@opengeni/core 0.12.5 → 0.12.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/core",
-  "version": "0.12.5",
+  "version": "0.12.7",
   "description": "OpenGeni framework-agnostic core: the domain, access, and billing layers (neutral access, off-HTTP V2 surface). Behavior-preserving extraction from apps/api — keeps Hono's HTTPException for error throwing (typed-errors cleanup deferred).",
   "license": "Apache-2.0",
   "repository": {
@@ -35,14 +35,14 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@opengeni/codex": "^0.2.7",
-    "@opengeni/config": "^0.7.10",
-    "@opengeni/contracts": "^0.21.0",
-    "@opengeni/db": "^0.13.4",
-    "@opengeni/documents": "^0.2.41",
-    "@opengeni/events": "^0.3.32",
+    "@opengeni/config": "^0.7.11",
+    "@opengeni/contracts": "^0.22.0",
+    "@opengeni/db": "^0.14.0",
+    "@opengeni/documents": "^0.2.42",
+    "@opengeni/events": "^0.3.33",
     "@opengeni/observability": "^0.3.0",
-    "@opengeni/runtime": "^0.14.0",
-    "@opengeni/storage": "^0.2.34",
+    "@opengeni/runtime": "^0.14.1",
+    "@opengeni/storage": "^0.2.35",
     "hono": "^4.12.18"
   },
   "engines": {

package/src/access/index.ts

@@ -236,6 +236,9 @@ async function delegatedAccessContext(
         metadata: {
           delegated: true,
           ...(payload.sessionId ? { sessionId: payload.sessionId } : {}),
+          ...(payload.firstPartyMcpTools !== undefined
+            ? { firstPartyMcpTools: payload.firstPartyMcpTools }
+            : {}),
           // Caller identity: the turn that minted this token. Tools classify the
           // CALLER from this instead of re-reading the live active pointer.
           ...(payload.turnId ? { turnId: payload.turnId } : {}),

package/src/dependencies.ts

@@ -5,6 +5,7 @@ import type {
   GitHubAppApiPort,
   ScheduledTask,
   SessionAuthorizationPort,
+  TurnInitiator,
 } from "@opengeni/contracts";
 import type { Database } from "@opengeni/db";
 import type { DocumentServices } from "@opengeni/documents";
@@ -53,8 +54,9 @@ export type SessionWorkflowClient = {
   deleteScheduledTaskSchedule: (input: { temporalScheduleId: string }) => Promise<void>;
   triggerScheduledTask: (input: {
     task: ScheduledTask;
-    agentRunUsageIdempotencyKey?: string;
-    triggerWorkflowId?: string;
+    agentRunUsageIdempotencyKey: string;
+    triggerWorkflowId: string;
+    initiator: TurnInitiator;
   }) => Promise<void>;
   startRigVerification: (input: {
     workspaceId: string;

package/src/domain/capabilities.ts

@@ -12,6 +12,12 @@ import {
   type EnableCapabilityRequest,
   type McpServerConnectionRef,
 } from "@opengeni/contracts";
+import {
+  CODEX_APPS_MCP_SERVER_ID,
+  CODEX_APPS_MCP_SERVER_NAME,
+  CODEX_APPS_MCP_URL,
+  CODEX_APPS_STARTUP_TIMEOUT_MS,
+} from "@opengeni/codex";
 import {
   decryptVariableSetValue,
   decryptedCapabilityHeaders,
@@ -711,7 +717,36 @@ export async function settingsWithEnabledCapabilityMcpServers(
   settings: Settings,
 ): Promise<Settings> {
   const enabled = await listEnabledMcpCapabilityServers(db, workspaceId);
-  return settingsWithMcpCapabilityServers(settings, enabled);
+  return settingsWithCodexAppsMcpServer(settingsWithMcpCapabilityServers(settings, enabled));
+}
+
+/**
+ * Register Codex Apps as an optional runtime MCP when the deployment enables
+ * it. Registration only makes the server selectable; the session tool policy
+ * decides whether the model sees it, and Codex credential resolution
+ * independently decides whether calls can authenticate.
+ */
+export function settingsWithCodexAppsMcpServer(settings: Settings): Settings {
+  if (
+    !settings.codexConnectedAppsEnabled ||
+    settings.mcpServers.some((server) => server.id === CODEX_APPS_MCP_SERVER_ID)
+  ) {
+    return settings;
+  }
+  return {
+    ...settings,
+    mcpServers: [
+      ...settings.mcpServers,
+      {
+        id: CODEX_APPS_MCP_SERVER_ID,
+        name: CODEX_APPS_MCP_SERVER_NAME,
+        url: CODEX_APPS_MCP_URL,
+        timeoutMs: CODEX_APPS_STARTUP_TIMEOUT_MS,
+        // Availability is credential-specific, so discover on every run.
+        cacheToolsList: false,
+      },
+    ],
+  };
 }
 
 export function settingsWithMcpCapabilityServers(

package/src/domain/sessions.ts

@@ -9,6 +9,7 @@ import {
 import {
   CreateSessionRequest,
   DEFAULT_FIRST_PARTY_MCP_PERMISSIONS,
+  DEFAULT_FIRST_PARTY_MCP_TOOLS,
   OPENGENI_SLACK_BOT_SESSION_METADATA_KEY,
   SessionSpawnDenial,
   ServiceTurnInitiator,
@@ -19,6 +20,7 @@ import {
   type AccessGrant,
   type CreateSessionResponse,
   type GoalSpec,
+  type FirstPartyMcpToolName,
   type Permission,
   type ReasoningEffort,
   type ResourceRef,
@@ -127,6 +129,21 @@ export class SessionSpawnDeniedError extends Error {
   }
 }
 
+/**
+ * Resolve per-session first-party tool visibility without consulting
+ * authorization. Top-level omission uses the minimal runtime default (stored
+ * as null); child omission snapshots the parent's exact effective selection.
+ * Explicit [] is authoritative and must never widen.
+ */
+export function resolveFirstPartyMcpToolsForCreate(
+  requested: FirstPartyMcpToolName[] | undefined,
+  parentStored: FirstPartyMcpToolName[] | null | undefined,
+): FirstPartyMcpToolName[] | null {
+  if (requested !== undefined) return [...requested];
+  if (parentStored === undefined) return null;
+  return [...(parentStored ?? DEFAULT_FIRST_PARTY_MCP_TOOLS)];
+}
+
 function sessionSpawnDeniedMessage(denial: SessionSpawnDenial): string {
   if (denial.code === "nested_agent_depth_override_forbidden") {
     return `requested nested-agent depth limit ${denial.requestedMaxNestedAgentDepthOverride ?? "unknown"} exceeds inherited limit ${denial.effectiveMaxNestedAgentDepth}; workspace:admin is required to increase it`;
@@ -522,6 +539,9 @@ export async function createAndStartSession(input: {
   instructions?: string | null;
   // Validated against the creating grant before this is called.
   firstPartyMcpPermissions?: Permission[] | null;
+  // Model-visible first-party tool names. Authorization remains controlled by
+  // firstPartyMcpPermissions and the target resource checks.
+  firstPartyMcpTools?: FirstPartyMcpToolName[] | null;
   // Encrypted DB rows plus matching safe metadata for create-time per-session
   // MCP servers. Metadata is the only shape emitted in events/responses.
   mcpServers?: CreateSessionMcpServerInput[];
@@ -593,6 +613,7 @@ export async function createAndStartSession(input: {
       rigId: input.rigId ?? null,
       rigVersionId: input.rigVersionId ?? null,
       firstPartyMcpPermissions: input.firstPartyMcpPermissions ?? null,
+      firstPartyMcpTools: input.firstPartyMcpTools ?? null,
       instructions: input.instructions ?? null,
       parentSessionId: input.parentSessionId ?? null,
       createIdempotencyKey: input.createIdempotencyKey,
@@ -637,6 +658,7 @@ export async function createAndStartSession(input: {
       rigId: input.rigId ?? null,
       rigVersionId: input.rigVersionId ?? null,
       firstPartyMcpPermissions: input.firstPartyMcpPermissions ?? null,
+      firstPartyMcpTools: input.firstPartyMcpTools ?? null,
       instructions: input.instructions ?? null,
       parentSessionId: input.parentSessionId ?? null,
       sandboxGroupId: input.sandboxGroupId ?? null,
@@ -1142,12 +1164,10 @@ export async function createSessionForRequest(
     );
     toolPolicy = { mode: "workspace_default", inheritedFromSessionId: null };
   }
-  // The first-party MCP server is attached to EVERY session. It hosts the
-  // session's own metadata tool (set_session_title) + goal tools, and — only
-  // when the grant carries the permission — the orchestration/variableSet/
-  // github tools. Capability is gated per-tool by permission, never by whether
-  // the server is attached, so a bare chat still gets titling while the
-  // dangerous tools stay off by default.
+  // The first-party MCP server is attached to EVERY session. Registration is
+  // independently intersected with the exact model-visible selection and the
+  // tool's permission/target authorization predicate, so attachment alone
+  // exposes nothing.
   const tools = withFirstPartyTools(selectedTools, runtimeSettings);
   await validateGitHubRepositorySelection(db, workspaceId, resources);
   if (resources.some((resource) => resource.kind === "file") && !objectStorage) {
@@ -1276,6 +1296,24 @@ export async function createSessionForRequest(
         "goal-bearing sessions require goals:manage in the resulting first-party MCP permission set",
     });
   }
+  // Tool visibility is independent from permission authority. A child that
+  // omits the field inherits the parent's exact effective selection; a
+  // top-level omission resolves to the fixed minimal default at execution.
+  const firstPartyMcpTools = resolveFirstPartyMcpToolsForCreate(
+    payload.firstPartyMcpTools,
+    parentSession ? parentSession.firstPartyMcpTools : undefined,
+  );
+  if (payload.goal) {
+    const effectiveTools = firstPartyMcpTools ?? [...DEFAULT_FIRST_PARTY_MCP_TOOLS];
+    const missingGoalTools = ["goal_update", "goal_complete", "goal_pause"].filter(
+      (name) => !effectiveTools.includes(name as FirstPartyMcpToolName),
+    );
+    if (missingGoalTools.length > 0) {
+      throw new HTTPException(422, {
+        message: `goal-bearing sessions require first-party MCP tools: ${missingGoalTools.join(", ")}`,
+      });
+    }
+  }
   // Parent linkage: a worker is linked to its manager ONLY from the
   // worker-signed sessionId claim on the creating grant — the manager
   // session's own id, signed into the delegated token by the worker and never
@@ -1541,6 +1579,7 @@ export async function createSessionForRequest(
       // time. Not surfaced as an event.
       instructions: payload.instructions ?? null,
       firstPartyMcpPermissions,
+      firstPartyMcpTools,
       mcpServers: sessionMcpServers.dbServers,
       sessionMcpServers: sessionMcpServers.metadata,
       parentSessionId,