@opengeni/core 0.12.2 → 0.12.5

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import { Settings } from '@opengeni/config';
-import { ScheduledTask, Document, GitHubAppApiPort, ConnectionCredentialsPort, SessionAuthorizationPort, Permission, AccessContext, AccessGrant, SessionAuthorizationActor, SessionAuthorizationTarget, SessionAuthorizationOperation, SessionAuthorizationSurface, SessionAuthorizationListScope, LimitAction, LimitDecision, TurnInitiator, TurnInitiatorContext, SessionTurnSource, CapabilityCatalogItem, CapabilityInstallation, CapabilityCatalogResponse, CreateCapabilityCatalogItemRequest, EnableCapabilityRequest, VariableSet, Rig, RigVersion, CreateRigRequest, RigDefinitionEditPayload, RigChange, ProposeRigChangeRequest, UpdateRigRequest, CapabilityPack, SocialConnection, ScheduledTaskAgentConfig, ToolRef, ResourceRef, SessionEffectiveToolPolicy, SessionToolPolicy, Session, CreateScheduledTaskRequest, UpdateScheduledTaskRequest, SessionSpawnDenial, ReasoningEffort, SessionMcpCredentialUpdateInput, SessionEvent, SessionTurn, TurnExecutionPolicyV1, GoalSpec, SessionMcpServerMetadata, CreateSessionResponse, SessionMcpApprovalPolicy, UpdateSessionMcpApprovalPolicyResponse, UpdateSessionToolPolicyRequest, ConnectionMetadata, OpenGeniSlackBotConnectionMetadata, WorkspaceMember, NewSessionDraft, SessionControlRequest, SessionControlResponse, WorkspaceInferenceControlRequest, WorkspaceInferenceControlResponse, DeleteSessionQueueItemRequest, SessionQueueMutationResponse, EditSessionQueueItemRequest, ComposerDraft, MoveSessionQueueItemRequest, SaveComposerDraftRequest, SteerSessionQueueItemRequest } from '@opengeni/contracts';
+import { ScheduledTask, Document, GitHubAppApiPort, ConnectionCredentialsPort, SessionAuthorizationPort, Permission, AccessContext, AccessGrant, SessionAuthorizationActor, SessionAuthorizationTarget, SessionAuthorizationOperation, SessionAuthorizationSurface, SessionAuthorizationListScope, LimitAction, LimitDecision, TurnInitiator, TurnInitiatorContext, SessionTurnSource, CapabilityCatalogItem, CapabilityInstallation, CapabilityCatalogResponse, CreateCapabilityCatalogItemRequest, EnableCapabilityRequest, VariableSet, Rig, RigVersion, CreateRigRequest, RigDefinitionEditPayload, RigChange, ProposeRigChangeRequest, UpdateRigRequest, CapabilityPack, SocialConnection, ScheduledTaskAgentConfig, ToolRef, ResourceRef, SessionEffectiveToolPolicy, SessionToolPolicy, Session, CreateScheduledTaskRequest, UpdateScheduledTaskRequest, SessionSpawnDenial, ReasoningEffort, SessionMcpCredentialUpdateInput, SessionEvent, SessionTurn, SessionSkill, TurnExecutionPolicyV1, GoalSpec, SessionMcpServerMetadata, CreateSessionResponse, SessionMcpApprovalPolicy, UpdateSessionMcpApprovalPolicyResponse, UpdateSessionToolPolicyRequest, ConnectionMetadata, OpenGeniSlackBotConnectionMetadata, WorkspaceMember, NewSessionDraft, SessionControlRequest, SessionControlResponse, WorkspaceInferenceControlRequest, WorkspaceInferenceControlResponse, DeleteSessionQueueItemRequest, SessionQueueMutationResponse, EditSessionQueueItemRequest, ComposerDraft, MoveSessionQueueItemRequest, SaveComposerDraftRequest, SteerSessionQueueItemRequest } from '@opengeni/contracts';
 export { mergeToolRefs, stableJson } from '@opengeni/contracts';
 import * as _opengeni_db from '@opengeni/db';
 import { Database, SandboxRecord, EnabledMcpCapabilityServer, UpdateScheduledTaskInput, SessionCommandActor, CreateSessionMcpServerInput, UpdateSessionMcpServerCredentialsInput, ConnectionMetadataWithVerification } from '@opengeni/db';
@@ -831,6 +831,7 @@ declare function createAndStartSession(input: {
     initialMessage: string;
     turnInstructions?: string | null;
     resources: ResourceRef[];
+    skills?: SessionSkill[];
     tools: ToolRef[];
     toolPolicy?: SessionToolPolicy;
     clientEventId?: string;

package/dist/index.js

@@ -698,6 +698,10 @@ function hasPermission(permissions, permission) {
 }
 async function resolveAccessContext(c, deps) {
   if (deps.settings.productAccessMode === "local") {
+    const delegated = await delegatedAccessContext(c, deps, "local");
+    if (delegated) {
+      return delegated;
+    }
     return await bootstrapWorkspace(deps.db, {
       accountExternalSource: "opengeni:local",
       accountExternalId: "default",
@@ -1200,6 +1204,7 @@ import {
   getVariableSet as getVariableSet2,
   listCapabilityCatalogItems,
   listCapabilityInstallations,
+  listConnectionsMetadata,
   listEnabledMcpCapabilityServers,
   listPackInstallations as listPackInstallations2,
   mcpServerIdForCapability,
@@ -1803,14 +1808,10 @@ function normalizedMcpCredentialHeaders(headers) {
   return Object.fromEntries(entries);
 }
 async function validateMcpCapabilityConnectionRef(input, item, ref) {
-  if (ref.subjectScope === "subject") {
-    throw new HTTPException6(422, {
-      message: "subject-owned connection refs are not supported for agent runtime use yet"
-    });
-  }
+  const subjectScope = ref.subjectScope ?? "workspace";
   const normalized = {
     providerDomain: ref.providerDomain.trim(),
-    subjectScope: "workspace",
+    subjectScope,
     ...ref.connectionId ? { connectionId: ref.connectionId } : {},
     ...ref.provider ? { provider: ref.provider.trim() } : {},
     ...ref.kind ? { kind: ref.kind } : {},
@@ -1826,23 +1827,30 @@ async function validateMcpCapabilityConnectionRef(input, item, ref) {
       message: "MCP capabilities need a remote streamable HTTP endpoint before they can use a connectionRef"
     });
   }
-  if (!normalized.connectionId) {
-    return normalized;
-  }
-  const connection = await getConnectionMetadata(
+  let connection = normalized.connectionId ? await getConnectionMetadata(
     input.db,
     input.workspaceId,
     normalized.connectionId,
     input.grant.subjectId
-  );
+  ) : null;
+  if (!connection && subjectScope === "subject" && !normalized.connectionId) {
+    const visible = await listConnectionsMetadata(
+      input.db,
+      input.workspaceId,
+      input.grant.subjectId
+    );
+    connection = visible.find(
+      (candidate) => candidate.subjectId === input.grant.subjectId && candidate.providerDomain === normalized.providerDomain && (!normalized.kind || candidate.kind === normalized.kind) && candidate.status === "active"
+    ) ?? null;
+  }
   if (!connection) {
     throw new HTTPException6(422, {
-      message: "connectionRef.connectionId does not reference a visible connection"
+      message: "connectionRef does not reference a visible active connection"
     });
   }
-  if (connection.subjectId !== null) {
+  if (subjectScope === "subject" && connection.subjectId !== input.grant.subjectId || subjectScope === "workspace" && connection.subjectId !== null) {
     throw new HTTPException6(422, {
-      message: "agent runtime connection refs must reference workspace-shared connections in I1"
+      message: `connectionRef does not reference a ${subjectScope}-owned connection`
     });
   }
   if (connection.status !== "active") {
@@ -1860,6 +1868,11 @@ async function validateMcpCapabilityConnectionRef(input, item, ref) {
       message: "connectionRef.kind does not match the referenced connection"
     });
   }
+  if (subjectScope === "subject") {
+    const genericSubjectRef = { ...normalized, kind: connection.kind };
+    delete genericSubjectRef.connectionId;
+    return genericSubjectRef;
+  }
   return normalized;
 }
 function authDeferredMcpConnectivity() {
@@ -2374,8 +2387,14 @@ function installationConnectionRef(config) {
   if (!ref || typeof ref !== "object") {
     return null;
   }
-  const { connectionId, providerDomain, kind } = ref;
-  if (typeof connectionId !== "string" || typeof providerDomain !== "string" || typeof kind !== "string") {
+  const { connectionId, providerDomain, kind, subjectScope } = ref;
+  if (typeof providerDomain !== "string" || typeof kind !== "string") {
+    return null;
+  }
+  if (subjectScope === "subject") {
+    return { providerDomain, kind, subjectScope: "subject" };
+  }
+  if (typeof connectionId !== "string") {
     return null;
   }
   return { connectionId, providerDomain, kind };
@@ -3745,6 +3764,7 @@ async function createAndStartSession(input) {
       initialMessage: input.initialMessage,
       initialTurnInstructions: input.turnInstructions ?? null,
       resources: input.resources,
+      skills: input.skills ?? [],
       tools: input.tools,
       ...input.toolPolicy ? { toolPolicy: input.toolPolicy } : {},
       metadata: sessionMetadata,
@@ -3788,6 +3808,7 @@ async function createAndStartSession(input) {
       initialMessage: input.initialMessage,
       initialTurnInstructions: input.turnInstructions ?? null,
       resources: input.resources,
+      skills: input.skills ?? [],
       tools: input.tools,
       ...input.toolPolicy ? { toolPolicy: input.toolPolicy } : {},
       metadata: sessionMetadata,
@@ -4082,6 +4103,7 @@ async function createSessionForRequest(deps, grant, workspaceId, rawPayload) {
   const resources = normalizeResources(
     hasOwnProperty(rawPayload, "resources") ? payload.resources : parentSession?.resources ?? payload.resources
   );
+  const skills = hasOwnProperty(rawPayload, "skills") ? payload.skills : parentSession?.skills ?? payload.skills;
   const toolsProvided = hasOwnProperty(rawPayload, "tools");
   const requestedTools = validateToolRefs(
     toolsProvided ? payload.tools : parentSession?.tools ?? payload.tools,
@@ -4308,6 +4330,7 @@ async function createSessionForRequest(deps, grant, workspaceId, rawPayload) {
       initialMessage: payload.initialMessage,
       turnInstructions: payload.turnInstructions ?? null,
       resources,
+      skills,
       tools,
       toolPolicy,
       ...payload.clientEventId ? { clientEventId: payload.clientEventId } : {},