@opengeni/core 0.21.10 → 0.28.0

package/src/domain/memory-slack-publication.ts

@@ -4,6 +4,7 @@ import {
   type KnowledgeMemoryKind,
   type KnowledgeMemoryStatus,
 } from "@opengeni/contracts";
+import { sanitizeSlackPublicationText } from "./slack-publication-secret-safety";
 
 const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 const SELECTOR_SEGMENT_PATTERN = /^[a-z0-9](?:[a-z0-9._-]{0,62}[a-z0-9])?$/;
@@ -197,7 +198,9 @@ export function evaluateMemorySlackPublication(
   const deliveryMode = effectiveDeliveryMode(policy, input.distribution);
   if (!deliveryMode) return denied("below_noise_policy");
 
-  const collapsedSummary = collapseText(input.distribution.shareSummary);
+  const collapsedSummary = sanitizeSlackPublicationText(
+    collapseText(input.distribution.shareSummary),
+  );
   if (!collapsedSummary) return denied("missing_summary");
   const summary = truncateUtf8(collapsedSummary, MEMORY_SLACK_SUMMARY_MAX_UTF8_BYTES);
 
@@ -397,7 +400,7 @@ function boundedOptionalText(
   value: string | null | undefined,
   maxBytes: number,
 ): { value: string | null; truncated: boolean } {
-  const collapsed = collapseText(value ?? "");
+  const collapsed = sanitizeSlackPublicationText(collapseText(value ?? ""));
   if (!collapsed) return { value: null, truncated: false };
   const bounded = truncateUtf8(collapsed, maxBytes);
   return {

package/src/domain/packs.ts

@@ -1,14 +1,27 @@
+import { createHash } from "node:crypto";
+
 import {
   CapabilityPack,
+  stableJson,
+  type CapabilityPackSkill,
+  type PackComponentResolution,
+  type PackInstallationPreview,
+  type PackRigResolution,
   type ScheduledTaskAgentConfig,
   type SocialConnection,
 } from "@opengeni/contracts";
 import {
+  getPackInstallation,
+  getRig,
+  getVariableSet,
   getWorkspacePack,
   listPackInstallations,
   listWorkspacePacks,
+  resolvePackComponentReferences,
+  resolvePackInlineSkillReferences,
   type Database,
 } from "@opengeni/db";
+import { buildPortableSkillArtifact } from "@opengeni/runtime/skill-library";
 import { HTTPException } from "hono/http-exception";
 
 export const MARKETING_SOCIAL_PACK_ID = "marketing-social-daily-analysis";
@@ -25,6 +38,7 @@ const marketingSocialPack: CapabilityPack = {
   // worker's pack-runtime resolution only reads manifest-registered packs
   // (see apps/worker/src/activities/packs.ts), and a test enforces this.
   skills: [],
+  components: [],
   tools: [
     { kind: "mcp", id: "opengeni" },
     { kind: "mcp", id: "docs" },
@@ -146,11 +160,18 @@ const marketingSocialPack: CapabilityPack = {
       "social_connections_list",
       "social_posts_recent",
       "social_daily_analysis_context",
-      "social_search_live",
-      "social_mentions_live",
-      "social_thread_fetch",
-      "social_posts_sync",
-      "social_post_reply",
+      "x_accounts_list",
+      "x_search_live",
+      "x_mentions_live",
+      "x_thread_fetch",
+      "x_posts_sync",
+      "x_post_reply",
+      "reddit_accounts_list",
+      "reddit_search_live",
+      "reddit_mentions_live",
+      "reddit_thread_fetch",
+      "reddit_posts_sync",
+      "reddit_post_reply",
     ],
   },
 };
@@ -207,6 +228,246 @@ export async function resolveCapabilityPack(
   return parsed.success ? parsed.data : null;
 }
 
+export function capabilityPackManifestDigest(pack: CapabilityPack): string {
+  return createHash("sha256").update(stableJson(pack)).digest("hex");
+}
+
+/** True when the Pack must use the owner-aware V2 preview/install lifecycle. */
+export function capabilityPackRequiresInstallationPlan(pack: CapabilityPack): boolean {
+  return (
+    pack.components.length > 0 ||
+    pack.skills.length > 0 ||
+    pack.rig !== undefined ||
+    pack.sandboxImage !== undefined ||
+    pack.sandboxProviderImages !== undefined
+  );
+}
+
+export type InlinePackSkillInstall = {
+  componentKey: string;
+  capabilityId: string;
+  pluginKey: string;
+  sourceUrl: string;
+  repositoryUrl: string;
+  sourceCommit: string;
+  sourcePath: string;
+  name: string;
+  description: string;
+  contentSha256: string;
+  totalBytes: number;
+  files: Array<{ path: string; content: string; byteSize: number; contentSha256: string }>;
+};
+
+/** Convert a legacy inline Pack Skill into the ordinary immutable Skill model. */
+export function inlinePackSkillInstall(
+  pack: CapabilityPack,
+  skill: CapabilityPackSkill,
+): InlinePackSkillInstall {
+  const artifact = buildPortableSkillArtifact(skill.files);
+  if (artifact.name.toLowerCase() !== skill.name.toLowerCase()) {
+    throw new HTTPException(422, {
+      message: `Pack Skill ${skill.name} has SKILL.md name ${artifact.name}; the names must match`,
+    });
+  }
+  const normalizedName = skill.name.toLowerCase();
+  const encodedSkill = encodeURIComponent(normalizedName);
+  const sourceUrl = `https://opengeni.invalid/pack-inline-skills/${encodedSkill}/${artifact.contentSha256}`;
+  const capabilityId = `skill:pack-inline/${normalizedName}@${artifact.contentSha256}`;
+  return {
+    componentKey: `inline-skill/${normalizedName}`,
+    capabilityId,
+    pluginKey: `pack-skill/${normalizedName}/${artifact.contentSha256}`,
+    sourceUrl,
+    repositoryUrl: "https://opengeni.invalid/pack-inline-skills",
+    sourceCommit: artifact.contentSha256,
+    sourcePath: normalizedName,
+    name: artifact.name,
+    description: artifact.description,
+    contentSha256: artifact.contentSha256,
+    totalBytes: artifact.totalBytes,
+    files: artifact.files.map((file) => ({
+      path: file.path,
+      content: file.content,
+      byteSize: new TextEncoder().encode(file.content).byteLength,
+      contentSha256: createHash("sha256").update(file.content).digest("hex"),
+    })),
+  };
+}
+
+export async function previewCapabilityPackInstallation(
+  db: Database,
+  workspaceId: string,
+  pack: CapabilityPack,
+  options: { rigId?: string; variableSetId?: string } = {},
+): Promise<PackInstallationPreview> {
+  const installation = await getPackInstallation(db, workspaceId, pack.id);
+  const inlineInstalls = pack.skills.map((skill) => inlinePackSkillInstall(pack, skill));
+  const [referencedComponents, inlineComponents] = await Promise.all([
+    resolvePackComponentReferences(db, workspaceId, pack.components),
+    resolvePackInlineSkillReferences(
+      db,
+      workspaceId,
+      inlineInstalls.map((inline) => ({
+        key: inline.componentKey,
+        capabilityId: inline.capabilityId,
+        name: inline.name,
+        contentSha256: inline.contentSha256,
+      })),
+      installation?.id,
+    ),
+  ]);
+  const manifestDigest = capabilityPackManifestDigest(pack);
+  const components: PackComponentResolution[] = [...referencedComponents, ...inlineComponents];
+  const blockers = components
+    .filter((component) => component.required && component.status !== "ready")
+    .map((component) =>
+      component.status === "missing"
+        ? `${component.label} is not installed in this workspace`
+        : `${component.label} does not match the Pack's pinned version`,
+    );
+  const rig = await resolvePackRig(
+    db,
+    workspaceId,
+    pack,
+    options.rigId,
+    installation?.selectedRigId,
+  );
+  if (
+    rig.status !== "ready" &&
+    rig.status !== "not_required" &&
+    (rig.required || rig.requestedRigId !== null || rig.rigId !== null)
+  ) {
+    blockers.push(packRigBlocker(rig, pack.sandboxImage ?? null));
+  }
+  const variableSetId =
+    options.variableSetId ?? storedVariableSetId(installation?.metadata) ?? null;
+  if (pack.variableSet?.required && !variableSetId) {
+    blockers.push("Choose saved configuration before installing this Pack");
+  } else if (variableSetId) {
+    const variableSet = await getVariableSet(db, workspaceId, variableSetId);
+    if (!variableSet) {
+      blockers.push("The selected configuration no longer exists in this workspace");
+    } else {
+      const missing = (pack.variableSet?.requiredVariables ?? []).filter(
+        (name) => !variableSet.variables.some((variable) => variable.name === name),
+      );
+      if (missing.length > 0) {
+        blockers.push(`Configuration is missing required value(s): ${missing.join(", ")}`);
+      }
+    }
+  }
+  const action =
+    !installation || installation.status === "disabled"
+      ? "install"
+      : installation.manifestDigest === manifestDigest
+        ? "repair"
+        : "update";
+  return {
+    packId: pack.id,
+    packVersion: pack.version,
+    manifestDigest,
+    installationVersion: installation?.version ?? null,
+    action,
+    ready: blockers.length === 0,
+    blockers,
+    components,
+    rig,
+    variableSetId,
+    legacyInlineSkillCount: pack.skills.length,
+    legacySandboxImage: pack.sandboxImage ?? null,
+  };
+}
+
+async function resolvePackRig(
+  db: Database,
+  workspaceId: string,
+  pack: CapabilityPack,
+  requestedRigId: string | undefined,
+  storedRigId: string | null | undefined,
+): Promise<PackRigResolution> {
+  const required = pack.rig?.required === true || Boolean(pack.sandboxImage);
+  const selectedRigId = pack.rig?.rigId ?? requestedRigId ?? storedRigId ?? null;
+  if (!required && !selectedRigId) {
+    return {
+      required: false,
+      status: "not_required",
+      requestedRigId: requestedRigId ?? null,
+      rigId: null,
+      rigVersionId: null,
+      name: null,
+      image: null,
+    };
+  }
+  if (pack.rig?.rigId && requestedRigId && pack.rig.rigId !== requestedRigId) {
+    return {
+      required,
+      status: "mismatch",
+      requestedRigId,
+      rigId: pack.rig.rigId,
+      rigVersionId: null,
+      name: null,
+      image: null,
+    };
+  }
+  if (!selectedRigId) {
+    return {
+      required,
+      status: "missing",
+      requestedRigId: requestedRigId ?? null,
+      rigId: null,
+      rigVersionId: null,
+      name: null,
+      image: null,
+    };
+  }
+  const rig = await getRig(db, workspaceId, selectedRigId);
+  if (!rig?.activeVersion) {
+    return {
+      required,
+      status: "missing",
+      requestedRigId: requestedRigId ?? null,
+      rigId: selectedRigId,
+      rigVersionId: null,
+      name: rig?.name ?? null,
+      image: null,
+    };
+  }
+  const image = rig.activeVersion.image ?? null;
+  const status =
+    pack.sandboxImage && image !== pack.sandboxImage
+      ? "mismatch"
+      : pack.rig?.requireVerified && rig.activeVersionHealth?.checkHealth !== "passing"
+        ? "unverified"
+        : "ready";
+  return {
+    required,
+    status,
+    requestedRigId: requestedRigId ?? null,
+    rigId: rig.id,
+    rigVersionId: rig.activeVersion.id,
+    name: rig.name,
+    image,
+  };
+}
+
+function packRigBlocker(rig: PackRigResolution, legacyImage: string | null): string {
+  if (rig.status === "missing") {
+    return "Choose an available compute environment before installing this Pack";
+  }
+  if (rig.status === "unverified") {
+    return "Verify the selected compute environment before installing this Pack";
+  }
+  if (legacyImage) {
+    return `The selected compute environment must use the Pack's previous image ${legacyImage}; the Pack will not replace workspace compute`;
+  }
+  return "The selected compute environment does not satisfy this Pack's requirement";
+}
+
+function storedVariableSetId(metadata: Record<string, unknown> | undefined): string | null {
+  const value = metadata?.variableSetId ?? metadata?.environmentId;
+  return typeof value === "string" && value.length > 0 ? value : null;
+}
+
 /**
  * v1 pack-scoped runtime rule: at most one enabled pack per workspace may
  * declare a `sandboxImage` — there is deliberately no image composition or

package/src/domain/personal-connection-delegations.ts

@@ -9,6 +9,7 @@ import type {
 } from "@opengeni/contracts";
 import {
   getSessionTurnPersonalConnectionDelegations,
+  getConnectionMetadata,
   getSocialConnection,
   getWorkspaceGrant,
   listConnectionsMetadata,
@@ -23,6 +24,10 @@ export type PersonalConnectionDelegationSource =
   | { kind: "turn"; sessionId: string; turnId: string }
   | { kind: "none" };
 export type AuthorizedSocialConnection = { connection: SocialConnection; subjectId: string | null };
+export type AuthorizedAtlassianConnection = {
+  connection: ConnectionMetadata;
+  subjectId: string | null;
+};
 
 export function directPersonalConnectionSubjectId(
   turn: Pick<SessionTurn, "source" | "initiator" | "initiatorContext">,
@@ -107,6 +112,70 @@ export async function authorizedSocialConnectionsForGrant(input: {
   return [...workspace.map((connection) => ({ connection, subjectId: null })), ...personal];
 }
 
+export async function authorizedAtlassianConnectionsForGrant(input: {
+  db: Database;
+  grant: AccessGrant;
+}): Promise<AuthorizedAtlassianConnection[]> {
+  const workspace = (await listConnectionsMetadata(input.db, input.grant.workspaceId, null)).filter(
+    (connection) =>
+      connection.subjectId === null &&
+      connection.status === "active" &&
+      sameProviderDomain(connection.providerDomain, "api.atlassian.com"),
+  );
+  const source = personalConnectionDelegationSourceForGrant(input.grant);
+  if (source.kind === "none") {
+    return workspace.map((connection) => ({ connection, subjectId: null }));
+  }
+  if (source.kind === "subject") {
+    const visible = await listConnectionsMetadata(
+      input.db,
+      input.grant.workspaceId,
+      source.subjectId,
+    );
+    return visible
+      .filter(
+        (connection) =>
+          connection.status === "active" &&
+          sameProviderDomain(connection.providerDomain, "api.atlassian.com"),
+      )
+      .map((connection) => ({
+        connection,
+        subjectId: connection.subjectId === null ? null : source.subjectId,
+      }));
+  }
+  const delegations = (
+    await getSessionTurnPersonalConnectionDelegations(
+      input.db,
+      input.grant.workspaceId,
+      source.sessionId,
+      source.turnId,
+    )
+  ).filter((item) => item.connectionType === "atlassian");
+  const personal: AuthorizedAtlassianConnection[] = [];
+  for (const delegation of delegations) {
+    if (!(await getWorkspaceGrant(input.db, delegation.ownerSubjectId, input.grant.workspaceId))) {
+      continue;
+    }
+    const connection = await getConnectionMetadata(
+      input.db,
+      input.grant.workspaceId,
+      delegation.connectionId,
+      delegation.ownerSubjectId,
+    );
+    if (
+      !connection ||
+      connection.subjectId !== delegation.ownerSubjectId ||
+      connection.status !== "active" ||
+      !sameProviderDomain(connection.providerDomain, delegation.providerDomain) ||
+      !sameProviderDomain(connection.providerDomain, "api.atlassian.com")
+    ) {
+      continue;
+    }
+    personal.push({ connection, subjectId: delegation.ownerSubjectId });
+  }
+  return [...workspace.map((connection) => ({ connection, subjectId: null })), ...personal];
+}
+
 export function selectedPersonalConnectionServers(
   settings: Pick<Settings, "mcpServers">,
   tools: ToolRef[],
@@ -181,7 +250,7 @@ export function personalConnectionDelegationsFromParent(input: {
   return [
     ...mcp,
     ...input.parentDelegations
-      .filter((item) => item.connectionType === "social")
+      .filter((item) => item.connectionType === "social" || item.connectionType === "atlassian")
       .map((item) => ({ ...item })),
   ];
 }
@@ -241,7 +310,7 @@ function personalAuthorityUnavailable(
 
 /**
  * Resolves subject-owned MCP credentials only through the exact authority
- * frozen on the causal turn. A direct human subject, worker Toolspace caller,
+ * frozen on the causal turn. A direct human subject, worker Codemode caller,
  * retry, or recovery can identify the caller, but none may widen or replace
  * the persisted connection UUID.
  */
@@ -288,8 +357,10 @@ export async function freezePersonalConnectionDelegations(input: {
   source: PersonalConnectionDelegationSource;
 }): Promise<McpPersonalConnectionDelegation[]> {
   const servers = selectedPersonalConnectionServers(input.settings, input.tools);
-  const includeSocial = input.tools.some((tool) => tool.id === "opengeni");
-  if ((servers.length === 0 && !includeSocial) || input.source.kind === "none") return [];
+  const includeFirstPartyConnections = input.tools.some((tool) => tool.id === "opengeni");
+  if ((servers.length === 0 && !includeFirstPartyConnections) || input.source.kind === "none") {
+    return [];
+  }
   if (input.source.kind === "turn") {
     const inherited = personalConnectionDelegationsFromParent({
       servers,
@@ -300,7 +371,11 @@ export async function freezePersonalConnectionDelegations(input: {
         input.source.turnId,
       ),
     });
-    return includeSocial ? inherited : inherited.filter((item) => item.connectionType !== "social");
+    return includeFirstPartyConnections
+      ? inherited
+      : inherited.filter(
+          (item) => item.connectionType !== "social" && item.connectionType !== "atlassian",
+        );
   }
   const membership = await getWorkspaceGrant(input.db, input.source.subjectId, input.workspaceId);
   if (!membership) return [];
@@ -309,7 +384,7 @@ export async function freezePersonalConnectionDelegations(input: {
     subjectId: input.source.subjectId,
     connections: await listConnectionsMetadata(input.db, input.workspaceId, input.source.subjectId),
   });
-  if (!includeSocial) return mcp;
+  if (!includeFirstPartyConnections) return mcp;
   const ownerSubjectId = input.source.subjectId;
   const visible = await listSocialConnections(input.db, input.workspaceId, 500, ownerSubjectId);
   const latest = new Map<"x" | "reddit", (typeof visible)[number]>();
@@ -324,6 +399,14 @@ export async function freezePersonalConnectionDelegations(input: {
     if (!prior || connection.updatedAt > prior.updatedAt)
       latest.set(connection.provider, connection);
   }
+  const personalAtlassian = (
+    await listConnectionsMetadata(input.db, input.workspaceId, ownerSubjectId)
+  ).filter(
+    (connection) =>
+      connection.subjectId === ownerSubjectId &&
+      connection.status === "active" &&
+      sameProviderDomain(connection.providerDomain, "api.atlassian.com"),
+  );
   return [
     ...mcp,
     ...[...latest.values()].map((connection) => ({
@@ -334,5 +417,13 @@ export async function freezePersonalConnectionDelegations(input: {
       kind: "oauth2" as const,
       connectionType: "social" as const,
     })),
+    ...personalAtlassian.map((connection) => ({
+      serverId: `atlassian:${connection.id}`,
+      connectionId: connection.id,
+      ownerSubjectId,
+      providerDomain: connection.providerDomain,
+      kind: connection.kind,
+      connectionType: "atlassian" as const,
+    })),
   ];
 }