@opengeni/api-router 2.5.0 → 2.6.4-canary.0

package/src/routes/scheduled-tasks.ts

@@ -6,7 +6,7 @@ import {
 import { listScheduledTaskRuns, listScheduledTasks } from "@opengeni/db";
 import type { Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
-import { requireAccessGrant } from "@opengeni/core";
+import { requireAccessGrant, resolveWorkspaceCatalogSettings } from "@opengeni/core";
 import { recordWorkspaceUsage, requireLimit } from "@opengeni/core";
 import type { ApiRouteDeps } from "@opengeni/core";
 import {
@@ -22,6 +22,7 @@ import {
   syncCreatedScheduledTask,
   syncUpdatedScheduledTask,
   updateScheduledTaskForApi,
+  validateScheduledTaskMachineTarget,
   validateScheduledTaskTarget,
   validatedScheduledTaskUpdate,
 } from "@opengeni/core";
@@ -29,7 +30,7 @@ import { boundedLimit } from "../http/common";
 import { deleteScheduledTaskWithDurableCleanup } from "../scheduled-task-deletion";
 
 export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void {
-  const { settings, db, workflowClient, objectStorage } = deps;
+  const { db, workflowClient, objectStorage } = deps;
 
   app.post("/v1/workspaces/:workspaceId/scheduled-tasks", async (c) => {
     const workspaceId = c.req.param("workspaceId");
@@ -42,6 +43,12 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
       });
     }
     const payload = parsedPayload.data;
+    const catalogSettings = (
+      await resolveWorkspaceCatalogSettings(db, deps.settings, {
+        accountId: grant.accountId,
+        workspaceId,
+      })
+    ).settings;
     await requireLimit(deps, {
       accountId: grant.accountId,
       workspaceId,
@@ -49,7 +56,7 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
       quantity: 1,
     });
     const task = await createValidatedScheduledTask({
-      settings,
+      settings: catalogSettings,
       db,
       objectStorage,
       grant,
@@ -90,8 +97,14 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
       });
     }
     const payload = parsedPayload.data;
+    const catalogSettings = (
+      await resolveWorkspaceCatalogSettings(db, deps.settings, {
+        accountId: grant.accountId,
+        workspaceId,
+      })
+    ).settings;
     const update = await validatedScheduledTaskUpdate({
-      settings,
+      settings: catalogSettings,
       db,
       objectStorage,
       grant,
@@ -123,8 +136,14 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
     const grant = await requireAccessGrant(c, deps, workspaceId, "scheduled_tasks:manage");
     const existing = await requireScheduledTaskForApi(db, workspaceId, c.req.param("taskId"));
     const previous = await captureScheduledTaskRestoreState(db, existing);
+    const catalogSettings = (
+      await resolveWorkspaceCatalogSettings(db, deps.settings, {
+        accountId: grant.accountId,
+        workspaceId,
+      })
+    ).settings;
     const update = await validatedScheduledTaskUpdate({
-      settings,
+      settings: catalogSettings,
       db,
       objectStorage,
       grant,
@@ -145,6 +164,12 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
     // recognised as codex-billed and skip the credit/cost gates at the edge.
     const task = await requireScheduledTaskForApi(db, workspaceId, c.req.param("taskId"));
     if (task.action.kind === "agent_turn") {
+      const catalogSettings = (
+        await resolveWorkspaceCatalogSettings(db, deps.settings, {
+          accountId: grant.accountId,
+          workspaceId,
+        })
+      ).settings;
       await validateScheduledTaskTarget({
         db,
         sessionAuthorization: deps.sessionAuthorization,
@@ -157,13 +182,24 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
         agentConfig: task.agentConfig,
         missingTargetStatus: 404,
       });
-      await requireLimit(deps, {
-        accountId: grant.accountId,
-        workspaceId,
-        action: "agent_run:create",
-        quantity: 1,
-        model: task.agentConfig.model ?? deps.settings.openaiModel,
+      await validateScheduledTaskMachineTarget({
+        settings: catalogSettings,
+        db,
+        grant,
+        runMode: task.runMode,
+        agentConfig: task.agentConfig,
+        requireOnline: true,
       });
+      await requireLimit(
+        { ...deps, settings: catalogSettings },
+        {
+          accountId: grant.accountId,
+          workspaceId,
+          action: "agent_run:create",
+          quantity: 1,
+          model: task.agentConfig.model ?? catalogSettings.openaiModel,
+        },
+      );
     }
     // Body is optional (a bare POST is still a valid trigger); only a present,
     // non-empty body must parse against the contract.

package/src/routes/sessions.ts

@@ -12,6 +12,7 @@ import {
   GatewayRealtimeConnectRequest,
   ClientSessionEvent,
   CompactSessionContextRequest,
+  CreateSessionRequest,
   DeleteSessionQueueItemRequest,
   EditSessionQueueItemRequest,
   EndSessionRealtimeRequest,
@@ -47,6 +48,7 @@ import {
   SessionEventSemanticClass,
   SessionEventType,
   SessionMcpServerId,
+  SaveNewSessionDraftRequest,
   compactSessionEventResult,
   sessionEventLatestClassToSemanticClass,
   SaveComposerDraftRequest,
@@ -231,6 +233,7 @@ import {
   requirePermission,
   requireSessionAuthorization,
   requireSessionAuthorizationListScope,
+  resolveWorkspaceCatalogSettings,
   withResolvedSessionAuthorization,
   SESSION_AUTHORIZATION_DEFAULT_REAUTHORIZE_MS,
   SessionAuthorizationDeniedError,
@@ -284,7 +287,7 @@ import {
   validateVariableSetAttachment,
 } from "@opengeni/core";
 import { assertSessionExists, boundedLimit } from "../http/common";
-import { sseSessionStream } from "../http/sse";
+import { browserSseDeliveryOptions, sseSessionStream } from "../http/sse";
 import {
   serveWorkspaceCapture,
   serveWorkspaceCaptureFile,
@@ -549,6 +552,7 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
     }
     let session: Session;
     try {
+      CreateSessionRequest.parse(payload);
       session = await createSessionForRequest(deps, grant, workspaceId, payload, authorization);
     } catch (error) {
       return sessionCreateErrorResponse(c, error);
@@ -562,7 +566,13 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
   app.get("/v1/workspaces/:workspaceId/new-session-draft", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "sessions:read");
-    return c.json(await getActorNewSessionDraft({ settings, db }, grant, workspaceId));
+    const catalog = await resolveWorkspaceCatalogSettings(db, settings, {
+      accountId: grant.accountId,
+      workspaceId,
+    });
+    return c.json(
+      await getActorNewSessionDraft({ settings: catalog.settings, db }, grant, workspaceId),
+    );
   });
 
   app.put("/v1/workspaces/:workspaceId/new-session-draft", async (c) => {
@@ -587,9 +597,14 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
       );
     }
     try {
+      SaveNewSessionDraftRequest.parse(payload);
+      const catalog = await resolveWorkspaceCatalogSettings(db, settings, {
+        accountId: grant.accountId,
+        workspaceId,
+      });
       return c.json(
         await saveActorNewSessionDraft(
-          { settings, db, objectStorage },
+          { settings: catalog.settings, db, objectStorage },
           grant,
           workspaceId,
           payload,
@@ -2659,6 +2674,7 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
       Number.isFinite(after) ? after : 0,
       c.req.raw.signal,
       {
+        ...browserSseDeliveryOptions(c.req.query("transport")),
         observability: deps.observability,
         actorEpoch: getManagedAuthRequestActorEpoch(c.req.raw) ?? undefined,
         reauthorizeAfterMs:
@@ -2897,28 +2913,33 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
     const sessionId = c.req.param("sessionId");
     await assertSessionExists(db, workspaceId, sessionId);
     const payload = parseSteerSessionAdmission(await c.req.json().catch(() => null));
-    const result = await acceptSessionUserMessage(deps, grant, workspaceId, sessionId, {
-      text: payload.text,
-      annotations: payload.annotations,
-      modelContext: payload.modelContext ?? null,
-      resources: payload.resources,
-      model: payload.model ?? null,
-      reasoningEffort: payload.reasoningEffort ?? null,
-      latencyMode: payload.latencyMode ?? null,
-      mcpCredentialUpdates: payload.mcpCredentialUpdates ?? [],
-      connectionAuthorities: payload.connectionAuthorities,
-      ...(payload.personalResourceAttachment
-        ? { personalResourceAttachment: payload.personalResourceAttachment }
-        : {}),
-      authorization,
-      delivery: "steer",
-      origin: "human",
-      ...(payload.controlEtag !== undefined ? { controlEtag: payload.controlEtag } : {}),
-      ...(payload.expectedDraftRevision !== undefined
-        ? { expectedDraftRevision: payload.expectedDraftRevision }
-        : {}),
-      ...(payload.clientEventId ? { clientEventId: payload.clientEventId } : {}),
-    });
+    let result: Awaited<ReturnType<typeof acceptSessionUserMessage>>;
+    try {
+      result = await acceptSessionUserMessage(deps, grant, workspaceId, sessionId, {
+        text: payload.text,
+        annotations: payload.annotations,
+        modelContext: payload.modelContext ?? null,
+        resources: payload.resources,
+        model: payload.model ?? null,
+        reasoningEffort: payload.reasoningEffort ?? null,
+        latencyMode: payload.latencyMode ?? null,
+        mcpCredentialUpdates: payload.mcpCredentialUpdates ?? [],
+        connectionAuthorities: payload.connectionAuthorities,
+        ...(payload.personalResourceAttachment
+          ? { personalResourceAttachment: payload.personalResourceAttachment }
+          : {}),
+        authorization,
+        delivery: "steer",
+        origin: "human",
+        ...(payload.controlEtag !== undefined ? { controlEtag: payload.controlEtag } : {}),
+        ...(payload.expectedDraftRevision !== undefined
+          ? { expectedDraftRevision: payload.expectedDraftRevision }
+          : {}),
+        ...(payload.clientEventId ? { clientEventId: payload.clientEventId } : {}),
+      });
+    } catch (error) {
+      return commandConflictResponse(c, error);
+    }
     return c.json(result, 202);
   });
 
@@ -2974,29 +2995,34 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
       }
     }
     if (event.type === "user.message") {
-      const { accepted } = await acceptSessionUserMessage(deps, grant, workspaceId, sessionId, {
-        text: event.payload.text,
-        annotations: event.payload.annotations,
-        modelContext: event.payload.modelContext ?? null,
-        resources: event.payload.resources ?? [],
-        model: event.payload.model ?? null,
-        reasoningEffort: event.payload.reasoningEffort ?? null,
-        latencyMode: event.payload.latencyMode ?? null,
-        mcpCredentialUpdates: event.payload.mcpCredentialUpdates ?? [],
-        connectionAuthorities: event.payload.connectionAuthorities,
-        ...(event.payload.personalResourceAttachment
-          ? { personalResourceAttachment: event.payload.personalResourceAttachment }
-          : {}),
-        authorization,
-        ...(event.payload.controlEtag !== undefined
-          ? { controlEtag: event.payload.controlEtag }
-          : {}),
-        ...(event.payload.expectedDraftRevision !== undefined
-          ? { expectedDraftRevision: event.payload.expectedDraftRevision }
-          : {}),
-        ...(event.clientEventId ? { clientEventId: event.clientEventId } : {}),
-      });
-      return c.json(accepted, 202);
+      let result: Awaited<ReturnType<typeof acceptSessionUserMessage>>;
+      try {
+        result = await acceptSessionUserMessage(deps, grant, workspaceId, sessionId, {
+          text: event.payload.text,
+          annotations: event.payload.annotations,
+          modelContext: event.payload.modelContext ?? null,
+          resources: event.payload.resources ?? [],
+          model: event.payload.model ?? null,
+          reasoningEffort: event.payload.reasoningEffort ?? null,
+          latencyMode: event.payload.latencyMode ?? null,
+          mcpCredentialUpdates: event.payload.mcpCredentialUpdates ?? [],
+          connectionAuthorities: event.payload.connectionAuthorities,
+          ...(event.payload.personalResourceAttachment
+            ? { personalResourceAttachment: event.payload.personalResourceAttachment }
+            : {}),
+          authorization,
+          ...(event.payload.controlEtag !== undefined
+            ? { controlEtag: event.payload.controlEtag }
+            : {}),
+          ...(event.payload.expectedDraftRevision !== undefined
+            ? { expectedDraftRevision: event.payload.expectedDraftRevision }
+            : {}),
+          ...(event.clientEventId ? { clientEventId: event.clientEventId } : {}),
+        });
+      } catch (error) {
+        return commandConflictResponse(c, error);
+      }
+      return c.json(result.accepted, 202);
     }
 
     if (event.type === "user.approvalDecision") {
@@ -3201,12 +3227,8 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
       // Human take-control: when the desktop is available + this policy is on
       // (default), the cell is mode "interactive" — the noVNC viewer drives :0
       // (x11vnc runs without -viewonly). Off → mode "read-only" (client disables
-      // take-control). Independent of the agent's computerUseReadOnly.
+      // take-control). Agent interaction uses managed ComputerSession tools.
       desktopInteractive: settings.sandboxDesktopInteractive,
-      // P4.3 computer-use: the agent drives the active display; availability
-      // tracks the desktop tier + a desktop-capable backend.
-      computerUseEnabled: settings.computerUseEnabled,
-      computerUseReadOnly: settings.computerUseReadOnly,
       // Graceful degrade when scoped stream credentials cannot be minted.
       streamTokenSecretAvailable: !streamTokenDegraded(settings),
       desktopAcknowledged: acknowledged,

package/src/routes/skills.ts

@@ -55,7 +55,7 @@ export function registerSkillRoutes(
 
   app.post("/v1/workspaces/:workspaceId/skills/library/:libraryId/install", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "capabilities:manage");
     const libraryId = decodeURIComponent(c.req.param("libraryId"));
     const payload = InstallLibrarySkillRequest.parse(await c.req.json());
     let loaded: ReturnType<typeof loadSkillLibrarySkill>;
@@ -136,7 +136,7 @@ export function registerSkillRoutes(
 
   app.post("/v1/workspaces/:workspaceId/skills/install", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "capabilities:manage");
     const payload = InstallSkillRequest.parse(await c.req.json());
     const resolved = await resolveForRoute(payload.url, github);
     if (
@@ -204,7 +204,7 @@ export function registerSkillRoutes(
 
   app.delete("/v1/workspaces/:workspaceId/skills/:capabilityId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "capabilities:manage");
     const capabilityId = decodeURIComponent(c.req.param("capabilityId"));
     const payload = UninstallSkillRequest.parse(await c.req.json());
     try {

package/src/routes/supergrok.ts

@@ -552,8 +552,9 @@ export function registerSuperGrokRoutes(app: Hono, deps: ApiRouteDeps): void {
     } catch {
       valid = false;
     }
-    const catalog = valid
-      ? configuredModels(withXaiSubscriptionCatalogProvider(deps.settings))
+    const catalogSettings = valid ? (await deps.resolveCatalogSettings()).settings : null;
+    const catalog = catalogSettings
+      ? configuredModels(withXaiSubscriptionCatalogProvider(catalogSettings))
           .filter(
             (model) =>
               model.credentialSource.kind === "connected_subscription" &&