@opengeni/api-router 0.30.3 → 2.2.0-canary.0

package/dist/sandbox-file-artifacts.d.ts

@@ -0,0 +1,11 @@
+import { SandboxFileArtifactReceipt, type AccessGrant, type Session } from "@opengeni/contracts";
+import { type ApiRouteDeps } from "@opengeni/core";
+export declare function publishSandboxFileArtifact(deps: ApiRouteDeps, input: {
+    grant: AccessGrant;
+    session: Session;
+    path: string;
+    signal?: AbortSignal | undefined;
+}): Promise<SandboxFileArtifactReceipt>;
+export declare function sandboxArtifactRelativePath(value: string): string;
+export declare function sandboxArtifactSafeFilename(filename: string): string;
+export declare function sandboxFileContentType(filename: string): string;

package/dist/scheduled-task-deletion.d.ts

@@ -0,0 +1,14 @@
+import type { ScheduledTask as ScheduledTaskValue } from "@opengeni/contracts";
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { TemporalScheduleCleanupClaim } from "@opengeni/db";
+/** Execute one exact connector obligation frozen into the tombstone outbox row. */
+export declare function cleanupScheduledTaskConnectorAuthorization(deps: ApiRouteDeps, claim: TemporalScheduleCleanupClaim): Promise<void>;
+/** Shared HTTP/MCP domain operation: authorize, tombstone, persist, then accelerate cleanup. */
+export declare function deleteScheduledTaskWithDurableCleanup(deps: ApiRouteDeps, input: {
+    workspaceId: string;
+    taskId: string;
+    subjectId: string;
+}): Promise<{
+    task: ScheduledTaskValue;
+    changed: boolean;
+}>;

package/dist/slack-reaction-files.d.ts

@@ -1,6 +1,6 @@
 import type { FileResourceRef } from "@opengeni/contracts";
 import { completeFileUpload, prepareGeneratedWorkspaceFile, type Database } from "@opengeni/db";
-import type { ObjectStorage } from "@opengeni/storage";
+import { type ObjectStorage } from "@opengeni/storage";
 import type { DownloadedSlackReactionImage } from "./integrations/slack-bot.js";
 export type SlackReactionImageImportSource = Readonly<{
     accountId: string;

package/dist/temporal-schedule-cleanup.d.ts

@@ -2,6 +2,7 @@ import { type Database, type TemporalScheduleCleanupClaim } from "@opengeni/db";
 import type { Observability } from "@opengeni/observability";
 type TemporalScheduleCleanupDependencies = {
     db: Database;
+    cleanupConnectorAuthorization?: (claim: TemporalScheduleCleanupClaim) => Promise<void>;
     deleteSchedule: (temporalScheduleId: string) => Promise<void>;
     observability?: Pick<Observability, "info" | "warn" | "error">;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/api-router",
-  "version": "0.30.3",
+  "version": "2.2.0-canary.0",
   "description": "OpenGeni HTTP surface: the Hono adapter/router (createApp), routes, MCP HTTP transport, and HTTP access adapters over @opengeni/core. An engine-distribution surface — its runtime closure includes engine-internal packages.",
   "license": "Apache-2.0",
   "repository": {
@@ -43,30 +43,32 @@
     "@hono/zod-validator": "^0.7.6",
     "@llamaindex/liteparse": "^1.5.3",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/agent-proto": "^0.5.0",
-    "@opengeni/artifact-tool": "^0.2.10",
-    "@opengeni/capabilities": "^0.2.0",
-    "@opengeni/codemode": "^0.4.4",
-    "@opengeni/codex": "^0.2.17",
-    "@opengeni/config": "^0.16.4",
-    "@opengeni/contracts": "^1.0.1",
-    "@opengeni/core": "^1.0.1",
-    "@opengeni/db": "^1.0.1",
-    "@opengeni/documents": "^0.5.41",
-    "@opengeni/events": "^0.3.112",
-    "@opengeni/github": "^0.4.59",
-    "@opengeni/network": "^0.2.2",
-    "@opengeni/observability": "^0.7.7",
-    "@opengeni/runtime": "^1.0.1",
-    "@opengeni/storage": "^0.2.96",
-    "@opengeni/xai-subscription": "^0.1.0",
+    "@opengeni/agent-proto": "^0.5.1-canary.1",
+    "@opengeni/artifact-tool": "^0.3.5-canary.0",
+    "@opengeni/capabilities": "^0.3.1-canary.0",
+    "@opengeni/codemode": "^0.4.13-canary.0",
+    "@opengeni/codex": "^0.2.19-canary.0",
+    "@opengeni/config": "^0.19.1-canary.0",
+    "@opengeni/contracts": "^2.3.0-canary.0",
+    "@opengeni/core": "^2.2.0-canary.0",
+    "@opengeni/db": "^3.2.0-canary.0",
+    "@opengeni/documents": "^0.7.0-canary.0",
+    "@opengeni/events": "^0.3.124-canary.0",
+    "@opengeni/github": "^0.5.3-canary.0",
+    "@opengeni/network": "^0.2.3-canary.0",
+    "@opengeni/observability": "^0.8.4-canary.0",
+    "@opengeni/runtime": "^1.3.1-canary.0",
+    "@opengeni/storage": "^0.2.106-canary.0",
+    "@opengeni/xai-subscription": "^0.1.2-canary.0",
     "@temporalio/client": "^1.17.0",
     "better-auth": "^1.6.14",
     "hono": "^4.12.18",
+    "json-bigint": "^1.0.0",
     "pg": "^8.21.0",
     "resend": "^6.12.4",
     "sharp": "^0.34.5",
     "stripe": "^22.2.0",
+    "ws": "8.21.1",
     "zod": "^4.2.1"
   },
   "engines": {

package/src/api-websocket.ts

@@ -0,0 +1,23 @@
+export type ApiWebSocketConnection = Readonly<{
+  attach(socket: ApiWebSocketLike): void;
+  receive(message: string | Uint8Array | ArrayBuffer): void;
+  transportClosed(): void;
+}>;
+
+export type ApiWebSocketLike = Readonly<{
+  data: ApiWebSocketConnection;
+  send(data: Uint8Array, compress?: boolean): number;
+  close(code?: number, reason?: string): void;
+  readonly bufferedAmount?: number;
+  getBufferedAmount?(): number;
+}>;
+
+export type ApiWebSocketUpgradeServer = Readonly<{
+  upgrade(
+    request: Request,
+    options: Readonly<{
+      data: ApiWebSocketConnection;
+      headers: HeadersInit;
+    }>,
+  ): boolean;
+}>;

package/src/app.ts

@@ -28,12 +28,13 @@ import {
   type DocumentServices,
 } from "@opengeni/documents";
 import {
-  CodemodeCallBudgetExceededError,
   CodemodeOperationConflictError,
   CodemodeOperationNotExecutableError,
   CodemodePayloadTooLargeError,
   CodemodeToolApprovalRequiredError,
   CodemodeToolNotInCatalogError,
+  configureChildLifecycleNotices,
+  configureWorkspaceControlRequestLockTimeoutMs,
   dbSql,
   getWorkspace,
   rlsContextForWorkspace,
@@ -42,12 +43,13 @@ import {
 import { createObservability } from "@opengeni/observability";
 import { createObjectStorage } from "@opengeni/storage";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
+import { handleMcpRequestWithClientAbort } from "./mcp/request-abort";
 import { Hono } from "hono";
 import { bodyLimit } from "hono/body-limit";
 import { compress } from "hono/compress";
 import { cors } from "hono/cors";
 import { HTTPException } from "hono/http-exception";
-import { ApiHttpError } from "./http/api-error";
+import { ApiHttpError, workspaceControlBusyHttpError } from "./http/api-error";
 import type { ContentfulStatusCode } from "hono/utils/http-status";
 import type { ApiRouteDeps, AppDependencies } from "@opengeni/core";
 import {
@@ -66,6 +68,7 @@ import { requireLimit } from "@opengeni/core";
 import { buildOpenGeniMcpServer } from "./mcp/server";
 import {
   CodemodeAuthorityError,
+  CodemodeCatalogNotReadyError,
   isCodemodeGrant,
   readCodemodeOperation,
   requireActiveCodemodeCatalog,
@@ -95,11 +98,18 @@ import { registerBrowserIdentityRoutes } from "./routes/browser-identities";
 import { registerBrowserSessionRoutes } from "./routes/browser-sessions";
 import { registerComputerSessionRoutes } from "./routes/computer-sessions";
 import { registerGitHubRoutes } from "./routes/github";
+import { registerPersonalGitHubRoutes } from "./routes/personal-github";
+import {
+  isPersonalGitHubGitBrokerRequest,
+  registerPersonalGitHubGitBrokerRoutes,
+} from "./routes/personal-github-git-broker";
 import { registerInstallRoutes } from "./routes/install";
 import { registerApiIntegrationRoutes } from "./routes/api-integrations";
 import { registerIntegrationFacetRoutes } from "./routes/integration-facets";
 import { registerInteractionResourceRoutes } from "./routes/interaction-resources";
+import { registerPrReviewRoutes } from "./routes/pr-review";
 import { registerPackRoutes } from "./routes/packs";
+import { registerAutomationRoutes } from "./routes/automations";
 import { registerPluginRoutes } from "./routes/plugins";
 import { registerSkillRoutes } from "./routes/skills";
 import { registerChannelRoutes } from "./routes/channels";
@@ -109,7 +119,9 @@ import { registerSessionRoutes } from "./routes/sessions";
 import { registerSocialRoutes } from "./routes/social";
 import { registerWorkspaceRoutes } from "./routes/workspaces";
 import { registerWorkspaceInstructionPolicyRoutes } from "./routes/workspace-instruction-policies";
+import { registerWorkspaceLearningRoutes } from "./routes/workspace-learning";
 import { registerCompanyProfileRoutes } from "./routes/company-profile";
+import { registerCompanyBrainRoutes } from "./routes/company-brain";
 import { registerSlackTaskPolicyRoutes } from "./routes/slack-task-policy";
 import { registerWorkspaceStateRoutes } from "./routes/workspace-state";
 import { registerWorkspaceArtifactRoutes } from "./routes/workspace-artifacts";
@@ -120,6 +132,8 @@ import { registerEditableArtifactRoutes } from "./routes/editable-artifacts";
 import { registerVideoGenerationRoutes } from "./routes/video-generation";
 import { registerCanonicalHumanIdentityRoutes } from "./routes/canonical-human-identities";
 import { registerOrganizationMembershipRoutes } from "./routes/organization-memberships";
+import { registerUserResourceAuthorityRoutes } from "./routes/user-resource-authorities";
+import { registerConnectionAuthorityRoutes } from "./routes/connection-authorities";
 import { projectClientModel } from "./model-catalog";
 import { createTranscriptionService } from "./transcription/service";
 import { createFfmpegTranscriptionSegmenter } from "./transcription/segmenter";
@@ -171,6 +185,14 @@ export function createAppComposition(deps: AppDependencies): {
   app: Hono;
   routeDeps: ApiRouteDeps;
 } {
+  // The request-scoped workspace control-prefix budget is validated once by
+  // @opengeni/config at boot; install it for every request-scoped db command
+  // (Send/Steer/control/queue/settings/delete) built by this app.
+  configureWorkspaceControlRequestLockTimeoutMs(deps.settings.workspaceControlLockTimeoutMs);
+  // Child lifecycle notice producers (human-input/approval resolutions, direct
+  // Pause) run inside API-originated db commands; install the boot-validated
+  // rollout flag once for this process.
+  configureChildLifecycleNotices({ enabled: deps.settings.childLifecycleNoticesEnabled });
   const managedAuth = deps.managedAuth ?? createManagedAuth(deps.settings, deps.db);
   const objectStorage =
     deps.objectStorage === undefined ? createObjectStorage(deps.settings) : deps.objectStorage;
@@ -332,14 +354,21 @@ export function createAppComposition(deps: AppDependencies): {
     return middleware(c, next);
   });
 
-  app.use(
-    "*",
-    bodyLimit({
-      maxSize: apiRequestBodyLimitBytes(deps.settings),
-      onError: (c) =>
-        c.json({ code: "PAYLOAD_TOO_LARGE", message: "Request body is too large." }, 413),
-    }),
-  );
+  const standardRequestBodyLimit = bodyLimit({
+    maxSize: apiRequestBodyLimitBytes(deps.settings),
+    onError: (c) =>
+      c.json({ code: "PAYLOAD_TOO_LARGE", message: "Request body is too large." }, 413),
+  });
+  app.use("*", async (c, next) => {
+    // Git packfiles must stay streaming and can legitimately exceed the JSON
+    // request ceiling. The exact closed broker routes apply their own method,
+    // content-type, authority, and idle-deadline checks.
+    if (isPersonalGitHubGitBrokerRequest(c.req.method, new URL(c.req.url).pathname)) {
+      await next();
+      return;
+    }
+    return await standardRequestBodyLimit(c, next);
+  });
 
   // Large catalog, capture, and session-list responses are on the browser's
   // critical path. Compress JSON at the API boundary while leaving SSE and
@@ -426,7 +455,17 @@ export function createAppComposition(deps: AppDependencies): {
     }
   });
 
-  app.use("*", requireAccessKey(deps.settings));
+  const accessKeyBoundary = requireAccessKey(deps.settings);
+  app.use("*", async (c, next) => {
+    // Git's credential helper supplies the exact encrypted broker bearer in
+    // Authorization. It cannot also supply the deployment access key, and the
+    // route performs its own attempt-bound authorization before every use.
+    if (isPersonalGitHubGitBrokerRequest(c.req.method, new URL(c.req.url).pathname)) {
+      await next();
+      return;
+    }
+    return await accessKeyBoundary(c, next);
+  });
 
   app.use("/v1/*", async (c, next) => {
     c.header(OPENGENI_API_CONTRACT_HEADER, OPENGENI_API_CONTRACT_REVISION);
@@ -597,7 +636,7 @@ export function createAppComposition(deps: AppDependencies): {
       }
       const workspace = await getWorkspace(routeDeps.db, workspaceId);
       const workspaceMemoryEnabled = resolveWorkspaceMemoryEnabled(workspace?.settings);
-      const workspaceMemoryPromptMode = resolveWorkspaceMemoryPromptMode(workspace?.settings);
+      const workspaceMemoryPromptMode = resolveWorkspaceMemoryPromptMode();
       const transport = new WebStandardStreamableHTTPServerTransport({
         enableJsonResponse: true,
       });
@@ -607,7 +646,9 @@ export function createAppComposition(deps: AppDependencies): {
         workspaceMemoryPromptMode,
       });
       await mcp.connect(transport);
-      return await transport.handleRequest(boundedRequest);
+      // Bind tool handlers' `extra.signal` to the HTTP client's connection: a
+      // worker that drops the call (Steer/Pause) aborts a blocking tool here.
+      return await handleMcpRequestWithClientAbort(transport, boundedRequest, c.req.raw.signal);
     });
   });
 
@@ -677,13 +718,17 @@ export function createAppComposition(deps: AppDependencies): {
   registerWorkspaceRoutes(app, routeDeps);
   registerInsightsRoutes(app, routeDeps);
   registerWorkspaceInstructionPolicyRoutes(app, routeDeps);
+  registerWorkspaceLearningRoutes(app, routeDeps);
   registerCompanyProfileRoutes(app, routeDeps);
+  registerCompanyBrainRoutes(app, routeDeps);
   registerSlackTaskPolicyRoutes(app, routeDeps);
   registerWorkspaceStateRoutes(app, routeDeps);
   registerMemorySlackPublicationRoutes(app, routeDeps);
   registerWorkspaceArtifactRoutes(app, routeDeps);
   registerPreferenceRegistryRoutes(app, routeDeps);
   registerSocialRoutes(app, routeDeps);
+  registerPersonalGitHubRoutes(app, routeDeps);
+  registerPersonalGitHubGitBrokerRoutes(app, routeDeps);
   registerConnectionRoutes(app, routeDeps);
   registerCapabilityRoutes(app, routeDeps);
   registerApiIntegrationRoutes(app, routeDeps);
@@ -695,6 +740,8 @@ export function createAppComposition(deps: AppDependencies): {
   registerChannelRoutes(app, routeDeps);
   registerRigRoutes(app, routeDeps);
   registerPackRoutes(app, routeDeps);
+  registerAutomationRoutes(app, routeDeps);
+  registerPrReviewRoutes(app, routeDeps);
   registerPluginRoutes(app, routeDeps);
   registerSkillRoutes(app, routeDeps);
   registerSessionRoutes(app, routeDeps);
@@ -706,6 +753,8 @@ export function createAppComposition(deps: AppDependencies): {
   registerVideoGenerationRoutes(app, routeDeps);
   registerCanonicalHumanIdentityRoutes(app, routeDeps);
   registerOrganizationMembershipRoutes(app, routeDeps);
+  registerUserResourceAuthorityRoutes(app, routeDeps);
+  registerConnectionAuthorityRoutes(app, routeDeps);
   registerSlackInteractionRoutes(app, routeDeps);
 
   app.notFound((c) => {
@@ -725,7 +774,10 @@ export function createAppComposition(deps: AppDependencies): {
     );
   });
 
-  app.onError((error, c) => {
+  app.onError((rawError, c) => {
+    // One central mapping for every Send/Steer/control route: a bounded
+    // control-prefix wait that expired is a known, retryable, not-applied 503.
+    const error = workspaceControlBusyHttpError(rawError) ?? rawError;
     const compactionLock = codexCompactionV2ProviderLockedError(error);
     const apiError = error instanceof ApiHttpError ? error : null;
     const status = compactionLock ? 422 : httpStatusForError(error);
@@ -747,7 +799,9 @@ export function createAppComposition(deps: AppDependencies): {
             ? (boundedPublicMessage(apiError.message) ?? "Request failed.")
             : publicErrorMessage(error, status),
         retryable: apiError?.retryable ?? retryableHttpStatus(status),
-        ...(mutationOutcomeUnknown(error, c.req.method) ? { outcomeUnknown: true } : {}),
+        ...((apiError?.outcomeUnknown ?? mutationOutcomeUnknown(error, c.req.method))
+          ? { outcomeUnknown: true }
+          : {}),
         requestId,
         ...(apiError?.details ? { details: apiError.details } : {}),
       },
@@ -870,7 +924,11 @@ async function requireMcpAccessGrant(
 
 function clientAuthConfig(settings: AppDependencies["settings"]) {
   if (settings.productAccessMode === "managed") {
-    return { mode: "managedSession" as const, session: "cookie" as const };
+    return {
+      mode: "managedSession" as const,
+      session: "cookie" as const,
+      emailVerificationRequired: settings.environment !== "local",
+    };
   }
   if (settings.productAccessMode === "configured") {
     return {
@@ -901,18 +959,30 @@ function codemodeHttpError(error: unknown): HTTPException {
       cause: error,
     });
   }
-  if (
-    error instanceof CodemodeAuthorityError ||
-    error instanceof CodemodeOperationNotExecutableError
-  ) {
+  if (error instanceof CodemodeCatalogNotReadyError) {
+    return new ApiHttpError(409, {
+      code: "conflict",
+      message: error.message,
+      retryable: true,
+      outcomeUnknown: false,
+      details: { code: error.code },
+    });
+  }
+  if (error instanceof CodemodeAuthorityError) {
+    return new ApiHttpError(error.reason === "invalid_grant" ? 403 : 409, {
+      code: error.reason === "invalid_grant" ? "forbidden" : "conflict",
+      message: error.message,
+      retryable: false,
+      outcomeUnknown: false,
+      details: { code: error.code },
+    });
+  }
+  if (error instanceof CodemodeOperationNotExecutableError) {
     return new HTTPException(409, { message: error.message, cause: error });
   }
   if (error instanceof CodemodeOperationConflictError) {
     return new HTTPException(409, { message: error.message, cause: error });
   }
-  if (error instanceof CodemodeCallBudgetExceededError) {
-    return new HTTPException(429, { message: error.message, cause: error });
-  }
   if (error instanceof CodemodeToolNotInCatalogError) {
     return new HTTPException(404, { message: error.message, cause: error });
   }
@@ -981,6 +1051,9 @@ export function httpStatusForError(error: unknown): number {
   if (codexCompactionV2ProviderLockedError(error)) {
     return 422;
   }
+  if (workspaceControlBusyHttpError(error)) {
+    return 503;
+  }
   if (error instanceof HTTPException) {
     return error.status;
   }
@@ -1171,6 +1244,10 @@ const routeLabelPatterns: Array<{
     label: "/v1/billing/entitlements",
   },
   { pattern: /^\/v1\/webhooks\/stripe$/, label: "/v1/webhooks/stripe" },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/pr-review\/(registrations|repositories)(?:\/[^/]+)?$/,
+    label: (match) => `/v1/workspaces/:workspaceId/pr-review/${match[1]}`,
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/mcp$/,
     label: "/v1/workspaces/:workspaceId/mcp",
@@ -1372,6 +1449,10 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/workspaces\/[^/]+\/sessions\/[^/]+\/events\/stream$/,
     label: "/v1/workspaces/:workspaceId/sessions/:id/events/stream",
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/sessions\/[^/]+\/(visibility|forks)$/,
+    label: (match) => `/v1/workspaces/:workspaceId/sessions/:id/${match[1]}`,
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/sessions\/[^/]+\/lineage$/,
     label: "/v1/workspaces/:workspaceId/sessions/:id/lineage",
@@ -1380,6 +1461,10 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/workspaces\/[^/]+\/sessions\/[^/]+\/events$/,
     label: "/v1/workspaces/:workspaceId/sessions/:id/events",
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/sessions\/[^/]+\/turns$/,
+    label: "/v1/workspaces/:workspaceId/sessions/:id/turns",
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/sessions\/[^/]+\/queue\/[^/]+\/(move|edit|steer|delete)$/,
     label: "/v1/workspaces/:workspaceId/sessions/:id/queue/:turnId/:action",
@@ -1388,6 +1473,10 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/workspaces\/[^/]+\/sessions\/[^/]+\/queue$/,
     label: "/v1/workspaces/:workspaceId/sessions/:id/queue",
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/sessions\/[^/]+\/composer-draft\/submit$/,
+    label: "/v1/workspaces/:workspaceId/sessions/:id/composer-draft/submit",
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/sessions\/[^/]+\/composer-draft$/,
     label: "/v1/workspaces/:workspaceId/sessions/:id/composer-draft",
@@ -1706,6 +1795,26 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/workspaces\/[^/]+\/connections\/oauth\/start$/,
     label: "/v1/workspaces/:workspaceId/connections/oauth/start",
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/connections\/github$/,
+    label: "/v1/workspaces/:workspaceId/connections/github",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/connections\/github\/oauth\/start$/,
+    label: "/v1/workspaces/:workspaceId/connections/github/oauth/start",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/connections\/[^/]+\/github\/reconnect$/,
+    label: "/v1/workspaces/:workspaceId/connections/:connectionId/github/reconnect",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/connections\/[^/]+\/github\/repositories\/verify$/,
+    label: "/v1/workspaces/:workspaceId/connections/:connectionId/github/repositories/verify",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/connections\/[^/]+\/github\/repositories$/,
+    label: "/v1/workspaces/:workspaceId/connections/:connectionId/github/repositories",
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/integrations\/oauth\/start$/,
     label: "/v1/workspaces/:workspaceId/integrations/oauth/start",
@@ -1730,6 +1839,18 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/workspaces\/[^/]+\/connections\/[^/]+$/,
     label: "/v1/workspaces/:workspaceId/connections/:connectionId",
   },
+  {
+    pattern: /^\/v1\/git\/personal\/[^/]+\/info\/refs$/,
+    label: "/v1/git/personal/:routeId/info/refs",
+  },
+  {
+    pattern: /^\/v1\/git\/personal\/[^/]+\/git-upload-pack$/,
+    label: "/v1/git/personal/:routeId/git-upload-pack",
+  },
+  {
+    pattern: /^\/v1\/git\/personal\/[^/]+\/git-receive-pack$/,
+    label: "/v1/git/personal/:routeId/git-receive-pack",
+  },
   { pattern: /^\/v1\/catalog-assets\/.+$/, label: "/v1/catalog-assets/*" },
   {
     pattern: /^\/v1\/integrations\/oauth\/callback$/,
@@ -1739,6 +1860,10 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/integrations\/provider-oauth\/callback$/,
     label: "/v1/integrations/provider-oauth/callback",
   },
+  {
+    pattern: /^\/v1\/integrations\/github-personal\/oauth\/callback$/,
+    label: "/v1/integrations/github-personal/oauth/callback",
+  },
   {
     pattern: /^\/v1\/integrations\/google-drive\/callback$/,
     label: "/v1/integrations/google-drive/callback",
@@ -1779,6 +1904,14 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/workspaces\/[^/]+\/machines\/[^/]+\/metrics\/series$/,
     label: "/v1/workspaces/:workspaceId/machines/:enrollmentId/metrics/series",
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/machines\/[^/]+\/operation-policy$/,
+    label: "/v1/workspaces/:workspaceId/machines/:enrollmentId/operation-policy",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/machines\/[^/]+\/update$/,
+    label: "/v1/workspaces/:workspaceId/machines/:enrollmentId/update",
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/machines$/,
     label: "/v1/workspaces/:workspaceId/machines",
@@ -1796,6 +1929,10 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/github\/oauth\/callback$/,
     label: "/v1/github/oauth/callback",
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+$/,
+    label: "/v1/workspaces/:workspaceId",
+  },
 ];
 
 export function routeLabel(pathname: string): string {
@@ -1824,6 +1961,7 @@ export function isApiContractProtectedMutation(method: string, pathname: string)
     pathname.startsWith("/v1/auth/") ||
     pathname.startsWith("/v1/webhooks/") ||
     pathname.startsWith("/v1/integrations/oauth/") ||
+    isPersonalGitHubGitBrokerRequest(method, pathname) ||
     pathname === "/v1/integrations/slack/events" ||
     pathname === "/v1/integrations/slack/commands" ||
     pathname === "/v1/integrations/slack/interactions" ||

package/src/auth/managed-auth.ts

@@ -20,10 +20,25 @@ import { decideCanonicalHumanSessionAdmission } from "./canonical-human-session-
 // importers (`app.ts`) keep the same import path.
 export type { ManagedAuth };
 
+export function managedAuthRequiresEmailVerification(
+  settings: Pick<Settings, "environment">,
+): boolean {
+  return settings.environment !== "local";
+}
+
+export function managedAuthUserCreateOverride(
+  settings: Pick<Settings, "environment">,
+  user: { emailVerified: boolean } & Record<string, unknown>,
+): { data: typeof user } | undefined {
+  if (managedAuthRequiresEmailVerification(settings)) return undefined;
+  return { data: { ...user, emailVerified: true } };
+}
+
 export function createManagedAuth(settings: Settings, db: Database): ManagedAuth | null {
   if (settings.productAccessMode !== "managed") {
     return null;
   }
+  const requireEmailVerification = managedAuthRequiresEmailVerification(settings);
   const pool = new Pool({ connectionString: settings.databaseUrl });
   return betterAuth({
     appName: "OpenGeni",
@@ -124,10 +139,13 @@ export function createManagedAuth(settings: Settings, db: Database): ManagedAuth
     },
     emailAndPassword: {
       enabled: true,
-      requireEmailVerification: true,
+      // Local managed mode exists so the complete human/org tenancy flow can
+      // be exercised without first configuring a transactional-email vendor.
+      // Every non-local deployment retains the verified-email boundary.
+      requireEmailVerification,
       revokeSessionsOnPasswordReset: true,
       onExistingUserSignUp: async ({ user }) => {
-        if (!user.emailVerified) {
+        if (requireEmailVerification && !user.emailVerified) {
           const url = await verificationUrl(settings, user.email);
           await sendEmail(settings, {
             to: user.email,
@@ -147,7 +165,7 @@ export function createManagedAuth(settings: Settings, db: Database): ManagedAuth
       },
     },
     emailVerification: {
-      sendOnSignUp: true,
+      sendOnSignUp: requireEmailVerification,
       sendVerificationEmail: async ({ user, url }) => {
         await sendEmail(settings, {
           to: user.email,
@@ -161,6 +179,7 @@ export function createManagedAuth(settings: Settings, db: Database): ManagedAuth
           userId: user.id,
           email: user.email,
           name: user.name,
+          emailVerified: true,
         });
       },
     },
@@ -239,11 +258,14 @@ export function createManagedAuth(settings: Settings, db: Database): ManagedAuth
       },
       user: {
         create: {
+          before: async (user) => managedAuthUserCreateOverride(settings, user),
           after: async (user) => {
+            if (!user.emailVerified) return;
             await ensureManagedAccessForUser(db, {
               userId: user.id,
               email: user.email,
               name: user.name,
+              emailVerified: true,
             });
           },
         },