@opengeni/core 2.6.4-canary.0 → 2.7.2-canary.0

package/src/model-catalog.ts

@@ -1,18 +1,25 @@
 import {
   applyModelCatalogDocument,
   configuredGatewayWorkspaceProductModelIds,
+  configuredGatewayOrganizationProductModelIds,
   configuredModels,
   configuredModelNotes,
   configuredOpenRouterWorkspaceProductModelIds,
+  configuredOpenRouterOrganizationProductModelIds,
   configuredProviders,
   validateModelCatalogSettings,
   withCodexCatalogProvider,
+  withOrganizationGatewayCatalogProvider,
+  withOrganizationOpenRouterCatalogProvider,
   withWorkspaceGatewayCatalogProvider,
   withWorkspaceOpenRouterCatalogProvider,
   withXaiSubscriptionCatalogProvider,
   WORKSPACE_GATEWAY_MODEL_ID_PREFIX,
   WORKSPACE_OPENROUTER_MODEL_ID_PREFIX,
   WORKSPACE_OPENROUTER_PROVIDER_ID,
+  ORGANIZATION_OPENROUTER_PROVIDER_ID,
+  ORGANIZATION_GATEWAY_MODEL_ID_PREFIX,
+  ORGANIZATION_OPENROUTER_MODEL_ID_PREFIX,
   type ConfiguredModel,
   type Settings,
 } from "@opengeni/config";
@@ -26,8 +33,13 @@ import {
   getDeploymentModelCatalog,
   getWorkspaceGatewayCustomModelForExecution,
   getWorkspaceOpenRouterCustomModelForExecution,
+  getOrganizationModelProviderCustomModelForExecution,
   listWorkspaceGatewayCustomModels,
   listWorkspaceOpenRouterCustomModels,
+  listOrganizationModelProviderCustomModelsForWorkspace,
+  lockActiveOrganizationModelProviderCustomModelForAdmission,
+  lockActiveWorkspaceGatewayCustomModelForAdmission,
+  lockActiveWorkspaceOpenRouterCustomModelForAdmission,
   type Database,
 } from "@opengeni/db";
 
@@ -58,6 +70,7 @@ export function isWorkspaceOpenRouterCustomModelId(settings: Settings, modelId:
 }
 
 export type WorkspaceCustomModelReference = {
+  scope: "workspace" | "organization";
   providerKind: "vercel_gateway" | "openrouter";
   upstreamModelId: string;
 };
@@ -68,16 +81,38 @@ export function workspaceCustomModelReference(
 ): WorkspaceCustomModelReference | null {
   if (isWorkspaceGatewayCustomModelId(settings, modelId)) {
     return {
+      scope: "workspace",
       providerKind: "vercel_gateway",
       upstreamModelId: modelId.slice(WORKSPACE_GATEWAY_MODEL_ID_PREFIX.length),
     };
   }
   if (isWorkspaceOpenRouterCustomModelId(settings, modelId)) {
     return {
+      scope: "workspace",
       providerKind: "openrouter",
       upstreamModelId: modelId.slice(WORKSPACE_OPENROUTER_MODEL_ID_PREFIX.length),
     };
   }
+  if (
+    modelId.startsWith(ORGANIZATION_GATEWAY_MODEL_ID_PREFIX) &&
+    !configuredGatewayOrganizationProductModelIds(settings).includes(modelId)
+  ) {
+    return {
+      scope: "organization",
+      providerKind: "vercel_gateway",
+      upstreamModelId: modelId.slice(ORGANIZATION_GATEWAY_MODEL_ID_PREFIX.length),
+    };
+  }
+  if (
+    modelId.startsWith(ORGANIZATION_OPENROUTER_MODEL_ID_PREFIX) &&
+    !configuredOpenRouterOrganizationProductModelIds(settings).includes(modelId)
+  ) {
+    return {
+      scope: "organization",
+      providerKind: "openrouter",
+      upstreamModelId: modelId.slice(ORGANIZATION_OPENROUTER_MODEL_ID_PREFIX.length),
+    };
+  }
   return null;
 }
 
@@ -85,6 +120,39 @@ export function isWorkspaceCustomModelId(settings: Settings, modelId: string): b
   return workspaceCustomModelReference(settings, modelId) !== null;
 }
 
+export async function lockActiveCustomModelForAdmission(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    reference: WorkspaceCustomModelReference;
+  },
+): Promise<boolean> {
+  if (input.reference.scope === "organization") {
+    return Boolean(
+      await lockActiveOrganizationModelProviderCustomModelForAdmission(db, {
+        accountId: input.accountId,
+        workspaceId: input.workspaceId,
+        providerKind: input.reference.providerKind,
+        upstreamModelId: input.reference.upstreamModelId,
+      }),
+    );
+  }
+  return Boolean(
+    input.reference.providerKind === "openrouter"
+      ? await lockActiveWorkspaceOpenRouterCustomModelForAdmission(db, {
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          upstreamModelId: input.reference.upstreamModelId,
+        })
+      : await lockActiveWorkspaceGatewayCustomModelForAdmission(db, {
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          upstreamModelId: input.reference.upstreamModelId,
+        }),
+  );
+}
+
 /**
  * Resolve the deployment catalog without making synchronous env settings read
  * Postgres. Database mode fails closed when the singleton is absent or invalid;
@@ -133,6 +201,11 @@ export async function resolveWorkspaceCatalogSettings(
     retainedProductModelIds?: readonly (string | null | undefined)[];
   },
 ): Promise<ResolvedCatalogSettings> {
+  // A few pure catalog tests inject the historical minimal DB port and mock the
+  // workspace model helpers directly. Real/injected runtime databases always
+  // expose transactions; keep that narrow test port compatible.
+  const supportsOrganizationProviderReads =
+    typeof (db as Database & { transaction?: unknown }).transaction === "function";
   const retainedProductModelIds = [
     ...(input.retainedProductModelIds ?? []),
     input.retainedProductModelId,
@@ -147,12 +220,28 @@ export async function resolveWorkspaceCatalogSettings(
       ? [productModelId.slice(WORKSPACE_OPENROUTER_MODEL_ID_PREFIX.length)]
       : [],
   );
+  const retainedOrganizationGatewayUpstreamModelIds = retainedProductModelIds.flatMap(
+    (productModelId) =>
+      productModelId?.startsWith(ORGANIZATION_GATEWAY_MODEL_ID_PREFIX)
+        ? [productModelId.slice(ORGANIZATION_GATEWAY_MODEL_ID_PREFIX.length)]
+        : [],
+  );
+  const retainedOrganizationOpenRouterUpstreamModelIds = retainedProductModelIds.flatMap(
+    (productModelId) =>
+      productModelId?.startsWith(ORGANIZATION_OPENROUTER_MODEL_ID_PREFIX)
+        ? [productModelId.slice(ORGANIZATION_OPENROUTER_MODEL_ID_PREFIX.length)]
+        : [],
+  );
   const [
     resolved,
     activeGatewayCustomModels,
     activeOpenRouterCustomModels,
     retainedGatewayCustomModels,
     retainedOpenRouterCustomModels,
+    organizationGatewayCustomModels,
+    organizationOpenRouterCustomModels,
+    retainedOrganizationGatewayCustomModels,
+    retainedOrganizationOpenRouterCustomModels,
   ] = await Promise.all([
     resolveCatalogSettings(db, envSettings),
     listWorkspaceGatewayCustomModels(db, {
@@ -183,6 +272,46 @@ export async function resolveWorkspaceCatalogSettings(
           }),
       ),
     ),
+    supportsOrganizationProviderReads
+      ? listOrganizationModelProviderCustomModelsForWorkspace(db, {
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          providerKind: "vercel_gateway",
+        })
+      : Promise.resolve([]),
+    supportsOrganizationProviderReads
+      ? listOrganizationModelProviderCustomModelsForWorkspace(db, {
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          providerKind: "openrouter",
+        })
+      : Promise.resolve([]),
+    supportsOrganizationProviderReads
+      ? Promise.all(
+          [...new Set(retainedOrganizationGatewayUpstreamModelIds)].map(
+            async (upstreamModelId) =>
+              await getOrganizationModelProviderCustomModelForExecution(db, {
+                accountId: input.accountId,
+                workspaceId: input.workspaceId,
+                providerKind: "vercel_gateway",
+                upstreamModelId,
+              }),
+          ),
+        )
+      : Promise.resolve([]),
+    supportsOrganizationProviderReads
+      ? Promise.all(
+          [...new Set(retainedOrganizationOpenRouterUpstreamModelIds)].map(
+            async (upstreamModelId) =>
+              await getOrganizationModelProviderCustomModelForExecution(db, {
+                accountId: input.accountId,
+                workspaceId: input.workspaceId,
+                providerKind: "openrouter",
+                upstreamModelId,
+              }),
+          ),
+        )
+      : Promise.resolve([]),
   ]);
   const includeRetainedModels = <T extends { upstreamModelId: string }>(
     activeModels: readonly T[],
@@ -209,11 +338,25 @@ export async function resolveWorkspaceCatalogSettings(
     activeOpenRouterCustomModels,
     retainedOpenRouterCustomModels,
   );
+  const organizationGatewayModels = includeRetainedModels(
+    organizationGatewayCustomModels,
+    retainedOrganizationGatewayCustomModels,
+  );
+  const organizationOpenRouterModels = includeRetainedModels(
+    organizationOpenRouterCustomModels,
+    retainedOrganizationOpenRouterCustomModels,
+  );
   return {
     ...resolved,
-    settings: withWorkspaceOpenRouterCatalogProvider(
-      withWorkspaceGatewayCatalogProvider(resolved.settings, gatewayCustomModels),
-      openRouterCustomModels,
+    settings: withOrganizationOpenRouterCatalogProvider(
+      withOrganizationGatewayCatalogProvider(
+        withWorkspaceOpenRouterCatalogProvider(
+          withWorkspaceGatewayCatalogProvider(resolved.settings, gatewayCustomModels),
+          openRouterCustomModels,
+        ),
+        organizationGatewayModels,
+      ),
+      organizationOpenRouterModels,
     ),
   };
 }
@@ -242,6 +385,8 @@ export type WorkspaceModelSelectionInput = {
   xaiSubscriptionActive?: boolean;
   workspaceGatewayConnectionActive?: boolean;
   workspaceOpenRouterConnectionActive?: boolean;
+  organizationGatewayConnectionActive?: boolean;
+  organizationOpenRouterConnectionActive?: boolean;
   workspaceGatewayCustomModels?: readonly {
     upstreamModelId: string;
     label?: string | null;
@@ -250,6 +395,14 @@ export type WorkspaceModelSelectionInput = {
     upstreamModelId: string;
     label?: string | null;
   }[];
+  organizationGatewayCustomModels?: readonly {
+    upstreamModelId: string;
+    label?: string | null;
+  }[];
+  organizationOpenRouterCustomModels?: readonly {
+    upstreamModelId: string;
+    label?: string | null;
+  }[];
   credentialReadinessObservations?:
     | Readonly<Record<string, ModelCredentialReadinessObservation>>
     | undefined;
@@ -332,6 +485,8 @@ function credentialReadinessFor(input: {
   xaiSubscriptionActive: boolean;
   workspaceGatewayConnectionActive: boolean;
   workspaceOpenRouterConnectionActive: boolean;
+  organizationGatewayConnectionActive: boolean;
+  organizationOpenRouterConnectionActive: boolean;
   observation: ModelCredentialReadinessObservation | undefined;
   nowMs: number;
   maxAgeMs: number;
@@ -363,6 +518,20 @@ function credentialReadinessFor(input: {
           checkedAt: null,
         };
   }
+  if (source.kind === "organization_connection") {
+    const connectionActive =
+      input.model.providerId === ORGANIZATION_OPENROUTER_PROVIDER_ID
+        ? input.organizationOpenRouterConnectionActive
+        : input.organizationGatewayConnectionActive;
+    return connectionActive
+      ? { status: "ready", reason: null, basis: "connection", checkedAt: null }
+      : {
+          status: "not_ready",
+          reason: "needs_reauth",
+          basis: "connection",
+          checkedAt: null,
+        };
+  }
   if (source.kind === "deployment" && source.mechanism === "none") {
     return { status: "ready", reason: null, basis: "configuration", checkedAt: null };
   }
@@ -512,9 +681,15 @@ export function resolveWorkspaceModelSelection(
   const xaiSettings = input.settings.supergrokSubscriptionEnabled
     ? withXaiSubscriptionCatalogProvider(codexSettings)
     : codexSettings;
-  const catalogSettings = withWorkspaceOpenRouterCatalogProvider(
-    withWorkspaceGatewayCatalogProvider(xaiSettings, input.workspaceGatewayCustomModels ?? []),
-    input.workspaceOpenRouterCustomModels ?? [],
+  const catalogSettings = withOrganizationOpenRouterCatalogProvider(
+    withOrganizationGatewayCatalogProvider(
+      withWorkspaceOpenRouterCatalogProvider(
+        withWorkspaceGatewayCatalogProvider(xaiSettings, input.workspaceGatewayCustomModels ?? []),
+        input.workspaceOpenRouterCustomModels ?? [],
+      ),
+      input.organizationGatewayCustomModels ?? [],
+    ),
+    input.organizationOpenRouterCustomModels ?? [],
   );
   const providers = new Map(
     configuredProviders(catalogSettings).map((provider) => [provider.id, provider]),
@@ -544,6 +719,8 @@ export function resolveWorkspaceModelSelection(
       xaiSubscriptionActive: input.xaiSubscriptionActive === true,
       workspaceGatewayConnectionActive: input.workspaceGatewayConnectionActive === true,
       workspaceOpenRouterConnectionActive: input.workspaceOpenRouterConnectionActive === true,
+      organizationGatewayConnectionActive: input.organizationGatewayConnectionActive === true,
+      organizationOpenRouterConnectionActive: input.organizationOpenRouterConnectionActive === true,
       observation: input.credentialReadinessObservations?.[model.definitionVersion],
       nowMs,
       maxAgeMs,

package/src/sandbox/fleet.ts

@@ -454,31 +454,18 @@ export async function listFleet(
   };
 }
 
-/** Resolve a swap target id → the value `setActiveSandbox` writes. The session's
- *  own group id maps to NULL (the default pointer); a first-class sandbox id is
- *  validated (workspace ownership + liveness) and written verbatim. */
-async function resolveTarget(
+type FleetResourceContext = Pick<FleetContext, "accountId" | "workspaceId" | "subjectId">;
+
+type ResolvedNamedSandboxTarget =
+  | { ok: true; targetSandboxId: string; workspaceRoot?: string }
+  | { ok: false; reason: string; code: BackendUnresolvableCode };
+
+/** Resolve one named sandbox, independent of any existing session pointer. */
+async function resolveNamedSandboxTarget(
   services: FleetServices,
-  ctx: FleetContext,
+  ctx: FleetResourceContext,
   target: string,
-): Promise<
-  | { ok: true; targetSandboxId: string | null; workspaceRoot?: string }
-  | { ok: false; reason: string; code: BackendUnresolvableCode }
-> {
-  // The session's own group box → the default pointer (null).
-  if (target === ctx.sessionGroupId || target === "session" || target === "default") {
-    if (!managedSessionGroupBackend(services.settings.sandboxBackend, ctx.sessionBackend)) {
-      return {
-        ok: false,
-        reason:
-          ctx.sessionBackend === "none"
-            ? "this session has no home sandbox; attach a Connected Machine"
-            : "this deployment has no managed session sandbox; select an enrolled machine",
-        code: "unsupported_backend_context",
-      };
-    }
-    return { ok: true, targetSandboxId: null };
-  }
+): Promise<ResolvedNamedSandboxTarget> {
   const sandbox = await getSandbox(
     services.db,
     ctx.subjectId
@@ -566,6 +553,81 @@ async function resolveTarget(
   };
 }
 
+export type CreateTimeSandboxTargetPreflight =
+  | { ok: true; targetSandboxId: string; workingDir: string | null }
+  | {
+      ok: false;
+      reason: string;
+      code: BackendUnresolvableCode | "invalid_working_directory";
+    };
+
+/**
+ * Validate a named create-time machine target before any session row exists.
+ * The caller still commits the pointer with `setActiveSandbox` inside the
+ * session-create transaction, which rechecks durable ownership/enrollment
+ * authority and closes the remove/revoke race without holding database locks
+ * across the liveness probe.
+ */
+export async function preflightCreateTimeSandboxTarget(
+  services: FleetServices,
+  ctx: FleetResourceContext,
+  target: string,
+  workingDir: string | null,
+): Promise<CreateTimeSandboxTargetPreflight> {
+  const resolved = await resolveNamedSandboxTarget(services, ctx, target);
+  if (!resolved.ok) return resolved;
+  if (!resolved.workspaceRoot) {
+    return {
+      ok: true,
+      targetSandboxId: resolved.targetSandboxId,
+      workingDir,
+    };
+  }
+  try {
+    return {
+      ok: true,
+      targetSandboxId: resolved.targetSandboxId,
+      workingDir:
+        resolveConnectedMachineWorkspaceRoot(resolved.workspaceRoot, workingDir) ??
+        resolved.workspaceRoot,
+    };
+  } catch (error) {
+    return {
+      ok: false,
+      reason: error instanceof Error ? error.message : String(error),
+      code: "invalid_working_directory",
+    };
+  }
+}
+
+/** Resolve a swap target id → the value `setActiveSandbox` writes. The session's
+ *  own group id maps to NULL (the default pointer); a first-class sandbox id is
+ *  validated (workspace ownership + liveness) and written verbatim. */
+async function resolveTarget(
+  services: FleetServices,
+  ctx: FleetContext,
+  target: string,
+): Promise<
+  | { ok: true; targetSandboxId: string | null; workspaceRoot?: string }
+  | { ok: false; reason: string; code: BackendUnresolvableCode }
+> {
+  // The session's own group box → the default pointer (null).
+  if (target === ctx.sessionGroupId || target === "session" || target === "default") {
+    if (!managedSessionGroupBackend(services.settings.sandboxBackend, ctx.sessionBackend)) {
+      return {
+        ok: false,
+        reason:
+          ctx.sessionBackend === "none"
+            ? "this session has no home sandbox; attach a Connected Machine"
+            : "this deployment has no managed session sandbox; select an enrolled machine",
+        code: "unsupported_backend_context",
+      };
+    }
+    return { ok: true, targetSandboxId: null };
+  }
+  return await resolveNamedSandboxTarget(services, ctx, target);
+}
+
 /**
  * THE SWAP (and attach — identical mechanic). Validate the target's ownership +
  * liveness, then repoint the session via the epoch-fenced CAS `setActiveSandbox`: