@opengeni/api-router 2.10.0-canary.0 → 2.10.0-canary.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/api-router",
-  "version": "2.10.0-canary.0",
+  "version": "2.10.0-canary.2",
   "description": "OpenGeni HTTP surface: the Hono adapter/router (createApp), routes, MCP HTTP transport, and HTTP access adapters over @opengeni/core. An engine-distribution surface — its runtime closure includes engine-internal packages.",
   "license": "Apache-2.0",
   "repository": {
@@ -43,24 +43,24 @@
     "@hono/zod-validator": "^0.7.6",
     "@llamaindex/liteparse": "2.14.2",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/agent-proto": "^0.5.1-canary.9",
-    "@opengeni/artifact-tool": "^0.3.19-canary.0",
-    "@opengeni/capabilities": "^0.3.2-canary.0",
-    "@opengeni/codemode": "^0.4.27-canary.0",
-    "@opengeni/codex": "^0.2.21-canary.0",
-    "@opengeni/config": "^1.0.0-canary.0",
-    "@opengeni/contracts": "^2.13.0-canary.0",
-    "@opengeni/core": "^2.7.5-canary.0",
-    "@opengeni/db": "^4.0.0-canary.0",
-    "@opengeni/documents": "^0.8.19-canary.0",
-    "@opengeni/events": "^0.4.17-canary.0",
-    "@opengeni/github": "^0.7.3-canary.0",
-    "@opengeni/network": "^0.3.0-canary.0",
-    "@opengeni/observability": "^0.8.19-canary.0",
-    "@opengeni/runtime": "^2.3.0-canary.0",
-    "@opengeni/storage": "^0.2.120-canary.0",
-    "@opengeni/tool-gateway": "^0.1.0-canary.0",
-    "@opengeni/xai-subscription": "^0.1.3-canary.0",
+    "@opengeni/agent-proto": "^0.5.1-canary.11",
+    "@opengeni/artifact-tool": "^0.3.19-canary.2",
+    "@opengeni/capabilities": "^0.3.2-canary.2",
+    "@opengeni/codemode": "^0.4.27-canary.2",
+    "@opengeni/codex": "^0.2.21-canary.2",
+    "@opengeni/config": "^1.0.0-canary.2",
+    "@opengeni/contracts": "^2.13.0-canary.2",
+    "@opengeni/core": "^2.7.5-canary.2",
+    "@opengeni/db": "^4.0.0-canary.2",
+    "@opengeni/documents": "^0.8.19-canary.2",
+    "@opengeni/events": "^0.4.17-canary.2",
+    "@opengeni/github": "^0.7.3-canary.2",
+    "@opengeni/network": "^0.3.0-canary.2",
+    "@opengeni/observability": "^0.8.19-canary.2",
+    "@opengeni/runtime": "^2.3.0-canary.2",
+    "@opengeni/storage": "^0.2.120-canary.2",
+    "@opengeni/tool-gateway": "^0.1.0-canary.2",
+    "@opengeni/xai-subscription": "^0.1.3-canary.2",
     "@temporalio/client": "^1.17.0",
     "better-auth": "^1.6.14",
     "hono": "^4.12.18",

package/src/app.ts

@@ -1,3 +1,4 @@
+import { codemodeSessionRequest } from "./codemode";
 import {
   canonicalizeConfiguredModelId,
   configuredAllowedModels,
@@ -895,6 +896,7 @@ export function createAppComposition(deps: AppDependencies): {
             : {}),
         },
         productAccessMode: deps.settings.productAccessMode,
+        billingMode: deps.settings.billingMode,
         managedAuthSessionSetMode: deps.settings.managedAuthSessionSetMode,
         auth: clientAuthConfig(deps.settings),
         analytics: clientAnalyticsConfig(deps.settings),
@@ -1127,6 +1129,20 @@ export function createAppComposition(deps: AppDependencies): {
     }
   });
 
+  app.all("/v1/workspaces/:workspaceId/codemode/sdk/*", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, routeDeps, workspaceId);
+    const url = new URL(c.req.url);
+    const prefix = `/v1/workspaces/${workspaceId}/codemode/sdk`;
+    const forwarded = await codemodeSessionRequest(
+      routeDeps,
+      grant,
+      c.req.raw,
+      url.pathname.slice(prefix.length) + url.search,
+    );
+    return app.fetch(forwarded);
+  });
+
   app.get("/v1/workspaces/:workspaceId/codemode/catalog", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, routeDeps, workspaceId);
@@ -2147,6 +2163,10 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/workspaces\/[^/]+\/github\/app$/,
     label: "/v1/workspaces/:workspaceId/github/app",
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/github\/action-policies$/,
+    label: "/v1/workspaces/:workspaceId/github/action-policies",
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/github\/repositories$/,
     label: "/v1/workspaces/:workspaceId/github/repositories",

package/src/codemode.ts

@@ -20,6 +20,58 @@ import {
   getCodemodeOperation,
   submitCodemodeOperation,
 } from "@opengeni/db";
+import { getSession } from "@opengeni/db";
+import { resolveFirstPartyDelegationSecret } from "@opengeni/config";
+import {
+  DEFAULT_FIRST_PARTY_MCP_PERMISSIONS,
+  signDelegatedAccessToken,
+  siteSessionPath,
+  OPENGENI_API_CONTRACT_HEADER,
+  OPENGENI_API_CONTRACT_REVISION,
+} from "@opengeni/contracts";
+
+/** Reuse normal REST handlers, including their resource/command authorization.
+ * The exact attempt is checked before issuing this internal-only credential. */
+export async function codemodeSessionRequest(
+  deps: ApiRouteDeps,
+  grant: AccessGrant,
+  request: Request,
+  path: string,
+): Promise<Request> {
+  siteSessionPath(path, grant.workspaceId, request.method);
+  const { authority } = await requireActiveCodemodeCatalog(deps, grant);
+  const session = await getSession(deps.db, authority.workspaceId, authority.sessionId);
+  const secret = resolveFirstPartyDelegationSecret(deps.settings);
+  if (!session || !secret) throw new CodemodeAuthorityError("invalid_grant");
+  const permissions = (
+    session.firstPartyMcpPermissions ?? [...DEFAULT_FIRST_PARTY_MCP_PERMISSIONS]
+  ).filter((p) =>
+    ["workspace:read", "sessions:read", "sessions:create", "sessions:control"].includes(p),
+  );
+  const token = await signDelegatedAccessToken(secret, {
+    ...authority,
+    permissions,
+    principalKind: "agent_attempt",
+    exp: Math.floor(Date.now() / 1000) + 60,
+  });
+  const target = new URL(request.url);
+  const rewritten = siteSessionPath(path, authority.workspaceId, request.method);
+  const url = new URL(rewritten, target.origin);
+  const headers = new Headers({
+    authorization: `Bearer ${token}`,
+    [OPENGENI_API_CONTRACT_HEADER]: OPENGENI_API_CONTRACT_REVISION,
+  });
+  for (const name of ["content-type", "accept", "last-event-id"]) {
+    const value = request.headers.get(name);
+    if (value) headers.set(name, value);
+  }
+  return new Request(url, {
+    method: request.method,
+    headers,
+    signal: request.signal,
+    ...(request.body ? { body: await request.text() } : {}),
+  });
+}
 
 export type CodemodeGrantAuthority = {
   accountId: string;

package/src/integrations/oauth-client.ts

@@ -15,6 +15,7 @@ import {
   createConnection,
   decryptEnvironmentValue,
   encryptEnvironmentValue,
+  findActiveWorkspaceApiKeyById,
   getConnectionMetadata,
   getGlobalCatalogOAuthProfile,
   getWorkspaceGrant,
@@ -191,6 +192,13 @@ class OAuthStartStageError extends Error {
   }
 }
 
+class OAuthMetadataUpstreamError extends Error {
+  constructor(readonly upstreamStatus: number) {
+    super(`OAuth metadata endpoint returned HTTP ${upstreamStatus}`);
+    this.name = "OAuthMetadataUpstreamError";
+  }
+}
+
 class OAuthStartDeadline {
   readonly signal: AbortSignal;
   private readonly controller = new AbortController();
@@ -811,7 +819,7 @@ async function requireOAuthCallbackGrant(db: Database, state: OAuthStatePayload)
       ? membershipGrant
       : state.personalOwnerVerified
         ? await resolveNamedManagedPersonalWorkspaceGrant(db, state)
-        : null;
+        : await apiKeyCallbackGrant(db, state);
   if (
     !grant ||
     grant.accountId !== state.accountId ||
@@ -823,6 +831,25 @@ async function requireOAuthCallbackGrant(db: Database, state: OAuthStatePayload)
   }
 }
 
+async function apiKeyCallbackGrant(
+  db: Database,
+  state: OAuthStatePayload,
+): Promise<{ accountId: string; permissions: Parameters<typeof hasPermission>[0] } | null> {
+  const prefix = "api_key:";
+  if (!state.subjectId.startsWith(prefix)) {
+    return null;
+  }
+  const apiKey = await findActiveWorkspaceApiKeyById(db, {
+    accountId: state.accountId,
+    workspaceId: state.workspaceId,
+    apiKeyId: state.subjectId.slice(prefix.length),
+  });
+  if (!apiKey) {
+    return null;
+  }
+  return { accountId: apiKey.accountId, permissions: apiKey.permissions };
+}
+
 /** The hosted-Slack profile's origin pins, kept exported for its tests. */
 export function assertSlackAuthorizationServer(as: AuthorizationServerMetadata): void {
   const pins = builtInOAuthProfileByKey("hosted-slack-mcp").authorizationServer;
@@ -928,7 +955,7 @@ async function fetchOAuthMetadata(
   }
   if (!response.ok) {
     await cancelResponseBody(response);
-    throw new Error(`OAuth metadata endpoint returned HTTP ${response.status}`);
+    throw new OAuthMetadataUpstreamError(response.status);
   }
   const payload = await readResponseJsonBounded<unknown>(
     response,
@@ -1711,6 +1738,9 @@ function logOAuthStartFailure(
 function oauthStartFailureReason(error: unknown): string {
   if (error instanceof RequestDeadlineError) return "timeout";
   if (error instanceof DestinationPolicyError) return error.reason;
+  if (error instanceof OAuthMetadataUpstreamError) {
+    return `upstream_http_${error.upstreamStatus}`;
+  }
   if (error instanceof HTTPException) return `http_${error.status}`;
   if (error instanceof SyntaxError) return "invalid_response";
   return "request_failed";
@@ -1754,15 +1784,29 @@ function isDatabaseStatementTimeout(error: unknown): boolean {
 
 function oauthStartApiError(error: OAuthStartStageError): ApiHttpError {
   const timeout = error.reason === "timeout";
-  const status = timeout ? 408 : error.cause instanceof HTTPException ? error.cause.status : 422;
+  const metadataUpstream = error.cause instanceof OAuthMetadataUpstreamError ? error.cause : null;
+  const status = timeout
+    ? 408
+    : metadataUpstream
+      ? 502
+      : error.cause instanceof HTTPException
+        ? error.cause.status
+        : 422;
   return new ApiHttpError(status, {
     code: timeout || status >= 500 ? "upstream_unavailable" : "validation_failed",
-    retryable: timeout || status === 429 || status >= 500,
+    retryable:
+      timeout ||
+      status === 429 ||
+      (metadataUpstream
+        ? metadataUpstream.upstreamStatus === 429 || metadataUpstream.upstreamStatus >= 500
+        : status >= 500),
     message: timeout
       ? oauthStartTimeoutMessage(error.stage)
-      : error.cause instanceof HTTPException
-        ? error.cause.message
-        : `Connection setup failed during ${oauthStartStageLabel(error.stage)}.`,
+      : metadataUpstream
+        ? `OAuth provider returned HTTP ${metadataUpstream.upstreamStatus} during ${oauthStartStageLabel(error.stage)}.`
+        : error.cause instanceof HTTPException
+          ? error.cause.message
+          : `Connection setup failed during ${oauthStartStageLabel(error.stage)}.`,
     details: {
       oauthStage: error.stage,
       oauthReason: error.reason,

package/src/mcp/command-read.ts

@@ -0,0 +1,109 @@
+import type { SessionEvent } from "@opengeni/contracts";
+import { COMMAND_OUTPUT_MAX_BYTES } from "@opengeni/db/session-background-commands";
+
+export const COMMAND_READ_MAX_WAIT_SECONDS = 50;
+export const COMMAND_WAIT_DEFAULT_SECONDS = 45;
+
+/** Shared provider-neutral command_read/command_wait operation. Notifications
+ * are only wake hints. Every result, including timeout, comes from durable DB
+ * state. Subscribe before reading to close the finish/subscription race, and
+ * periodically recheck durable state because live hints may be lost. */
+export async function readCommandWithWait<
+  T extends { terminal: boolean; chunks: unknown[]; hasMore?: boolean },
+>(input: {
+  commandId: string;
+  waitSeconds?: number;
+  maxOutputBytes?: number | undefined;
+  signal?: AbortSignal;
+  read: () => Promise<T>;
+  subscribe: (onEvents: (events: SessionEvent[]) => void) => Promise<() => void>;
+}) {
+  const seconds = input.waitSeconds ?? 0;
+  if (!Number.isInteger(seconds) || seconds < 0 || seconds > COMMAND_READ_MAX_WAIT_SECONDS) {
+    throw new Error("waitSeconds must be between 0 and 50");
+  }
+  if (
+    input.maxOutputBytes !== undefined &&
+    (!Number.isInteger(input.maxOutputBytes) ||
+      input.maxOutputBytes < 4 ||
+      input.maxOutputBytes > COMMAND_OUTPUT_MAX_BYTES)
+  ) {
+    throw new Error("maxOutputBytes must be between 4 and 65536");
+  }
+  const started = Date.now();
+  const deadline = started + seconds * 1000;
+  let unsubscribe: (() => void) | undefined;
+  let wake: (() => void) | undefined;
+  let changed = false;
+  let liveFanout = true;
+  const notify = () => {
+    changed = true;
+    wake?.();
+  };
+  input.signal?.addEventListener("abort", notify);
+  try {
+    if (seconds > 0) {
+      try {
+        unsubscribe = await input.subscribe((events) => {
+          if (
+            events.some(
+              (event) =>
+                (event.type === "session.command.finished" ||
+                  event.type === "sandbox.command.output.delta") &&
+                event.payload !== null &&
+                typeof event.payload === "object" &&
+                (event.payload as Record<string, unknown>).commandId === input.commandId,
+            )
+          )
+            notify();
+        });
+      } catch {
+        liveFanout = false;
+      }
+    }
+    while (true) {
+      changed = false;
+      const result = await input.read();
+      const expired = Date.now() >= deadline;
+      if (
+        result.terminal ||
+        result.chunks.length > 0 ||
+        result.hasMore ||
+        expired ||
+        input.signal?.aborted
+      ) {
+        return {
+          ...result,
+          waitedMs: Date.now() - started,
+          timedOut:
+            seconds > 0 &&
+            expired &&
+            !result.terminal &&
+            result.chunks.length === 0 &&
+            !result.hasMore,
+          aborted: input.signal?.aborted ?? false,
+          liveFanout,
+        };
+      }
+      if (changed) continue;
+      await new Promise<void>((resolve) => {
+        const timer = setTimeout(
+          () => {
+            wake = undefined;
+            resolve();
+          },
+          Math.max(0, Math.min(1_000, deadline - Date.now())),
+        );
+        wake = () => {
+          clearTimeout(timer);
+          wake = undefined;
+          resolve();
+        };
+        if (changed || input.signal?.aborted) wake();
+      });
+    }
+  } finally {
+    input.signal?.removeEventListener("abort", notify);
+    unsubscribe?.();
+  }
+}