@opengeni/api-router 2.2.0-canary.0 → 2.3.2-canary.0

package/src/routes/pr-review.ts

@@ -44,9 +44,11 @@ import {
   PrReviewProviderRepositoryError,
   verifyPrReviewProviderRepository,
 } from "../integrations/pr-review-provider";
+import { registerPrReviewGitHubRoutes } from "./pr-review-github";
 
 export function registerPrReviewRoutes(app: Hono, deps: ApiRouteDeps): void {
   const { db, settings } = deps;
+  registerPrReviewGitHubRoutes(app, deps);
 
   app.get("/v1/workspaces/:workspaceId/pr-review/registrations", async (c) => {
     const workspaceId = c.req.param("workspaceId");
@@ -144,6 +146,24 @@ export function registerPrReviewRoutes(app: Hono, deps: ApiRouteDeps): void {
       throw new HTTPException(404, {
         message: "PR Review app registration not found",
       });
+    if (existing.credentialKind === "managed_github_app") {
+      if (
+        payload.accessToken !== undefined ||
+        payload.privateKey !== undefined ||
+        payload.webhookSecret !== undefined ||
+        payload.webhookUsername !== undefined ||
+        payload.accessTokenExpiresAt !== undefined
+      ) {
+        throw new HTTPException(422, {
+          message: "OpenGeni Lens credentials are managed by the deployment",
+        });
+      }
+      if (payload.status === "active") {
+        throw new HTTPException(409, {
+          message: "Reconnect OpenGeni Lens to reactivate and resync its repositories",
+        });
+      }
+    }
     if (payload.accessToken && existing.credentialKind !== "provider_token") {
       throw new HTTPException(422, {
         message: "GitHub App registrations accept private keys, not access tokens",

package/src/routes/rigs.ts

@@ -12,6 +12,7 @@ import {
 import type { Hono } from "hono";
 import type { Context } from "hono";
 import { HTTPException } from "hono/http-exception";
+import type { ZodType } from "zod";
 import {
   requireAccessGrant,
   requireAccessGrantAuthorization,
@@ -32,6 +33,38 @@ import {
   updateRigForApi,
 } from "@opengeni/core";
 import { boundedLimit } from "../http/common";
+import { ApiHttpError } from "../http/api-error";
+
+async function parseRigRequest<T>(c: Context, schema: ZodType<T>, label: string): Promise<T> {
+  const body: unknown = await c.req.json().catch(() => null);
+  const bodyRecord = body && typeof body === "object" ? (body as Record<string, unknown>) : null;
+  const payloadRecord =
+    bodyRecord?.payload && typeof bodyRecord.payload === "object"
+      ? (bodyRecord.payload as Record<string, unknown>)
+      : null;
+  const imageOverrideUnsupported = Boolean(
+    (bodyRecord && Object.hasOwn(bodyRecord, "image")) ||
+    (payloadRecord && Object.hasOwn(payloadRecord, "image")),
+  );
+  const parsed = schema.safeParse(body);
+  if (parsed.success && !imageOverrideUnsupported) return parsed.data;
+  throw new ApiHttpError(422, {
+    code: "validation_failed",
+    message: imageOverrideUnsupported
+      ? "Rig base-image overrides are not supported; Rigs use the deployment-managed platform sandbox."
+      : `Invalid ${label}.`,
+    retryable: false,
+    details: {
+      ...(imageOverrideUnsupported ? { code: "RIG_IMAGE_OVERRIDE_UNSUPPORTED" } : {}),
+      fields: parsed.success
+        ? []
+        : parsed.error.issues.slice(0, 16).map((issue) => ({
+            path: issue.path,
+            code: issue.code,
+          })),
+    },
+  });
+}
 
 export function registerRigRoutes(app: Hono, deps: ApiRouteDeps): void {
   const { db, workflowClient } = deps;
@@ -150,7 +183,7 @@ export function registerRigRoutes(app: Hono, deps: ApiRouteDeps): void {
     const authorization = await requireAccessGrantAuthorization(c, deps, workspaceId);
     const grant = authorization.grant;
     requirePermission(grant, "rigs:manage");
-    const payload = CreateRigRequest.parse(await c.req.json());
+    const payload = await parseRigRequest(c, CreateRigRequest, "Rig create request");
     const allowOrganization =
       payload.scope === "organization" &&
       authorization.accountGrant?.permissions.includes("account:admin") === true;
@@ -189,7 +222,7 @@ export function registerRigRoutes(app: Hono, deps: ApiRouteDeps): void {
         message: "missing permission: account:admin",
       });
     }
-    const payload = UpdateRigRequest.parse(await c.req.json());
+    const payload = await parseRigRequest(c, UpdateRigRequest, "Rig update request");
     return c.json(await updateRigForApi({ db }, grant, rig, payload, { allowOrganization }));
   });
 
@@ -221,7 +254,7 @@ export function registerRigRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.post("/v1/workspaces/:workspaceId/rigs/:rigId/versions", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const { grant, rig } = await requireRigMutation(c, workspaceId, "rigs:manage");
-    const payload = RigDefinitionEditPayload.parse(await c.req.json());
+    const payload = await parseRigRequest(c, RigDefinitionEditPayload, "Rig version request");
     const version = await createRigVersionForApi({ db }, grant, rig, payload);
     const started = await tryStartInitialVersionVerification(rig.workspaceId, version.id);
     if (!started) c.header("OpenGeni-Rig-Verification", "deferred");
@@ -256,7 +289,7 @@ export function registerRigRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.post("/v1/workspaces/:workspaceId/rigs/:rigId/changes", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const { grant, rig } = await requireRigMutation(c, workspaceId, "rigs:use");
-    const request = ProposeRigChangeRequest.parse(await c.req.json());
+    const request = await parseRigRequest(c, ProposeRigChangeRequest, "Rig change request");
     const change = await proposeRigChangeForApi({ db }, grant, rig, request);
     const verification = await startChangeVerification(rig.workspaceId, change.id);
     if (!verification.started) c.header("OpenGeni-Rig-Verification", "deferred");

package/src/routes/sessions.ts

@@ -61,6 +61,7 @@ import {
   UpdateSessionGoalRequest,
   UpdateSessionMcpApprovalPolicyRequest,
   UpdateSessionRequest,
+  UpdateSessionVariableSetsRequest,
   UpdateSessionVisibilityRequest,
   UpdateSessionToolPolicyRequest,
   ViewerHeartbeatRequest,
@@ -79,6 +80,7 @@ import {
   type TerminalPtyExitedPayload,
   type TerminalPtyOutputDeltaPayload,
   type TerminalPtyStartedPayload,
+  type VariableSet,
 } from "@opengeni/contracts";
 import { streamTokenDegraded } from "@opengeni/config";
 import {
@@ -121,6 +123,7 @@ import {
   setSessionCodexPinInTransaction,
   withSessionCodexCapacityMutation,
   setSessionChannel,
+  updateSessionVariableSets,
   ChannelNotFoundError,
   setSessionAttention,
   setSessionArchive,
@@ -150,6 +153,7 @@ import {
   SessionRealtimeConflictError,
   SessionToolPolicyVersionConflictError,
   SessionContextBusyError,
+  SessionVariableSetSelectionUnavailableError,
   workspaceControlRequestLockTimeoutMs,
   SessionTenancyAccessError,
   SessionTenancyConflictError,
@@ -264,6 +268,7 @@ import {
   workspaceSessionToolPolicyDefaultServerIds,
   workspaceSessionToolPolicyServerIds,
   relayConfigFromSettings,
+  validateVariableSetAttachment,
 } from "@opengeni/core";
 import { assertSessionExists, boundedLimit } from "../http/common";
 import { sseSessionStream } from "../http/sse";
@@ -1769,6 +1774,91 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
     return c.json(await withEffectivePolicy(deps, workspaceId, grant.subjectId, session));
   });
 
+  // Replace the complete ordered Variable Set selection. The DB mutation
+  // serializes with turn claim, rejects live/shared sandbox use, and requests a
+  // cold rotation before the new environment can be materialized.
+  app.put("/v1/workspaces/:workspaceId/sessions/:sessionId/variable-sets", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const sessionId = c.req.param("sessionId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "sessions:control");
+    try {
+      await requireSessionAuthorization(deps, grant, {
+        sessionId,
+        operation: "session.variable_sets.write",
+        surface: "http",
+      });
+    } catch (error) {
+      throw sessionAuthorizationHttpError(error);
+    }
+    // Detach still requires attach authority: it changes which protected
+    // resources the session may materialize. Non-empty selections additionally
+    // require use authority through validateVariableSetAttachment.
+    requirePermission(grant, "variable-sets:attach");
+    const parsed = UpdateSessionVariableSetsRequest.safeParse(await c.req.json().catch(() => null));
+    if (!parsed.success) {
+      throw new ApiHttpError(422, {
+        code: "validation_failed",
+        message: "Invalid session Variable Set request.",
+        retryable: false,
+        details: { fields: zodErrorFields(parsed.error) },
+      });
+    }
+    const variableSets: VariableSet[] = [];
+    for (const variableSetId of parsed.data.variableSetIds) {
+      variableSets.push(
+        await validateVariableSetAttachment({ settings, db }, grant, workspaceId, variableSetId),
+      );
+    }
+    const result = await updateSessionVariableSets(db, {
+      accountId: grant.accountId,
+      workspaceId,
+      sessionId,
+      subjectId: grant.subjectId,
+      variableSets: variableSets.map((variableSet) => ({
+        id: variableSet.id,
+        name: variableSet.name,
+        scope: variableSet.scope,
+      })),
+    });
+    if (result.status === "not_found") {
+      throw new HTTPException(404, { message: "session not found" });
+    }
+    if (result.status === "invalid_variable_sets") {
+      throw new ApiHttpError(422, {
+        code: "validation_failed",
+        message: "One or more selected Variable Sets are no longer available.",
+        retryable: false,
+        outcomeUnknown: false,
+        details: { variableSetIds: result.variableSetIds },
+      });
+    }
+    if (result.status === "blocked") {
+      const messages = {
+        turn_in_flight:
+          "Variable Sets can be changed only when the session has no accepted, queued, claimed, or pending work.",
+        shared_sandbox_group:
+          "Variable Sets cannot be changed while this session shares a sandbox; fork it into a separate session first.",
+        live_sandbox_holders:
+          "Close active terminal, desktop, and sandbox operations before changing Variable Sets.",
+      } as const;
+      throw new HTTPException(409, { message: messages[result.reason] });
+    }
+    if (result.status === "updated") {
+      await publishDurableSessionEvents(bus, workspaceId, sessionId, [result.event]);
+    }
+    const session = await getSessionForSubject(
+      db,
+      workspaceId,
+      sessionId,
+      grant.subjectId,
+      relatedSessionAccessFor(c),
+    );
+    if (!session) {
+      throw new HTTPException(404, { message: "session not found" });
+    }
+    return c.json(await withEffectivePolicy(deps, workspaceId, grant.subjectId, session));
+  });
+
   // Manual rename. A user-set title is permanent: the db write is
   // unconditional (source='user'), so it always pins the session over later
   // agent writes. Returns the refreshed session, mirroring GET detail.
@@ -4125,6 +4215,7 @@ export function sessionAuthorizationOperationForHttp(
   if (suffix === "/visibility" && verb === "PUT") return "session.visibility.write";
   if (suffix === "/forks" && verb === "POST") return "session.fork.create";
   if (suffix === "/channel" && verb === "PUT") return "session.channel.write";
+  if (suffix === "/variable-sets" && verb === "PUT") return "session.variable_sets.write";
   if (suffix === "/tool-policy" && verb === "PUT") return "session.tool_policy.write";
   if (/^\/mcp-servers\/[^/]+\/approval-policy$/.test(suffix) && verb === "PATCH") {
     return "session.mcp.approval_policy.write";
@@ -4584,6 +4675,16 @@ export function sessionCreateErrorResponse(c: Context, error: unknown): Response
     // insert's FK rejection surfaces as the same 422 an unknown id gets.
     return c.json({ code: "SESSION_CREATE_REJECTED", message: error.message }, 422);
   }
+  if (error instanceof SessionVariableSetSelectionUnavailableError) {
+    return c.json(
+      {
+        code: "SESSION_CREATE_REJECTED",
+        message: error.message,
+        details: { variableSetIds: error.variableSetIds },
+      },
+      422,
+    );
+  }
   if (error instanceof SessionSpawnDeniedError) {
     return c.json(
       sessionSpawnDenialEnvelope(error),

package/src/sandbox/channel-a.ts

@@ -32,6 +32,7 @@ import {
   getSandboxSessionEnvelope,
   getLiveEnrollmentConnection,
   getSandbox,
+  getScheduledScopedRigVersionMetadata,
   touchLeaseHolder,
   loadWorkspaceEnvironmentForRun,
   markWarmLeaseInstanceLost,
@@ -539,19 +540,45 @@ async function withChannelAOperation<T>(
 
   // The STABLE run-environment used by both a cloud home and a machine home.
   // It also carries the per-session Codemode pointer selected below.
-  const workspaceEnvironment = await loadWorkspaceEnvironmentForRun(db, settings, {
-    accountId,
-    workspaceId,
-    variableSetId: session.environmentId,
-    authority: { kind: "session_attach", sessionId: session.id, subjectId: ctx.subjectId },
-  });
+  const workspaceEnvironmentValues: Record<string, string> = {};
+  const rigVersion =
+    session.rigId && session.rigVersionId
+      ? await getScheduledScopedRigVersionMetadata(
+          db,
+          {
+            accountId,
+            workspaceId,
+            subjectId: ctx.subjectId ?? "session-attach",
+          },
+          session.rigId,
+          session.rigVersionId,
+        )
+      : null;
+  for (const variableSetId of rigVersion?.version.defaultVariableSetIds ?? []) {
+    const workspaceEnvironment = await loadWorkspaceEnvironmentForRun(db, settings, {
+      accountId,
+      workspaceId,
+      variableSetId,
+      authority: { kind: "session_attach", sessionId: session.id, subjectId: ctx.subjectId },
+    });
+    Object.assign(workspaceEnvironmentValues, workspaceEnvironment?.values ?? {});
+  }
+  for (const variableSetId of session.variableSetIds) {
+    const workspaceEnvironment = await loadWorkspaceEnvironmentForRun(db, settings, {
+      accountId,
+      workspaceId,
+      variableSetId,
+      authority: { kind: "session_attach", sessionId: session.id, subjectId: ctx.subjectId },
+    });
+    Object.assign(workspaceEnvironmentValues, workspaceEnvironment?.values ?? {});
+  }
   const settingsForSession =
     session.sandboxBackend !== settings.sandboxBackend
       ? { ...settings, sandboxBackend: session.sandboxBackend }
       : settings;
   const environment = stableSandboxEnvironmentForRun(
     settingsForSession,
-    workspaceEnvironment?.values ?? {},
+    workspaceEnvironmentValues,
     { workspaceId },
   );
   if (hasGitCredentialRepositorySelection(session.resources)) {

package/src/sandbox/viewer.ts

@@ -35,6 +35,7 @@ import {
   acquireLease,
   getLiveEnrollmentConnection,
   getSandbox,
+  getScheduledScopedRigVersionMetadata,
   getSandboxSessionEnvelope,
   heartbeatLeaseHolder,
   loadWorkspaceEnvironmentForRun,
@@ -149,16 +150,51 @@ export async function sessionAttachEnvironment(
    *  the materialization audit fact. Null records the legacy service sentinel. */
   attachSubjectId: string | null,
 ): Promise<Record<string, string>> {
-  const workspaceEnvironment = await loadWorkspaceEnvironmentForRun(
-    services.db,
-    services.settings,
-    {
-      accountId: session.accountId,
-      workspaceId,
-      variableSetId: session.environmentId,
-      authority: { kind: "session_attach", sessionId: session.id, subjectId: attachSubjectId },
-    },
-  );
+  const workspaceEnvironmentValues: Record<string, string> = {};
+  const rigVersion =
+    session.rigId && session.rigVersionId
+      ? await getScheduledScopedRigVersionMetadata(
+          services.db,
+          {
+            accountId: session.accountId,
+            workspaceId,
+            subjectId: attachSubjectId ?? "session-attach",
+          },
+          session.rigId,
+          session.rigVersionId,
+        )
+      : null;
+  for (const variableSetId of rigVersion?.version.defaultVariableSetIds ?? []) {
+    const workspaceEnvironment = await loadWorkspaceEnvironmentForRun(
+      services.db,
+      services.settings,
+      {
+        accountId: session.accountId,
+        workspaceId,
+        variableSetId,
+        authority: { kind: "session_attach", sessionId: session.id, subjectId: attachSubjectId },
+      },
+    );
+    Object.assign(workspaceEnvironmentValues, workspaceEnvironment?.values ?? {});
+  }
+  // Older persisted/test projections can omit the plural field. Preserve the
+  // legacy final alias as the single explicit selection until every caller is
+  // guaranteed to have crossed the plural contract boundary.
+  const explicitVariableSetIds =
+    session.variableSetIds ?? (session.variableSetId ? [session.variableSetId] : []);
+  for (const variableSetId of explicitVariableSetIds) {
+    const workspaceEnvironment = await loadWorkspaceEnvironmentForRun(
+      services.db,
+      services.settings,
+      {
+        accountId: session.accountId,
+        workspaceId,
+        variableSetId,
+        authority: { kind: "session_attach", sessionId: session.id, subjectId: attachSubjectId },
+      },
+    );
+    Object.assign(workspaceEnvironmentValues, workspaceEnvironment?.values ?? {});
+  }
   // Build the env with the SESSION's backend, not the deployment default: the
   // stable base is backend-aware (HOME = the descriptor workspaceRoot, and the
   // git token-file/askpass pointers derive from HOME), the box is established
@@ -173,7 +209,7 @@ export async function sessionAttachEnvironment(
       : services.settings;
   const environment = stableSandboxEnvironmentForRun(
     settingsForSession,
-    workspaceEnvironment?.values ?? {},
+    workspaceEnvironmentValues,
     { workspaceId },
   );
   if (hasGitCredentialRepositorySelection(session.resources)) {