@opengeni/core 0.20.13 → 0.20.16

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/core",
-  "version": "0.20.13",
+  "version": "0.20.16",
   "description": "OpenGeni framework-agnostic core: the domain, access, and billing layers (neutral access, off-HTTP V2 surface). Behavior-preserving extraction from apps/api — keeps Hono's HTTPException for error throwing (typed-errors cleanup deferred).",
   "license": "Apache-2.0",
   "repository": {
@@ -34,15 +34,15 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/codex": "^0.2.10",
-    "@opengeni/config": "^0.10.12",
-    "@opengeni/contracts": "^0.38.2",
-    "@opengeni/db": "^0.27.9",
-    "@opengeni/documents": "^0.5.5",
-    "@opengeni/events": "^0.3.75",
-    "@opengeni/observability": "^0.4.15",
-    "@opengeni/runtime": "^0.18.12",
-    "@opengeni/storage": "^0.2.65",
+    "@opengeni/codex": "^0.2.11",
+    "@opengeni/config": "^0.10.14",
+    "@opengeni/contracts": "^0.38.3",
+    "@opengeni/db": "^0.27.11",
+    "@opengeni/documents": "^0.5.7",
+    "@opengeni/events": "^0.3.77",
+    "@opengeni/observability": "^0.4.16",
+    "@opengeni/runtime": "^0.18.15",
+    "@opengeni/storage": "^0.2.67",
     "hono": "^4.12.18"
   },
   "engines": {

package/src/domain/capabilities.ts

@@ -29,6 +29,8 @@ import {
   getCapabilityCatalogItem,
   getCapabilityInstallation,
   getConnectionMetadata,
+  getCodexAppsCredentialAuthorizationForRun,
+  getWorkspaceGrant,
   getPackInstallation,
   getStoredCapabilityHeaderCiphertext,
   getVariableSet,
@@ -45,6 +47,7 @@ import {
   type EnabledMcpCapabilityServer,
 } from "@opengeni/db";
 import { HTTPException } from "hono/http-exception";
+import { hasPermission } from "../access";
 import {
   getSkillLibraryEntry,
   listSkillLibraryEntries,
@@ -137,6 +140,15 @@ export async function createCatalogItem(input: {
       message: "skill ids are managed by the OpenGeni skill library or runtime adapters",
     });
   }
+  if (
+    input.payload.kind === "mcp" &&
+    typeof input.payload.metadata.mcpServerId === "string" &&
+    input.payload.metadata.mcpServerId.trim() === CODEX_APPS_MCP_SERVER_ID
+  ) {
+    throw new HTTPException(422, {
+      message: `${CODEX_APPS_MCP_SERVER_ID} is reserved for the canonical Codex Apps service`,
+    });
+  }
   const source =
     input.payload.source === "built_in" ||
     input.payload.source === "library" ||
@@ -721,36 +733,76 @@ export async function settingsWithEnabledCapabilityMcpServers(
   workspaceId: string,
   settings: Settings,
 ): Promise<Settings> {
-  const enabled = await listEnabledMcpCapabilityServers(db, workspaceId);
-  return settingsWithCodexAppsMcpServer(settingsWithMcpCapabilityServers(settings, enabled));
+  const [enabled, codexAppsCredentialId] = await Promise.all([
+    listEnabledMcpCapabilityServers(db, workspaceId),
+    resolveCodexAppsCredentialIdForRun(db, workspaceId),
+  ]);
+  return settingsWithCodexAppsMcpServer(
+    settingsWithMcpCapabilityServers(settings, enabled),
+    codexAppsCredentialId !== null,
+  );
+}
+
+/**
+ * Resolve executable Apps authority. The connector must remain active and its
+ * exact owner must still hold workspace connection-management permission.
+ */
+export async function resolveCodexAppsCredentialIdForRun(
+  db: Database,
+  workspaceId: string,
+): Promise<string | null> {
+  const authorization = await getCodexAppsCredentialAuthorizationForRun(db, workspaceId);
+  if (!authorization) return null;
+  const grant = await getWorkspaceGrant(db, authorization.ownerSubjectId, workspaceId);
+  return grant && hasPermission(grant.permissions, "connections:write")
+    ? authorization.credentialId
+    : null;
 }
 
 /**
- * Register Codex Apps as an optional runtime MCP when the deployment enables
- * it. Registration only makes the server selectable; the session tool policy
- * decides whether the model sees it, and Codex credential resolution
- * independently decides whether calls can authenticate.
+ * Register Codex Apps as an optional runtime MCP only when the deployment is
+ * enabled and this workspace has an active explicit Apps designation.
+ * Registration only makes the server selectable; session policy decides
+ * whether the model sees it.
  */
-export function settingsWithCodexAppsMcpServer(settings: Settings): Settings {
+export function settingsWithCodexAppsMcpServer(
+  settings: Settings,
+  credentialAvailable: boolean,
+): Settings {
+  const canonicalServer = {
+    id: CODEX_APPS_MCP_SERVER_ID,
+    name: CODEX_APPS_MCP_SERVER_NAME,
+    url: CODEX_APPS_MCP_URL,
+    timeoutMs: CODEX_APPS_STARTUP_TIMEOUT_MS,
+    // Availability is credential-specific, so discover on every run.
+    cacheToolsList: false,
+  };
+  // The id is a credential-routing trust boundary. Discard every configured or
+  // capability-provided claimant before optionally appending the one canonical
+  // endpoint; preserving an existing id could send the designated bearer to an
+  // attacker-controlled URL.
+  const withoutReservedId = settings.mcpServers.filter(
+    (server) => server.id !== CODEX_APPS_MCP_SERVER_ID,
+  );
+  if (!settings.codexConnectedAppsEnabled || !credentialAvailable) {
+    return withoutReservedId.length === settings.mcpServers.length
+      ? settings
+      : { ...settings, mcpServers: withoutReservedId };
+  }
+  const existing = settings.mcpServers.at(-1);
   if (
-    !settings.codexConnectedAppsEnabled ||
-    settings.mcpServers.some((server) => server.id === CODEX_APPS_MCP_SERVER_ID)
+    withoutReservedId.length === settings.mcpServers.length - 1 &&
+    existing !== undefined &&
+    Object.keys(existing).length === Object.keys(canonicalServer).length &&
+    Object.entries(canonicalServer).every(
+      ([key, value]) => existing[key as keyof typeof existing] === value,
+    )
   ) {
     return settings;
   }
   return {
     ...settings,
-    mcpServers: [
-      ...settings.mcpServers,
-      {
-        id: CODEX_APPS_MCP_SERVER_ID,
-        name: CODEX_APPS_MCP_SERVER_NAME,
-        url: CODEX_APPS_MCP_URL,
-        timeoutMs: CODEX_APPS_STARTUP_TIMEOUT_MS,
-        // Availability is credential-specific, so discover on every run.
-        cacheToolsList: false,
-      },
-    ],
+    mcpServers: [...withoutReservedId, canonicalServer],
   };
 }