@opengeni/api-router 3.1.3-canary.38890816741001 → 3.3.0

package/dist/integrations/external-vault-providers.d.ts

@@ -0,0 +1,29 @@
+import type { Settings } from "@opengeni/config";
+import type { ExternalVaultProviderFactories } from "@opengeni/core";
+import { type PinnedFetchOptions } from "@opengeni/network";
+import type { KeeperRuntimeOptions } from "@opengeni/vaults-keeper";
+/** Test seams only; production passes nothing. */
+export type NativeExternalVaultOptions = {
+    keeper?: Pick<KeeperRuntimeOptions, "queryFunction" | "fetchFile" | "sdk">;
+    /** Applies when this call creates the pool for its CLI path. */
+    protonpass?: {
+        stateRoot?: string;
+        hostEnv?: Readonly<Record<string, string | undefined>>;
+    };
+};
+/**
+ * Native external vault adapters that run inside this server: Keeper Secrets
+ * Manager always, Proton Pass only when the operator installed `pass-cli`
+ * (`OPENGENI_PROTON_PASS_CLI_PATH`). Both packages load through `import()`
+ * on first use (packages/vaults-keeper/test/import-guard.test.ts). Keep this
+ * file identical to apps/worker/src/external-vault-providers.ts.
+ */
+export declare function createNativeExternalVaultFactories(settings: Settings, options?: NativeExternalVaultOptions): ExternalVaultProviderFactories;
+/** Logs out every pooled Proton Pass CLI session and wipes its state (graceful shutdown). */
+export declare function closeNativeExternalVaultProviders(): Promise<void>;
+/**
+ * The fetch every Keeper request and file download uses: DNS-pinned and
+ * policy-checked (no private or special-use targets). The adapter adds
+ * HTTPS-only, no redirects, deadlines, size bounds and the caller's abort.
+ */
+export declare function nativeKeeperFetch(settings: Settings, pinned?: Pick<PinnedFetchOptions, "dnsLookup" | "fetchImpl" | "agentFactory">): (input: string | URL, init: RequestInit) => Promise<Response>;

package/dist/interaction-secrets-vault.d.ts

@@ -7,7 +7,7 @@ import type { VaultProviderRegistry } from "@opengeni/vaults";
 import { type BrowserPasskeyCredentialMaterial } from "@opengeni/contracts";
 import { type VaultService } from "@opengeni/core";
 import { type Database } from "@opengeni/db";
-import type { InteractionSecretsPort } from "./interaction-secrets.js";
+import type { AttemptSecretPrincipal, InteractionSecretsPort } from "./interaction-secrets.js";
 export declare function passkeyItemName(credential: BrowserPasskeyCredentialMaterial): string;
 export declare function createVaultInteractionSecretsPort(deps: {
     db: Database;
@@ -16,5 +16,5 @@ export declare function createVaultInteractionSecretsPort(deps: {
     /** Defaults to a service over the same database and key. */
     vaultService?: VaultService;
     /** Connected vaults (1Password, host) for a workspace's acting subject. */
-    providersFor?: (workspaceId: string, subjectId: string | null) => VaultProviderRegistry;
+    providersFor?: (workspaceId: string, subjectId: string | null, principal?: AttemptSecretPrincipal) => VaultProviderRegistry;
 }): InteractionSecretsPort;

package/dist/mcp/action-descriptions.d.ts

@@ -1,4 +1,4 @@
 import type { ActionCatalogEntry } from "./action-catalog-types.js";
-/** Actions that must carry a description (subscription and model settings). */
+/** Actions that must carry a description (subscriptions, models and vault connections). */
 export declare const DESCRIBED_ACTION_PATH: RegExp;
 export declare function actionDescription(entry: Pick<ActionCatalogEntry, "method" | "path">): string | undefined;

package/dist/mcp/scheduled-task-view.d.ts

@@ -83,8 +83,8 @@ export declare function scheduledTaskMcpSummary(task: ScheduledTask): {
     runMode: "existing_session" | "new_session_per_run" | "reusable_session";
     overlapPolicy: "allow_concurrent" | "buffer_one" | "skip";
     action: {
-        readonly sourceId?: never;
         kind: "agent_turn";
+        sourceId?: never;
         sourceGeneration?: never;
         sourceLifecycleGeneration?: never;
         destination?: never;
@@ -221,8 +221,8 @@ export declare function boundScheduledTaskDetailMcp(task: ScheduledTask): {
     runMode: "existing_session" | "new_session_per_run" | "reusable_session";
     overlapPolicy: "allow_concurrent" | "buffer_one" | "skip";
     action: {
-        readonly sourceId?: never;
         kind: "agent_turn";
+        sourceId?: never;
         sourceGeneration?: never;
         sourceLifecycleGeneration?: never;
         destination?: never;
@@ -408,8 +408,8 @@ export declare function boundScheduledTaskDetailMcp(task: ScheduledTask): {
     runMode: "existing_session" | "new_session_per_run" | "reusable_session";
     overlapPolicy: "allow_concurrent" | "buffer_one" | "skip";
     action: {
-        readonly sourceId?: never;
         kind: "agent_turn";
+        sourceId?: never;
         sourceGeneration?: never;
         sourceLifecycleGeneration?: never;
         destination?: never;
@@ -601,8 +601,8 @@ export declare function boundScheduledTaskMcpPage(input: {
         runMode: "existing_session" | "new_session_per_run" | "reusable_session";
         overlapPolicy: "allow_concurrent" | "buffer_one" | "skip";
         action: {
-            readonly sourceId?: never;
             kind: "agent_turn";
+            sourceId?: never;
             sourceGeneration?: never;
             sourceLifecycleGeneration?: never;
             destination?: never;

package/dist/routes/vault-providers.d.ts

@@ -1,7 +1,7 @@
 import type { Hono } from "hono";
-import { type ApiRouteDeps, type OnePasswordConnectionMetadata, type OnePasswordVaultProviderFactory } from "@opengeni/core";
+import { type ApiRouteDeps, type OnePasswordConnectionMetadata, type OnePasswordVaultProviderFactory, type ExternalVaultProviderFactories } from "@opengeni/core";
 import { type VaultDbContext } from "@opengeni/db";
-import { type VaultProvider, type VaultProviderRegistry } from "@opengeni/vaults";
+import { type VaultProvider, type VaultProviderRegistry, type VaultProviderAuthority } from "@opengeni/vaults";
 export declare function onePasswordFactoryFor(deps: ApiRouteDeps): OnePasswordVaultProviderFactory;
 /**
  * The 1Password provider for a stored connection the caller can see, plus its
@@ -23,7 +23,9 @@ export declare function onePasswordProviderForConnection(deps: ApiRouteDeps, inp
 export declare function vaultProviderRegistryFor(deps: ApiRouteDeps, input: {
     workspaceId: string;
     subjectId: string | null;
+    executionContext?: Pick<VaultProviderAuthority, "sessionId" | "turnId" | "attemptId" | "siteId">;
 }): VaultProviderRegistry;
+export declare function externalVaultFactoriesFor(deps: ApiRouteDeps): ExternalVaultProviderFactories;
 export type LinkedVaultLookup = (input: {
     workspaceId: string;
     connectionId: string;

package/dist/sandbox/channel-a.d.ts

@@ -1,6 +1,6 @@
 import { type Settings } from "@opengeni/config";
 import type { AccessGrant, Session } from "@opengeni/contracts";
-import { type Database, type LeaseSnapshot } from "@opengeni/db";
+import { type Database, type EnrollmentRecord, type LeaseSnapshot } from "@opengeni/db";
 import { type EventBus } from "@opengeni/events";
 import { type Observability } from "@opengeni/observability";
 import type { ObjectStorage } from "@opengeni/storage";
@@ -56,6 +56,15 @@ export type ChannelAHandle = {
      * who started an agent's turn, or the calling person. Routes that look up
      * the routed machine again must use it rather than the raw caller grant. */
     machineAuthority: () => Promise<ChannelAMachineAuthority>;
+    /** For a machine-home request, the Connected Machine and live runner this
+     * request was pinned to under `machineAuthority`. The routing session fails
+     * rather than follow a changed pointer, so a route that resolved this same
+     * sandbox can use it instead of looking the machine up again. */
+    pinnedMachine: {
+        sandboxId: string;
+        sandboxWorkspaceId: string;
+        enrollment: EnrollmentRecord;
+    } | null;
     requestId: string;
 };
 export type EstablishedHandleCacheKind = "read" | "process" | "none";

package/dist/shutdown.d.ts

@@ -0,0 +1,14 @@
+type ShutdownSignal = "SIGINT" | "SIGTERM";
+type ShutdownProcess = {
+    on(signal: ShutdownSignal, handler: () => void): unknown;
+    off(signal: ShutdownSignal, handler: () => void): unknown;
+    exit(code: number): void;
+};
+/** Standalone process boundary; embedded hosts keep owning their explicit close(). */
+export declare function installApiShutdownHandlers(input: {
+    close: () => Promise<void>;
+    process?: ShutdownProcess;
+    timeoutMs?: number;
+    onFailure?: () => void;
+}): () => void;
+export {};

package/dist/site-publishing/agent-data-tools.d.ts

@@ -1,5 +1,5 @@
-import { type FirstPartyMcpToolName, type SiteLimitProfileKind } from "@opengeni/contracts";
-import type { ApiRouteDeps } from "@opengeni/core";
+import { type FirstPartyMcpToolName, type Permission, type SiteLimitProfileKind } from "@opengeni/contracts";
+import { type ApiRouteDeps } from "@opengeni/core";
 import { type SiteRuntimeConversationViewerKind } from "@opengeni/db";
 import type { PublishedSiteDataViewer } from "../site-data/service.js";
 import { type SiteRuntimeHost } from "./runtime.js";
@@ -21,8 +21,6 @@ import { type SiteRuntimeHost } from "./runtime.js";
 export declare const SITE_AGENT_DATA_TOOLS: readonly ["site_data_query", "site_data_write"];
 export declare const SITE_AGENT_SQL_TOOLS: readonly ["site_sql_run"];
 export declare const SITE_AGENT_MEMBER_SQL_TOOLS: readonly ["site_sql_query"];
-/** The first-party permissions those tools need (Site Data writes need publish). */
-export declare const SITE_AGENT_DATA_TOOL_PERMISSIONS: readonly ["artifacts:read", "artifacts:publish"];
 export declare const SITE_AGENT_OTHER_SITE_MESSAGE = "This Site's assistant can only use this Site's data";
 export declare const SITE_AGENT_MANAGEMENT_MESSAGE = "This Site's assistant can use the Site's data, not manage the Site";
 /** The data tools one viewer's Site agent conversation gets, within the deployment's tools. */
@@ -32,6 +30,8 @@ export declare function siteAgentDataToolNames(input: {
     siteSql: boolean;
     /** The deployment's first-party tool allowlist. */
     allowed: readonly string[];
+    /** Live member ceiling; omitted only where the native caller filters tools itself. */
+    memberPermissions?: readonly Permission[];
 }): FirstPartyMcpToolName[];
 /** Whether Site SQL is offered on this deployment and turned on for the Site. */
 export declare function siteAgentSiteSqlOn(deps: Pick<ApiRouteDeps, "db" | "settings">, scope: {
@@ -42,7 +42,7 @@ export declare function siteAgentSiteSqlOn(deps: Pick<ApiRouteDeps, "db" | "sett
 export declare function siteAgentDataToolsForStart(deps: Pick<ApiRouteDeps, "db" | "settings">, scope: {
     accountId: string;
     workspaceId: string;
-}, siteId: string, viewerKind: SiteRuntimeConversationViewerKind): Promise<FirstPartyMcpToolName[]>;
+}, siteId: string, viewerKind: SiteRuntimeConversationViewerKind, memberPermissions?: readonly Permission[]): Promise<FirstPartyMcpToolName[]>;
 /** This Site's viewer (`user:<subject>` or `guest:<visitor>`) as Site Data and Site SQL see it. */
 export declare function sitePublishedDataViewer(host: Pick<SiteRuntimeHost, "scope" | "site">, principal: string, guest: boolean): PublishedSiteDataViewer;
 /**

package/dist/site-publishing/agent-session.d.ts

@@ -1,7 +1,8 @@
+import { type Permission } from "@opengeni/contracts";
 import { type ApiRouteDeps } from "@opengeni/core";
 import type { SiteRuntimeHost } from "./runtime.js";
 import type { SiteRuntimeViewer } from "./viewer.js";
-export declare const SITE_AGENT_DEFAULTS_VERSION = 1;
+export declare const SITE_AGENT_DEFAULTS_VERSION = 2;
 /**
  * Before admitting more work, converge pre-redesign published-host sessions to
  * the same Site-local tools as a new conversation. This is a trusted host
@@ -13,4 +14,4 @@ export declare const SITE_AGENT_DEFAULTS_VERSION = 1;
  * audit event and completion marker atomic. Failed writes remain retryable.
  * Existing attempts keep their accepted execution policy; no turn is rewritten.
  */
-export declare function normalizeSiteAgentSession(deps: Pick<ApiRouteDeps, "db" | "settings" | "bus" | "objectStorage">, host: SiteRuntimeHost, viewer: SiteRuntimeViewer, sessionId: string, retainedToolIds: readonly string[]): Promise<void>;
+export declare function normalizeSiteAgentSession(deps: Pick<ApiRouteDeps, "db" | "settings" | "bus" | "objectStorage">, host: SiteRuntimeHost, viewer: SiteRuntimeViewer, sessionId: string, retainedToolIds: readonly string[], memberPermissions?: readonly Permission[]): Promise<void>;

package/dist/site-publishing/runtime.d.ts

@@ -7,8 +7,8 @@ import { type SiteRuntimeViewer } from "./viewer.js";
 /**
  * Site-runtime: the narrow API a Site gateway calls for one published Site
  * host, after the gateway signature passed. Everything here works for exactly
- * one Site: the host names it, the viewer is resolved for it, and the agent
- * principal is `site:<siteId>`.
+ * one Site: the host names it and the viewer is resolved for it. Members retain
+ * their human identity; outsiders use the viewer-bound `site:<siteId>` principal.
  */
 export type SiteRuntimeDeps = Pick<ApiRouteDeps, "db" | "settings" | "objectStorage">;
 export type SiteRuntimeHost = {
@@ -43,7 +43,7 @@ export declare function resolveSiteRuntimeViewer(deps: SiteRuntimeDeps, host: Si
     ignoreViewAs?: boolean;
 }): Promise<SiteRuntimeViewer>;
 /** What a viewer cannot do on a Site: 403 with `details.code` `not_available_for_viewer`. */
-export type SiteViewerFeature = "agent" | "agent_model" | "workspace_tools" | "site_data" | "site_sql";
+export type SiteViewerFeature = "agent" | "private_conversations" | "agent_model" | "workspace_tools" | "site_data" | "site_sql";
 export declare function siteNotAvailableForViewer(feature: SiteViewerFeature, message: string, extra?: Record<string, unknown>): import("../http/api-error.js").ApiHttpError;
 /** The viewer capabilities a page reads from `site.config` to hide what won't work. */
 export declare function siteViewerCapabilities(deps: SiteRuntimeDeps, host: SiteRuntimeHost, viewer: SiteRuntimeViewer, limits: SiteLimits): SiteViewerCapabilities;
@@ -160,9 +160,9 @@ export declare function meterSiteRuntime(deps: SiteRuntimeDeps, host: SiteRuntim
     viewer?: SiteRuntimeViewer;
 }): Promise<void>;
 /**
- * Run an ordinary session route in this process as the Site's service
- * principal (`site:<siteId>`), with a 60-second delegated token carrying only
- * session permissions and the viewer as its display label. The Site and the
+ * Run an ordinary session route in this process as the verified member, or
+ * the Site service principal for an outsider. The latter uses a 60-second
+ * delegated token plus the separate trusted viewer audience. The Site and the
  * served version ride along as the request's Site origin, so new sessions and
  * turns record where they came from. The route authorizes as usual.
  */
@@ -174,6 +174,7 @@ export declare function siteRuntimeSessionRequest(deps: SiteRuntimeDeps, host: S
     path: string;
     body?: unknown;
     extraPermissions?: readonly Permission[];
+    reauthorize: () => Promise<void>;
 }): Promise<Request>;
 /** A forwarded response without cookies (site-runtime never sets any). */
 export declare function siteRuntimeForwardedResponse(response: Response): Response;

package/dist/site-publishing/service.d.ts

@@ -1,6 +1,6 @@
 import { type ErrorCode, type Permission, type SiteHostMapRecord, type SiteHostnameAvailability, type SitePublication, type UpsertSitePublicationRequest } from "@opengeni/contracts";
 import type { AccessGrant } from "@opengeni/contracts";
-import { type ApiRouteDeps } from "@opengeni/core";
+import { type ApiRouteDeps, type cancelPublishedSiteSession } from "@opengeni/core";
 import { SitePublishingError, type PublishedSiteRecord, type SiteDataSite, type SiteHostnameEdgeState, type SitePublicationRecord, type SitePublishingScope, type StoredSiteLimitProfile } from "@opengeni/db";
 import { ApiHttpError } from "../http/api-error.js";
 import { type SiteContentScanner } from "./content-scanner.js";
@@ -40,13 +40,12 @@ export type SitePublishingEffects = {
 };
 /** Background effects running at once per process. */
 export declare const SITE_EFFECT_CONCURRENCY = 4;
+type SiteCancellation = (input: Parameters<typeof cancelPublishedSiteSession>[1]) => Promise<unknown>;
 /**
- * The app's in-process dispatch, registered with the site-runtime routes, so
- * publication changes can cancel a Site's conversations through the ordinary
- * session routes. Without it (the operator script) cancellation is skipped.
+ * Internal host lifecycle adapter. This never grants the Site service bearer
+ * ordinary session access and never impersonates a conversation's viewer.
  */
-export declare function setSitePublishingDispatch(settings: ApiRouteDeps["settings"], dispatch: (request: Request) => Promise<Response>): void;
-export declare function sitePublishingDispatch(settings: ApiRouteDeps["settings"]): ((request: Request) => Promise<Response>) | null;
+export declare function setSitePublishingCancellation(settings: ApiRouteDeps["settings"], cancel: SiteCancellation): void;
 type SitePublishingEffectsOptions = {
     fetch?: typeof fetch;
     backoffMs?: number;
@@ -164,11 +163,9 @@ export declare function siteServiceSessionRequest(deps: Pick<SitePublishingDeps,
  * Stop a Site's viewers after a takedown, unpublish or narrower access:
  * revoke every site-session now, and after commit cancel the Site's agent
  * conversations that may still be working (in-flight turns and queued
- * messages), as the Site itself through the ordinary control route. The
- * gateway refuses new work at once regardless: every site-runtime call
- * re-checks the publication. Without an in-process dispatch (the operator
- * script) the cancellation is skipped and logged; per-conversation caps
- * still bound what running turns can spend.
+ * messages), through the native cancel-only lifecycle adapter. The original
+ * actor survives queued background execution. No transcript access is granted.
+ * Every page is drained, including old conversations; there is no age cutoff.
  */
 export declare function stopSiteViewers(deps: SitePublishingDeps, scope: SitePublishingScope, siteId: string, options: {
     revokeSessions?: boolean;

package/dist/site-publishing/session-request-authority.d.ts

@@ -0,0 +1,3 @@
+export declare function bindSiteSessionRequestAuthority(request: Request, reauthorize: () => Promise<void>): void;
+/** Periodic SSE reauthorization must check the Site cookie, not only its delegate. */
+export declare function reauthorizeSiteSessionRequest(request: Request): Promise<void>;

package/dist/workspace-tool-gateway-secrets.d.ts

@@ -23,5 +23,5 @@ export declare function workspaceGatewaySecretArguments(input: {
     settings: Settings;
     grant: AccessGrant;
     /** Connected vaults (1Password, host) for the resolved acting subject. */
-    providersForSubject?: ((subjectId: string | null) => VaultProviderRegistry) | undefined;
+    providersForSubject?: ((subjectId: string | null, site?: SiteSecretContext | null) => VaultProviderRegistry) | undefined;
 }): ToolGatewayArgumentResolver;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/api-router",
-  "version": "3.1.3-canary.38890816741001",
+  "version": "3.3.0",
   "description": "Opengeni HTTP surface: the Hono adapter/router (createApp), routes, MCP HTTP transport, and HTTP access adapters over @opengeni/core. An engine-distribution surface — its runtime closure includes engine-internal packages.",
   "license": "Apache-2.0",
   "repository": {
@@ -42,29 +42,32 @@
     "@aws-sdk/client-s3": "^3.1044.0",
     "@aws-sdk/s3-request-presigner": "^3.1044.0",
     "@hono/zod-validator": "^0.7.6",
+    "@keeper-security/secrets-manager-core": "17.6.0",
     "@llamaindex/liteparse": "2.14.2",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/agent-proto": "3.1.3-canary.38890816741001",
-    "@opengeni/artifact-tool": "3.1.3-canary.38890816741001",
-    "@opengeni/capabilities": "3.1.3-canary.38890816741001",
-    "@opengeni/codemode": "3.1.3-canary.38890816741001",
-    "@opengeni/codex": "3.1.3-canary.38890816741001",
-    "@opengeni/config": "3.1.3-canary.38890816741001",
-    "@opengeni/contracts": "3.1.3-canary.38890816741001",
-    "@opengeni/core": "3.1.3-canary.38890816741001",
-    "@opengeni/db": "3.1.3-canary.38890816741001",
-    "@opengeni/documents": "3.1.3-canary.38890816741001",
-    "@opengeni/events": "3.1.3-canary.38890816741001",
-    "@opengeni/github": "3.1.3-canary.38890816741001",
-    "@opengeni/interaction": "3.1.3-canary.38890816741001",
-    "@opengeni/network": "3.1.3-canary.38890816741001",
-    "@opengeni/observability": "3.1.3-canary.38890816741001",
-    "@opengeni/runtime": "3.1.3-canary.38890816741001",
-    "@opengeni/storage": "3.1.3-canary.38890816741001",
-    "@opengeni/tool-gateway": "3.1.3-canary.38890816741001",
-    "@opengeni/vaults": "3.1.3-canary.38890816741001",
-    "@opengeni/vaults-onepassword": "3.1.3-canary.38890816741001",
-    "@opengeni/xai-subscription": "3.1.3-canary.38890816741001",
+    "@opengeni/agent-proto": "3.3.0",
+    "@opengeni/artifact-tool": "3.3.0",
+    "@opengeni/capabilities": "3.3.0",
+    "@opengeni/codemode": "3.3.0",
+    "@opengeni/codex": "3.3.0",
+    "@opengeni/config": "3.3.0",
+    "@opengeni/contracts": "3.3.0",
+    "@opengeni/core": "3.3.0",
+    "@opengeni/db": "3.3.0",
+    "@opengeni/documents": "3.3.0",
+    "@opengeni/events": "3.3.0",
+    "@opengeni/github": "3.3.0",
+    "@opengeni/interaction": "3.3.0",
+    "@opengeni/network": "3.3.0",
+    "@opengeni/observability": "3.3.0",
+    "@opengeni/runtime": "3.3.0",
+    "@opengeni/storage": "3.3.0",
+    "@opengeni/tool-gateway": "3.3.0",
+    "@opengeni/vaults": "3.3.0",
+    "@opengeni/vaults-keeper": "3.3.0",
+    "@opengeni/vaults-onepassword": "3.3.0",
+    "@opengeni/vaults-protonpass": "3.3.0",
+    "@opengeni/xai-subscription": "3.3.0",
     "@temporalio/client": "^1.17.0",
     "ajv": "^8.20.0",
     "better-auth": "^1.6.14",

package/src/access-grant-rls.ts

@@ -87,6 +87,7 @@ export async function withAccessGrantSessionRlsContext<T>(
           {
             subjectId: actor.subjectId,
             initiatingHumanSubjectId: actor.initiatingHumanSubjectId,
+            agentRootSessionId: actor.callerRootSessionId,
             privateFileOwnerSubjectId:
               learning.defaultScope === "personal" ? learning.subjectId : null,
           },

package/src/app.ts

@@ -2200,8 +2200,20 @@ export function createAppComposition(deps: AppDependencies): {
   const interactionSecrets = createVaultInteractionSecretsPort({
     db: routeDeps.db,
     encryptionKey: environmentsEncryptionKeyBytes(routeDeps.settings) ?? null,
-    providersFor: (workspaceId, subjectId) =>
-      vaultProviderRegistryFor(routeDeps, { workspaceId, subjectId }),
+    providersFor: (workspaceId, subjectId, principal) =>
+      vaultProviderRegistryFor(routeDeps, {
+        workspaceId,
+        subjectId,
+        ...(principal
+          ? {
+              executionContext: {
+                sessionId: principal.sessionId,
+                turnId: principal.turnId,
+                attemptId: principal.attemptId,
+              },
+            }
+          : {}),
+      }),
   });
   registerBrowserSessionRoutes(app, routeDeps, { interactionSecrets });
   registerComputerSessionRoutes(app, routeDeps, { interactionSecrets });

package/src/http/sse.ts

@@ -7,6 +7,7 @@ import {
   getWorkspaceInteractionRevisionState,
   listSessionEventPage,
   listWorkspaceControlEvents,
+  getWorkspaceControlEvent,
   readSessionEventStorageGapEnd,
   type Database,
 } from "@opengeni/db";
@@ -677,7 +678,10 @@ export async function sseWorkspaceControlStream(
         }
       }
     }
-    await writeFrame(formatWorkspaceControlEventSse(event));
+    // The bus is workspace-wide, not an authorization projection. Re-read the
+    // exact durable row under this stream's actor before delivering live data.
+    const visible = await getWorkspaceControlEvent(db, workspaceId, event.id);
+    if (visible) await writeFrame(formatWorkspaceControlEventSse(visible));
     lastSent = event.sequence;
   };
   delivery = createLatestWinsDelivery(send, fail);

package/src/index.ts

@@ -52,6 +52,7 @@ import { createAutomaticAgentUpdater } from "./sandbox/agent-update";
 import { startSlackInteractionPump } from "./integrations/slack-interactions";
 import { startMemorySlackPublicationPump } from "./memory-slack-delivery";
 import { startTemporalScheduleCleanupPump } from "./temporal-schedule-cleanup";
+import { closeNativeExternalVaultProviders } from "./integrations/external-vault-providers";
 import { startScheduledTaskLifecyclePump } from "./scheduled-task-lifecycle";
 import { createTemporalScheduleSynchronizer } from "./temporal-schedule-sync";
 import { startNativePushDispatchPump } from "./native-push-dispatch";
@@ -73,6 +74,7 @@ import {
   type StandaloneEditableArtifactApplication,
 } from "./editable-artifact-production";
 import { installApiFatalProcessBoundary } from "./fatal-process-boundary";
+import { installApiShutdownHandlers } from "./shutdown";
 
 /**
  * A REJECT_DUPLICATE start collides on the deterministic workflowId when the
@@ -590,6 +592,8 @@ export async function startApi(
     server,
     close: async () => {
       server.stop(true);
+      // Start private CLI session cleanup even if another service's drain stalls.
+      const vaultProvidersClosed = closeNativeExternalVaultProviders().catch(() => undefined);
       metricsServer?.stop(true);
       stopSlackInteractionPump?.();
       await stopMemorySlackPublicationPump();
@@ -602,6 +606,7 @@ export async function startApi(
       // Write queued presence before the database pool closes.
       await routeDeps.userPresence?.close().catch(() => undefined);
       await Promise.allSettled([
+        vaultProvidersClosed,
         Promise.resolve(editableArtifactComposition?.close()),
         authCalloutResponder?.close(),
         bus.close(),
@@ -618,7 +623,14 @@ if (import.meta.main) {
     const settings = getSettings();
     const observability = createObservability(settings, { component: "api" });
     fatalBoundary.attachObservability(observability);
-    await startApi({ settings, observability });
+    const api = await startApi({ settings, observability });
+    installApiShutdownHandlers({
+      close: api.close,
+      onFailure: () =>
+        observability.warn("Opengeni API shutdown did not finish cleanly", {
+          errorCode: "api_shutdown_failed",
+        }),
+    });
     fatalBoundary.markRunning();
   } catch (error) {
     await fatalBoundary.reportStartupFailure(error);

package/src/integrations/external-vault-providers.ts

@@ -0,0 +1,136 @@
+import type { Settings } from "@opengeni/config";
+import type {
+  ExternalVaultProviderFactories,
+  ExternalVaultProviderFactory,
+  StoredVaultProviderCredentials,
+} from "@opengeni/core";
+import { pinnedFetch, type PinnedFetchOptions } from "@opengeni/network";
+import { VaultProviderError } from "@opengeni/vaults";
+import type { KeeperRuntimeOptions } from "@opengeni/vaults-keeper";
+import type { ProtonPassProviderPool } from "@opengeni/vaults-protonpass";
+
+/** Test seams only; production passes nothing. */
+export type NativeExternalVaultOptions = {
+  keeper?: Pick<KeeperRuntimeOptions, "queryFunction" | "fetchFile" | "sdk">;
+  /** Applies when this call creates the pool for its CLI path. */
+  protonpass?: { stateRoot?: string; hostEnv?: Readonly<Record<string, string | undefined>> };
+};
+
+/**
+ * Native external vault adapters that run inside this server: Keeper Secrets
+ * Manager always, Proton Pass only when the operator installed `pass-cli`
+ * (`OPENGENI_PROTON_PASS_CLI_PATH`). Both packages load through `import()`
+ * on first use (packages/vaults-keeper/test/import-guard.test.ts). Keep this
+ * file identical to apps/worker/src/external-vault-providers.ts.
+ */
+export function createNativeExternalVaultFactories(
+  settings: Settings,
+  options: NativeExternalVaultOptions = {},
+): ExternalVaultProviderFactories {
+  const factories: ExternalVaultProviderFactories = {
+    keeper: keeperFactory(settings, options.keeper ?? {}),
+  };
+  const cliPath = settings.protonPassCliPath;
+  if (cliPath) factories.protonpass = protonPassFactory(cliPath, options.protonpass ?? {});
+  return factories;
+}
+
+/** Logs out every pooled Proton Pass CLI session and wipes its state (graceful shutdown). */
+export async function closeNativeExternalVaultProviders(): Promise<void> {
+  const pools = [...protonPools.values()];
+  protonPools.clear();
+  await Promise.all(pools.map(async (pool) => (await pool.catch(() => null))?.close()));
+}
+
+function mismatch(): never {
+  throw new VaultProviderError(
+    "provider_unavailable",
+    "The configured adapter does not match this connection.",
+  );
+}
+
+/**
+ * The fetch every Keeper request and file download uses: DNS-pinned and
+ * policy-checked (no private or special-use targets). The adapter adds
+ * HTTPS-only, no redirects, deadlines, size bounds and the caller's abort.
+ */
+export function nativeKeeperFetch(
+  settings: Settings,
+  pinned: Pick<PinnedFetchOptions, "dnsLookup" | "fetchImpl" | "agentFactory"> = {},
+) {
+  return (input: string | URL, init: RequestInit) =>
+    pinnedFetch(input, init, settings, {
+      ...pinned,
+      label: "Keeper Secrets Manager",
+      requireHttpsOutsideLocalTest: true,
+    });
+}
+
+function keeperFactory(
+  settings: Settings,
+  seams: NonNullable<NativeExternalVaultOptions["keeper"]>,
+): ExternalVaultProviderFactory {
+  const fetch = nativeKeeperFetch(settings);
+  return async (input) => {
+    const credentials = input.credentials;
+    if (credentials.provider !== "keeper") mismatch();
+    const persist = input.persistCredentials;
+    const { openKeeperConnection } = await import("@opengeni/vaults-keeper");
+    const opened = await openKeeperConnection({
+      credentials:
+        "oneTimeToken" in credentials
+          ? {
+              oneTimeToken: credentials.oneTimeToken,
+              ...(credentials.hostname ? { hostname: credentials.hostname } : {}),
+            }
+          : { configuration: credentials.configuration },
+      // Without it openKeeperConnection refuses: a redeemed token or rotated
+      // key must never live only in memory.
+      ...(persist
+        ? {
+            persistConfiguration: (configuration: Record<string, string>) =>
+              persist({ provider: "keeper", configuration }),
+          }
+        : {}),
+      ...(input.operations ? { operations: input.operations } : {}),
+      // Cancels a pending bootstrap; a stored configuration opens without a request.
+      ...(input.signal ? { signal: input.signal } : {}),
+      fetch,
+      ...seams,
+    });
+    const stored: StoredVaultProviderCredentials = {
+      provider: "keeper",
+      configuration: opened.configuration,
+    };
+    return { provider: opened.provider, credentials: stored };
+  };
+}
+
+/** One pool per CLI path per process, so repeated factory creation never leaks sessions. */
+const protonPools = new Map<string, Promise<ProtonPassProviderPool>>();
+
+function protonPassFactory(
+  binaryPath: string,
+  seams: NonNullable<NativeExternalVaultOptions["protonpass"]>,
+): ExternalVaultProviderFactory {
+  return async (input) => {
+    const credentials = input.credentials;
+    if (credentials.provider !== "protonpass") mismatch();
+    let pool = protonPools.get(binaryPath);
+    if (!pool) {
+      pool = import("@opengeni/vaults-protonpass").then(({ createProtonPassProviderPool }) =>
+        createProtonPassProviderPool({ ...seams, binaryPath }),
+      );
+      protonPools.set(binaryPath, pool);
+      pool.catch(() => protonPools.delete(binaryPath));
+    }
+    // Sessions are scoped to the connection, so two connections never share
+    // CLI state even with the same token. Without a connection id (a setup
+    // probe) the provider gets an isolated session of its own.
+    const provider = (await pool).provider(credentials.token, {
+      ...(input.connectionId === undefined ? {} : { connectionId: input.connectionId }),
+      ...(input.operations ? { operations: input.operations } : {}),
+    });
+    return { provider, credentials: { provider: "protonpass", token: credentials.token } };
+  };
+}

package/src/interaction-secrets-vault.ts

@@ -59,7 +59,11 @@ export function createVaultInteractionSecretsPort(deps: {
   /** Defaults to a service over the same database and key. */
   vaultService?: VaultService;
   /** Connected vaults (1Password, host) for a workspace's acting subject. */
-  providersFor?: (workspaceId: string, subjectId: string | null) => VaultProviderRegistry;
+  providersFor?: (
+    workspaceId: string,
+    subjectId: string | null,
+    principal?: AttemptSecretPrincipal,
+  ) => VaultProviderRegistry;
 }): InteractionSecretsPort {
   const encryptionKey = deps.encryptionKey;
   let service = deps.vaultService ?? null;
@@ -203,7 +207,7 @@ export function createVaultInteractionSecretsPort(deps: {
         ...(providersFor
           ? {
               providersForSubject: (subjectId: string | null) =>
-                providersFor(principal.workspaceId, subjectId),
+                providersFor(principal.workspaceId, subjectId, principal),
             }
           : {}),
       });