@opengeni/api-router 2.12.4-canary.3 → 2.13.0-canary.0

package/dist/app.js

@@ -24,7 +24,7 @@ import {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession,
   workspaceActorContextExempt
-} from "./chunk-VQCBJV4P.js";
+} from "./chunk-BJWHVMOL.js";
 export {
   API_MAX_REQUEST_BODY_BYTES,
   allowedCorsOrigin,

package/dist/{chunk-VQCBJV4P.js → chunk-BJWHVMOL.js}

@@ -5766,6 +5766,7 @@ import { requireLimit as requireLimit10 } from "@opengeni/core";
 
 // src/mcp/server.ts
 import {
+  getAttemptToolCatalog as getAttemptToolCatalog2,
   createChannel,
   listChannels,
   getChannel,
@@ -29777,6 +29778,25 @@ function registerCapabilityDiscoveryTools(server, deps, grant, sessionId, json)
   const authorize = async () => {
     await authorizeFirstPartySession(deps, grant, sessionId, "session.first_party_mcp.call");
   };
+  const setupProjections = async (items) => {
+    const availableServerIds = /* @__PURE__ */ new Set();
+    if (items.some((item) => item.enabled && item.connectionRef?.subjectScope === "subject")) {
+      const claims = exactAgentCommandContext(grant, sessionId);
+      const attemptCatalog = await getAttemptToolCatalog2(deps.db, {
+        accountId: grant.accountId,
+        workspaceId: grant.workspaceId,
+        attemptId: claims.callerAttemptId
+      });
+      if (attemptCatalog?.sessionId === sessionId && attemptCatalog.turnId === claims.callerTurnId && attemptCatalog.executionGeneration === claims.callerExecutionGeneration) {
+        for (const entry2 of attemptCatalog.entries) availableServerIds.add(entry2.identity.serverId);
+      }
+    }
+    return await Promise.all(
+      items.map(
+        (item) => capabilitySetupProjection(deps, grant.workspaceId, item, availableServerIds)
+      )
+    );
+  };
   server.registerTool(
     "capability_catalog_search",
     {
@@ -29794,25 +29814,24 @@ function registerCapabilityDiscoveryTools(server, deps, grant, sessionId, json)
         query,
         limit ?? 8
       );
-      const matches = await Promise.all(
-        ranked.map(async ({ item, matchedOn }) => ({
-          capabilityId: item.id,
-          name: item.name,
-          description: item.description,
-          kind: item.kind,
-          source: item.source,
-          category: item.category,
-          tags: item.tags.slice(0, 16),
-          providerDomain: item.providerDomain,
-          authKind: item.authKind,
-          tier: item.tier,
-          matchedOn,
-          setup: {
-            ...await capabilitySetupProjection(deps, grant.workspaceId, item),
-            requiredVariables: capabilityRequiredVariables(item)
-          }
-        }))
-      );
+      const setups = await setupProjections(ranked.map(({ item }) => item));
+      const matches = ranked.map(({ item, matchedOn }, index) => ({
+        capabilityId: item.id,
+        name: item.name,
+        description: item.description,
+        kind: item.kind,
+        source: item.source,
+        category: item.category,
+        tags: item.tags.slice(0, 16),
+        providerDomain: item.providerDomain,
+        authKind: item.authKind,
+        tier: item.tier,
+        matchedOn,
+        setup: {
+          ...setups[index],
+          requiredVariables: capabilityRequiredVariables(item)
+        }
+      }));
       return json({ query, matches });
     }
   );
@@ -29834,7 +29853,8 @@ function registerCapabilityDiscoveryTools(server, deps, grant, sessionId, json)
       if (!item || !capabilityCatalogItemIsTrustedForExposure(item)) {
         throw new Error("Unknown or untrusted capability; search the catalog again.");
       }
-      const setup = await capabilitySetupProjection(deps, grant.workspaceId, item);
+      const [setup] = await setupProjections([item]);
+      if (!setup) throw new Error("Capability setup projection is unavailable.");
       if (setup.status === "ready") {
         return json({
           capabilityId: item.id,
@@ -29890,7 +29910,7 @@ function registerCapabilityDiscoveryTools(server, deps, grant, sessionId, json)
     }
   );
 }
-async function capabilitySetupProjection(deps, workspaceId, item) {
+async function capabilitySetupProjection(deps, workspaceId, item, availableServerIds) {
   if (item.id === "api:github-app" || item.surfaceType === "first_party_github") {
     const missing = githubAppMissingSettings(deps.settings);
     if (missing.length > 0) {
@@ -29925,6 +29945,20 @@ async function capabilitySetupProjection(deps, workspaceId, item) {
       detail: "A workspace admin must designate an authorized Codex Apps subscription."
     };
   }
+  if (item.enabled && item.connectionRef?.subjectScope === "subject") {
+    if (item.runtime.mcpServerId && availableServerIds.has(item.runtime.mcpServerId)) {
+      return {
+        status: "ready",
+        action: null,
+        detail: "This capability has tools available in this turn."
+      };
+    }
+    return {
+      status: "authorization_required",
+      action: "connect",
+      detail: "This capability is enabled, but its personal account is not available in this turn. The account owner must review access using Use in this conversation, then send a new message. Shared conversations require acknowledgement that results are visible to workspace members."
+    };
+  }
   if (item.enabled) {
     return {
       status: "ready",
@@ -86024,6 +86058,7 @@ import {
   requireAccessGrant as requireAccessGrant33,
   requireAccessGrantAuthorization as requireAccessGrantAuthorization23,
   requireFreshAccessGrant as requireFreshAccessGrant2,
+  rotateSessionMcpCredentialsForRequest,
   hasVerifiedOwningUserAuthorization,
   requirePermission as requirePermission8,
   requireSessionAuthorization as requireSessionAuthorization11,
@@ -88601,6 +88636,26 @@ function registerSessionRoutes(app, deps) {
       await listSessionTurns(db, workspaceId, sessionId, boundedLimit(c.req.query("limit")))
     );
   });
+  app.post("/v1/workspaces/:workspaceId/sessions/:sessionId/mcp-credentials/rotate", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const authorization = await requireAccessGrantAuthorization23(
+      c,
+      deps,
+      workspaceId,
+      "sessions:control"
+    );
+    const payload = await c.req.json().catch(() => null);
+    c.header("cache-control", "private, no-store");
+    return c.json(
+      await rotateSessionMcpCredentialsForRequest(
+        deps,
+        authorization,
+        c.req.param("sessionId"),
+        payload,
+        (tx) => requireFreshAccessGrant2(c, { ...deps, db: tx }, workspaceId, "sessions:control")
+      )
+    );
+  });
   app.get("/v1/workspaces/:workspaceId/sessions/:sessionId/queue", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     await requireAccessGrant33(c, deps, workspaceId, "sessions:read");
@@ -89942,6 +89997,8 @@ function sessionAuthorizationOperationForHttp(method, pathname, sessionId) {
   if (suffix === "/channel" && verb === "PUT") return "session.channel.write";
   if (suffix === "/variable-sets" && verb === "PUT") return "session.variable_sets.write";
   if (suffix === "/tool-policy" && verb === "PUT") return "session.tool_policy.write";
+  if (suffix === "/mcp-credentials/rotate" && verb === "POST")
+    return "session.mcp.credentials.rotate";
   if (/^\/mcp-servers\/[^/]+\/approval-policy$/.test(suffix) && verb === "PATCH") {
     return "session.mcp.approval_policy.write";
   }
@@ -105819,4 +105876,4 @@ export {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession4 as workflowIdForSession
 };
-//# sourceMappingURL=chunk-VQCBJV4P.js.map
+//# sourceMappingURL=chunk-BJWHVMOL.js.map