@opengeni/api-router 2.4.2-canary.0 → 2.6.3-canary.0

package/src/mcp/session-wait.ts

@@ -81,7 +81,51 @@ export const SESSION_WAIT_EVENT_TYPES = [
   "goal.continuation",
 ] as const satisfies readonly SessionEventType[];
 
-const SESSION_WAIT_EVENT_TYPE_SET: ReadonlySet<string> = new Set(SESSION_WAIT_EVENT_TYPES);
+/**
+ * Settlement and blocking events that make a child result usable.
+ * Goal facts are deliberately absent: an agent can complete its durable goal
+ * before it emits the final assistant message and settles the turn. Completed
+ * agent messages are also absent because commentary messages use the same
+ * event type; an ordinary result-bearing `turn.completed` carries the
+ * authoritative final output.
+ */
+export const SESSION_WAIT_COMPLETION_EVENT_TYPES = [
+  "turn.completed",
+  "turn.failed",
+  "turn.cancelled",
+  "turn.superseded",
+  "turn.capacity_waiting",
+  "session.requiresAction",
+  "session.humanInput.requested",
+  "session.control.paused",
+  "tool.auth_needed",
+  "credential.auth_needed",
+  "rig.setup.failed",
+  "goal.paused",
+] as const satisfies readonly SessionEventType[];
+
+const SESSION_WAIT_COMPLETION_EVENT_TYPE_SET: ReadonlySet<string> = new Set(
+  SESSION_WAIT_COMPLETION_EVENT_TYPES,
+);
+
+/**
+ * A completed turn is result-bearing only when it carries the ordinary final
+ * output. Segment-limit and maintenance turns settle one execution segment
+ * while the session still has work to do, so they must not release a parent.
+ */
+export function sessionWaitCompletionEventMatches(event: SessionEvent): boolean {
+  if (!SESSION_WAIT_COMPLETION_EVENT_TYPE_SET.has(event.type)) return false;
+  if (event.type !== "turn.completed") return true;
+  if (event.payload === null || typeof event.payload !== "object" || Array.isArray(event.payload)) {
+    return false;
+  }
+  const payload = event.payload as Record<string, unknown>;
+  return (
+    Object.prototype.hasOwnProperty.call(payload, "output") &&
+    !Object.prototype.hasOwnProperty.call(payload, "segmentLimit") &&
+    !Object.prototype.hasOwnProperty.call(payload, "maintenance")
+  );
+}
 
 /** The self-session event that announces a newly pending machine input. */
 export const SESSION_WAIT_OWN_PENDING_EVENT_TYPE =
@@ -188,6 +232,10 @@ export type SessionWaitInput = {
   targets: readonly SessionWaitTarget[];
   ownSessionId: string | null;
   maxWaitMs: number;
+  /** Target events that end the wait. Defaults to the ordinary activity set. */
+  targetEventTypes?: readonly SessionEventType[] | undefined;
+  /** Optional payload-aware refinement applied after the event-type filter. */
+  targetEventMatches?: ((event: SessionEvent) => boolean) | undefined;
   source: SessionWaitSource;
   signal?: AbortSignal | undefined;
   now?: (() => number) | undefined;
@@ -206,6 +254,11 @@ export async function waitForSessionChanges(input: SessionWaitInput): Promise<Se
   let liveFanout = true;
   let waited = false;
   const ownSessionId = input.source.readOwnPendingUpdateKinds ? input.ownSessionId : null;
+  const targetEventTypeSet: ReadonlySet<string> = new Set(
+    input.targetEventTypes ?? SESSION_WAIT_EVENT_TYPES,
+  );
+  const targetEventMatches = (event: SessionEvent): boolean =>
+    targetEventTypeSet.has(event.type) && (input.targetEventMatches?.(event) ?? true);
 
   // One subscription per distinct session; a session may be both a target and
   // the caller's own session, in which case either condition wakes the wait.
@@ -230,11 +283,7 @@ export async function waitForSessionChanges(input: SessionWaitInput): Promise<Se
     const after = targetAfter.get(sessionId);
     for (const event of events) {
       if (event.sessionId !== sessionId) continue;
-      if (
-        after !== undefined &&
-        event.sequence > after &&
-        SESSION_WAIT_EVENT_TYPE_SET.has(event.type)
-      ) {
+      if (after !== undefined && event.sequence > after && targetEventMatches(event)) {
         return true;
       }
       if (sessionId === ownSessionId && event.type === SESSION_WAIT_OWN_PENDING_EVENT_TYPE) {
@@ -274,8 +323,7 @@ export async function waitForSessionChanges(input: SessionWaitInput): Promise<Se
     const changed: SessionWaitTargetResult[] = [];
     for (const { target, read } of targetReads) {
       const events = read.events.filter(
-        (event) =>
-          event.sequence > target.afterSequence && SESSION_WAIT_EVENT_TYPE_SET.has(event.type),
+        (event) => event.sequence > target.afterSequence && targetEventMatches(event),
       );
       if (events.length === 0) continue;
       changed.push({

package/src/routes/api-integrations.ts

@@ -148,7 +148,7 @@ export function registerApiIntegrationRoutes(
 
   app.post("/v1/workspaces/:workspaceId/integrations/install", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "capabilities:manage");
     const payload = InstallApiIntegrationRequest.parse(await c.req.json());
     const resolved = await resolveForRoute({
       deps,
@@ -261,7 +261,7 @@ export function registerApiIntegrationRoutes(
     "/v1/workspaces/:workspaceId/integrations/:capabilityId/instances/:instanceKey",
     async (c) => {
       const workspaceId = c.req.param("workspaceId");
-      const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+      const grant = await requireAccessGrant(c, deps, workspaceId, "capabilities:manage");
       const capabilityId = decodeURIComponent(c.req.param("capabilityId"));
       const instanceKey = decodeURIComponent(c.req.param("instanceKey"));
       const payload = UninstallApiIntegrationRequest.parse(await c.req.json());

package/src/routes/api-keys.ts

@@ -1,12 +1,41 @@
-import { CreateApiKeyRequest, CreateApiKeyResponse, Permission } from "@opengeni/contracts";
-import { createApiKey, listApiKeys, revokeApiKey } from "@opengeni/db";
+import {
+  CreateApiKeyRequest,
+  CreateApiKeyResponse,
+  CreateOrganizationApiKeyRequest,
+  Permission,
+  type AccessContext,
+} from "@opengeni/contracts";
+import {
+  createApiKey,
+  createOrganizationApiKey as createOrganizationApiKeyRecord,
+  listApiKeys,
+  listOrganizationApiKeys,
+  OrganizationApiKeyLimitExceededError,
+  revokeApiKey,
+  revokeOrganizationApiKey,
+} from "@opengeni/db";
+import { configuredStaticUsageLimits } from "@opengeni/config";
 import { zValidator } from "@hono/zod-validator";
 import type { Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
 import type { ApiRouteDeps } from "@opengeni/core";
-import { requireAccessGrant } from "@opengeni/core";
+import {
+  accountScopedApiKeyWorkspaceAuthority,
+  requireAccessContext,
+  requireAccessGrant,
+  requireAccessGrantAuthorization,
+  type AccessGrantAuthorization,
+} from "@opengeni/core";
 import { requireLimit } from "@opengeni/core";
 
+export const organizationApiKeyPermissions: Permission[] = [
+  "account:read",
+  "workspace:create",
+  "workspace:read",
+  "workspace:admin",
+  "api_keys:manage",
+];
+
 export function registerApiKeyRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.get("/v1/workspaces/:workspaceId/api-keys", async (c) => {
     const workspaceId = c.req.param("workspaceId");
@@ -19,11 +48,17 @@ export function registerApiKeyRoutes(app: Hono, deps: ApiRouteDeps): void {
     zValidator("json", CreateApiKeyRequest.omit({ workspaceId: true })),
     async (c) => {
       const workspaceId = c.req.param("workspaceId");
-      const grant = await requireAccessGrant(c, deps, workspaceId, "api_keys:manage");
+      const authorization = await requireAccessGrantAuthorization(
+        c,
+        deps,
+        workspaceId,
+        "api_keys:manage",
+      );
+      const grant = authorization.grant;
       const body = c.req.valid("json");
       const permissions: Permission[] =
         body.permissions.length > 0 ? (body.permissions as Permission[]) : ["workspace:read"];
-      ensureDelegablePermissions(grant.permissions, permissions);
+      ensureDelegablePermissions(authorization, permissions);
       await requireLimit(deps, {
         accountId: grant.accountId,
         workspaceId,
@@ -51,12 +86,90 @@ export function registerApiKeyRoutes(app: Hono, deps: ApiRouteDeps): void {
     await requireAccessGrant(c, deps, workspaceId, "api_keys:manage");
     return c.json(await revokeApiKey(deps.db, workspaceId, c.req.param("apiKeyId")));
   });
+
+  app.get("/v1/organizations/:organizationId/api-keys", async (c) => {
+    const organizationId = c.req.param("organizationId");
+    const context = await requireAccessContext(c, deps);
+    requireOrganizationApiKeyControlPermission(context, organizationId);
+    return c.json({ apiKeys: await listOrganizationApiKeys(deps.db, organizationId) });
+  });
+
+  app.post(
+    "/v1/organizations/:organizationId/api-keys",
+    zValidator("json", CreateOrganizationApiKeyRequest),
+    async (c) => {
+      const organizationId = c.req.param("organizationId");
+      const context = await requireAccessContext(c, deps);
+      requireOrganizationApiKeyControlPermission(context, organizationId);
+      const body = c.req.valid("json");
+      const token = generateApiKeyToken();
+      try {
+        const apiKey = await createOrganizationApiKeyRecord(deps.db, {
+          accountId: organizationId,
+          name: body.name,
+          description: body.description ?? null,
+          prefix: token.slice(0, 14),
+          keyHash: await sha256Hex(token),
+          permissions: organizationApiKeyPermissions,
+          expiresAt: body.expiresAt ? new Date(body.expiresAt) : null,
+          maxActiveKeys: organizationApiKeyLimit(deps),
+          rotationSourceApiKeyId: authenticatedApiKeyId(context),
+        });
+        return c.json(CreateApiKeyResponse.parse({ apiKey, token }), 201);
+      } catch (error) {
+        if (error instanceof OrganizationApiKeyLimitExceededError) {
+          throw new HTTPException(429, { message: error.message });
+        }
+        throw error;
+      }
+    },
+  );
+
+  app.delete("/v1/organizations/:organizationId/api-keys/:apiKeyId", async (c) => {
+    const organizationId = c.req.param("organizationId");
+    const context = await requireAccessContext(c, deps);
+    requireOrganizationApiKeyControlPermission(context, organizationId);
+    const apiKey = await revokeOrganizationApiKey(deps.db, organizationId, c.req.param("apiKeyId"));
+    if (!apiKey) {
+      throw new HTTPException(404, { message: "API key not found" });
+    }
+    return c.json(apiKey);
+  });
+}
+
+function requireAccountPermission(
+  context: AccessContext,
+  accountId: string,
+  permission: Permission,
+): void {
+  const grant = context.accountGrants.find((candidate) => candidate.accountId === accountId);
+  if (
+    !grant ||
+    (!grant.permissions.includes(permission) && !grant.permissions.includes("account:admin"))
+  ) {
+    throw new HTTPException(403, { message: `missing permission: ${permission}` });
+  }
 }
 
-function ensureDelegablePermissions(grantPermissions: Permission[], requested: Permission[]): void {
+function ensureDelegablePermissions(
+  authorization: AccessGrantAuthorization,
+  requested: Permission[],
+): void {
+  const grantPermissions = authorization.grant.permissions;
   if (grantPermissions.includes("workspace:admin")) {
+    const accountLiteralPermissions = new Set<Permission>([
+      "account:read",
+      "account:admin",
+      "workspace:create",
+      "billing:read",
+      "billing:manage",
+    ]);
+    const workspaceLiteralPermissions = new Set<Permission>(["members:manage", "secrets:read"]);
     const highTrustMissing = requested.filter(
-      (permission) => permission === "secrets:read" && !grantPermissions.includes("secrets:read"),
+      (permission) =>
+        (accountLiteralPermissions.has(permission) &&
+          !authorization.accountGrant?.permissions.includes(permission)) ||
+        (workspaceLiteralPermissions.has(permission) && !grantPermissions.includes(permission)),
     );
     if (highTrustMissing.length === 0) return;
     throw new HTTPException(403, {
@@ -71,6 +184,35 @@ function ensureDelegablePermissions(grantPermissions: Permission[], requested: P
   }
 }
 
+function requireOrganizationApiKeyControlPermission(
+  context: AccessContext,
+  organizationId: string,
+): void {
+  requireAccountPermission(context, organizationId, "api_keys:manage");
+  if (!context.subjectId.startsWith("api_key:")) return;
+  const authority = accountScopedApiKeyWorkspaceAuthority(context);
+  if (
+    !authority ||
+    authority.accountId !== organizationId ||
+    !authority.permissions.includes("api_keys:manage")
+  ) {
+    throw new HTTPException(403, { message: "organization API key authority required" });
+  }
+}
+
+function authenticatedApiKeyId(context: AccessContext): string | null {
+  return context.subjectId.startsWith("api_key:")
+    ? context.subjectId.slice("api_key:".length)
+    : null;
+}
+
+function organizationApiKeyLimit(deps: ApiRouteDeps): number | null {
+  if (deps.settings.usageLimitsMode !== "static" && deps.settings.usageLimitsMode !== "managed") {
+    return null;
+  }
+  return configuredStaticUsageLimits(deps.settings).maxApiKeysPerWorkspace ?? null;
+}
+
 function generateApiKeyToken(): string {
   const bytes = new Uint8Array(32);
   crypto.getRandomValues(bytes);

package/src/routes/browser-sessions.ts

@@ -3435,7 +3435,14 @@ async function ensureHeadedBrowserDisplayStack(
   headless: boolean,
   linkedComputer: boolean,
 ): Promise<void> {
-  if (!browserNeedsStandaloneDisplayStack({ headless, linkedComputer })) return;
+  if (
+    !browserNeedsStandaloneDisplayStack({
+      headless,
+      linkedComputer,
+      nativeBrowserControl: typeof session.ensureBrowserControl === "function",
+    })
+  )
+    return;
   if (typeof session.exec !== "function" && typeof session.execCommand !== "function") return;
   await ensureDisplayStack(session, {
     telemetryContext: { callerKind: "viewer" },
@@ -3445,8 +3452,9 @@ async function ensureHeadedBrowserDisplayStack(
 export function browserNeedsStandaloneDisplayStack(input: {
   headless: boolean;
   linkedComputer: boolean;
+  nativeBrowserControl: boolean;
 }): boolean {
-  return !input.headless && !input.linkedComputer;
+  return !input.headless && !input.linkedComputer && !input.nativeBrowserControl;
 }
 
 async function ensureLinkedComputerController(

package/src/routes/capabilities.ts

@@ -32,7 +32,7 @@ export function registerCapabilityRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.post("/v1/workspaces/:workspaceId/capabilities", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "capabilities:manage");
     const payload = CreateCapabilityCatalogItemRequest.parse(await c.req.json());
     return c.json(
       await createCatalogItem({ db, accountId: grant.accountId, workspaceId, payload }),
@@ -62,7 +62,7 @@ export function registerCapabilityRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.post("/v1/workspaces/:workspaceId/capabilities/:capabilityId/enable", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "capabilities:manage");
     const payload = EnableCapabilityRequest.parse(await c.req.json());
     const installation = await enableCapability({
       db,
@@ -78,7 +78,7 @@ export function registerCapabilityRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.post("/v1/workspaces/:workspaceId/capabilities/:capabilityId/disable", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "capabilities:manage");
     const installation = await disableCapability({
       db,
       accountId: grant.accountId,