@opengeni/core 0.20.13 → 0.20.16

package/dist/domain/capabilities.d.ts

@@ -45,12 +45,17 @@ export declare function disableCapability(input: {
 }): Promise<CapabilityInstallation>;
 export declare function settingsWithEnabledCapabilityMcpServers(db: Database, workspaceId: string, settings: Settings): Promise<Settings>;
 /**
- * Register Codex Apps as an optional runtime MCP when the deployment enables
- * it. Registration only makes the server selectable; the session tool policy
- * decides whether the model sees it, and Codex credential resolution
- * independently decides whether calls can authenticate.
+ * Resolve executable Apps authority. The connector must remain active and its
+ * exact owner must still hold workspace connection-management permission.
  */
-export declare function settingsWithCodexAppsMcpServer(settings: Settings): Settings;
+export declare function resolveCodexAppsCredentialIdForRun(db: Database, workspaceId: string): Promise<string | null>;
+/**
+ * Register Codex Apps as an optional runtime MCP only when the deployment is
+ * enabled and this workspace has an active explicit Apps designation.
+ * Registration only makes the server selectable; session policy decides
+ * whether the model sees it.
+ */
+export declare function settingsWithCodexAppsMcpServer(settings: Settings, credentialAvailable: boolean): Settings;
 export declare function settingsWithMcpCapabilityServers(settings: Settings, enabled: EnabledMcpCapabilityServer[]): Settings;
 export declare function discoverMcpRegistryCapabilities(input: {
     query?: string;

package/dist/index.js

@@ -1383,6 +1383,8 @@ import {
   getCapabilityCatalogItem,
   getCapabilityInstallation,
   getConnectionMetadata,
+  getCodexAppsCredentialAuthorizationForRun,
+  getWorkspaceGrant as getWorkspaceGrant2,
   getPackInstallation,
   getStoredCapabilityHeaderCiphertext,
   getVariableSet as getVariableSet2,
@@ -1792,6 +1794,11 @@ async function createCatalogItem(input) {
       message: "skill ids are managed by the OpenGeni skill library or runtime adapters"
     });
   }
+  if (input.payload.kind === "mcp" && typeof input.payload.metadata.mcpServerId === "string" && input.payload.metadata.mcpServerId.trim() === CODEX_APPS_MCP_SERVER_ID) {
+    throw new HTTPException6(422, {
+      message: `${CODEX_APPS_MCP_SERVER_ID} is reserved for the canonical Codex Apps service`
+    });
+  }
   const source = input.payload.source === "built_in" || input.payload.source === "library" || input.payload.source === "configured" || input.payload.source === "registry" ? "manual" : input.payload.source;
   const metadata = {
     ...input.payload.metadata,
@@ -2236,26 +2243,45 @@ async function disableCapability(input) {
   return await disableCapabilityInstallation(input.db, input.workspaceId, item.id);
 }
 async function settingsWithEnabledCapabilityMcpServers(db, workspaceId, settings) {
-  const enabled = await listEnabledMcpCapabilityServers(db, workspaceId);
-  return settingsWithCodexAppsMcpServer(settingsWithMcpCapabilityServers(settings, enabled));
+  const [enabled, codexAppsCredentialId] = await Promise.all([
+    listEnabledMcpCapabilityServers(db, workspaceId),
+    resolveCodexAppsCredentialIdForRun(db, workspaceId)
+  ]);
+  return settingsWithCodexAppsMcpServer(
+    settingsWithMcpCapabilityServers(settings, enabled),
+    codexAppsCredentialId !== null
+  );
 }
-function settingsWithCodexAppsMcpServer(settings) {
-  if (!settings.codexConnectedAppsEnabled || settings.mcpServers.some((server) => server.id === CODEX_APPS_MCP_SERVER_ID)) {
+async function resolveCodexAppsCredentialIdForRun(db, workspaceId) {
+  const authorization = await getCodexAppsCredentialAuthorizationForRun(db, workspaceId);
+  if (!authorization) return null;
+  const grant = await getWorkspaceGrant2(db, authorization.ownerSubjectId, workspaceId);
+  return grant && hasPermission(grant.permissions, "connections:write") ? authorization.credentialId : null;
+}
+function settingsWithCodexAppsMcpServer(settings, credentialAvailable) {
+  const canonicalServer = {
+    id: CODEX_APPS_MCP_SERVER_ID,
+    name: CODEX_APPS_MCP_SERVER_NAME,
+    url: CODEX_APPS_MCP_URL,
+    timeoutMs: CODEX_APPS_STARTUP_TIMEOUT_MS,
+    // Availability is credential-specific, so discover on every run.
+    cacheToolsList: false
+  };
+  const withoutReservedId = settings.mcpServers.filter(
+    (server) => server.id !== CODEX_APPS_MCP_SERVER_ID
+  );
+  if (!settings.codexConnectedAppsEnabled || !credentialAvailable) {
+    return withoutReservedId.length === settings.mcpServers.length ? settings : { ...settings, mcpServers: withoutReservedId };
+  }
+  const existing = settings.mcpServers.at(-1);
+  if (withoutReservedId.length === settings.mcpServers.length - 1 && existing !== void 0 && Object.keys(existing).length === Object.keys(canonicalServer).length && Object.entries(canonicalServer).every(
+    ([key, value]) => existing[key] === value
+  )) {
     return settings;
   }
   return {
     ...settings,
-    mcpServers: [
-      ...settings.mcpServers,
-      {
-        id: CODEX_APPS_MCP_SERVER_ID,
-        name: CODEX_APPS_MCP_SERVER_NAME,
-        url: CODEX_APPS_MCP_URL,
-        timeoutMs: CODEX_APPS_STARTUP_TIMEOUT_MS,
-        // Availability is credential-specific, so discover on every run.
-        cacheToolsList: false
-      }
-    ]
+    mcpServers: [...withoutReservedId, canonicalServer]
   };
 }
 function settingsWithMcpCapabilityServers(settings, enabled) {
@@ -3229,7 +3255,7 @@ async function listRigChangesForApi(deps, workspaceId, rigId, limit) {
 import {
   getSessionTurnPersonalConnectionDelegations,
   getSocialConnection,
-  getWorkspaceGrant as getWorkspaceGrant2,
+  getWorkspaceGrant as getWorkspaceGrant3,
   listConnectionsMetadata as listConnectionsMetadata2,
   listSocialConnections as listSocialConnections2
 } from "@opengeni/db";
@@ -3282,7 +3308,7 @@ async function authorizedSocialConnectionsForGrant(input) {
   )).filter((item) => item.connectionType === "social");
   const personal = [];
   for (const delegation of delegations) {
-    if (!await getWorkspaceGrant2(input.db, delegation.ownerSubjectId, input.grant.workspaceId))
+    if (!await getWorkspaceGrant3(input.db, delegation.ownerSubjectId, input.grant.workspaceId))
       continue;
     const connection = await getSocialConnection(
       input.db,
@@ -3421,7 +3447,7 @@ async function freezePersonalConnectionDelegations(input) {
     });
     return includeSocial ? inherited : inherited.filter((item) => item.connectionType !== "social");
   }
-  const membership = await getWorkspaceGrant2(input.db, input.source.subjectId, input.workspaceId);
+  const membership = await getWorkspaceGrant3(input.db, input.source.subjectId, input.workspaceId);
   if (!membership) return [];
   const mcp = personalConnectionDelegationsFromVisibleConnections({
     servers,
@@ -7205,6 +7231,7 @@ export {
   requireVariableSetEncryption,
   requireVariableSetForApi,
   resolveCapabilityPack,
+  resolveCodexAppsCredentialIdForRun,
   resolveFirstPartyMcpToolsForCreate,
   resolveMemberSubjectId,
   resolveSessionToolPolicy,