@opengeni/api-router 2.12.3 → 2.12.4-canary.1

package/dist/integrations/oauth-client.d.ts

@@ -60,6 +60,11 @@ export declare function requireIntegrationsStateSecret(settings: Settings): stri
 export declare function assertSlackAuthorizationServer(as: AuthorizationServerMetadata): void;
 /** The official-Gmail profile's origin pins, kept exported for its tests. */
 export declare function assertGoogleAuthorizationServer(as: AuthorizationServerMetadata): void;
+/** Inspect without credentials, registration, or running tools. */
+export declare function inspectMcpAuthentication(resource: string, settings: Settings): Promise<{
+    kind: "oauth2" | "none" | "unknown";
+    message?: string;
+}>;
 export declare function preferredOAuthSelfRegistration(as: Pick<AuthorizationServerMetadata, "clientIdMetadataDocumentSupported" | "registrationEndpoint">, clientSource: OAuthProviderProfile["clientSource"]): "cimd" | "dcr" | null;
 export declare function buildAuthorizationUrl(input: {
     endpoint: string;

package/dist/mcp/scheduled-task-view.d.ts

@@ -82,8 +82,8 @@ export declare function scheduledTaskMcpSummary(task: ScheduledTask): {
     runMode: "existing_session" | "new_session_per_run" | "reusable_session";
     overlapPolicy: "allow_concurrent" | "buffer_one" | "skip";
     action: {
+        readonly sourceId?: never;
         kind: "agent_turn";
-        sourceId?: never;
         sourceGeneration?: never;
         sourceLifecycleGeneration?: never;
         destination?: never;
@@ -205,8 +205,8 @@ export declare function boundScheduledTaskDetailMcp(task: ScheduledTask): {
     runMode: "existing_session" | "new_session_per_run" | "reusable_session";
     overlapPolicy: "allow_concurrent" | "buffer_one" | "skip";
     action: {
+        readonly sourceId?: never;
         kind: "agent_turn";
-        sourceId?: never;
         sourceGeneration?: never;
         sourceLifecycleGeneration?: never;
         destination?: never;
@@ -389,8 +389,8 @@ export declare function boundScheduledTaskMcpPage(input: {
         runMode: "existing_session" | "new_session_per_run" | "reusable_session";
         overlapPolicy: "allow_concurrent" | "buffer_one" | "skip";
         action: {
+            readonly sourceId?: never;
             kind: "agent_turn";
-            sourceId?: never;
             sourceGeneration?: never;
             sourceLifecycleGeneration?: never;
             destination?: never;

package/dist/sandbox/metrics-ingestion.d.ts

@@ -86,6 +86,7 @@ export declare function helloReportsDisplay(hello: Hello): boolean;
 export declare function helloDesktopUnavailableReason(hello: Hello): string | null;
 /** Whether the runner's current Hello advertises the op-stream engine. */
 export declare function helloReportsOpStream(hello: Hello): boolean;
+export declare function helloRuntimeCapabilities(hello: Hello): Record<string, boolean>;
 /**
  * Reconcile `enrollments.has_display` (+ the capture-blocked reason) to what a Hello
  * reports. Resolves the enrollment (the accountId is the RLS principal + the

package/dist/sandbox/rematerialize.d.ts

@@ -1,7 +1,7 @@
 import type { Settings } from "@opengeni/config";
 import { type Database, type LeaseSnapshot } from "@opengeni/db";
 import { type EstablishedSandboxSession } from "@opengeni/runtime/sandbox";
-import type { ObjectStorage } from "@opengeni/storage";
+import { type ObjectStorage } from "@opengeni/storage";
 /** The sole API-direct cold->warming owner path used by Channel A and viewer
  * attach. It never publishes warm until archive identity, hydrated tree, command
  * routing, provider identity, and the selected rematerialization attempt all

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/api-router",
-  "version": "2.12.3",
+  "version": "2.12.4-canary.1",
   "description": "OpenGeni HTTP surface: the Hono adapter/router (createApp), routes, MCP HTTP transport, and HTTP access adapters over @opengeni/core. An engine-distribution surface — its runtime closure includes engine-internal packages.",
   "license": "Apache-2.0",
   "repository": {
@@ -43,24 +43,24 @@
     "@hono/zod-validator": "^0.7.6",
     "@llamaindex/liteparse": "2.14.2",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/agent-proto": "^0.5.1",
-    "@opengeni/artifact-tool": "^0.3.25",
-    "@opengeni/capabilities": "^0.3.3",
-    "@opengeni/codemode": "^0.5.5",
-    "@opengeni/codex": "^0.2.22",
-    "@opengeni/config": "^1.1.1",
-    "@opengeni/contracts": "^3.0.1",
-    "@opengeni/core": "^2.9.3",
-    "@opengeni/db": "^4.3.2",
-    "@opengeni/documents": "^0.8.26",
-    "@opengeni/events": "^0.4.24",
-    "@opengeni/github": "^0.7.9",
-    "@opengeni/network": "^0.3.1",
-    "@opengeni/observability": "^0.8.25",
-    "@opengeni/runtime": "^2.5.2",
-    "@opengeni/storage": "^0.2.126",
-    "@opengeni/tool-gateway": "^0.1.6",
-    "@opengeni/xai-subscription": "^0.1.4",
+    "@opengeni/agent-proto": "^0.5.1-canary.27",
+    "@opengeni/artifact-tool": "^0.3.26-canary.1",
+    "@opengeni/capabilities": "^0.3.3-canary.9",
+    "@opengeni/codemode": "^0.5.6-canary.1",
+    "@opengeni/codex": "^0.2.22-canary.9",
+    "@opengeni/config": "^1.1.2-canary.1",
+    "@opengeni/contracts": "^3.0.2-canary.1",
+    "@opengeni/core": "^2.9.4-canary.1",
+    "@opengeni/db": "^4.3.3-canary.1",
+    "@opengeni/documents": "^0.8.27-canary.1",
+    "@opengeni/events": "^0.4.25-canary.1",
+    "@opengeni/github": "^0.7.10-canary.1",
+    "@opengeni/network": "^0.3.1-canary.9",
+    "@opengeni/observability": "^0.8.26-canary.1",
+    "@opengeni/runtime": "^2.5.3-canary.1",
+    "@opengeni/storage": "^0.2.127-canary.1",
+    "@opengeni/tool-gateway": "^0.1.7-canary.1",
+    "@opengeni/xai-subscription": "^0.1.4-canary.9",
     "@temporalio/client": "^1.17.0",
     "better-auth": "^1.6.14",
     "hono": "^4.12.18",

package/src/integrations/marketplace-plugin.ts

@@ -0,0 +1,48 @@
+import snapshot from "../../../../data/catalog/plugins-snapshot.json";
+import { PluginManifest, pluginMcpUnavailableReason } from "@opengeni/contracts";
+import { HTTPException } from "hono/http-exception";
+
+/** Adapt only indexed portable components. Never silently drop required components. */
+export function marketplacePlugin(url: string) {
+  const source = snapshot.sources.find((candidate) =>
+    candidate.entries.some((item) => item.sourceUrl === url),
+  );
+  const item = source?.entries.find((candidate) => candidate.sourceUrl === url);
+  if (!item || !source) return null;
+  if (!item.skills || !item.mcpServers)
+    throw new HTTPException(422, {
+      message: "This external plugin must be indexed before it can be installed.",
+    });
+  const servers = item.mcpServers
+    .filter((server) => pluginMcpUnavailableReason(server) === null)
+    .map((server, index) => ({
+      id: "marketplace-" + source.provider + "-" + item.name + "-" + index,
+      name: server.name,
+      url: server.endpoint!,
+      cacheToolsList: true,
+    }));
+  if (!item.skills.length && !servers.length)
+    throw new HTTPException(422, {
+      message: "This plugin has no skills or remote MCP servers that OpenGeni can install.",
+    });
+  const manifest = PluginManifest.parse({
+    schemaVersion: 1,
+    pluginKey: "marketplace/" + source.provider + "/" + item.name,
+    name: item.displayName,
+    description: item.description.slice(0, 4000),
+    version: item.version || source.revision,
+    components: [
+      ...item.skills.map((skill, index) => ({
+        key: "skill-" + index,
+        kind: "skill",
+        url: skill.sourceUrl,
+      })),
+      ...servers.map((server, index) => ({
+        key: "mcp-" + index,
+        kind: "mcp",
+        serverId: server.id,
+      })),
+    ],
+  });
+  return { manifest, servers, discovery: { ...item, provider: source.provider } };
+}

package/src/integrations/oauth-client.ts

@@ -961,10 +961,136 @@ export function assertGoogleAuthorizationServer(as: AuthorizationServerMetadata)
   }
 }
 
+/** Inspect without credentials, registration, or running tools. */
+export async function inspectMcpAuthentication(
+  resource: string,
+  settings: Settings,
+): Promise<{
+  kind: "oauth2" | "none" | "unknown";
+  message?: string;
+}> {
+  const deadline = new OAuthStartDeadline(12_000);
+  try {
+    const response = await deadline.run("mcp_challenge", (signal) =>
+      fetchOAuth(resource, settings, {
+        method: "POST",
+        headers: {
+          accept: "application/json, text/event-stream",
+          "content-type": "application/json",
+        },
+        body: JSON.stringify({
+          jsonrpc: "2.0",
+          id: "auth-discovery",
+          method: "initialize",
+          params: {
+            protocolVersion: "2025-03-26",
+            capabilities: {},
+            clientInfo: { name: "OpenGeni", version: "1.0" },
+          },
+        }),
+        signal,
+      }),
+    );
+    const challenge = parseMcpOAuthChallenge(response.headers.get("www-authenticate"));
+    let initialized = false;
+    if (response.ok) {
+      initialized = await deadline.run("mcp_challenge", async () => {
+        const reader = response.body?.getReader();
+        if (!reader) return false;
+        const decoder = new TextDecoder();
+        let text = "";
+        let bytes = 0;
+        const sse = response.headers.get("content-type")?.includes("text/event-stream");
+        try {
+          while (true) {
+            const chunk = await reader.read();
+            if (chunk.done) return false;
+            bytes += chunk.value.byteLength;
+            if (bytes > 262144) return false;
+            text += decoder.decode(chunk.value, { stream: true });
+            const messages = sse
+              ? text
+                  .split(/\r?\n/)
+                  .filter((line) => line.startsWith("data:"))
+                  .map((line) => line.slice(5).trim())
+              : [text];
+            for (const message of messages) {
+              try {
+                const value = JSON.parse(message);
+                if (
+                  value.id === "auth-discovery" &&
+                  typeof value.result?.protocolVersion === "string" &&
+                  value.result?.serverInfo &&
+                  value.result?.capabilities
+                )
+                  return true;
+              } catch {
+                /* Wait for a complete JSON message. */
+              }
+            }
+          }
+        } finally {
+          await reader.cancel().catch(() => undefined);
+        }
+      });
+    } else {
+      await cancelResponseBody(response);
+    }
+    let metadataRead = false;
+    let metadataAbsent = true;
+    try {
+      await resolveMcpOAuthDiscovery({
+        resourceUrl: resource,
+        challenge,
+        fetchMetadata: async ({ url }) => {
+          try {
+            const result = await deadline.run("protected_resource_metadata", (signal) =>
+              fetchOAuthMetadata(url, settings, signal),
+            );
+            metadataRead = true;
+            if (result.status !== "absent") metadataAbsent = false;
+            return result;
+          } catch (error) {
+            metadataAbsent = false;
+            throw error;
+          }
+        },
+        validateEndpoint: (url, label) => oauthEndpointUrl(url, settings, label),
+        canonicalizeResource: canonicalOAuthResource,
+      });
+      return { kind: "oauth2" };
+    } catch {
+      // Public initialization does not exclude optional or tool-level OAuth.
+      // Only explicit absence of metadata permits the unauthenticated path.
+      if (
+        initialized &&
+        !challenge.scheme &&
+        !challenge.resourceMetadata &&
+        metadataRead &&
+        metadataAbsent
+      )
+        return { kind: "none" };
+      return {
+        kind: "unknown",
+        message:
+          "This server's sign-in requirements could not be determined. Check its setup instructions.",
+      };
+    }
+  } catch {
+    return {
+      kind: "unknown",
+      message: "Could not check this server. Retry or consult its setup instructions.",
+    };
+  } finally {
+    deadline.dispose();
+  }
+}
+
 async function discoverMcpOAuth(
   resource: string,
   settings: Settings,
   deadline: OAuthStartDeadline,
+  knownChallenge?: WwwAuthenticateChallenge,
 ): Promise<{
   challenge: WwwAuthenticateChallenge;
   prm: ProtectedResourceMetadata;
@@ -977,9 +1103,11 @@ async function discoverMcpOAuth(
     metadataSha256: string;
   };
 }> {
-  const challenge = await deadline.run("mcp_challenge", (signal) =>
-    probeMcpChallenge(resource, settings, signal),
-  );
+  const challenge =
+    knownChallenge ??
+    (await deadline.run("mcp_challenge", (signal) =>
+      probeMcpChallenge(resource, settings, signal),
+    ));
   try {
     const discovery = await resolveMcpOAuthDiscovery({
       resourceUrl: resource,

package/src/routes/browser-sessions.ts

@@ -2703,6 +2703,7 @@ export function registerBrowserSessionRoutes(app: Hono, deps: ApiRouteDeps): voi
         operationResourcePolicySupported:
           enrollment.agentCapabilities.operationResourcePolicy === true,
         operationCpuQuotaSupported: enrollment.agentCapabilities.operationCpuQuota === true,
+        transactionalFsWriteSupported: enrollment.agentCapabilities.transactionalFsWrite === true,
         ...(deps.settings.agentOpStreamEnabled === true &&
         enrollment.opStream === true &&
         deps.bus.getOpStreamConnection

package/src/routes/capabilities.ts

@@ -16,9 +16,59 @@ import {
   officialMcpRegistryUrl,
 } from "@opengeni/core";
 import { boundedLimit } from "../http/common";
+import { z } from "zod";
+import pluginSnapshot from "../../../../data/catalog/plugins-snapshot.json";
+const discoverablePlugins = pluginSnapshot.sources
+  .flatMap((source) => source.entries.map((entry) => ({ ...entry, provider: source.provider })))
+  .sort((a, b) => a.displayName.localeCompare(b.displayName) || a.id.localeCompare(b.id));
+import { inspectMcpAuthentication } from "../integrations/oauth-client";
 
 export function registerCapabilityRoutes(app: Hono, deps: ApiRouteDeps): void {
   const { db, settings } = deps;
+  app.get("/v1/workspaces/:workspaceId/capabilities/discovery/plugins", async (c) => {
+    await requireAccessGrant(c, deps, c.req.param("workspaceId"), "workspace:read");
+    const query = (c.req.query("query") ?? "").trim().toLowerCase();
+    const provider = c.req.query("provider");
+    const id = c.req.query("id");
+    const offset = z.coerce
+      .number()
+      .int()
+      .min(0)
+      .max(10000)
+      .parse(c.req.query("offset") ?? 0);
+    const matches = discoverablePlugins.filter(
+      (item) =>
+        (!id || item.id === id) &&
+        (!provider || item.provider === provider) &&
+        query
+          .split(/\s+/)
+          .every((term) =>
+            [
+              item.displayName,
+              item.name,
+              item.description,
+              item.category,
+              item.author?.name,
+              ...item.keywords,
+              ...(item.components ?? []),
+            ]
+              .join(" ")
+              .toLowerCase()
+              .includes(term),
+          ),
+    );
+    const end = offset + 40;
+    return c.json({
+      items: matches.slice(offset, end),
+      total: matches.length,
+      nextOffset: end < matches.length ? end : null,
+    });
+  });
+  app.post("/v1/workspaces/:workspaceId/capabilities/discovery/mcp-auth", async (c) => {
+    await requireAccessGrant(c, deps, c.req.param("workspaceId"), "workspace:read");
+    const { url } = z.object({ url: z.string().url().max(2048) }).parse(await c.req.json());
+    return c.json(await inspectMcpAuthentication(url, settings));
+  });
 
   app.get("/v1/workspaces/:workspaceId/capabilities", async (c) => {
     const workspaceId = c.req.param("workspaceId");

package/src/routes/computer-sessions.ts

@@ -979,6 +979,7 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
         operationResourcePolicySupported:
           enrollment.agentCapabilities.operationResourcePolicy === true,
         operationCpuQuotaSupported: enrollment.agentCapabilities.operationCpuQuota === true,
+        transactionalFsWriteSupported: enrollment.agentCapabilities.transactionalFsWrite === true,
         ...(deps.settings.agentOpStreamEnabled === true &&
         enrollment.opStream === true &&
         deps.bus.getOpStreamConnection

package/src/routes/plugins.ts

@@ -1,3 +1,7 @@
+import pluginSnapshot from "../../../../data/catalog/plugins-snapshot.json";
+import { marketplacePlugin } from "../integrations/marketplace-plugin";
+import { mcpEndpointIdentity } from "@opengeni/contracts";
+import { buildCapabilityCatalog, createCatalogItem } from "@opengeni/core";
 import { createHash } from "node:crypto";
 
 import {
@@ -101,11 +105,80 @@ export function registerPluginRoutes(
     await requireAccessGrant(c, deps, workspaceId, "workspace:read");
     return c.json(
       ListInstalledPluginsResponse.parse({
-        plugins: await listInstalledPluginPackages(deps.db, workspaceId),
+        plugins: (await listInstalledPluginPackages(deps.db, workspaceId)).map((plugin) => {
+          const source = pluginSnapshot.sources.find((candidate) =>
+            plugin.pluginKey.startsWith("marketplace/" + candidate.provider + "/"),
+          );
+          const entry = source?.entries.find(
+            (candidate) =>
+              plugin.pluginKey === "marketplace/" + source!.provider + "/" + candidate.name,
+          );
+          return { ...plugin, logoUrl: plugin.logoUrl ?? entry?.logoUrl ?? null };
+        }),
       }),
     );
   });
 
+  app.get("/v1/workspaces/:workspaceId/plugins/details", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:read");
+    const plugin = await getInstalledPluginPackage(
+      deps.db,
+      workspaceId,
+      c.req.query("pluginKey") ?? "",
+    );
+    if (!plugin || plugin.status === "disabled")
+      throw new HTTPException(404, { message: "Plugin is not installed" });
+    const stored = plugin.manifest as Record<string, any>;
+    if (stored.discovery) return c.json(stored.discovery);
+    const catalog = await buildCapabilityCatalog({
+      db: deps.db,
+      workspaceId,
+      settings: deps.settings,
+      subjectId: grant.subjectId,
+    });
+    const members = Array.isArray(stored.components) ? stored.components : [];
+    return c.json({
+      id: String(stored.pluginKey ?? "installed")
+        .replace("marketplace/", "")
+        .replace("/", ":"),
+      name: stored.name,
+      displayName: stored.name,
+      description: stored.description ?? "",
+      longDescription: stored.description ?? "",
+      provider: "custom",
+      category: stored.category ?? null,
+      logoUrl: null,
+      darkLogoUrl: null,
+      sourceUrl: stored.sourceUrl ?? null,
+      author: null,
+      version: stored.version,
+      skills: members
+        .filter((member) => member.kind === "skill")
+        .map((member) => ({
+          name: decodeURIComponent(member.url.split("/").filter(Boolean).at(-2) ?? member.key),
+          sourceUrl: member.url,
+        })),
+      mcpServers: members
+        .filter((member) => member.kind === "mcp")
+        .map((member) => {
+          const bom = Array.isArray(stored.bom)
+            ? stored.bom.find((entry: any) => entry.key === member.key)
+            : null;
+          const item = catalog.items.find((candidate) => candidate.id === bom?.capabilityId);
+          return {
+            name: item?.name ?? member.serverId,
+            transport: item?.transport ?? "http",
+            endpoint: item?.endpointUrl ?? null,
+          };
+        }),
+      components: [
+        ...new Set(members.map((member) => (member.kind === "skill" ? "skills" : member.kind))),
+      ],
+      installation: "installed",
+    });
+  });
+
   app.post("/v1/workspaces/:workspaceId/plugins/preview", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:read");
@@ -329,15 +402,20 @@ async function resolvePluginPackage(input: {
   >;
 }): Promise<ResolvedPluginPackage> {
   let manifest;
+  const marketplace = marketplacePlugin(input.url);
   try {
-    const bytes = await fetchIntegrationSourceDocument(
-      input.transport,
-      input.url,
-      MAX_PLUGIN_MANIFEST_BYTES,
-    );
-    manifest = PluginManifest.parse(
-      JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes)),
-    );
+    if (marketplace) {
+      manifest = marketplace.manifest;
+    } else {
+      const bytes = await fetchIntegrationSourceDocument(
+        input.transport,
+        input.url,
+        MAX_PLUGIN_MANIFEST_BYTES,
+      );
+      manifest = PluginManifest.parse(
+        JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes)),
+      );
+    }
   } catch (error) {
     if (error instanceof HTTPException) throw error;
     throw new HTTPException(422, {
@@ -346,6 +424,14 @@ async function resolvePluginPackage(input: {
   }
   const manifestDigest = sha256(stableJson(manifest));
   const components: ResolvedPluginComponent[] = [];
+  const catalog = marketplace
+    ? await buildCapabilityCatalog({
+        db: input.deps.db,
+        workspaceId: input.workspaceId,
+        settings: input.deps.settings,
+        subjectId: input.subjectId,
+      })
+    : null;
   for (const component of manifest.components) {
     if (component.kind === "skill") {
       const resolved = await resolveSkillImport(component.url, input.github);
@@ -511,7 +597,62 @@ async function resolvePluginPackage(input: {
       });
       continue;
     }
-    const server = configuredMcpServer(input.deps.settings.mcpServers, component.serverId);
+    const server = configuredMcpServer(
+      [...(marketplace?.servers ?? []), ...input.deps.settings.mcpServers],
+      component.serverId,
+    );
+    if (marketplace) {
+      const endpoint = mcpEndpointIdentity(server.url)!;
+      const matches = (catalog?.items ?? []).filter(
+        (item) => item.kind === "mcp" && mcpEndpointIdentity(item.endpointUrl) === endpoint,
+      );
+      // Prefer the original catalogue connection over legacy plugin-created duplicates.
+      matches.sort(
+        (a, b) =>
+          Number(a.id.startsWith("mcp:configured:marketplace-")) -
+            Number(b.id.startsWith("mcp:configured:marketplace-")) ||
+          Number(b.enabled) - Number(a.enabled) ||
+          a.id.localeCompare(b.id),
+      );
+      const existing = matches[0];
+      const capabilityId = existing?.id ?? "mcp:endpoint:" + sha256(endpoint).slice(0, 24);
+      const digest = sha256(stableJson({ endpoint, capabilityId }));
+      components.push({
+        preview: {
+          key: component.key,
+          kind: "mcp",
+          name: existing?.name ?? server.name ?? server.id,
+          capabilityId,
+          digest,
+          connectionRequired: !existing?.enabled,
+          connectionId: null,
+          instanceKey: null,
+          displayName: null,
+          facts: { endpointUrl: endpoint, connectionManagedSeparately: true },
+        },
+        install: async () => {
+          if (!existing)
+            await createCatalogItem({
+              db: input.deps.db,
+              accountId: input.accountId,
+              workspaceId: input.workspaceId,
+              payload: {
+                id: capabilityId,
+                kind: "mcp",
+                source: "manual",
+                name: server.name ?? server.id,
+                endpointUrl: endpoint,
+                category: "integrations",
+                tags: ["mcp"],
+                metadata: { authDiscovery: "unknown" },
+              },
+            });
+          // Connections are independently owned: installing/removing a plugin never signs in or disconnects an account.
+          return { facetInstallationIds: [] };
+        },
+      });
+      continue;
+    }
     const digest = sha256(stableJson(safeMcpFacts(server)));
     components.push({
       preview: {
@@ -584,7 +725,13 @@ async function resolvePluginPackage(input: {
       components: components.map((component) => component.preview),
       diff,
     }),
-    storedManifest: { ...manifest, sourceUrl: input.url, manifestDigest, bom },
+    storedManifest: {
+      ...manifest,
+      ...(marketplace ? { discovery: marketplace.discovery } : {}),
+      sourceUrl: input.url,
+      manifestDigest,
+      bom,
+    },
     components,
   };
 }

package/src/routes/skills.ts

@@ -11,6 +11,8 @@ import {
 } from "@opengeni/contracts";
 import {
   portableSkillCapabilityId,
+  createPublicSkillSearchClient,
+  PublicSkillSearchError,
   portableSkillPluginKey,
   requireAccessGrant,
   requireAccessGrantAuthorization,
@@ -48,6 +50,22 @@ export function registerSkillRoutes(
 ): void {
   registerSkillContentRoutes(app, deps);
   const github = overrides.github ?? createGitHubSkillSourceClient(deps.settings);
+  const discovery = createPublicSkillSearchClient(deps.settings);
+  app.get("/v1/workspaces/:workspaceId/skills/search", async (c) => {
+    await requireAccessGrant(c, deps, c.req.param("workspaceId"), "workspace:read");
+    try {
+      return c.json(await discovery.search({ query: c.req.query("q") ?? "", limit: 20 }));
+    } catch (error) {
+      if (!(error instanceof PublicSkillSearchError)) throw error;
+      if (error.retryAfterSeconds) c.header("Retry-After", String(error.retryAfterSeconds));
+      throw new HTTPException(
+        error.code === "invalid_query" ? 422 : error.code === "rate_limited" ? 429 : 503,
+        {
+          message: "Skill search is unavailable. Please try again.",
+        },
+      );
+    }
+  });
 
   app.get("/v1/workspaces/:workspaceId/skills", async (c) => {
     const workspaceId = c.req.param("workspaceId");
@@ -165,8 +183,7 @@ export function registerSkillRoutes(
       resolved.preview.contentSha256 !== payload.expectedContentSha256
     ) {
       throw new HTTPException(409, {
-        message:
-          "The Skill source changed after preview. Review the new commit and contents before installing.",
+        message: "The skill changed after preview. Review its contents again before installing.",
       });
     }
     const fileSummaryByPath = new Map(

package/src/sandbox/channel-a.ts

@@ -727,6 +727,7 @@ async function withChannelAOperation<T>(
         operationResourcePolicySupported:
           enrollment.agentCapabilities.operationResourcePolicy === true,
         operationCpuQuotaSupported: enrollment.agentCapabilities.operationCpuQuota === true,
+        transactionalFsWriteSupported: enrollment.agentCapabilities.transactionalFsWrite === true,
         ...(settings.agentOpStreamEnabled === true &&
         enrollment?.opStream === true &&
         bus.getOpStreamConnection

package/src/sandbox/machines.ts

@@ -112,6 +112,7 @@ function runtimeFor(settings: Settings, enrollment: EnrollmentRecord): MachineVi
       browserBridge: capability("browserBridge"),
       operationResourcePolicy: capability("operationResourcePolicy"),
       operationCpuQuota: capability("operationCpuQuota"),
+      transactionalFsWrite: capability("transactionalFsWrite"),
     },
     update,
   };