@opengeni/core 1.4.5-canary.38533733713001 → 2.0.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/core",
-  "version": "1.4.5-canary.38533733713001",
+  "version": "2.0.1",
   "description": "Opengeni framework-agnostic core: the domain, access, and billing layers (neutral access, off-HTTP V2 surface). Behavior-preserving extraction from apps/api — keeps Hono's HTTPException for error throwing (typed-errors cleanup deferred).",
   "license": "Apache-2.0",
   "repository": {
@@ -50,18 +50,18 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/capabilities": "1.4.5-canary.38533733713001",
-    "@opengeni/codex": "1.4.5-canary.38533733713001",
-    "@opengeni/config": "1.4.5-canary.38533733713001",
-    "@opengeni/contracts": "1.4.5-canary.38533733713001",
-    "@opengeni/db": "1.4.5-canary.38533733713001",
-    "@opengeni/documents": "1.4.5-canary.38533733713001",
-    "@opengeni/events": "1.4.5-canary.38533733713001",
-    "@opengeni/network": "1.4.5-canary.38533733713001",
-    "@opengeni/observability": "1.4.5-canary.38533733713001",
-    "@opengeni/runtime": "1.4.5-canary.38533733713001",
-    "@opengeni/storage": "1.4.5-canary.38533733713001",
-    "@opengeni/vaults": "1.4.5-canary.38533733713001",
+    "@opengeni/capabilities": "2.0.1",
+    "@opengeni/codex": "2.0.1",
+    "@opengeni/config": "2.0.1",
+    "@opengeni/contracts": "2.0.1",
+    "@opengeni/db": "2.0.1",
+    "@opengeni/documents": "2.0.1",
+    "@opengeni/events": "2.0.1",
+    "@opengeni/network": "2.0.1",
+    "@opengeni/observability": "2.0.1",
+    "@opengeni/runtime": "2.0.1",
+    "@opengeni/storage": "2.0.1",
+    "@opengeni/vaults": "2.0.1",
     "hono": "^4.12.18",
     "zod": "^4.2.1"
   },

package/src/access/service-initiator.ts

@@ -34,7 +34,7 @@ export function serviceInitiatorFromHeaders(
       )
         throw new Error("flat");
       context = parsed as typeof context;
-      // Keep delegated provenance's reserved, OpenGeni-owned lineage fields.
+      // Keep delegated provenance's reserved, Opengeni-owned lineage fields.
       if (!ServiceTurnInitiatorContext.safeParse(context).success) throw new Error("reserved");
     } catch {
       throw new HTTPException(422, {

package/src/domain/capabilities.ts

@@ -1732,7 +1732,7 @@ export function nativeConnectionCapabilityRecommendations(
         source: "built_in",
         name: "Connected Machine",
         description:
-          "Run this chat on the person's own computer or server (Mac, Linux or Windows), and optionally let agents use their Chrome through the OpenGeni Browser extension.",
+          "Run this chat on the person's own computer or server (Mac, Linux or Windows), and optionally let agents use their Chrome through the Opengeni Browser extension.",
         category: "compute",
         tags: [
           "machine",
@@ -1760,7 +1760,7 @@ export function nativeConnectionCapabilityRecommendations(
         tools: [{ kind: "mcp", id: "opengeni" }],
         runtime: {
           available: true,
-          notes: `The person runs a one-line connect command on their machine from the chat card. The OpenGeni Browser Chrome extension (${OPENGENI_BROWSER_EXTENSION_URL}) works only after the machine is connected.`,
+          notes: `The person runs a one-line connect command on their machine from the chat card. The Opengeni Browser Chrome extension (${OPENGENI_BROWSER_EXTENSION_URL}) works only after the machine is connected.`,
         },
         lifecycle: {
           status: "available",

package/src/domain/sessions.ts

@@ -3246,7 +3246,7 @@ async function createSessionForRequestInFileScope(
   // model and reasoning fields therefore inherit that calling turn rather than the
   // deployment defaults. This is especially important for Codex subscription
   // managers: falling back to the deployment model would silently move a child
-  // onto the OpenGeni-credits billing path. Legacy session-bound grants without
+  // onto the Opengeni-credits billing path. Legacy session-bound grants without
   // exact attempt claims fall back to the parent session's persisted defaults.
   const model = canonicalConfiguredModel(settings, effectiveModelId);
   if (model === null || model === undefined) {

package/src/domain/vaults/provider-registry.ts

@@ -2,6 +2,7 @@ import type { Settings } from "@opengeni/config";
 import type { ConnectionMetadata, VaultErrorCode } from "@opengeni/contracts";
 import {
   getConnectionMetadata,
+  getProviderConnectionHomeWorkspace,
   loadConnectionCredentialForBroker,
   type Database,
 } from "@opengeni/db";
@@ -100,9 +101,12 @@ export function onePasswordCredentialBundle(token: string): Record<string, unkno
 }
 
 /**
- * Decrypts the token of one 1Password connection the caller can see
- * (workspace-shared, or personal to `subjectId`). The token goes only to the
- * provider factory; it is never logged or returned to a client.
+ * Decrypts the token of one 1Password connection the caller can use from
+ * `workspaceId`: one in this workspace (shared, or personal to `subjectId`),
+ * or one added in another workspace that still serves vaults reached here
+ * (the caller's own personal connection, or a shared connection behind an
+ * organization vault). The token goes only to the provider factory; it is
+ * never logged or returned to a client.
  */
 export async function loadOnePasswordConnectionToken(
   db: Database,
@@ -114,12 +118,25 @@ export async function loadOnePasswordConnectionToken(
       "provider_auth_invalid",
       "The 1Password connection for this vault was removed or is not available to you; reconnect 1Password",
     );
-  const connection = await getConnectionMetadata(
+  let homeWorkspaceId = input.workspaceId;
+  let connection = await getConnectionMetadata(
     db,
     input.workspaceId,
     input.connectionId,
     input.subjectId,
   );
+  if (!connection) {
+    const home = await getProviderConnectionHomeWorkspace(
+      db,
+      input.workspaceId,
+      input.connectionId,
+      input.subjectId,
+    );
+    if (home && home !== input.workspaceId) {
+      homeWorkspaceId = home;
+      connection = await getConnectionMetadata(db, home, input.connectionId, input.subjectId);
+    }
+  }
   if (!connection || !isOnePasswordConnection(connection)) throw unavailable();
   if (connection.status !== "active") {
     throw new VaultProviderError(
@@ -129,7 +146,7 @@ export async function loadOnePasswordConnectionToken(
   }
   const personal = connection.subjectId !== null;
   const credential = await loadConnectionCredentialForBroker(db, settings, {
-    workspaceId: input.workspaceId,
+    workspaceId: homeWorkspaceId,
     connectionId: connection.id,
     providerDomain: ONEPASSWORD_PROVIDER_DOMAIN,
     kind: "api_key",

package/src/domain/vaults/provider-sync.ts

@@ -168,7 +168,7 @@ export function providerPrimaryFieldId(
 /**
  * Deterministic mirror projection. Items are ordered by provider name then
  * external id before de-duplication, so the same provider state always yields
- * the same OpenGeni names; field names are de-duplicated within each item.
+ * the same Opengeni names; field names are de-duplicated within each item.
  */
 export function planProviderMirror(
   items: readonly ProviderItemMeta[],
@@ -426,3 +426,100 @@ export async function syncLinkedProviderVault(input: {
     ...(input.force ? { force: true } : {}),
   });
 }
+
+/** How stale a linked vault's mirror may be before a search refreshes it. */
+export const LINKED_VAULT_SEARCH_MAX_AGE_MS = 10 * 60_000;
+/** How stale it may be before a reference that found nothing refreshes it. */
+export const LINKED_VAULT_MISS_MAX_AGE_MS = 2 * 60_000;
+/** How long a search or resolution waits for refreshes before answering. */
+export const LINKED_VAULT_REFRESH_WAIT_MS = 8_000;
+
+/** The vault fields a freshness check needs (a `VaultRow` has them all). */
+export type LinkedVaultFreshness = {
+  id: string;
+  source: string;
+  syncStatus: VaultSyncStatus;
+  lastSyncedAt: string | null;
+  rateLimitedUntil: string | null;
+  updatedAt: string;
+};
+
+/**
+ * Whether a linked vault's mirror is older than `maxAgeMs`. A vault whose last
+ * sync failed counts from that failure (it is recorded as `updatedAt`), so a
+ * broken connection is retried once per `maxAgeMs`, not on every call. A vault
+ * under a provider rate limit is never stale until the limit lifts.
+ */
+export function linkedVaultNeedsRefresh(
+  vault: LinkedVaultFreshness,
+  maxAgeMs: number,
+  now: Date,
+): boolean {
+  if (vault.source === "opengeni") return false;
+  if (vault.rateLimitedUntil && new Date(vault.rateLimitedUntil).getTime() > now.getTime()) {
+    return false;
+  }
+  const last =
+    vault.syncStatus === "ok" || vault.syncStatus === "syncing"
+      ? vault.lastSyncedAt
+      : vault.updatedAt;
+  if (!last) return true;
+  return now.getTime() - new Date(last).getTime() >= maxAgeMs;
+}
+
+const linkedVaultRefreshes = new Map<string, Promise<ProviderVaultSyncResult | null>>();
+
+/**
+ * Bring stale linked vault mirrors up to date, so items added in the provider
+ * (for example straight in 1Password) are found without anyone pressing Sync.
+ *
+ * Each refresh is the ordinary non-forced sync: one `listVaults` call, and an
+ * item listing only when the provider says the vault changed. Refreshes of the
+ * same vault share one call per process. The caller waits at most `waitMs`;
+ * slower refreshes finish in the background and record their own status.
+ * Never throws: failures are recorded as the vault's sync status.
+ *
+ * Returns the ids of the vaults whose mirror changed before the wait ended.
+ */
+export async function refreshStaleLinkedVaults(input: {
+  db: Database;
+  context: VaultDbContext;
+  vaults: readonly LinkedVaultFreshness[];
+  providers: VaultProviderRegistry;
+  maxAgeMs: number;
+  waitMs?: number;
+  now?: () => Date;
+}): Promise<string[]> {
+  const now = (input.now ?? (() => new Date()))();
+  const stale = input.vaults.filter((vault) => linkedVaultNeedsRefresh(vault, input.maxAgeMs, now));
+  if (stale.length === 0) return [];
+  const changed: string[] = [];
+  const runs = stale.map((vault) => {
+    let run = linkedVaultRefreshes.get(vault.id);
+    if (!run) {
+      run = syncLinkedProviderVault({
+        db: input.db,
+        context: input.context,
+        vaultId: vault.id,
+        providers: input.providers,
+        ...(input.now ? { now: input.now } : {}),
+      })
+        .catch(() => null)
+        .finally(() => linkedVaultRefreshes.delete(vault.id));
+      linkedVaultRefreshes.set(vault.id, run);
+    }
+    return run.then((result) => {
+      if (result?.status === "synced") changed.push(vault.id);
+    });
+  });
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  await Promise.race([
+    Promise.all(runs),
+    new Promise<void>((resolve) => {
+      timer = setTimeout(resolve, input.waitMs ?? LINKED_VAULT_REFRESH_WAIT_MS);
+      timer.unref?.();
+    }),
+  ]);
+  if (timer) clearTimeout(timer);
+  return [...changed];
+}

package/src/domain/vaults/provider-writes.ts

@@ -28,7 +28,7 @@ import { syncLinkedProviderVault } from "./provider-sync";
  * Edits of items in a read-write connected vault (OP-3): the change is written
  * to the provider (1Password `items.get` → patch → `items.put`, with the
  * mirrored version as the expected version), then the metadata mirror is
- * refreshed. Values never touch OpenGeni storage.
+ * refreshed. Values never touch Opengeni storage.
  */
 
 /** One field change; the REST `VaultFieldInput` and the agent `secret_save` field both fit. */
@@ -112,7 +112,7 @@ async function providerFieldWrites(
     if (input.fileBase64 !== undefined || kind === "file") {
       throw new VaultError(
         "provider_unavailable",
-        "files in connected vaults are read-only in OpenGeni",
+        "files in connected vaults are read-only in Opengeni",
         { field: input.name },
       );
     }
@@ -181,7 +181,7 @@ async function refreshAndFind(
     if (error instanceof VaultError && error.code === "vault_item_not_found") {
       throw new VaultError(
         "provider_unavailable",
-        "saved in the provider; OpenGeni will show it after the next sync",
+        "saved in the provider; Opengeni will show it after the next sync",
         { vaultId: vault.id },
       );
     }
@@ -210,7 +210,7 @@ export async function writeProviderVaultItem(
   const { vault, existing, change } = input;
   assertProviderVaultWritable(vault);
   if ((change.type ?? existing?.type) === "passkey") {
-    throw new VaultError("vault_permission_denied", "passkeys live only in OpenGeni vaults");
+    throw new VaultError("vault_permission_denied", "passkeys live only in Opengeni vaults");
   }
   let externalItemId: string | undefined;
   let expectedVersion: string | null | undefined;

package/src/domain/vaults/secret-resolver.ts

@@ -23,6 +23,7 @@ import {
 } from "@opengeni/contracts";
 import {
   decryptEnvironmentValue,
+  listVaultsForSubject,
   recordVaultSecretUse,
   resolveSecretReferenceCandidates,
   type SecretReferenceCandidate,
@@ -37,6 +38,7 @@ import {
   type VaultProviderErrorCode,
   type VaultProviderRegistry,
 } from "@opengeni/vaults";
+import { LINKED_VAULT_MISS_MAX_AGE_MS, refreshStaleLinkedVaults } from "./provider-sync";
 import type { VaultServiceDeps } from "./types";
 
 export type SecretResolverOptions = {
@@ -286,20 +288,43 @@ export function createSecretResolver(
       );
     }
 
-    const { meta, candidates } = await resolveSecretReferenceCandidates(deps.db, context, {
-      refs: references.map((reference, index) => lookupFor(reference, index)),
-    });
-    const failures: SecretReferenceFailure[] = [];
-    const chosen: Chosen[] = [];
-    references.forEach((reference, index) => {
-      const outcome = chooseSecretCandidate(
-        reference,
-        candidates.filter((candidate) => candidate.refIndex === index),
-        meta,
-      );
-      if ("failure" in outcome) failures.push(outcome.failure);
-      else chosen.push({ reference, candidate: outcome.candidate });
-    });
+    const choose = async () => {
+      const { meta, candidates } = await resolveSecretReferenceCandidates(deps.db, context, {
+        refs: references.map((reference, index) => lookupFor(reference, index)),
+      });
+      const failures: SecretReferenceFailure[] = [];
+      const chosen: Chosen[] = [];
+      references.forEach((reference, index) => {
+        const outcome = chooseSecretCandidate(
+          reference,
+          candidates.filter((candidate) => candidate.refIndex === index),
+          meta,
+        );
+        if ("failure" in outcome) failures.push(outcome.failure);
+        else chosen.push({ reference, candidate: outcome.candidate });
+      });
+      return { meta, failures, chosen };
+    };
+    let { meta, failures, chosen } = await choose();
+    // A reference to an item added straight in a connected provider (1Password)
+    // finds nothing until the vault's mirror catches up: refresh stale linked
+    // vaults once and look again before reporting it missing.
+    if (failures.some((failure) => failure.code === "not_found")) {
+      const registry = deps.providers ?? opts.providersForSubject?.(meta.subjectId);
+      if (registry) {
+        const reachable = await listVaultsForSubject(deps.db, context, {
+          workspaceId: principal.workspaceId,
+        });
+        const changed = await refreshStaleLinkedVaults({
+          db: deps.db,
+          context,
+          vaults: reachable,
+          providers: registry,
+          maxAgeMs: LINKED_VAULT_MISS_MAX_AGE_MS,
+        });
+        if (changed.length > 0) ({ meta, failures, chosen } = await choose());
+      }
+    }
     const hasActingHuman = meta.humanExpected && meta.humanValid;
     if (failures.length > 0) {
       throw new SecretReferenceError(

package/src/domain/vaults/vault-service.ts

@@ -92,6 +92,7 @@ import {
   type VaultCallerAuthority,
 } from "./mapping";
 import { vaultErrorCodeForProvider } from "./provider-registry";
+import { LINKED_VAULT_SEARCH_MAX_AGE_MS, refreshStaleLinkedVaults } from "./provider-sync";
 import {
   archiveProviderVaultItem,
   writeProviderVaultItem,
@@ -423,7 +424,7 @@ export function createVaultService(deps: VaultServiceDeps): VaultService {
    * Values never live in both stores' databases at once: each field is read
    * from the source (service-side, unaudited like other internal copies),
    * written to the target through its own path, and a move then archives the
-   * source so the old item stays recoverable. OpenGeni-to-OpenGeni moves keep
+   * source so the old item stays recoverable. Opengeni-to-Opengeni moves keep
    * the single-statement database move, which preserves the item id.
    */
   async function moveAcrossProviders(input: {
@@ -940,9 +941,25 @@ export function createVaultService(deps: VaultServiceDeps): VaultService {
 
     async searchForAgent(principal, input) {
       const context = principalContext(principal);
-      const reachable = await listVaultsForSubject(deps.db, context, {
+      let reachable = await listVaultsForSubject(deps.db, context, {
         workspaceId: principal.workspaceId,
       });
+      // Items added straight in a connected provider (1Password) appear here
+      // without anyone pressing Sync: stale mirrors refresh before the scan.
+      if (deps.providers) {
+        const changed = await refreshStaleLinkedVaults({
+          db: deps.db,
+          context,
+          vaults: reachable,
+          providers: deps.providers,
+          maxAgeMs: LINKED_VAULT_SEARCH_MAX_AGE_MS,
+        });
+        if (changed.length > 0) {
+          reachable = await listVaultsForSubject(deps.db, context, {
+            workspaceId: principal.workspaceId,
+          });
+        }
+      }
       const byTier = (vaults: VaultRow[]) =>
         [...vaults].sort(
           (left, right) => left.tier - right.tier || left.name.localeCompare(right.name),