@opengeni/core 0.12.2 → 0.12.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/core",
-  "version": "0.12.2",
+  "version": "0.12.7",
   "description": "OpenGeni framework-agnostic core: the domain, access, and billing layers (neutral access, off-HTTP V2 surface). Behavior-preserving extraction from apps/api — keeps Hono's HTTPException for error throwing (typed-errors cleanup deferred).",
   "license": "Apache-2.0",
   "repository": {
@@ -35,14 +35,14 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@opengeni/codex": "^0.2.7",
-    "@opengeni/config": "^0.7.8",
-    "@opengeni/contracts": "^0.20.1",
-    "@opengeni/db": "^0.13.1",
-    "@opengeni/documents": "^0.2.38",
-    "@opengeni/events": "^0.3.29",
+    "@opengeni/config": "^0.7.11",
+    "@opengeni/contracts": "^0.22.0",
+    "@opengeni/db": "^0.14.0",
+    "@opengeni/documents": "^0.2.42",
+    "@opengeni/events": "^0.3.33",
     "@opengeni/observability": "^0.3.0",
-    "@opengeni/runtime": "^0.13.13",
-    "@opengeni/storage": "^0.2.32",
+    "@opengeni/runtime": "^0.14.1",
+    "@opengeni/storage": "^0.2.35",
     "hono": "^4.12.18"
   },
   "engines": {

package/src/access/index.ts

@@ -86,6 +86,10 @@ export function hasPermission(permissions: Permission[], permission: Permission)
 
 async function resolveAccessContext(c: Context, deps: AccessDeps): Promise<AccessContext | null> {
   if (deps.settings.productAccessMode === "local") {
+    const delegated = await delegatedAccessContext(c, deps, "local");
+    if (delegated) {
+      return delegated;
+    }
     return await bootstrapWorkspace(deps.db, {
       accountExternalSource: "opengeni:local",
       accountExternalId: "default",
@@ -198,7 +202,7 @@ async function apiKeyAccessContext(
 async function delegatedAccessContext(
   c: Context,
   deps: AccessDeps,
-  mode: "configured" | "managed",
+  mode: "local" | "configured" | "managed",
   token = bearerToken(c),
 ): Promise<AccessContext | null> {
   if (!token || !deps.settings.delegationSecret) {
@@ -232,6 +236,9 @@ async function delegatedAccessContext(
         metadata: {
           delegated: true,
           ...(payload.sessionId ? { sessionId: payload.sessionId } : {}),
+          ...(payload.firstPartyMcpTools !== undefined
+            ? { firstPartyMcpTools: payload.firstPartyMcpTools }
+            : {}),
           // Caller identity: the turn that minted this token. Tools classify the
           // CALLER from this instead of re-reading the live active pointer.
           ...(payload.turnId ? { turnId: payload.turnId } : {}),

package/src/dependencies.ts

@@ -5,6 +5,7 @@ import type {
   GitHubAppApiPort,
   ScheduledTask,
   SessionAuthorizationPort,
+  TurnInitiator,
 } from "@opengeni/contracts";
 import type { Database } from "@opengeni/db";
 import type { DocumentServices } from "@opengeni/documents";
@@ -53,8 +54,9 @@ export type SessionWorkflowClient = {
   deleteScheduledTaskSchedule: (input: { temporalScheduleId: string }) => Promise<void>;
   triggerScheduledTask: (input: {
     task: ScheduledTask;
-    agentRunUsageIdempotencyKey?: string;
-    triggerWorkflowId?: string;
+    agentRunUsageIdempotencyKey: string;
+    triggerWorkflowId: string;
+    initiator: TurnInitiator;
   }) => Promise<void>;
   startRigVerification: (input: {
     workspaceId: string;

package/src/domain/capabilities.ts

@@ -12,6 +12,12 @@ import {
   type EnableCapabilityRequest,
   type McpServerConnectionRef,
 } from "@opengeni/contracts";
+import {
+  CODEX_APPS_MCP_SERVER_ID,
+  CODEX_APPS_MCP_SERVER_NAME,
+  CODEX_APPS_MCP_URL,
+  CODEX_APPS_STARTUP_TIMEOUT_MS,
+} from "@opengeni/codex";
 import {
   decryptVariableSetValue,
   decryptedCapabilityHeaders,
@@ -27,6 +33,7 @@ import {
   getVariableSet,
   listCapabilityCatalogItems,
   listCapabilityInstallations,
+  listConnectionsMetadata,
   listEnabledMcpCapabilityServers,
   listPackInstallations,
   mcpServerIdForCapability,
@@ -424,14 +431,10 @@ async function validateMcpCapabilityConnectionRef(
   item: CapabilityCatalogItem,
   ref: McpServerConnectionRef,
 ): Promise<McpServerConnectionRef> {
-  if (ref.subjectScope === "subject") {
-    throw new HTTPException(422, {
-      message: "subject-owned connection refs are not supported for agent runtime use yet",
-    });
-  }
+  const subjectScope = ref.subjectScope ?? "workspace";
   const normalized: McpServerConnectionRef = {
     providerDomain: ref.providerDomain.trim(),
-    subjectScope: "workspace",
+    subjectScope,
     ...(ref.connectionId ? { connectionId: ref.connectionId } : {}),
     ...(ref.provider ? { provider: ref.provider.trim() } : {}),
     ...(ref.kind ? { kind: ref.kind } : {}),
@@ -450,23 +453,41 @@ async function validateMcpCapabilityConnectionRef(
         "MCP capabilities need a remote streamable HTTP endpoint before they can use a connectionRef",
     });
   }
-  if (!normalized.connectionId) {
-    return normalized;
+
+  let connection = normalized.connectionId
+    ? await getConnectionMetadata(
+        input.db,
+        input.workspaceId,
+        normalized.connectionId,
+        input.grant.subjectId,
+      )
+    : null;
+  if (!connection && subjectScope === "subject" && !normalized.connectionId) {
+    const visible = await listConnectionsMetadata(
+      input.db,
+      input.workspaceId,
+      input.grant.subjectId,
+    );
+    connection =
+      visible.find(
+        (candidate) =>
+          candidate.subjectId === input.grant.subjectId &&
+          candidate.providerDomain === normalized.providerDomain &&
+          (!normalized.kind || candidate.kind === normalized.kind) &&
+          candidate.status === "active",
+      ) ?? null;
   }
-  const connection = await getConnectionMetadata(
-    input.db,
-    input.workspaceId,
-    normalized.connectionId,
-    input.grant.subjectId,
-  );
   if (!connection) {
     throw new HTTPException(422, {
-      message: "connectionRef.connectionId does not reference a visible connection",
+      message: "connectionRef does not reference a visible active connection",
     });
   }
-  if (connection.subjectId !== null) {
+  if (
+    (subjectScope === "subject" && connection.subjectId !== input.grant.subjectId) ||
+    (subjectScope === "workspace" && connection.subjectId !== null)
+  ) {
     throw new HTTPException(422, {
-      message: "agent runtime connection refs must reference workspace-shared connections in I1",
+      message: `connectionRef does not reference a ${subjectScope}-owned connection`,
     });
   }
   if (connection.status !== "active") {
@@ -484,6 +505,11 @@ async function validateMcpCapabilityConnectionRef(
       message: "connectionRef.kind does not match the referenced connection",
     });
   }
+  if (subjectScope === "subject") {
+    const genericSubjectRef = { ...normalized, kind: connection.kind };
+    delete genericSubjectRef.connectionId;
+    return genericSubjectRef;
+  }
   return normalized;
 }
 
@@ -691,7 +717,36 @@ export async function settingsWithEnabledCapabilityMcpServers(
   settings: Settings,
 ): Promise<Settings> {
   const enabled = await listEnabledMcpCapabilityServers(db, workspaceId);
-  return settingsWithMcpCapabilityServers(settings, enabled);
+  return settingsWithCodexAppsMcpServer(settingsWithMcpCapabilityServers(settings, enabled));
+}
+
+/**
+ * Register Codex Apps as an optional runtime MCP when the deployment enables
+ * it. Registration only makes the server selectable; the session tool policy
+ * decides whether the model sees it, and Codex credential resolution
+ * independently decides whether calls can authenticate.
+ */
+export function settingsWithCodexAppsMcpServer(settings: Settings): Settings {
+  if (
+    !settings.codexConnectedAppsEnabled ||
+    settings.mcpServers.some((server) => server.id === CODEX_APPS_MCP_SERVER_ID)
+  ) {
+    return settings;
+  }
+  return {
+    ...settings,
+    mcpServers: [
+      ...settings.mcpServers,
+      {
+        id: CODEX_APPS_MCP_SERVER_ID,
+        name: CODEX_APPS_MCP_SERVER_NAME,
+        url: CODEX_APPS_MCP_URL,
+        timeoutMs: CODEX_APPS_STARTUP_TIMEOUT_MS,
+        // Availability is credential-specific, so discover on every run.
+        cacheToolsList: false,
+      },
+    ],
+  };
 }
 
 export function settingsWithMcpCapabilityServers(
@@ -1157,12 +1212,16 @@ function installationConnectionRef(
   if (!ref || typeof ref !== "object") {
     return null;
   }
-  const { connectionId, providerDomain, kind } = ref as Record<string, unknown>;
-  if (
-    typeof connectionId !== "string" ||
-    typeof providerDomain !== "string" ||
-    typeof kind !== "string"
-  ) {
+  const { connectionId, providerDomain, kind, subjectScope } = ref as Record<string, unknown>;
+  if (typeof providerDomain !== "string" || typeof kind !== "string") {
+    return null;
+  }
+  if (subjectScope === "subject") {
+    // Never project a personal connection UUID through workspace-visible
+    // capability configuration, including legacy rows that still contain one.
+    return { providerDomain, kind, subjectScope: "subject" };
+  }
+  if (typeof connectionId !== "string") {
     return null;
   }
   return { connectionId, providerDomain, kind };

package/src/domain/sessions.ts

@@ -9,6 +9,7 @@ import {
 import {
   CreateSessionRequest,
   DEFAULT_FIRST_PARTY_MCP_PERMISSIONS,
+  DEFAULT_FIRST_PARTY_MCP_TOOLS,
   OPENGENI_SLACK_BOT_SESSION_METADATA_KEY,
   SessionSpawnDenial,
   ServiceTurnInitiator,
@@ -19,10 +20,12 @@ import {
   type AccessGrant,
   type CreateSessionResponse,
   type GoalSpec,
+  type FirstPartyMcpToolName,
   type Permission,
   type ReasoningEffort,
   type ResourceRef,
   type Session,
+  type SessionSkill,
   type SessionEvent,
   SessionMcpApprovalPolicy,
   type SessionMcpCredentialUpdateInput,
@@ -126,6 +129,21 @@ export class SessionSpawnDeniedError extends Error {
   }
 }
 
+/**
+ * Resolve per-session first-party tool visibility without consulting
+ * authorization. Top-level omission uses the minimal runtime default (stored
+ * as null); child omission snapshots the parent's exact effective selection.
+ * Explicit [] is authoritative and must never widen.
+ */
+export function resolveFirstPartyMcpToolsForCreate(
+  requested: FirstPartyMcpToolName[] | undefined,
+  parentStored: FirstPartyMcpToolName[] | null | undefined,
+): FirstPartyMcpToolName[] | null {
+  if (requested !== undefined) return [...requested];
+  if (parentStored === undefined) return null;
+  return [...(parentStored ?? DEFAULT_FIRST_PARTY_MCP_TOOLS)];
+}
+
 function sessionSpawnDeniedMessage(denial: SessionSpawnDenial): string {
   if (denial.code === "nested_agent_depth_override_forbidden") {
     return `requested nested-agent depth limit ${denial.requestedMaxNestedAgentDepthOverride ?? "unknown"} exceeds inherited limit ${denial.effectiveMaxNestedAgentDepth}; workspace:admin is required to increase it`;
@@ -491,6 +509,7 @@ export async function createAndStartSession(input: {
   initialMessage: string;
   turnInstructions?: string | null;
   resources: ResourceRef[];
+  skills?: SessionSkill[];
   tools: ToolRef[];
   // Public admission always supplies provenance; optional keeps internal
   // callers that predate durable tool-policy provenance source-compatible
@@ -520,6 +539,9 @@ export async function createAndStartSession(input: {
   instructions?: string | null;
   // Validated against the creating grant before this is called.
   firstPartyMcpPermissions?: Permission[] | null;
+  // Model-visible first-party tool names. Authorization remains controlled by
+  // firstPartyMcpPermissions and the target resource checks.
+  firstPartyMcpTools?: FirstPartyMcpToolName[] | null;
   // Encrypted DB rows plus matching safe metadata for create-time per-session
   // MCP servers. Metadata is the only shape emitted in events/responses.
   mcpServers?: CreateSessionMcpServerInput[];
@@ -578,6 +600,7 @@ export async function createAndStartSession(input: {
       initialMessage: input.initialMessage,
       initialTurnInstructions: input.turnInstructions ?? null,
       resources: input.resources,
+      skills: input.skills ?? [],
       tools: input.tools,
       ...(input.toolPolicy ? { toolPolicy: input.toolPolicy } : {}),
       metadata: sessionMetadata,
@@ -590,6 +613,7 @@ export async function createAndStartSession(input: {
       rigId: input.rigId ?? null,
       rigVersionId: input.rigVersionId ?? null,
       firstPartyMcpPermissions: input.firstPartyMcpPermissions ?? null,
+      firstPartyMcpTools: input.firstPartyMcpTools ?? null,
       instructions: input.instructions ?? null,
       parentSessionId: input.parentSessionId ?? null,
       createIdempotencyKey: input.createIdempotencyKey,
@@ -621,6 +645,7 @@ export async function createAndStartSession(input: {
       initialMessage: input.initialMessage,
       initialTurnInstructions: input.turnInstructions ?? null,
       resources: input.resources,
+      skills: input.skills ?? [],
       tools: input.tools,
       ...(input.toolPolicy ? { toolPolicy: input.toolPolicy } : {}),
       metadata: sessionMetadata,
@@ -633,6 +658,7 @@ export async function createAndStartSession(input: {
       rigId: input.rigId ?? null,
       rigVersionId: input.rigVersionId ?? null,
       firstPartyMcpPermissions: input.firstPartyMcpPermissions ?? null,
+      firstPartyMcpTools: input.firstPartyMcpTools ?? null,
       instructions: input.instructions ?? null,
       parentSessionId: input.parentSessionId ?? null,
       sandboxGroupId: input.sandboxGroupId ?? null,
@@ -1090,6 +1116,9 @@ export async function createSessionForRequest(
       ? payload.resources
       : (parentSession?.resources ?? payload.resources),
   );
+  const skills = hasOwnProperty(rawPayload, "skills")
+    ? payload.skills
+    : (parentSession?.skills ?? payload.skills);
   const toolsProvided = hasOwnProperty(rawPayload, "tools");
   const requestedTools = validateToolRefs(
     toolsProvided ? payload.tools : (parentSession?.tools ?? payload.tools),
@@ -1135,12 +1164,10 @@ export async function createSessionForRequest(
     );
     toolPolicy = { mode: "workspace_default", inheritedFromSessionId: null };
   }
-  // The first-party MCP server is attached to EVERY session. It hosts the
-  // session's own metadata tool (set_session_title) + goal tools, and — only
-  // when the grant carries the permission — the orchestration/variableSet/
-  // github tools. Capability is gated per-tool by permission, never by whether
-  // the server is attached, so a bare chat still gets titling while the
-  // dangerous tools stay off by default.
+  // The first-party MCP server is attached to EVERY session. Registration is
+  // independently intersected with the exact model-visible selection and the
+  // tool's permission/target authorization predicate, so attachment alone
+  // exposes nothing.
   const tools = withFirstPartyTools(selectedTools, runtimeSettings);
   await validateGitHubRepositorySelection(db, workspaceId, resources);
   if (resources.some((resource) => resource.kind === "file") && !objectStorage) {
@@ -1269,6 +1296,24 @@ export async function createSessionForRequest(
         "goal-bearing sessions require goals:manage in the resulting first-party MCP permission set",
     });
   }
+  // Tool visibility is independent from permission authority. A child that
+  // omits the field inherits the parent's exact effective selection; a
+  // top-level omission resolves to the fixed minimal default at execution.
+  const firstPartyMcpTools = resolveFirstPartyMcpToolsForCreate(
+    payload.firstPartyMcpTools,
+    parentSession ? parentSession.firstPartyMcpTools : undefined,
+  );
+  if (payload.goal) {
+    const effectiveTools = firstPartyMcpTools ?? [...DEFAULT_FIRST_PARTY_MCP_TOOLS];
+    const missingGoalTools = ["goal_update", "goal_complete", "goal_pause"].filter(
+      (name) => !effectiveTools.includes(name as FirstPartyMcpToolName),
+    );
+    if (missingGoalTools.length > 0) {
+      throw new HTTPException(422, {
+        message: `goal-bearing sessions require first-party MCP tools: ${missingGoalTools.join(", ")}`,
+      });
+    }
+  }
   // Parent linkage: a worker is linked to its manager ONLY from the
   // worker-signed sessionId claim on the creating grant — the manager
   // session's own id, signed into the delegated token by the worker and never
@@ -1501,6 +1546,7 @@ export async function createSessionForRequest(
       initialMessage: payload.initialMessage,
       turnInstructions: payload.turnInstructions ?? null,
       resources,
+      skills,
       tools,
       toolPolicy,
       ...(payload.clientEventId ? { clientEventId: payload.clientEventId } : {}),
@@ -1533,6 +1579,7 @@ export async function createSessionForRequest(
       // time. Not surfaced as an event.
       instructions: payload.instructions ?? null,
       firstPartyMcpPermissions,
+      firstPartyMcpTools,
       mcpServers: sessionMcpServers.dbServers,
       sessionMcpServers: sessionMcpServers.metadata,
       parentSessionId,