@opengeni/api-router 4.3.3-canary.39780140124001 → 4.4.1

package/dist/app.js

@@ -28,7 +28,7 @@ import {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession,
   workspaceActorContextExempt
-} from "./chunk-S5VJ3GVR.js";
+} from "./chunk-3KRHXJPM.js";
 import "./chunk-OGQDXVXY.js";
 export {
   API_MAX_REQUEST_BODY_BYTES,

package/dist/{chunk-S5VJ3GVR.js → chunk-3KRHXJPM.js}

@@ -6515,44 +6515,30 @@ function capabilityAccountReadiness(availableRoutes, bindings) {
   return { available, accepted };
 }
 
-// src/mcp/machine-permission-card.ts
-var MACHINE_PERMISSION_REQUIRED_CODE = "personal_machine_permission_required";
-function machinePermissionCardShownReason(chatUrl) {
-  const elsewhere = chatUrl ? `If they are reading this chat somewhere else (for example Slack, or this is a worker or scheduled chat), give them this link to allow it: ${chatUrl}. ` : "If they are reading this chat somewhere else (for example Slack, or this is a worker or scheduled chat), tell them to open this chat in Opengeni to allow it. ";
-  return "This is a personal (Only me) machine, and its owner has not allowed this chat to use it yet. A card where the owner can allow it is now posted in this chat in Opengeni. If they are reading this chat in Opengeni, tell them in one short sentence that they can allow it there; do not describe buttons or steps. " + elsewhere + "Do not wait for it and do not retry: when they allow it, their message continues this chat.";
-}
-async function withMachinePermissionCard(result2, post) {
-  if (result2.code !== MACHINE_PERMISSION_REQUIRED_CODE) return result2;
+// src/mcp/user-setup-card.ts
+import {
+  userSetupBlocker,
+  userSetupCardShownMessage
+} from "@opengeni/contracts";
+import { sessionChatUrl } from "@opengeni/contracts";
+async function withUserSetupCard(result2, post) {
+  const blocker = userSetupBlocker(result2.code);
+  if (!blocker) return result2;
   let posted;
   try {
-    posted = await post();
+    posted = await post(blocker);
   } catch {
     return result2;
   }
   if (!posted) return result2;
   return {
     ...result2,
-    reason: machinePermissionCardShownReason(posted.chatUrl),
+    reason: userSetupCardShownMessage(blocker, posted.chatUrl),
     card: "shown",
     cardEventId: posted.eventId,
     ...posted.chatUrl ? { chatUrl: posted.chatUrl } : {}
   };
 }
-function sessionChatUrl(base, workspaceId, sessionId) {
-  if (!base) return null;
-  try {
-    const url = new URL(
-      `/workspaces/${encodeURIComponent(workspaceId)}/sessions/${encodeURIComponent(sessionId)}`,
-      base
-    );
-    if (url.protocol !== "https:" && url.protocol !== "http:" || url.username || url.password) {
-      return null;
-    }
-    return url.toString();
-  } catch {
-    return null;
-  }
-}
 
 // src/site-uploads.ts
 import { WorkspaceArtifactSourceBundle as WorkspaceArtifactSourceBundle2 } from "@opengeni/contracts";
@@ -16608,6 +16594,7 @@ import {
   CONNECTED_MACHINE_CAPABILITY_ID,
   EXCEL_ADDIN_CAPABILITY_ID as EXCEL_ADDIN_CAPABILITY_ID2,
   nativeConnectionCapabilityRecommendations,
+  userSetupCardPayload,
   OPENGENI_BROWSER_EXTENSION_URL,
   requireLiveAgentAttemptAuthorization as requireLiveAgentAttemptAuthorization7,
   requireSessionAuthorization as requireSessionAuthorization3,
@@ -19560,7 +19547,9 @@ function sandboxArtifactRelativePath(value, workspaceRoot = "/workspace") {
   }
   if (!relative) {
     throw new HTTPException24(400, {
-      message: "sandbox artifact path must name a file inside the active workspace root"
+      // Say which root: on a connected machine the file may exist outside it,
+      // and copying it in is the way forward.
+      message: `sandbox artifact path must name a file inside this session's workspace root ${workspaceRoot}; ${path} is outside it, so copy the file into the workspace first and use that path`
     });
   }
   if (absolute.length > SANDBOX_ARTIFACT_ABSOLUTE_PATH_MAX_CHARS) {
@@ -48581,13 +48570,12 @@ function registerFleetTools(server, deps, grant, sessionId, json2) {
       ...deps.settings.ogtoolPackageSpec ? { OPENGENI_OGTOOL_PACKAGE_SPEC: deps.settings.ogtoolPackageSpec } : {}
     };
   };
-  const machinePermissionCard = (toolName, target) => async () => {
+  const userSetupCard = (toolName, target) => async (blocker) => {
     const requestedSandboxId = UUID_TARGET.test(target) ? target.toLowerCase() : null;
     if (!exactAgentAttemptClaims(grant)) return null;
     const claims = exactAgentCommandContext(grant, sessionId);
-    const item = nativeConnectionCapabilityRecommendations({ connectedMachines: true }).find(
-      (candidate) => candidate.id === CONNECTED_MACHINE_CAPABILITY_ID
-    );
+    const payload = userSetupCardPayload(blocker, { toolName, requestedSandboxId });
+    if (!payload) return null;
     const appended = await appendTurnCapabilityCardOnce(
       deps.db,
       grant.workspaceId,
@@ -48595,23 +48583,13 @@ function registerFleetTools(server, deps, grant, sessionId, json2) {
       claims.callerTurnId,
       claims.callerExecutionGeneration,
       claims.callerAttemptId,
-      item.id,
-      {
-        type: "tool.auth_needed",
-        payload: {
-          ...capabilityCardPayload(item, {
-            action: "connect",
-            rationale: "Allow this chat to use your computer.",
-            toolName
-          }),
-          ...requestedSandboxId ? { requestedSandboxId } : {}
-        }
-      },
+      blocker.capabilityId,
+      { type: "tool.auth_needed", payload },
       requestedSandboxId
     );
     await publishDurableSessionEvents(deps.bus, grant.workspaceId, sessionId, appended.events);
     if (!appended.accepted) {
-      throw new Error("The calling turn was replaced before the machine card committed.");
+      throw new Error("The calling turn was replaced before the setup card committed.");
     }
     return {
       eventId: appended.existingEventId ?? appended.events[0]?.id ?? null,
@@ -48640,9 +48618,9 @@ function registerFleetTools(server, deps, grant, sessionId, json2) {
       inputSchema: { target: z47.string().min(1) }
     },
     async ({ target }) => json2(
-      await withMachinePermissionCard(
+      await withUserSetupCard(
         await swapActiveSandbox(services, await fleetContext(), target),
-        machinePermissionCard("sandbox_attach", target)
+        userSetupCard("sandbox_attach", target)
       )
     )
   );
@@ -48653,9 +48631,9 @@ function registerFleetTools(server, deps, grant, sessionId, json2) {
       inputSchema: { target: z47.string().min(1) }
     },
     async ({ target }) => json2(
-      await withMachinePermissionCard(
+      await withUserSetupCard(
         await swapActiveSandbox(services, await fleetContext(), target),
-        machinePermissionCard("sandbox_swap", target)
+        userSetupCard("sandbox_swap", target)
       )
     )
   );
@@ -48690,12 +48668,12 @@ function registerFleetTools(server, deps, grant, sessionId, json2) {
         (subjectId) => vaultProviderRegistryFor(deps, { workspaceId: grant.workspaceId, subjectId })
       ) : null;
       return json2(
-        await withMachinePermissionCard(
+        await withUserSetupCard(
           await runOnSandbox(services, await fleetContext(), target, typedOp, {
             ...transientExecEnvironment ? { transientExecEnvironment } : {},
             ...secretResolver ? { secretResolver } : {}
           }),
-          machinePermissionCard("run_on", target)
+          userSetupCard("run_on", target)
         )
       );
     }
@@ -152239,4 +152217,4 @@ export {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession4 as workflowIdForSession
 };
-//# sourceMappingURL=chunk-S5VJ3GVR.js.map
+//# sourceMappingURL=chunk-3KRHXJPM.js.map