[^/]+\/sessions\/[^/]+\/events\/stream$/,
     label: "/v1/workspaces/:workspaceId/sessions/:id/events/stream",
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/sessions\/[^/]+\/(visibility|forks)$/,
+    label: (match) => `/v1/workspaces/:workspaceId/sessions/:id/${match[1]}`,
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/sessions\/[^/]+\/lineage$/,
     label: "/v1/workspaces/:workspaceId/sessions/:id/lineage",
@@ -1385,6 +1469,10 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/workspaces\/[^/]+\/sessions\/[^/]+\/queue$/,
     label: "/v1/workspaces/:workspaceId/sessions/:id/queue",
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/sessions\/[^/]+\/composer-draft\/submit$/,
+    label: "/v1/workspaces/:workspaceId/sessions/:id/composer-draft/submit",
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/sessions\/[^/]+\/composer-draft$/,
     label: "/v1/workspaces/:workspaceId/sessions/:id/composer-draft",
@@ -1703,6 +1791,26 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/workspaces\/[^/]+\/connections\/oauth\/start$/,
     label: "/v1/workspaces/:workspaceId/connections/oauth/start",
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/connections\/github$/,
+    label: "/v1/workspaces/:workspaceId/connections/github",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/connections\/github\/oauth\/start$/,
+    label: "/v1/workspaces/:workspaceId/connections/github/oauth/start",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/connections\/[^/]+\/github\/reconnect$/,
+    label: "/v1/workspaces/:workspaceId/connections/:connectionId/github/reconnect",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/connections\/[^/]+\/github\/repositories\/verify$/,
+    label: "/v1/workspaces/:workspaceId/connections/:connectionId/github/repositories/verify",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/connections\/[^/]+\/github\/repositories$/,
+    label: "/v1/workspaces/:workspaceId/connections/:connectionId/github/repositories",
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/integrations\/oauth\/start$/,
     label: "/v1/workspaces/:workspaceId/integrations/oauth/start",
@@ -1727,6 +1835,18 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/workspaces\/[^/]+\/connections\/[^/]+$/,
     label: "/v1/workspaces/:workspaceId/connections/:connectionId",
   },
+  {
+    pattern: /^\/v1\/git\/personal\/[^/]+\/info\/refs$/,
+    label: "/v1/git/personal/:routeId/info/refs",
+  },
+  {
+    pattern: /^\/v1\/git\/personal\/[^/]+\/git-upload-pack$/,
+    label: "/v1/git/personal/:routeId/git-upload-pack",
+  },
+  {
+    pattern: /^\/v1\/git\/personal\/[^/]+\/git-receive-pack$/,
+    label: "/v1/git/personal/:routeId/git-receive-pack",
+  },
   { pattern: /^\/v1\/catalog-assets\/.+$/, label: "/v1/catalog-assets/*" },
   {
     pattern: /^\/v1\/integrations\/oauth\/callback$/,
@@ -1736,6 +1856,10 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/integrations\/provider-oauth\/callback$/,
     label: "/v1/integrations/provider-oauth/callback",
   },
+  {
+    pattern: /^\/v1\/integrations\/github-personal\/oauth\/callback$/,
+    label: "/v1/integrations/github-personal/oauth/callback",
+  },
   {
     pattern: /^\/v1\/integrations\/google-drive\/callback$/,
     label: "/v1/integrations/google-drive/callback",
@@ -1776,6 +1900,14 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/workspaces\/[^/]+\/machines\/[^/]+\/metrics\/series$/,
     label: "/v1/workspaces/:workspaceId/machines/:enrollmentId/metrics/series",
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/machines\/[^/]+\/operation-policy$/,
+    label: "/v1/workspaces/:workspaceId/machines/:enrollmentId/operation-policy",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/machines\/[^/]+\/update$/,
+    label: "/v1/workspaces/:workspaceId/machines/:enrollmentId/update",
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/machines$/,
     label: "/v1/workspaces/:workspaceId/machines",
@@ -1821,6 +1953,7 @@ export function isApiContractProtectedMutation(method: string, pathname: string)
     pathname.startsWith("/v1/auth/") ||
     pathname.startsWith("/v1/webhooks/") ||
     pathname.startsWith("/v1/integrations/oauth/") ||
+    isPersonalGitHubGitBrokerRequest(method, pathname) ||
     pathname === "/v1/integrations/slack/events" ||
     pathname === "/v1/integrations/slack/commands" ||
     pathname === "/v1/integrations/slack/interactions" ||