@opengeni/api-router 2.6.4 → 2.10.0-canary.0

package/src/routes/workspaces.ts

@@ -1,3 +1,4 @@
+import { createHash } from "node:crypto";
 import {
   AddWorkspaceMemberRequest,
   CreateWorkspaceRequest,
@@ -7,16 +8,25 @@ import {
   ListWorkspaceMembersResponse,
   SetWorkspaceDefaultRigRequest,
   UpdateWorkspaceMemberRequest,
+  CreateWorkspaceGatewayCustomModelRequest,
+  CreateWorkspaceOpenRouterCustomModelRequest,
+  DeleteWorkspaceGatewayCustomModelRequest,
+  DeleteWorkspaceOpenRouterCustomModelRequest,
   UpdateWorkspaceModelPolicyRequest,
   UpdateWorkspaceRequest,
   UpdateWorkspaceSettingsRequest,
   WORKSPACE_CONTROL_ACTOR_MAX_BYTES,
   WorkspaceModelCatalogResponse,
+  WorkspaceGatewayCustomModel,
+  WorkspaceGatewayCustomModelsResponse,
+  WorkspaceOpenRouterCustomModel,
+  WorkspaceOpenRouterCustomModelsResponse,
   WorkspaceRealtimeModelCatalogResponse,
   WorkspaceInferenceControlRequest,
   Workspace,
   WorkspaceMember,
   workspaceControlUtf8Bytes,
+  stableJson,
   type AccessContext,
   type Permission,
   type WorkspaceMemberCandidate,
@@ -25,7 +35,6 @@ import {
 import {
   allWorkspacePermissions,
   createWorkspace,
-  deleteWorkspaceIfQuiescent,
   ensureWorkspaceByExternalIdentity,
   findWorkspaceByExternalIdentity,
   getManagedUserProfilesByIds,
@@ -36,6 +45,14 @@ import {
   normalizeWorkspaceMembershipPermissions,
   listWorkspaceControlEvents,
   listSharedWorkspacesForAccount,
+  listWorkspaceGatewayCustomModels,
+  listWorkspaceOpenRouterCustomModels,
+  createWorkspaceGatewayCustomModel,
+  createWorkspaceOpenRouterCustomModel,
+  deleteWorkspaceGatewayCustomModel,
+  deleteWorkspaceOpenRouterCustomModel,
+  replayWorkspaceGatewayCustomModelCreate,
+  replayWorkspaceOpenRouterCustomModelCreate,
   listWorkspacesForSubject,
   nestedPostgresSqlState,
   removeWorkspaceMember,
@@ -50,7 +67,14 @@ import {
   workspaceControlRequestLockTimeoutMs,
   workspaceXaiSubscriptionActive,
   workspaceVercelAiGatewayConnectionActive,
+  workspaceOpenRouterConnectionActive,
+  organizationModelProviderConnectionActiveForWorkspace,
+  listOrganizationModelProviderCustomModelsForWorkspace,
+  WorkspaceGatewayCustomModelHistoryLimitError,
+  WorkspaceOpenRouterCustomModelHistoryLimitError,
   WorkspaceExternalIdentityConflictError,
+  WorkspaceGatewayCustomModelLimitError,
+  WorkspaceOpenRouterCustomModelLimitError,
   WorkspaceLimitExceededError,
 } from "@opengeni/db";
 import { boundWorkspaceControlHttpPage } from "@opengeni/events";
@@ -63,6 +87,7 @@ import {
   requireAccessContext,
   requireAccessGrant,
   requireFreshAccessGrant,
+  resolveWorkspaceCatalogSettings,
 } from "@opengeni/core";
 import { requireLimit } from "@opengeni/core";
 import type { ApiRouteDeps } from "@opengeni/core";
@@ -75,14 +100,20 @@ import { boundedLimit } from "../http/common";
 import { ApiHttpError } from "../http/api-error";
 import { browserSseDeliveryOptions, sseWorkspaceControlStream } from "../http/sse";
 import { buildWorkspaceModelCatalog } from "../model-catalog";
-import { processTemporalScheduleCleanupClaims } from "../temporal-schedule-cleanup";
-import { workspaceDeleteObserver } from "../workspace-delete-observability";
+import { deleteWorkspaceForRequest } from "../workspace-deletion";
 import {
   AI_GATEWAY_REALTIME_MODELS,
   CODEX_REALTIME_MODEL_ID,
   SUPERGROK_REALTIME_MODEL_ID,
   canonicalizeConfiguredModelId,
   configuredStaticUsageLimits,
+  configuredGatewayUpstreamModelIds,
+  configuredGatewayWorkspaceProductModelIds,
+  configuredModelInputIdentities,
+  configuredOpenRouterUpstreamModelIds,
+  configuredOpenRouterWorkspaceProductModelIds,
+  WORKSPACE_GATEWAY_MODEL_ID_PREFIX,
+  WORKSPACE_OPENROUTER_MODEL_ID_PREFIX,
   type Settings,
 } from "@opengeni/config";
 
@@ -96,6 +127,46 @@ export function canonicalWorkspacePolicyModelIds(
   return [...new Set(modelIds.map((modelId) => canonicalizeConfiguredModelId(settings, modelId)))];
 }
 
+function projectWorkspaceGatewayCustomModel(model: {
+  id: string;
+  upstreamModelId: string;
+  label: string | null;
+  version: number;
+  createdAt: Date;
+  updatedAt: Date;
+}) {
+  return WorkspaceGatewayCustomModel.parse({
+    id: model.id,
+    upstreamModelId: model.upstreamModelId,
+    label: model.label,
+    version: model.version,
+    createdAt: model.createdAt.toISOString(),
+    updatedAt: model.updatedAt.toISOString(),
+  });
+}
+
+function projectWorkspaceOpenRouterCustomModel(model: {
+  id: string;
+  upstreamModelId: string;
+  label: string | null;
+  version: number;
+  createdAt: Date;
+  updatedAt: Date;
+}) {
+  return WorkspaceOpenRouterCustomModel.parse({
+    id: model.id,
+    upstreamModelId: model.upstreamModelId,
+    label: model.label,
+    version: model.version,
+    createdAt: model.createdAt.toISOString(),
+    updatedAt: model.updatedAt.toISOString(),
+  });
+}
+
+function workspaceCustomModelRequestHash(value: unknown): string {
+  return createHash("sha256").update(stableJson(value), "utf8").digest("hex");
+}
+
 type WorkspaceMemberProjectionInput = Omit<WorkspaceMemberValue, "permissions"> & {
   permissions: unknown;
 };
@@ -192,7 +263,9 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
         name: payload.name,
         slug: payload.slug ?? null,
         ...(payload.agentInstructions !== undefined
-          ? { agentInstructions: normalizeAgentInstructions(payload.agentInstructions) }
+          ? {
+              agentInstructions: normalizeAgentInstructions(payload.agentInstructions),
+            }
           : {}),
         maxWorkspacesPerAccount: workspaceLimit(deps),
       });
@@ -317,30 +390,351 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:read");
     const [
+      resolvedCatalog,
       policy,
       codexSubscriptionActive,
       xaiSubscriptionActive,
       workspaceGatewayConnectionActive,
+      workspaceGatewayCustomModels,
+      openRouterConnectionActive,
+      workspaceOpenRouterCustomModels,
+      organizationGatewayConnectionActive,
+      organizationOpenRouterConnectionActive,
+      organizationGatewayCustomModels,
+      organizationOpenRouterCustomModels,
     ] = await Promise.all([
+      deps.resolveCatalogSettings(),
       getWorkspaceModelPolicy(deps.db, workspaceId),
       workspaceCodexSubscriptionActive(deps.db, deps.settings, workspaceId),
       workspaceXaiSubscriptionActive(deps.db, deps.settings, workspaceId, grant.subjectId),
       workspaceVercelAiGatewayConnectionActive(deps.db, workspaceId),
+      listWorkspaceGatewayCustomModels(deps.db, {
+        accountId: grant.accountId,
+        workspaceId,
+      }),
+      workspaceOpenRouterConnectionActive(deps.db, workspaceId),
+      listWorkspaceOpenRouterCustomModels(deps.db, {
+        accountId: grant.accountId,
+        workspaceId,
+      }),
+      organizationModelProviderConnectionActiveForWorkspace(deps.db, {
+        accountId: grant.accountId,
+        workspaceId,
+        providerKind: "vercel_gateway",
+      }),
+      organizationModelProviderConnectionActiveForWorkspace(deps.db, {
+        accountId: grant.accountId,
+        workspaceId,
+        providerKind: "openrouter",
+      }),
+      listOrganizationModelProviderCustomModelsForWorkspace(deps.db, {
+        accountId: grant.accountId,
+        workspaceId,
+        providerKind: "vercel_gateway",
+      }),
+      listOrganizationModelProviderCustomModelsForWorkspace(deps.db, {
+        accountId: grant.accountId,
+        workspaceId,
+        providerKind: "openrouter",
+      }),
     ]);
     c.header("cache-control", "private, no-store");
     return c.json(
       WorkspaceModelCatalogResponse.parse(
         buildWorkspaceModelCatalog({
-          settings: deps.settings,
+          settings: resolvedCatalog.settings,
           policy,
           codexSubscriptionActive,
           xaiSubscriptionActive,
           workspaceGatewayConnectionActive,
+          workspaceGatewayCustomModels,
+          workspaceOpenRouterConnectionActive: openRouterConnectionActive,
+          workspaceOpenRouterCustomModels,
+          organizationGatewayConnectionActive,
+          organizationOpenRouterConnectionActive,
+          organizationGatewayCustomModels,
+          organizationOpenRouterCustomModels,
         }),
       ),
     );
   });
 
+  app.get("/v1/workspaces/:workspaceId/gateway-custom-models", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:read");
+    const models = await listWorkspaceGatewayCustomModels(deps.db, {
+      accountId: grant.accountId,
+      workspaceId,
+    });
+    c.header("cache-control", "private, no-store");
+    return c.json(
+      WorkspaceGatewayCustomModelsResponse.parse({
+        models: models.map(projectWorkspaceGatewayCustomModel),
+      }),
+    );
+  });
+
+  app.post("/v1/workspaces/:workspaceId/gateway-custom-models", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const parsed = CreateWorkspaceGatewayCustomModelRequest.safeParse(
+      await c.req.json().catch(() => null),
+    );
+    if (!parsed.success) {
+      throw new HTTPException(422, { message: "invalid Gateway custom model" });
+    }
+    const requestHash = workspaceCustomModelRequestHash({
+      action: "create",
+      upstreamModelId: parsed.data.upstreamModelId,
+      label: parsed.data.label ?? null,
+    });
+    const replay = await replayWorkspaceGatewayCustomModelCreate(deps.db, {
+      accountId: grant.accountId,
+      workspaceId,
+      operationId: parsed.data.operationId,
+      requestHash,
+    });
+    if (replay.outcome === "conflict") {
+      throw new HTTPException(409, {
+        message: "Gateway custom model operation conflicts with current state",
+      });
+    }
+    if (replay.outcome === "success") {
+      return c.json(projectWorkspaceGatewayCustomModel(replay.model), 201);
+    }
+    const catalog = await deps.resolveCatalogSettings();
+    if (configuredGatewayUpstreamModelIds(catalog.settings).includes(parsed.data.upstreamModelId)) {
+      throw new HTTPException(422, {
+        message: "Gateway model is already included in the deployment catalog",
+      });
+    }
+    const customProductId = `${WORKSPACE_GATEWAY_MODEL_ID_PREFIX}${parsed.data.upstreamModelId}`;
+    const deploymentProductIds = new Set([
+      ...configuredModelInputIdentities(catalog.settings),
+      ...configuredGatewayWorkspaceProductModelIds(catalog.settings),
+    ]);
+    if (deploymentProductIds.has(customProductId)) {
+      throw new HTTPException(422, {
+        message: "Gateway model product id conflicts with the deployment catalog",
+      });
+    }
+    try {
+      const model = await createWorkspaceGatewayCustomModel(deps.db, {
+        accountId: grant.accountId,
+        workspaceId,
+        upstreamModelId: parsed.data.upstreamModelId,
+        label: parsed.data.label ?? null,
+        operationId: parsed.data.operationId,
+        requestHash,
+        createdBySubjectId: grant.subjectId,
+      });
+      if (!model || model.retiredAt) {
+        throw new HTTPException(409, {
+          message: "Gateway custom model operation conflicts with current state",
+        });
+      }
+      return c.json(projectWorkspaceGatewayCustomModel(model), 201);
+    } catch (error) {
+      if (
+        error instanceof WorkspaceGatewayCustomModelLimitError ||
+        error instanceof WorkspaceGatewayCustomModelHistoryLimitError
+      ) {
+        throw new HTTPException(422, { message: error.message });
+      }
+      if (nestedPostgresSqlState(error) === "23505") {
+        throw new HTTPException(422, {
+          message: "Gateway custom model already exists",
+        });
+      }
+      throw error;
+    }
+  });
+
+  app.delete("/v1/workspaces/:workspaceId/gateway-custom-models/:customModelId", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const customModelId = c.req.param("customModelId");
+    if (
+      !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(
+        customModelId,
+      )
+    ) {
+      throw new HTTPException(422, {
+        message: "invalid Gateway custom model id",
+      });
+    }
+    const parsed = DeleteWorkspaceGatewayCustomModelRequest.safeParse(
+      await c.req.json().catch(() => null),
+    );
+    if (!parsed.success) {
+      throw new HTTPException(422, {
+        message: "invalid Gateway custom model deletion",
+      });
+    }
+    const removed = await deleteWorkspaceGatewayCustomModel(deps.db, {
+      accountId: grant.accountId,
+      workspaceId,
+      customModelId,
+      expectedVersion: parsed.data.expectedVersion,
+      operationId: parsed.data.operationId,
+      requestHash: workspaceCustomModelRequestHash({
+        action: "delete",
+        customModelId,
+        expectedVersion: parsed.data.expectedVersion,
+      }),
+    });
+    if (removed.outcome === "not_found") {
+      throw new HTTPException(404, {
+        message: "Gateway custom model not found",
+      });
+    }
+    if (removed.outcome === "conflict") {
+      throw new HTTPException(409, {
+        message: "Gateway custom model changed; reload and retry",
+      });
+    }
+    return c.body(null, 204);
+  });
+
+  app.get("/v1/workspaces/:workspaceId/openrouter-custom-models", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:read");
+    const models = await listWorkspaceOpenRouterCustomModels(deps.db, {
+      accountId: grant.accountId,
+      workspaceId,
+    });
+    c.header("cache-control", "private, no-store");
+    return c.json(
+      WorkspaceOpenRouterCustomModelsResponse.parse({
+        models: models.map(projectWorkspaceOpenRouterCustomModel),
+      }),
+    );
+  });
+
+  app.post("/v1/workspaces/:workspaceId/openrouter-custom-models", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const parsed = CreateWorkspaceOpenRouterCustomModelRequest.safeParse(
+      await c.req.json().catch(() => null),
+    );
+    if (!parsed.success) {
+      throw new HTTPException(422, { message: "invalid OpenRouter custom model" });
+    }
+    const requestHash = workspaceCustomModelRequestHash({
+      action: "create",
+      upstreamModelId: parsed.data.upstreamModelId,
+      label: parsed.data.label ?? null,
+    });
+    const replay = await replayWorkspaceOpenRouterCustomModelCreate(deps.db, {
+      accountId: grant.accountId,
+      workspaceId,
+      operationId: parsed.data.operationId,
+      requestHash,
+    });
+    if (replay.outcome === "conflict") {
+      throw new HTTPException(409, {
+        message: "OpenRouter custom model operation conflicts with current state",
+      });
+    }
+    if (replay.outcome === "success") {
+      return c.json(projectWorkspaceOpenRouterCustomModel(replay.model), 201);
+    }
+    const catalog = await deps.resolveCatalogSettings();
+    if (
+      configuredOpenRouterUpstreamModelIds(catalog.settings).includes(parsed.data.upstreamModelId)
+    ) {
+      throw new HTTPException(422, {
+        message: "OpenRouter model is already included in the deployment catalog",
+      });
+    }
+    const customProductId = `${WORKSPACE_OPENROUTER_MODEL_ID_PREFIX}${parsed.data.upstreamModelId}`;
+    const deploymentProductIds = new Set([
+      ...configuredModelInputIdentities(catalog.settings),
+      ...configuredOpenRouterWorkspaceProductModelIds(catalog.settings),
+    ]);
+    if (deploymentProductIds.has(customProductId)) {
+      throw new HTTPException(422, {
+        message: "OpenRouter model product id conflicts with the deployment catalog",
+      });
+    }
+    try {
+      const model = await createWorkspaceOpenRouterCustomModel(deps.db, {
+        accountId: grant.accountId,
+        workspaceId,
+        upstreamModelId: parsed.data.upstreamModelId,
+        label: parsed.data.label ?? null,
+        operationId: parsed.data.operationId,
+        requestHash,
+        createdBySubjectId: grant.subjectId,
+      });
+      if (!model || model.retiredAt) {
+        throw new HTTPException(409, {
+          message: "OpenRouter custom model operation conflicts with current state",
+        });
+      }
+      return c.json(projectWorkspaceOpenRouterCustomModel(model), 201);
+    } catch (error) {
+      if (
+        error instanceof WorkspaceOpenRouterCustomModelLimitError ||
+        error instanceof WorkspaceOpenRouterCustomModelHistoryLimitError
+      ) {
+        throw new HTTPException(422, { message: error.message });
+      }
+      if (nestedPostgresSqlState(error) === "23505") {
+        throw new HTTPException(422, {
+          message: "OpenRouter custom model already exists",
+        });
+      }
+      throw error;
+    }
+  });
+
+  app.delete("/v1/workspaces/:workspaceId/openrouter-custom-models/:customModelId", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const customModelId = c.req.param("customModelId");
+    if (
+      !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(
+        customModelId,
+      )
+    ) {
+      throw new HTTPException(422, {
+        message: "invalid OpenRouter custom model id",
+      });
+    }
+    const parsed = DeleteWorkspaceOpenRouterCustomModelRequest.safeParse(
+      await c.req.json().catch(() => null),
+    );
+    if (!parsed.success) {
+      throw new HTTPException(422, {
+        message: "invalid OpenRouter custom model deletion",
+      });
+    }
+    const removed = await deleteWorkspaceOpenRouterCustomModel(deps.db, {
+      accountId: grant.accountId,
+      workspaceId,
+      customModelId,
+      expectedVersion: parsed.data.expectedVersion,
+      operationId: parsed.data.operationId,
+      requestHash: workspaceCustomModelRequestHash({
+        action: "delete",
+        customModelId,
+        expectedVersion: parsed.data.expectedVersion,
+      }),
+    });
+    if (removed.outcome === "not_found") {
+      throw new HTTPException(404, {
+        message: "OpenRouter custom model not found",
+      });
+    }
+    if (removed.outcome === "conflict") {
+      throw new HTTPException(409, {
+        message: "OpenRouter custom model changed; reload and retry",
+      });
+    }
+    return c.body(null, 204);
+  });
+
   app.get("/v1/workspaces/:workspaceId/realtime-model-catalog", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:read");
@@ -417,11 +811,15 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
     const payload = UpdateWorkspaceModelPolicyRequest.parse(await c.req.json());
+    const catalog = await resolveWorkspaceCatalogSettings(deps.db, deps.settings, {
+      accountId: grant.accountId,
+      workspaceId,
+    });
     const policy = await upsertWorkspaceModelPolicy(deps.db, {
       accountId: grant.accountId,
       workspaceId,
       allowedProviders: payload.allowedProviders ?? null,
-      allowedModels: canonicalWorkspacePolicyModelIds(deps.settings, payload.allowedModels),
+      allowedModels: canonicalWorkspacePolicyModelIds(catalog.settings, payload.allowedModels),
     });
     return c.json(policy);
   });
@@ -513,65 +911,10 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.delete("/v1/workspaces/:workspaceId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
-    // The DB transaction locks the account/workspace and every existing
-    // session/lease before checking runtime quiescence, then returns the exact
-    // external schedules removed by the cascade. A racing cold->warm transition
-    // can therefore never erase the only provider/capture ownership receipt.
-    const deleteObserver = workspaceDeleteObserver(deps.observability, {
-      accountId: grant.accountId,
-      workspaceId,
-    });
-    const deleted = await deleteWorkspaceIfQuiescent(deps.db, {
+    await deleteWorkspaceForRequest(deps, {
       accountId: grant.accountId,
       workspaceId,
-      ...(deleteObserver ? { observer: deleteObserver } : {}),
     });
-    if (deleted.status === "not_found") {
-      throw new HTTPException(404, { message: "workspace not found" });
-    }
-    if (deleted.status === "only_workspace") {
-      throw new HTTPException(409, {
-        message: "cannot delete the account's only workspace",
-      });
-    }
-    if (deleted.status === "active_sessions") {
-      throw new HTTPException(409, {
-        message: "stop the workspace's running sessions before deleting it",
-      });
-    }
-    if (deleted.status === "active_video_generations") {
-      throw new HTTPException(409, {
-        message: "wait for the workspace's active video generations to finish before deleting it",
-      });
-    }
-    if (deleted.status === "active_background_commands") {
-      throw new HTTPException(409, {
-        message: "pause or cancel the workspace's background commands before deleting it",
-      });
-    }
-    if (deleted.status === "live_sandboxes") {
-      throw new HTTPException(409, {
-        message: "wait for the workspace's active sandboxes to finish draining before deleting it",
-      });
-    }
-    if (deleted.status !== "deleted") {
-      throw new Error(`Unhandled workspace deletion outcome: ${deleted.status}`);
-    }
-    // The cleanup claims were inserted in the same transaction as the cascade.
-    // Try them immediately; failures are released to the replica-safe outbox
-    // pump, so a process crash or Temporal outage cannot orphan the schedules.
-    await processTemporalScheduleCleanupClaims(
-      {
-        db: deps.db,
-        deleteSchedule: async (temporalScheduleId) => {
-          await deps.workflowClient.deleteScheduledTaskSchedule({
-            temporalScheduleId,
-          });
-        },
-        ...(deps.observability ? { observability: deps.observability } : {}),
-      },
-      deleted.temporalScheduleCleanups,
-    );
     return c.body(null, 204);
   });
 

package/src/sandbox/channel-a.ts

@@ -65,9 +65,11 @@ import {
   NatsOpStreamTransport,
   SandboxResumeIdentityMismatchError,
   SandboxResumeIdentityUnavailableError,
+  RoutingActiveRouteChangedError,
   RoutingWorkspaceRootChangedError,
   SelfhostedWorkspaceRootChangedError,
   ChannelAConflictError,
+  ChannelAFileSystemRouteChangedError,
   ChannelANotFoundError,
   ChannelAUnsupportedError,
   ChannelAUnavailableError,
@@ -612,11 +614,18 @@ async function withChannelAOperation<T>(
           codemodeTokenFileFromEnvironment(environment, session.id),
         )
       : credentialSession;
-    const fileSystemRoot = await routingSession.fileSystemRoot();
+    const fileSystemAuthority = await routingSession.fileSystemAuthority();
+    const fileSystemEpoch =
+      fileSystemAuthority.backendKind === "selfhosted"
+        ? fileSystemAuthority.activeEpoch
+        : (lease?.leaseEpoch ?? fileSystemAuthority.activeEpoch);
     const service = new SandboxChannelAService({
       session: scopedSession as ChannelASession,
-      workspaceRoot: fileSystemRoot,
-      leaseEpoch: lease?.leaseEpoch ?? session.activeEpoch,
+      workspaceRoot: fileSystemAuthority.root,
+      leaseEpoch: fileSystemEpoch,
+      ...(fileSystemAuthority.backendKind === "selfhosted"
+        ? { providerPathMode: "workspace-relative" as const, fileReadScope: "machine" as const }
+        : {}),
       emit,
     });
     const result = await fn({
@@ -1200,8 +1209,10 @@ export function mapChannelAError(error: unknown, waitSignal?: AbortSignal): unkn
   )
     return new HTTPException(409, { message: error.message });
   if (
+    error instanceof RoutingActiveRouteChangedError ||
     error instanceof RoutingWorkspaceRootChangedError ||
-    error instanceof SelfhostedWorkspaceRootChangedError
+    error instanceof SelfhostedWorkspaceRootChangedError ||
+    error instanceof ChannelAFileSystemRouteChangedError
   )
     return new ApiHttpError(409, {
       code: "conflict",
@@ -1299,8 +1310,10 @@ export function channelAOperationFailureDiagnostic(
   if (
     error instanceof SandboxResumeIdentityMismatchError ||
     error instanceof SandboxResumeIdentityUnavailableError ||
+    error instanceof RoutingActiveRouteChangedError ||
     error instanceof RoutingWorkspaceRootChangedError ||
     error instanceof SelfhostedWorkspaceRootChangedError ||
+    error instanceof ChannelAFileSystemRouteChangedError ||
     (error instanceof HTTPException && error.status === 409)
   ) {
     return {

package/src/work-discovery-observability.ts

@@ -19,7 +19,7 @@ export type WorkDiscoveryObservation = {
 };
 
 type WorkDiscoveryObservedRow = {
-  relatedWork: {
+  relatedWork?: {
     match: { class: WorkDiscoveryMatchClass } | null;
     possibleOverlap: boolean;
   };
@@ -35,8 +35,8 @@ export function summarizeWorkDiscoveryRows(
   const matchCounts: WorkDiscoveryObservation["matchCounts"] = {};
   let overlapCount = 0;
   for (const row of rows) {
-    if (row.relatedWork.possibleOverlap) overlapCount += 1;
-    const matchClass = row.relatedWork.match?.class;
+    if (row.relatedWork?.possibleOverlap) overlapCount += 1;
+    const matchClass = row.relatedWork?.match?.class;
     if (matchClass) matchCounts[matchClass] = (matchCounts[matchClass] ?? 0) + 1;
   }
   return { resultCount: rows.length, overlapCount, matchCounts };