@opengeni/api-router 2.12.4-canary.3 → 2.13.0-canary.0

package/dist/index.js

@@ -7,7 +7,7 @@ import {
   createOpenGeniSlackBotInteractionClient,
   startSlackInteractionPump,
   startTemporalScheduleCleanupPump
-} from "./chunk-VQCBJV4P.js";
+} from "./chunk-BJWHVMOL.js";
 
 // src/index.ts
 import {

package/dist/integrations/marketplace-plugin.d.ts

@@ -663,11 +663,11 @@ export declare function marketplacePlugin(url: string): {
         installation: string;
         upstream: {
             source: {
-                ref?: never;
                 path?: never;
                 source: string;
                 url: string;
                 sha: string;
+                ref?: never;
             };
             policy: null;
         };
@@ -707,11 +707,11 @@ export declare function marketplacePlugin(url: string): {
         installation: string;
         upstream: {
             source: {
-                ref?: never;
                 path?: never;
                 source: string;
                 url: string;
                 sha: string;
+                ref?: never;
             };
             policy: null;
         };
@@ -795,11 +795,11 @@ export declare function marketplacePlugin(url: string): {
         installation: string;
         upstream: {
             source: {
-                ref?: never;
                 path?: never;
                 source: string;
                 url: string;
                 sha: string;
+                ref?: never;
             };
             policy: null;
         };
@@ -922,11 +922,11 @@ export declare function marketplacePlugin(url: string): {
         installation: string;
         upstream: {
             source: {
-                ref?: never;
                 path?: never;
                 source: string;
                 url: string;
                 sha: string;
+                ref?: never;
             };
             policy: null;
         };
@@ -966,11 +966,11 @@ export declare function marketplacePlugin(url: string): {
         installation: string;
         upstream: {
             source: {
-                ref?: never;
                 path?: never;
                 source: string;
                 url: string;
                 sha: string;
+                ref?: never;
             };
             policy: null;
         };
@@ -1185,11 +1185,11 @@ export declare function marketplacePlugin(url: string): {
         installation: string;
         upstream: {
             source: {
-                ref?: never;
                 path?: never;
                 source: string;
                 url: string;
                 sha: string;
+                ref?: never;
             };
             policy: null;
         };
@@ -1225,11 +1225,11 @@ export declare function marketplacePlugin(url: string): {
         installation: string;
         upstream: {
             source: {
-                ref?: never;
                 path?: never;
                 source: string;
                 url: string;
                 sha: string;
+                ref?: never;
             };
             policy: null;
         };
@@ -1360,11 +1360,11 @@ export declare function marketplacePlugin(url: string): {
         installation: string;
         upstream: {
             source: {
-                ref?: never;
                 path?: never;
                 source: string;
                 url: string;
                 sha: string;
+                ref?: never;
             };
             policy: null;
         };
@@ -1409,11 +1409,11 @@ export declare function marketplacePlugin(url: string): {
         installation: string;
         upstream: {
             source: {
-                ref?: never;
                 path?: never;
                 source: string;
                 url: string;
                 sha: string;
+                ref?: never;
             };
             policy: null;
         };
@@ -1453,11 +1453,11 @@ export declare function marketplacePlugin(url: string): {
         installation: string;
         upstream: {
             source: {
-                ref?: never;
                 path?: never;
                 source: string;
                 url: string;
                 sha: string;
+                ref?: never;
             };
             policy: null;
         };
@@ -1523,11 +1523,11 @@ export declare function marketplacePlugin(url: string): {
         installation: string;
         upstream: {
             source: {
-                ref?: never;
                 path?: never;
                 source: string;
                 url: string;
                 sha: string;
+                ref?: never;
             };
             policy: null;
         };
@@ -1596,11 +1596,11 @@ export declare function marketplacePlugin(url: string): {
         installation: string;
         upstream: {
             source: {
-                ref?: never;
                 path?: never;
                 source: string;
                 url: string;
                 sha: string;
+                ref?: never;
             };
             policy: null;
         };
@@ -1640,11 +1640,11 @@ export declare function marketplacePlugin(url: string): {
         installation: string;
         upstream: {
             source: {
-                ref?: never;
                 path?: never;
                 source: string;
                 url: string;
                 sha: string;
+                ref?: never;
             };
             policy: null;
         };
@@ -1679,11 +1679,11 @@ export declare function marketplacePlugin(url: string): {
         installation: string;
         upstream: {
             source: {
-                ref?: never;
                 path?: never;
                 source: string;
                 url: string;
                 sha: string;
+                ref?: never;
             };
             policy: null;
         };
@@ -1723,11 +1723,11 @@ export declare function marketplacePlugin(url: string): {
         installation: string;
         upstream: {
             source: {
-                ref?: never;
                 path?: never;
                 source: string;
                 url: string;
                 sha: string;
+                ref?: never;
             };
             policy: null;
         };
@@ -1835,11 +1835,11 @@ export declare function marketplacePlugin(url: string): {
         installation: string;
         upstream: {
             source: {
-                ref?: never;
                 path?: never;
                 source: string;
                 url: string;
                 sha: string;
+                ref?: never;
             };
             policy: null;
         };
@@ -2006,11 +2006,11 @@ export declare function marketplacePlugin(url: string): {
         installation: string;
         upstream: {
             source: {
-                ref?: never;
                 path?: never;
                 source: string;
                 url: string;
                 sha: string;
+                ref?: never;
             };
             policy: null;
         };
@@ -2050,11 +2050,11 @@ export declare function marketplacePlugin(url: string): {
         installation: string;
         upstream: {
             source: {
-                ref?: never;
                 path?: never;
                 source: string;
                 url: string;
                 sha: string;
+                ref?: never;
             };
             policy: null;
         };
@@ -2090,11 +2090,11 @@ export declare function marketplacePlugin(url: string): {
         installation: string;
         upstream: {
             source: {
-                ref?: never;
                 path?: never;
                 source: string;
                 url: string;
                 sha: string;
+                ref?: never;
             };
             policy: null;
         };
@@ -2178,11 +2178,11 @@ export declare function marketplacePlugin(url: string): {
         installation: string;
         upstream: {
             source: {
-                ref?: never;
                 path?: never;
                 source: string;
                 url: string;
                 sha: string;
+                ref?: never;
             };
             policy: null;
         };
@@ -2261,11 +2261,11 @@ export declare function marketplacePlugin(url: string): {
         installation: string;
         upstream: {
             source: {
-                ref?: never;
                 path?: never;
                 source: string;
                 url: string;
                 sha: string;
+                ref?: never;
             };
             policy: null;
         };
@@ -2307,11 +2307,11 @@ export declare function marketplacePlugin(url: string): {
         installation: string;
         upstream: {
             source: {
-                ref?: never;
                 path?: never;
                 source: string;
                 url: string;
                 sha: string;
+                ref?: never;
             };
             policy: null;
         };
@@ -2351,11 +2351,11 @@ export declare function marketplacePlugin(url: string): {
         installation: string;
         upstream: {
             source: {
-                ref?: never;
                 source: string;
                 url: string;
                 path: string;
                 sha: string;
+                ref?: never;
             };
             policy: null;
         };
@@ -2390,11 +2390,11 @@ export declare function marketplacePlugin(url: string): {
         installation: string;
         upstream: {
             source: {
-                ref?: never;
                 path?: never;
                 source: string;
                 url: string;
                 sha: string;
+                ref?: never;
             };
             policy: null;
         };
@@ -2429,11 +2429,11 @@ export declare function marketplacePlugin(url: string): {
         installation: string;
         upstream: {
             source: {
-                ref?: never;
                 path?: never;
                 source: string;
                 url: string;
                 sha: string;
+                ref?: never;
             };
             policy: null;
         };
@@ -2556,11 +2556,11 @@ export declare function marketplacePlugin(url: string): {
         installation: string;
         upstream: {
             source: {
-                ref?: never;
                 path?: never;
                 source: string;
                 url: string;
                 sha: string;
+                ref?: never;
             };
             policy: null;
         };

package/dist/mcp/scheduled-task-view.d.ts

@@ -82,8 +82,8 @@ export declare function scheduledTaskMcpSummary(task: ScheduledTask): {
     runMode: "existing_session" | "new_session_per_run" | "reusable_session";
     overlapPolicy: "allow_concurrent" | "buffer_one" | "skip";
     action: {
-        readonly sourceId?: never;
         kind: "agent_turn";
+        sourceId?: never;
         sourceGeneration?: never;
         sourceLifecycleGeneration?: never;
         destination?: never;
@@ -205,8 +205,8 @@ export declare function boundScheduledTaskDetailMcp(task: ScheduledTask): {
     runMode: "existing_session" | "new_session_per_run" | "reusable_session";
     overlapPolicy: "allow_concurrent" | "buffer_one" | "skip";
     action: {
-        readonly sourceId?: never;
         kind: "agent_turn";
+        sourceId?: never;
         sourceGeneration?: never;
         sourceLifecycleGeneration?: never;
         destination?: never;
@@ -389,8 +389,8 @@ export declare function boundScheduledTaskMcpPage(input: {
         runMode: "existing_session" | "new_session_per_run" | "reusable_session";
         overlapPolicy: "allow_concurrent" | "buffer_one" | "skip";
         action: {
-            readonly sourceId?: never;
             kind: "agent_turn";
+            sourceId?: never;
             sourceGeneration?: never;
             sourceLifecycleGeneration?: never;
             destination?: never;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/api-router",
-  "version": "2.12.4-canary.3",
+  "version": "2.13.0-canary.0",
   "description": "OpenGeni HTTP surface: the Hono adapter/router (createApp), routes, MCP HTTP transport, and HTTP access adapters over @opengeni/core. An engine-distribution surface — its runtime closure includes engine-internal packages.",
   "license": "Apache-2.0",
   "repository": {
@@ -43,24 +43,24 @@
     "@hono/zod-validator": "^0.7.6",
     "@llamaindex/liteparse": "2.14.2",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/agent-proto": "^0.5.1-canary.29",
-    "@opengeni/artifact-tool": "^0.3.26-canary.3",
-    "@opengeni/capabilities": "^0.3.3-canary.11",
-    "@opengeni/codemode": "^0.5.6-canary.3",
-    "@opengeni/codex": "^0.2.22-canary.11",
-    "@opengeni/config": "^1.1.2-canary.3",
-    "@opengeni/contracts": "^3.0.2-canary.3",
-    "@opengeni/core": "^2.9.4-canary.3",
-    "@opengeni/db": "^4.3.3-canary.3",
-    "@opengeni/documents": "^0.8.27-canary.3",
-    "@opengeni/events": "^0.4.25-canary.3",
-    "@opengeni/github": "^0.7.10-canary.3",
-    "@opengeni/network": "^0.3.1-canary.11",
-    "@opengeni/observability": "^0.8.26-canary.3",
-    "@opengeni/runtime": "^2.5.3-canary.3",
-    "@opengeni/storage": "^0.2.127-canary.3",
-    "@opengeni/tool-gateway": "^0.1.7-canary.3",
-    "@opengeni/xai-subscription": "^0.1.4-canary.11",
+    "@opengeni/agent-proto": "^0.6.0-canary.0",
+    "@opengeni/artifact-tool": "^0.3.27-canary.0",
+    "@opengeni/capabilities": "^0.3.3-canary.12",
+    "@opengeni/codemode": "^0.5.7-canary.0",
+    "@opengeni/codex": "^0.2.22-canary.12",
+    "@opengeni/config": "^1.2.0-canary.0",
+    "@opengeni/contracts": "^3.1.0-canary.0",
+    "@opengeni/core": "^2.10.0-canary.0",
+    "@opengeni/db": "^4.4.0-canary.0",
+    "@opengeni/documents": "^0.8.28-canary.0",
+    "@opengeni/events": "^0.4.26-canary.0",
+    "@opengeni/github": "^0.7.11-canary.0",
+    "@opengeni/network": "^0.3.1-canary.12",
+    "@opengeni/observability": "^0.8.27-canary.0",
+    "@opengeni/runtime": "^2.6.0-canary.0",
+    "@opengeni/storage": "^0.2.128-canary.0",
+    "@opengeni/tool-gateway": "^0.1.8-canary.0",
+    "@opengeni/xai-subscription": "^0.1.4-canary.12",
     "@temporalio/client": "^1.17.0",
     "better-auth": "^1.6.14",
     "hono": "^4.12.18",

package/src/mcp/server.ts

@@ -1,4 +1,5 @@
 import {
+  getAttemptToolCatalog,
   createChannel,
   listChannels,
   getChannel,
@@ -6072,6 +6073,33 @@ function registerCapabilityDiscoveryTools(
     await authorizeFirstPartySession(deps, grant, sessionId, "session.first_party_mcp.call");
   };
 
+  // Installation is workspace metadata; an enabled personal MCP is usable only
+  // when its tools actually made it into this caller's immutable attempt catalog.
+  // This is a readiness projection, never credential resolution or a new grant.
+  const setupProjections = async (items: CapabilityCatalogItem[]) => {
+    const availableServerIds = new Set<string>();
+    if (items.some((item) => item.enabled && item.connectionRef?.subjectScope === "subject")) {
+      const claims = exactAgentCommandContext(grant, sessionId);
+      const attemptCatalog = await getAttemptToolCatalog(deps.db, {
+        accountId: grant.accountId,
+        workspaceId: grant.workspaceId,
+        attemptId: claims.callerAttemptId,
+      });
+      if (
+        attemptCatalog?.sessionId === sessionId &&
+        attemptCatalog.turnId === claims.callerTurnId &&
+        attemptCatalog.executionGeneration === claims.callerExecutionGeneration
+      ) {
+        for (const entry of attemptCatalog.entries) availableServerIds.add(entry.identity.serverId);
+      }
+    }
+    return await Promise.all(
+      items.map((item) =>
+        capabilitySetupProjection(deps, grant.workspaceId, item, availableServerIds),
+      ),
+    );
+  };
+
   server.registerTool(
     "capability_catalog_search",
     {
@@ -6090,25 +6118,24 @@ function registerCapabilityDiscoveryTools(
         query,
         limit ?? 8,
       );
-      const matches = await Promise.all(
-        ranked.map(async ({ item, matchedOn }) => ({
-          capabilityId: item.id,
-          name: item.name,
-          description: item.description,
-          kind: item.kind,
-          source: item.source,
-          category: item.category,
-          tags: item.tags.slice(0, 16),
-          providerDomain: item.providerDomain,
-          authKind: item.authKind,
-          tier: item.tier,
-          matchedOn,
-          setup: {
-            ...(await capabilitySetupProjection(deps, grant.workspaceId, item)),
-            requiredVariables: capabilityRequiredVariables(item),
-          },
-        })),
-      );
+      const setups = await setupProjections(ranked.map(({ item }) => item));
+      const matches = ranked.map(({ item, matchedOn }, index) => ({
+        capabilityId: item.id,
+        name: item.name,
+        description: item.description,
+        kind: item.kind,
+        source: item.source,
+        category: item.category,
+        tags: item.tags.slice(0, 16),
+        providerDomain: item.providerDomain,
+        authKind: item.authKind,
+        tier: item.tier,
+        matchedOn,
+        setup: {
+          ...setups[index]!,
+          requiredVariables: capabilityRequiredVariables(item),
+        },
+      }));
       return json({ query, matches });
     },
   );
@@ -6132,7 +6159,8 @@ function registerCapabilityDiscoveryTools(
       if (!item || !capabilityCatalogItemIsTrustedForExposure(item)) {
         throw new Error("Unknown or untrusted capability; search the catalog again.");
       }
-      const setup = await capabilitySetupProjection(deps, grant.workspaceId, item);
+      const [setup] = await setupProjections([item]);
+      if (!setup) throw new Error("Capability setup projection is unavailable.");
       if (setup.status === "ready") {
         return json({
           capabilityId: item.id,
@@ -6194,6 +6222,7 @@ async function capabilitySetupProjection(
   deps: ApiRouteDeps,
   workspaceId: string,
   item: CapabilityCatalogItem,
+  availableServerIds: ReadonlySet<string>,
 ): Promise<CapabilitySetupProjection> {
   if (item.id === "api:github-app" || item.surfaceType === "first_party_github") {
     const missing = githubAppMissingSettings(deps.settings);
@@ -6234,6 +6263,21 @@ async function capabilitySetupProjection(
           detail: "A workspace admin must designate an authorized Codex Apps subscription.",
         };
   }
+  if (item.enabled && item.connectionRef?.subjectScope === "subject") {
+    if (item.runtime.mcpServerId && availableServerIds.has(item.runtime.mcpServerId)) {
+      return {
+        status: "ready",
+        action: null,
+        detail: "This capability has tools available in this turn.",
+      };
+    }
+    return {
+      status: "authorization_required",
+      action: "connect",
+      detail:
+        "This capability is enabled, but its personal account is not available in this turn. The account owner must review access using Use in this conversation, then send a new message. Shared conversations require acknowledgement that results are visible to workspace members.",
+    };
+  }
   if (item.enabled) {
     return {
       status: "ready",

package/src/routes/sessions.ts

@@ -242,6 +242,7 @@ import {
   requireAccessGrant,
   requireAccessGrantAuthorization,
   requireFreshAccessGrant,
+  rotateSessionMcpCredentialsForRequest,
   hasVerifiedOwningUserAuthorization,
   requirePermission,
   requireSessionAuthorization,
@@ -2872,6 +2873,27 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
     );
   });
 
+  app.post("/v1/workspaces/:workspaceId/sessions/:sessionId/mcp-credentials/rotate", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const authorization = await requireAccessGrantAuthorization(
+      c,
+      deps,
+      workspaceId,
+      "sessions:control",
+    );
+    const payload = await c.req.json().catch(() => null);
+    c.header("cache-control", "private, no-store");
+    return c.json(
+      await rotateSessionMcpCredentialsForRequest(
+        deps,
+        authorization,
+        c.req.param("sessionId"),
+        payload,
+        (tx) => requireFreshAccessGrant(c, { ...deps, db: tx }, workspaceId, "sessions:control"),
+      ),
+    );
+  });
+
   app.get("/v1/workspaces/:workspaceId/sessions/:sessionId/queue", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     await requireAccessGrant(c, deps, workspaceId, "sessions:read");
@@ -4519,6 +4541,8 @@ export function sessionAuthorizationOperationForHttp(
   if (suffix === "/channel" && verb === "PUT") return "session.channel.write";
   if (suffix === "/variable-sets" && verb === "PUT") return "session.variable_sets.write";
   if (suffix === "/tool-policy" && verb === "PUT") return "session.tool_policy.write";
+  if (suffix === "/mcp-credentials/rotate" && verb === "POST")
+    return "session.mcp.credentials.rotate";
   if (/^\/mcp-servers\/[^/]+\/approval-policy$/.test(suffix) && verb === "PATCH") {
     return "session.mcp.approval_policy.write";
   }