@opengeni/api-router 2.5.0 → 2.6.4-canary.0

package/src/routes/company-profile.ts

@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
 import {
   ActivateCompanyProfileRevisionRequest,
+  CompanyProfileAgentPolicy,
   CompanyProfileConflictResponse,
   CompanyProfileDiffRequest,
   CompanyProfileDiffResponse,
@@ -11,6 +12,7 @@ import {
   CompanyProfileRevision,
   RollbackCompanyProfileRequest,
   UpdateCompanyProfileRequest,
+  UpdateCompanyProfileAgentPolicyRequest,
 } from "@opengeni/contracts";
 import {
   requireAccessGrant,
@@ -20,15 +22,18 @@ import {
 } from "@opengeni/core";
 import {
   activateCompanyProfileRevision,
+  CompanyProfileAgentPolicyError,
   CompanyProfileConflictError,
   CompanyProfileInvalidOperationError,
   CompanyProfileNotFoundError,
   CompanyProfileOperationReuseError,
   diffCompanyProfileRevisions,
   getCompanyProfileRevision,
+  getCompanyProfileAgentPolicy,
   listCompanyProfile,
   rollbackCompanyProfileRevision,
   updateCompanyProfile,
+  updateCompanyProfileAgentPolicy,
 } from "@opengeni/db";
 import type { Context, Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
@@ -84,6 +89,15 @@ function profileError(context: Context, error: unknown): Response {
   if (error instanceof CompanyProfileInvalidOperationError) {
     return context.json({ code: "INVALID_COMPANY_PROFILE_OPERATION", message: error.message }, 422);
   }
+  if (error instanceof CompanyProfileAgentPolicyError) {
+    if (error.code === "authority_unavailable") {
+      throw new HTTPException(403, { message: error.message });
+    }
+    if (error.code === "policy_conflict" || error.code === "operation_reused") {
+      throw new HTTPException(409, { message: error.message });
+    }
+    throw new HTTPException(422, { message: error.message });
+  }
   throw error;
 }
 
@@ -97,6 +111,56 @@ function revisionId(context: Context): string {
 export function registerCompanyProfileRoutes(app: Hono, deps: ApiRouteDeps): void {
   const base = "/v1/workspaces/:workspaceId/company-profile";
 
+  app.get(`${base}/agent-policy`, async (context) => {
+    const workspaceId = context.req.param("workspaceId");
+    const access = await requireAccessGrantAuthorization(
+      context,
+      deps,
+      workspaceId,
+      "workspace:read",
+    );
+    requireDirectAccountAdmin(access);
+    try {
+      return context.json(
+        CompanyProfileAgentPolicy.parse(
+          await getCompanyProfileAgentPolicy(deps.db, {
+            accountId: access.grant.accountId,
+            workspaceId,
+            actorSubjectId: access.grant.subjectId,
+          }),
+        ),
+      );
+    } catch (error) {
+      return profileError(context, error);
+    }
+  });
+
+  app.patch(`${base}/agent-policy`, async (context) => {
+    const workspaceId = context.req.param("workspaceId");
+    const access = await requireAccessGrantAuthorization(
+      context,
+      deps,
+      workspaceId,
+      "workspace:read",
+    );
+    requireDirectAccountAdmin(access);
+    const request = await parseBody(context, UpdateCompanyProfileAgentPolicyRequest);
+    try {
+      return context.json(
+        CompanyProfileAgentPolicy.parse(
+          await updateCompanyProfileAgentPolicy(deps.db, {
+            accountId: access.grant.accountId,
+            workspaceId,
+            actorSubjectId: access.grant.subjectId,
+            ...request,
+          }),
+        ),
+      );
+    } catch (error) {
+      return profileError(context, error);
+    }
+  });
+
   app.get(base, async (context) => {
     const workspaceId = context.req.param("workspaceId");
     const grant = await requireAccessGrant(context, deps, workspaceId, "workspace:read");

package/src/routes/computer-sessions.ts

@@ -68,6 +68,7 @@ import {
   BrowserControlServerUnsupportedError,
   BrowserControlTransportError,
   BrowserControlUnsupportedError,
+  ComputerFrameEvidenceMismatchError,
   buildSelfhostedBackendSession,
   buildStreamUrl,
   exposedPortEndpointFromUrl,
@@ -75,8 +76,11 @@ import {
   NatsControlRpc,
   NatsOpStreamTransport,
   provisionBrowserControlClient,
+  validateComputerControlFrameEvidence,
   renewSandboxProviderExpiration,
   type BrowserControlPlacementSession,
+  type ComputerControlFrame,
+  type ExpectedComputerFrameEvidence,
 } from "@opengeni/runtime/sandbox";
 import type { Context, Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
@@ -101,7 +105,11 @@ import {
   createInteractionFrameProxyAttachment,
   placementUsesInteractionFrameProxy,
 } from "../interaction-frame-proxy";
-import { observeComputerActionResult, observeLifecycleResult } from "../interaction-metrics";
+import {
+  observeComputerActionResult,
+  observeComputerFrameEvidenceMismatch,
+  observeLifecycleResult,
+} from "../interaction-metrics";
 import { withChannelA, withChannelARead, type ChannelAOperation } from "../sandbox/channel-a";
 
 type ComputerPlacement = {
@@ -111,6 +119,59 @@ type ComputerPlacement = {
   lease: LeaseSnapshot | null;
 };
 
+const MODEL_COMPUTER_FRAME_MAX_BYTES = 256 * 1024;
+
+type ComputerFrameCaptureClient = {
+  capture(
+    targetId: string,
+    options: {
+      format?: "jpeg" | "png";
+      quality?: number;
+      maxWidth?: number;
+      maxHeight?: number;
+    },
+  ): Promise<ComputerControlFrame>;
+};
+
+export function validateComputerFrameForApi(
+  frame: Pick<ComputerControlFrame, "data" | "mediaType" | "metadataHeader">,
+  expected: ExpectedComputerFrameEvidence,
+): ComputerControlFrame {
+  return validateComputerControlFrameEvidence(frame, expected);
+}
+
+export async function captureModelComputerFrame(
+  sessionClient: ComputerFrameCaptureClient,
+  expected: ExpectedComputerFrameEvidence,
+): Promise<ComputerControlFrame> {
+  let captured = validateComputerFrameForApi(
+    await sessionClient.capture(expected.targetId, {
+      format: "jpeg",
+      quality: 55,
+      maxWidth: 1_024,
+      maxHeight: 768,
+    }),
+    expected,
+  );
+  if (captured.data.byteLength > MODEL_COMPUTER_FRAME_MAX_BYTES) {
+    captured = validateComputerFrameForApi(
+      await sessionClient.capture(expected.targetId, {
+        format: "jpeg",
+        quality: 30,
+        maxWidth: 640,
+        maxHeight: 480,
+      }),
+      expected,
+    );
+  }
+  if (captured.data.byteLength > MODEL_COMPUTER_FRAME_MAX_BYTES) {
+    throw new BrowserControlProtocolError(
+      "computer screenshot could not honor the model image byte bound",
+    );
+  }
+  return captured;
+}
+
 /** Public ComputerSession resource surface. Physical app/window authority stays
  * in the same placement controller used by BrowserSession; this route owns only
  * durable authorization, placement fencing, lifecycle receipts, and routing. */
@@ -389,6 +450,47 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
     },
   );
 
+  app.get(
+    "/v1/workspaces/:workspaceId/computer-sessions/:computerSessionId/targets/:targetId/screenshot",
+    async (context) => {
+      const { workspaceId, grant, computerSessionId } = await routePreamble(
+        context,
+        "sessions:read",
+      );
+      const targetId = requireOpaqueParam(context, "targetId");
+      const frame = await withActiveComputerController(
+        context,
+        grant,
+        workspaceId,
+        computerSessionId,
+        "session.read",
+        "computer.read",
+        async ({ sessionClient, binding }) => {
+          try {
+            return await captureModelComputerFrame(sessionClient, {
+              computerSessionId,
+              controllerGeneration: binding.controllerGeneration,
+              targetId,
+            });
+          } catch (error) {
+            if (error instanceof ComputerFrameEvidenceMismatchError) {
+              observeComputerFrameEvidenceMismatch(deps.observability, error.reason);
+            }
+            throw error;
+          }
+        },
+      );
+      return new Response(frame.data.slice().buffer, {
+        status: 200,
+        headers: {
+          "cache-control": "no-store",
+          "content-type": frame.mediaType,
+          "x-opengeni-computer-frame": frame.metadataHeader,
+        },
+      });
+    },
+  );
+
   app.get(
     "/v1/workspaces/:workspaceId/computer-sessions/:computerSessionId/clipboard",
     async (context) => {

package/src/routes/connections.ts

@@ -1,4 +1,10 @@
-import { createHash } from "node:crypto";
+import { createHash, createHmac } from "node:crypto";
+import {
+  WORKSPACE_OPENROUTER_CONNECTION_DOMAIN,
+  WORKSPACE_OPENROUTER_CONNECTION_ROLE,
+  VERCEL_AI_GATEWAY_CONNECTION_DOMAIN,
+  VERCEL_AI_GATEWAY_CONNECTION_ROLE,
+} from "@opengeni/config";
 import {
   ATLASSIAN_PROVIDER_DOMAIN,
   AtlassianConnectionMetadata,
@@ -21,11 +27,16 @@ import {
   IntegrationClientMetadata,
   ListSlackInstallationBindingsResponse,
   ListConnectionsResponse,
+  OPENROUTER_CREDENTIAL_OPERATION_DIGEST_METADATA_KEY,
+  OPENROUTER_CREDENTIAL_OPERATION_ID_METADATA_KEY,
   OpenGeniSlackBotInstallRequest,
   OpenGeniSlackBotInstallStart,
   OAuthStartRequest,
   OAuthStartResponse,
   UpdateConnectionRequest,
+  VERCEL_AI_GATEWAY_CREDENTIAL_OPERATION_DIGEST_METADATA_KEY,
+  VERCEL_AI_GATEWAY_CREDENTIAL_OPERATION_ID_METADATA_KEY,
+  stableJson,
 } from "@opengeni/contracts";
 import {
   bindConnectorDocumentDestination,
@@ -69,11 +80,17 @@ import {
   persistSlackBotInstallationWithSuccessAudit,
   recordSlackBotInstallCallbackFailure,
   revokeConnection,
+  revokeWorkspaceOpenRouterConnections,
+  revokeWorkspaceVercelAiGatewayConnections,
   revokeConnectionWithSlackBotSuccessAudit,
+  rotateWorkspaceVercelAiGatewayConnection,
+  rotateWorkspaceOpenRouterConnection,
   SlackBotLifecycleSuccessAuditError,
   SlackInstallationBindingConflictError,
   updateConnection,
   updateSlackBotDocumentDestination,
+  upsertWorkspaceVercelAiGatewayConnection,
+  upsertWorkspaceOpenRouterConnection,
   type SlackBotInstallCallbackFailureReason,
   type SlackBotInstallCallbackFailureStage,
 } from "@opengeni/db";
@@ -193,18 +210,69 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
     assertNotDirectGoogleDriveOAuth(providerDomain, payload.kind, payload.metadata);
     assertNotDirectAtlassianOAuth(providerDomain, payload.kind, payload.metadata);
     assertNotDirectPersonalGitHubOAuth(providerDomain, payload.kind, payload.metadata);
-    const connection = await createConnection(db, {
-      accountId: grant.accountId,
-      workspaceId,
+    const credentialEncrypted = encryptCredentialBundle(key, payload.credential);
+    const workspaceProviderKind = workspaceProviderApiKeyConnectionKind({
       subjectId,
       providerDomain,
       kind: payload.kind,
-      credentialEncrypted: encryptCredentialBundle(key, payload.credential),
-      grantedScopes: payload.grantedScopes,
-      expiresAt: payload.expiresAt ? new Date(payload.expiresAt) : null,
       metadata: payload.metadata,
-      createdBySubjectId: grant.subjectId,
     });
+    const connection = workspaceProviderKind
+      ? await (async () => {
+          const provider = workspaceProviderApiKeyConnectionSpec(workspaceProviderKind);
+          if (!payload.operationId) {
+            throw new HTTPException(400, {
+              message: `connecting ${provider.label} requires an operationId`,
+            });
+          }
+          const expiresAt = payload.expiresAt ? new Date(payload.expiresAt) : null;
+          const metadata = workspaceProviderCredentialMetadata(
+            workspaceProviderKind,
+            payload.metadata,
+          );
+          const input = {
+            accountId: grant.accountId,
+            workspaceId,
+            operationId: payload.operationId,
+            requestDigest: workspaceProviderCredentialRequestDigest(key, {
+              action: "create",
+              providerDomain,
+              kind: payload.kind,
+              subjectId,
+              credential: payload.credential,
+              grantedScopes: payload.grantedScopes,
+              expiresAt: expiresAt?.toISOString() ?? null,
+              metadata,
+            }),
+            credentialEncrypted,
+            grantedScopes: payload.grantedScopes,
+            expiresAt,
+            metadata,
+            updatedBySubjectId: grant.subjectId,
+          };
+          const created =
+            workspaceProviderKind === "vercel_gateway"
+              ? await upsertWorkspaceVercelAiGatewayConnection(db, input)
+              : await upsertWorkspaceOpenRouterConnection(db, input);
+          if (!created || created.status === "revoked") {
+            throw new HTTPException(409, {
+              message: `${provider.label} is already connected; reload before replacing its key`,
+            });
+          }
+          return created;
+        })()
+      : await createConnection(db, {
+          accountId: grant.accountId,
+          workspaceId,
+          subjectId,
+          providerDomain,
+          kind: payload.kind,
+          credentialEncrypted,
+          grantedScopes: payload.grantedScopes,
+          expiresAt: payload.expiresAt ? new Date(payload.expiresAt) : null,
+          metadata: payload.metadata,
+          createdBySubjectId: grant.subjectId,
+        });
     return c.json(ConnectionResponse.parse({ connection }), 201);
   });
 
@@ -794,6 +862,24 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
         payload.providerDomain ?? existing.providerDomain,
       );
       const kind = payload.kind ?? existing.kind;
+      const subjectId =
+        payload.subjectId === undefined
+          ? existing.subjectId
+          : writableSubjectId(payload.subjectId, grant.subjectId);
+      const targetWorkspaceProviderKind = workspaceProviderApiKeyConnectionKind({
+        subjectId,
+        providerDomain,
+        kind,
+        metadata: payload.metadata ?? existing.metadata,
+      });
+      if (!workspaceProviderApiKeyConnectionKind(existing) && targetWorkspaceProviderKind) {
+        throw new HTTPException(422, {
+          message:
+            targetWorkspaceProviderKind === "vercel_gateway"
+              ? "use the Vercel AI Gateway connect flow to create this connection"
+              : "use the OpenRouter connect flow to create this connection",
+        });
+      }
       assertNotDirectPersonalSlackOAuth(providerDomain, kind);
       assertNotDirectGoogleDriveOAuth(providerDomain, kind, payload.metadata ?? existing.metadata);
       assertNotDirectAtlassianOAuth(providerDomain, kind, payload.metadata ?? existing.metadata);
@@ -819,6 +905,86 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
         });
       }
     }
+    const existingWorkspaceProviderKind = existing
+      ? workspaceProviderApiKeyConnectionKind(existing)
+      : null;
+    if (existing && existingWorkspaceProviderKind) {
+      const provider = workspaceProviderApiKeyConnectionSpec(existingWorkspaceProviderKind);
+      const providerDomain = canonicalProviderDomain(
+        payload.providerDomain ?? existing.providerDomain,
+      );
+      const subjectId =
+        payload.subjectId === undefined
+          ? existing.subjectId
+          : writableSubjectId(payload.subjectId, grant.subjectId);
+      const kind = payload.kind ?? existing.kind;
+      if (
+        subjectId !== null ||
+        providerDomain !== provider.providerDomain ||
+        kind !== "api_key" ||
+        (payload.metadata?.credentialRole !== undefined &&
+          payload.metadata.credentialRole !== provider.credentialRole)
+      ) {
+        throw new HTTPException(422, {
+          message: `${provider.label} connection identity cannot be changed`,
+        });
+      }
+      if (payload.credential === undefined) {
+        throw new HTTPException(400, {
+          message: `updating a ${provider.label} connection requires a new credential`,
+        });
+      }
+      if (payload.expectedVersion === undefined || payload.operationId === undefined) {
+        throw new HTTPException(400, {
+          message: `updating a ${provider.label} connection requires expectedVersion and operationId`,
+        });
+      }
+      const key = requireEnvironmentEncryption(settings);
+      const grantedScopes = payload.grantedScopes ?? existing.grantedScopes;
+      const expiresAt =
+        payload.expiresAt !== undefined
+          ? payload.expiresAt
+            ? new Date(payload.expiresAt)
+            : null
+          : existing.expiresAt
+            ? new Date(existing.expiresAt)
+            : null;
+      const metadata = workspaceProviderCredentialMetadata(existingWorkspaceProviderKind, {
+        ...existing.metadata,
+        ...(payload.metadata ?? {}),
+      });
+      const input = {
+        accountId: grant.accountId,
+        workspaceId,
+        connectionId: existing.id,
+        expectedVersion: payload.expectedVersion,
+        operationId: payload.operationId,
+        requestDigest: workspaceProviderCredentialRequestDigest(key, {
+          action: "rotate",
+          connectionId: existing.id,
+          expectedVersion: payload.expectedVersion,
+          credential: payload.credential,
+          grantedScopes,
+          expiresAt: expiresAt?.toISOString() ?? null,
+          metadata,
+        }),
+        credentialEncrypted: encryptCredentialBundle(key, payload.credential),
+        grantedScopes,
+        expiresAt,
+        metadata,
+        updatedBySubjectId: grant.subjectId,
+      };
+      const connection =
+        existingWorkspaceProviderKind === "vercel_gateway"
+          ? await rotateWorkspaceVercelAiGatewayConnection(db, input)
+          : await rotateWorkspaceOpenRouterConnection(db, input);
+      if (!connection) {
+        throw new HTTPException(409, {
+          message: `${provider.label} connection changed; reload before replacing its key`,
+        });
+      }
+      return c.json(ConnectionResponse.parse({ connection }));
+    }
     const key = payload.credential === undefined ? null : requireEnvironmentEncryption(settings);
     const subjectId =
       payload.subjectId === undefined
@@ -879,6 +1045,7 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
       existing.providerDomain === ATLASSIAN_PROVIDER_DOMAIN &&
       existing.kind === "oauth2" &&
       AtlassianConnectionMetadata.safeParse(existing.metadata).success;
+    const workspaceProviderKind = workspaceProviderApiKeyConnectionKind(existing);
     const disconnectPayload = await c.req.json().catch(() => null);
     const googleDriveDisconnect = isGoogleDrive
       ? GoogleDriveDisconnectRequest.safeParse(disconnectPayload)
@@ -909,7 +1076,13 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
           "invalid personal GitHub disconnect request",
       });
     }
-    if (existing.status === "revoked" && !isGoogleDrive && !isAtlassian && !isPersonalGitHub) {
+    if (
+      existing.status === "revoked" &&
+      !isGoogleDrive &&
+      !isAtlassian &&
+      !isPersonalGitHub &&
+      !workspaceProviderKind
+    ) {
       return c.json(ConnectionResponse.parse({ connection: existing }));
     }
     const connection = isGoogleDrive
@@ -944,13 +1117,29 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
                 credentialLabel: OPENGENI_SLACK_BOT_CREDENTIAL_LABEL,
                 slackTeamId: openGeniSlackBotMetadata(existing.metadata)!.slackTeamId,
               })
-            : await revokeConnection(
-                db,
-                workspaceId,
-                connectionId,
-                grant.subjectId,
-                existing.version,
-              );
+            : workspaceProviderKind
+              ? workspaceProviderKind === "vercel_gateway"
+                ? await revokeWorkspaceVercelAiGatewayConnections(db, {
+                    accountId: grant.accountId,
+                    workspaceId,
+                    connectionId,
+                    expectedVersion: existing.version,
+                    updatedBySubjectId: grant.subjectId,
+                  })
+                : await revokeWorkspaceOpenRouterConnections(db, {
+                    accountId: grant.accountId,
+                    workspaceId,
+                    connectionId,
+                    expectedVersion: existing.version,
+                    updatedBySubjectId: grant.subjectId,
+                  })
+              : await revokeConnection(
+                  db,
+                  workspaceId,
+                  connectionId,
+                  grant.subjectId,
+                  existing.version,
+                );
     if (!connection) {
       throw new HTTPException(409, { message: "connection changed during disconnect; try again" });
     }
@@ -1367,6 +1556,51 @@ function assertNotReservedPersonalGitHubMetadata(
   }
 }
 
+type WorkspaceProviderApiKeyConnectionKind = "vercel_gateway" | "openrouter";
+
+function workspaceProviderApiKeyConnectionSpec(
+  providerKind: WorkspaceProviderApiKeyConnectionKind,
+): {
+  providerDomain: string;
+  credentialRole: string;
+  label: string;
+} {
+  return providerKind === "vercel_gateway"
+    ? {
+        providerDomain: VERCEL_AI_GATEWAY_CONNECTION_DOMAIN,
+        credentialRole: VERCEL_AI_GATEWAY_CONNECTION_ROLE,
+        label: "Vercel AI Gateway",
+      }
+    : {
+        providerDomain: WORKSPACE_OPENROUTER_CONNECTION_DOMAIN,
+        credentialRole: WORKSPACE_OPENROUTER_CONNECTION_ROLE,
+        label: "OpenRouter",
+      };
+}
+
+function workspaceProviderApiKeyConnectionKind(input: {
+  subjectId?: string | null;
+  providerDomain: string;
+  kind: string;
+  metadata?: Record<string, unknown>;
+}): WorkspaceProviderApiKeyConnectionKind | null {
+  if (input.subjectId != null || input.kind !== "api_key") return null;
+  const providerDomain = input.providerDomain.toLowerCase();
+  if (
+    providerDomain === VERCEL_AI_GATEWAY_CONNECTION_DOMAIN &&
+    input.metadata?.credentialRole === VERCEL_AI_GATEWAY_CONNECTION_ROLE
+  ) {
+    return "vercel_gateway";
+  }
+  if (
+    providerDomain === WORKSPACE_OPENROUTER_CONNECTION_DOMAIN &&
+    input.metadata?.credentialRole === WORKSPACE_OPENROUTER_CONNECTION_ROLE
+  ) {
+    return "openrouter";
+  }
+  return null;
+}
+
 function assertNotReservedSlackBotMetadata(metadata: Record<string, unknown> | undefined): void {
   if (hasReservedOpenGeniSlackBotMetadata(metadata)) {
     throw new HTTPException(422, {
@@ -1426,6 +1660,27 @@ function encryptCredentialBundle(key: Uint8Array, credential: Record<string, unk
   return encryptEnvironmentValue(key, JSON.stringify(credential));
 }
 
+function workspaceProviderCredentialMetadata(
+  providerKind: WorkspaceProviderApiKeyConnectionKind,
+  metadata: Record<string, unknown> | undefined,
+): Record<string, unknown> {
+  const {
+    [OPENROUTER_CREDENTIAL_OPERATION_ID_METADATA_KEY]: _openRouterOperationId,
+    [OPENROUTER_CREDENTIAL_OPERATION_DIGEST_METADATA_KEY]: _openRouterOperationDigest,
+    [VERCEL_AI_GATEWAY_CREDENTIAL_OPERATION_ID_METADATA_KEY]: _operationId,
+    [VERCEL_AI_GATEWAY_CREDENTIAL_OPERATION_DIGEST_METADATA_KEY]: _operationDigest,
+    ...effectiveMetadata
+  } = metadata ?? {};
+  return {
+    ...effectiveMetadata,
+    credentialRole: workspaceProviderApiKeyConnectionSpec(providerKind).credentialRole,
+  };
+}
+
+function workspaceProviderCredentialRequestDigest(key: Uint8Array, value: unknown): string {
+  return createHmac("sha256", key).update(stableJson(value), "utf8").digest("hex");
+}
+
 function slackBotCredentialBundle(token: string): Record<string, unknown> {
   const headerName = ["author", "ization"].join("");
   const scheme = ["Bear", "er"].join("");

package/src/routes/github.ts

@@ -428,14 +428,6 @@ export function registerGitHubRoutes(app: Hono, deps: ApiRouteDeps): void {
       if (candidates.length === 0) {
         return redirectToGitHubInstallation(c, deps, selectionState);
       }
-      if (candidates.length === 1) {
-        return redirectToExactGitHubAuthorization(
-          c,
-          deps,
-          selectionState,
-          candidates[0]!.installation.installationId,
-        );
-      }
       setGitHubStateCookie(c, deps, selectionState);
       return c.html(
         githubInstallationChooserHtml(

package/src/routes/integration-facets.ts

@@ -66,7 +66,7 @@ export function registerIntegrationFacetRoutes(app: Hono, deps: ApiRouteDeps): v
         c,
         deps,
         workspaceId,
-        "workspace:admin",
+        "capabilities:manage",
       );
       const { grant } = authorization;
       try {
@@ -82,7 +82,10 @@ export function registerIntegrationFacetRoutes(app: Hono, deps: ApiRouteDeps): v
               payload: await c.req.json(),
               canManageOrganizationDestination:
                 authorization.accountGrant?.permissions.includes("account:admin") === true,
-              canManageWorkspaceDestination: hasPermission(grant.permissions, "workspace:admin"),
+              canManageWorkspaceDestination: hasPermission(
+                grant.permissions,
+                "capabilities:manage",
+              ),
               canManagePersonalDestination:
                 authorization.contextIntegrity &&
                 authorization.authenticatedSubjectId === grant.subjectId,
@@ -122,7 +125,7 @@ export function registerIntegrationFacetRoutes(app: Hono, deps: ApiRouteDeps): v
     "/v1/workspaces/:workspaceId/integrations/:capabilityId/instances/:instanceKey/facets/:facetKey",
     async (c) => {
       const workspaceId = c.req.param("workspaceId");
-      const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+      const grant = await requireAccessGrant(c, deps, workspaceId, "capabilities:manage");
       const payload = UpsertIntegrationFacetRequest.parse(await c.req.json());
       const capabilityId = decoded(c.req.param("capabilityId"));
       const instanceKey = decoded(c.req.param("instanceKey"));
@@ -204,7 +207,7 @@ export function registerIntegrationFacetRoutes(app: Hono, deps: ApiRouteDeps): v
       `/v1/workspaces/:workspaceId/integrations/:capabilityId/instances/:instanceKey/facets/:facetKey/${action}`,
       async (c) => {
         const workspaceId = c.req.param("workspaceId");
-        const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+        const grant = await requireAccessGrant(c, deps, workspaceId, "capabilities:manage");
         const payload = MutateIntegrationFacetRequest.parse(await c.req.json());
         try {
           return c.json(
@@ -233,7 +236,7 @@ export function registerIntegrationFacetRoutes(app: Hono, deps: ApiRouteDeps): v
     "/v1/workspaces/:workspaceId/integrations/:capabilityId/instances/:instanceKey/facets/:facetKey",
     async (c) => {
       const workspaceId = c.req.param("workspaceId");
-      const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+      const grant = await requireAccessGrant(c, deps, workspaceId, "capabilities:manage");
       const payload = MutateIntegrationFacetRequest.parse(await c.req.json());
       try {
         return c.json(