@opengeni/api-router 2.12.4-canary.3 → 2.13.0-canary.1

package/dist/app.js

@@ -24,7 +24,7 @@ import {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession,
   workspaceActorContextExempt
-} from "./chunk-VQCBJV4P.js";
+} from "./chunk-V4IDX7VJ.js";
 export {
   API_MAX_REQUEST_BODY_BYTES,
   allowedCorsOrigin,

package/dist/{chunk-VQCBJV4P.js → chunk-V4IDX7VJ.js}

@@ -156,6 +156,7 @@ function feedbackHttpError(error) {
 }
 
 // src/codemode.ts
+import { siteRequestHeaders } from "@opengeni/contracts/site-session-http";
 import {
   codemodeDispatchSubject,
   decodeCodemodeDispatchAck,
@@ -476,14 +477,9 @@ async function codemodeSessionRequest(deps, grant, request, path) {
   const target = new URL(request.url);
   const rewritten = siteSessionPath(path, authority.workspaceId, request.method);
   const url = new URL(rewritten, target.origin);
-  const headers = new Headers({
-    authorization: `Bearer ${token}`,
-    [OPENGENI_API_CONTRACT_HEADER]: OPENGENI_API_CONTRACT_REVISION
-  });
-  for (const name of ["content-type", "accept", "last-event-id"]) {
-    const value = request.headers.get(name);
-    if (value) headers.set(name, value);
-  }
+  const headers = siteRequestHeaders(request.headers);
+  headers.set("authorization", `Bearer ${token}`);
+  headers.set(OPENGENI_API_CONTRACT_HEADER, OPENGENI_API_CONTRACT_REVISION);
   return new Request(url, {
     method: request.method,
     headers,
@@ -5766,6 +5762,7 @@ import { requireLimit as requireLimit10 } from "@opengeni/core";
 
 // src/mcp/server.ts
 import {
+  getAttemptToolCatalog as getAttemptToolCatalog2,
   createChannel,
   listChannels,
   getChannel,
@@ -6142,8 +6139,8 @@ import {
   upsertSessionGoalWithEvent,
   RigChangeTransitionError,
   createWorkspaceArtifact,
-  getWorkspaceArtifact as getWorkspaceArtifact3,
-  getWorkspaceArtifactContentRef,
+  getWorkspaceArtifact as getWorkspaceArtifact2,
+  getWorkspaceArtifactContentRef as getWorkspaceArtifactContentRef2,
   listWorkspaceArtifacts,
   publishWorkspaceArtifactVersion,
   rollbackWorkspaceArtifact,
@@ -7979,7 +7976,7 @@ import {
   requireWorkspace,
   withCodexAppsRequestAuthorization,
   consumeToolGatewayApproval,
-  getWorkspaceArtifact,
+  getWorkspaceArtifactContentRef,
   issueToolGatewayApproval,
   ToolGatewayApprovalOperationStartedError,
   ToolGatewayApprovalRateLimitError,
@@ -9015,14 +9012,18 @@ function throwWorkspaceToolGatewayHttpError(error) {
   }
   throw error;
 }
-async function requireWorkspaceSiteToolAuthorization(db, grant, context) {
+async function requireWorkspaceSiteToolAuthorization(db, grant, context, resolveVersion = getWorkspaceArtifactContentRef) {
   try {
-    const detail = await getWorkspaceArtifact(db, grant.workspaceId, context.siteArtifactId);
-    const currentVersion = detail.artifact.currentVersion;
-    const requested = currentVersion?.requestedTools.some(
+    const { status, version: version2 } = await resolveVersion(
+      db,
+      grant.workspaceId,
+      context.siteArtifactId,
+      context.siteVersionId
+    );
+    const requested = version2.requestedTools.some(
       (identity) => identity.serverId === context.identity.serverId && identity.toolName === context.identity.toolName
     );
-    if (detail.artifact.status !== "active" || currentVersion?.id !== context.siteVersionId || !requested) {
+    if (status !== "active" || version2.id !== context.siteVersionId || !requested) {
       throw new HTTPException8(403, { message: "site_tool_not_authorized" });
     }
   } catch (error) {
@@ -9815,7 +9816,7 @@ function registerFileRoutes(app, deps) {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant5(c, deps, workspaceId, "files:read");
     const artifactId2 = retainedArtifactId(c.req.param("artifactId"));
-    const artifact = await getWorkspaceArtifact2(db, {
+    const artifact = await getWorkspaceArtifact(db, {
       accountId: grant.accountId,
       workspaceId,
       subjectId: await fileAuthoritySubjectIdForGrant(deps, grant),
@@ -9830,7 +9831,7 @@ function registerFileRoutes(app, deps) {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant5(c, deps, workspaceId, "files:read");
     const artifactId2 = retainedArtifactId(c.req.param("artifactId"));
-    const artifact = await getWorkspaceArtifact2(db, {
+    const artifact = await getWorkspaceArtifact(db, {
       accountId: grant.accountId,
       workspaceId,
       subjectId: await fileAuthoritySubjectIdForGrant(deps, grant),
@@ -10115,7 +10116,7 @@ function retainedArtifactMetadata(artifact) {
   }
   return retainedArtifactUnavailable(file.id, "unsupported");
 }
-async function getWorkspaceArtifact2(db, input) {
+async function getWorkspaceArtifact(db, input) {
   const generated = await getGeneratedImageArtifact(db, input.workspaceId, input.artifactId);
   if (generated) {
     return { file: generated.file, metadata: retainedGeneratedImageMetadata(generated) };
@@ -27186,8 +27187,8 @@ function registerWorkspaceArtifactTools(server, deps, grant, sessionId, json) {
       await authorize();
       if (!deps.objectStorage) throw new Error("Object storage is not configured");
       const [rawDetail, ref] = await Promise.all([
-        getWorkspaceArtifact3(deps.db, grant.workspaceId, artifactId2),
-        getWorkspaceArtifactContentRef(deps.db, grant.workspaceId, artifactId2, versionId)
+        getWorkspaceArtifact2(deps.db, grant.workspaceId, artifactId2),
+        getWorkspaceArtifactContentRef2(deps.db, grant.workspaceId, artifactId2, versionId)
       ]);
       const sourceAuthorizations = /* @__PURE__ */ new Map();
       const canReadSourceSession = (sourceSessionId) => {
@@ -29777,6 +29778,25 @@ function registerCapabilityDiscoveryTools(server, deps, grant, sessionId, json)
   const authorize = async () => {
     await authorizeFirstPartySession(deps, grant, sessionId, "session.first_party_mcp.call");
   };
+  const setupProjections = async (items) => {
+    const availableServerIds = /* @__PURE__ */ new Set();
+    if (items.some((item) => item.enabled && item.connectionRef?.subjectScope === "subject")) {
+      const claims = exactAgentCommandContext(grant, sessionId);
+      const attemptCatalog = await getAttemptToolCatalog2(deps.db, {
+        accountId: grant.accountId,
+        workspaceId: grant.workspaceId,
+        attemptId: claims.callerAttemptId
+      });
+      if (attemptCatalog?.sessionId === sessionId && attemptCatalog.turnId === claims.callerTurnId && attemptCatalog.executionGeneration === claims.callerExecutionGeneration) {
+        for (const entry2 of attemptCatalog.entries) availableServerIds.add(entry2.identity.serverId);
+      }
+    }
+    return await Promise.all(
+      items.map(
+        (item) => capabilitySetupProjection(deps, grant.workspaceId, item, availableServerIds)
+      )
+    );
+  };
   server.registerTool(
     "capability_catalog_search",
     {
@@ -29794,25 +29814,24 @@ function registerCapabilityDiscoveryTools(server, deps, grant, sessionId, json)
         query,
         limit ?? 8
       );
-      const matches = await Promise.all(
-        ranked.map(async ({ item, matchedOn }) => ({
-          capabilityId: item.id,
-          name: item.name,
-          description: item.description,
-          kind: item.kind,
-          source: item.source,
-          category: item.category,
-          tags: item.tags.slice(0, 16),
-          providerDomain: item.providerDomain,
-          authKind: item.authKind,
-          tier: item.tier,
-          matchedOn,
-          setup: {
-            ...await capabilitySetupProjection(deps, grant.workspaceId, item),
-            requiredVariables: capabilityRequiredVariables(item)
-          }
-        }))
-      );
+      const setups = await setupProjections(ranked.map(({ item }) => item));
+      const matches = ranked.map(({ item, matchedOn }, index) => ({
+        capabilityId: item.id,
+        name: item.name,
+        description: item.description,
+        kind: item.kind,
+        source: item.source,
+        category: item.category,
+        tags: item.tags.slice(0, 16),
+        providerDomain: item.providerDomain,
+        authKind: item.authKind,
+        tier: item.tier,
+        matchedOn,
+        setup: {
+          ...setups[index],
+          requiredVariables: capabilityRequiredVariables(item)
+        }
+      }));
       return json({ query, matches });
     }
   );
@@ -29834,7 +29853,8 @@ function registerCapabilityDiscoveryTools(server, deps, grant, sessionId, json)
       if (!item || !capabilityCatalogItemIsTrustedForExposure(item)) {
         throw new Error("Unknown or untrusted capability; search the catalog again.");
       }
-      const setup = await capabilitySetupProjection(deps, grant.workspaceId, item);
+      const [setup] = await setupProjections([item]);
+      if (!setup) throw new Error("Capability setup projection is unavailable.");
       if (setup.status === "ready") {
         return json({
           capabilityId: item.id,
@@ -29890,7 +29910,7 @@ function registerCapabilityDiscoveryTools(server, deps, grant, sessionId, json)
     }
   );
 }
-async function capabilitySetupProjection(deps, workspaceId, item) {
+async function capabilitySetupProjection(deps, workspaceId, item, availableServerIds) {
   if (item.id === "api:github-app" || item.surfaceType === "first_party_github") {
     const missing = githubAppMissingSettings(deps.settings);
     if (missing.length > 0) {
@@ -29925,6 +29945,20 @@ async function capabilitySetupProjection(deps, workspaceId, item) {
       detail: "A workspace admin must designate an authorized Codex Apps subscription."
     };
   }
+  if (item.enabled && item.connectionRef?.subjectScope === "subject") {
+    if (item.runtime.mcpServerId && availableServerIds.has(item.runtime.mcpServerId)) {
+      return {
+        status: "ready",
+        action: null,
+        detail: "This capability has tools available in this turn."
+      };
+    }
+    return {
+      status: "authorization_required",
+      action: "connect",
+      detail: "This capability is enabled, but its personal account is not available in this turn. The account owner must review access using Use in this conversation, then send a new message. Shared conversations require acknowledgement that results are visible to workspace members."
+    };
+  }
   if (item.enabled) {
     return {
       status: "ready",
@@ -86024,6 +86058,7 @@ import {
   requireAccessGrant as requireAccessGrant33,
   requireAccessGrantAuthorization as requireAccessGrantAuthorization23,
   requireFreshAccessGrant as requireFreshAccessGrant2,
+  rotateSessionMcpCredentialsForRequest,
   hasVerifiedOwningUserAuthorization,
   requirePermission as requirePermission8,
   requireSessionAuthorization as requireSessionAuthorization11,
@@ -88601,6 +88636,26 @@ function registerSessionRoutes(app, deps) {
       await listSessionTurns(db, workspaceId, sessionId, boundedLimit(c.req.query("limit")))
     );
   });
+  app.post("/v1/workspaces/:workspaceId/sessions/:sessionId/mcp-credentials/rotate", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const authorization = await requireAccessGrantAuthorization23(
+      c,
+      deps,
+      workspaceId,
+      "sessions:control"
+    );
+    const payload = await c.req.json().catch(() => null);
+    c.header("cache-control", "private, no-store");
+    return c.json(
+      await rotateSessionMcpCredentialsForRequest(
+        deps,
+        authorization,
+        c.req.param("sessionId"),
+        payload,
+        (tx) => requireFreshAccessGrant2(c, { ...deps, db: tx }, workspaceId, "sessions:control")
+      )
+    );
+  });
   app.get("/v1/workspaces/:workspaceId/sessions/:sessionId/queue", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     await requireAccessGrant33(c, deps, workspaceId, "sessions:read");
@@ -89942,6 +89997,8 @@ function sessionAuthorizationOperationForHttp(method, pathname, sessionId) {
   if (suffix === "/channel" && verb === "PUT") return "session.channel.write";
   if (suffix === "/variable-sets" && verb === "PUT") return "session.variable_sets.write";
   if (suffix === "/tool-policy" && verb === "PUT") return "session.tool_policy.write";
+  if (suffix === "/mcp-credentials/rotate" && verb === "POST")
+    return "session.mcp.credentials.rotate";
   if (/^\/mcp-servers\/[^/]+\/approval-policy$/.test(suffix) && verb === "PATCH") {
     return "session.mcp.approval_policy.write";
   }
@@ -94051,8 +94108,8 @@ import {
 } from "@opengeni/core";
 import {
   createWorkspaceArtifact as createWorkspaceArtifact2,
-  getWorkspaceArtifact as getWorkspaceArtifact4,
-  getWorkspaceArtifactContentRef as getWorkspaceArtifactContentRef2,
+  getWorkspaceArtifact as getWorkspaceArtifact3,
+  getWorkspaceArtifactContentRef as getWorkspaceArtifactContentRef3,
   listWorkspaceArtifacts as listWorkspaceArtifacts2,
   nestedPostgresSqlState as nestedPostgresSqlState6,
   publishWorkspaceArtifactVersion as publishWorkspaceArtifactVersion2,
@@ -94174,7 +94231,7 @@ function registerWorkspaceArtifactRoutes(app, deps) {
       throw new HTTPException81(503, {
         message: "Object storage is not configured"
       });
-    const ref = await getWorkspaceArtifactContentRef2(
+    const ref = await getWorkspaceArtifactContentRef3(
       deps.db,
       workspaceId,
       artifactId(context),
@@ -94258,7 +94315,7 @@ function registerWorkspaceArtifactRoutes(app, deps) {
     const workspaceId = context.req.param("workspaceId");
     const grant = await requireAccessGrant42(context, deps, workspaceId, "artifacts:read");
     try {
-      const detail = await getWorkspaceArtifact4(deps.db, workspaceId, artifactId(context));
+      const detail = await getWorkspaceArtifact3(deps.db, workspaceId, artifactId(context));
       return context.json(
         WorkspaceArtifactDetailResponse.parse(
           await projectWorkspaceArtifactDetailProvenance(
@@ -94278,7 +94335,7 @@ function registerWorkspaceArtifactRoutes(app, deps) {
       throw new HTTPException81(503, {
         message: "Object storage is not configured"
       });
-    const ref = await getWorkspaceArtifactContentRef2(
+    const ref = await getWorkspaceArtifactContentRef3(
       deps.db,
       workspaceId,
       artifactId(context),
@@ -94318,7 +94375,7 @@ function registerWorkspaceArtifactRoutes(app, deps) {
       });
     const parsedVersion = parseVersionId(context.req.query("versionId"));
     try {
-      const ref = await getWorkspaceArtifactContentRef2(
+      const ref = await getWorkspaceArtifactContentRef3(
         deps.db,
         workspaceId,
         artifactId(context),
@@ -105819,4 +105876,4 @@ export {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession4 as workflowIdForSession
 };
-//# sourceMappingURL=chunk-VQCBJV4P.js.map
+//# sourceMappingURL=chunk-V4IDX7VJ.js.map