@opengeni/core 2.6.4 → 2.7.5-canary.0

package/dist/model-catalog.d.ts

@@ -0,0 +1,105 @@
+import { type ConfiguredModel, type Settings } from "@opengeni/config";
+import { type ModelAvailabilityV1, type ModelCredentialReadinessV1, type WorkspaceModelPolicyContract } from "@opengeni/contracts";
+import { type Database } from "@opengeni/db";
+export type ResolvedCatalogSettings = {
+    settings: Settings;
+    source: "code" | "database";
+    version: number | null;
+    modelNotes: Record<string, string>;
+};
+/**
+ * Curated workspace Gateway products and workspace-owned custom slugs share
+ * one public prefix. Only the latter have a mutable catalog row whose active
+ * generation must be rechecked at a fresh acceptance commit boundary.
+ */
+export declare function isWorkspaceGatewayCustomModelId(settings: Settings, modelId: string): boolean;
+export declare function isWorkspaceOpenRouterCustomModelId(settings: Settings, modelId: string): boolean;
+export type WorkspaceCustomModelReference = {
+    scope: "workspace" | "organization";
+    providerKind: "vercel_gateway" | "openrouter";
+    upstreamModelId: string;
+};
+export declare function workspaceCustomModelReference(settings: Settings, modelId: string): WorkspaceCustomModelReference | null;
+export declare function isWorkspaceCustomModelId(settings: Settings, modelId: string): boolean;
+export declare function lockActiveCustomModelForAdmission(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    reference: WorkspaceCustomModelReference;
+}): Promise<boolean>;
+/**
+ * Resolve the deployment catalog without making synchronous env settings read
+ * Postgres. Database mode fails closed when the singleton is absent or invalid;
+ * code mode preserves the already-validated env catalog.
+ */
+export declare function resolveCatalogSettings(db: Database, envSettings: Settings): Promise<ResolvedCatalogSettings>;
+/**
+ * Resolve the deployment catalog and add only the custom Gateway slugs owned by
+ * one workspace. Use this at model-bearing workspace boundaries; public config
+ * and deployment-operator surfaces must continue to use `resolveCatalogSettings`.
+ */
+export declare function resolveWorkspaceCatalogSettings(db: Database, envSettings: Settings, input: {
+    accountId: string;
+    workspaceId: string;
+    retainedProductModelId?: string | null;
+    retainedProductModelIds?: readonly (string | null | undefined)[];
+}): Promise<ResolvedCatalogSettings>;
+export type ModelAvailabilityObservation = {
+    status: "available" | "degraded" | "unavailable";
+    reason: "not_entitled" | "provider_unhealthy" | null;
+    checkedAt: string;
+};
+export type ModelCredentialReadinessObservation = {
+    status: "ready";
+    checkedAt: string;
+} | {
+    status: "not_ready";
+    reason: "prerequisites_missing" | "needs_reauth";
+    checkedAt: string;
+} | {
+    status: "error";
+    reason: "resolver_error";
+    checkedAt: string;
+};
+export declare const MODEL_CREDENTIAL_READINESS_OBSERVATION_MAX_AGE_MS: number;
+export type WorkspaceModelSelectionInput = {
+    settings: Settings;
+    policy: WorkspaceModelPolicyContract | null;
+    codexSubscriptionActive: boolean;
+    xaiSubscriptionActive?: boolean;
+    workspaceGatewayConnectionActive?: boolean;
+    workspaceOpenRouterConnectionActive?: boolean;
+    organizationGatewayConnectionActive?: boolean;
+    organizationOpenRouterConnectionActive?: boolean;
+    workspaceGatewayCustomModels?: readonly {
+        upstreamModelId: string;
+        label?: string | null;
+    }[];
+    workspaceOpenRouterCustomModels?: readonly {
+        upstreamModelId: string;
+        label?: string | null;
+    }[];
+    organizationGatewayCustomModels?: readonly {
+        upstreamModelId: string;
+        label?: string | null;
+    }[];
+    organizationOpenRouterCustomModels?: readonly {
+        upstreamModelId: string;
+        label?: string | null;
+    }[];
+    credentialReadinessObservations?: Readonly<Record<string, ModelCredentialReadinessObservation>> | undefined;
+    observations?: Readonly<Record<string, ModelAvailabilityObservation>> | undefined;
+    now?: Date | undefined;
+    credentialReadinessMaxAgeMs?: number | undefined;
+};
+export type WorkspaceModelSelection = {
+    model: ConfiguredModel;
+    credentialReadiness: ModelCredentialReadinessV1;
+    policyAllowed: boolean;
+    availability: ModelAvailabilityV1;
+};
+/**
+ * One shared picker/tool decision. Catalog membership, credential readiness,
+ * workspace policy, and optional provider-health observations are evaluated in
+ * configured catalog order so every consumer exposes the same selectable set.
+ */
+export declare function resolveWorkspaceModelSelection(input: WorkspaceModelSelectionInput): WorkspaceModelSelection[];

package/dist/sandbox/fleet.d.ts

@@ -128,6 +128,24 @@ export type FleetSwapResult = {
  * means no compute is attached.
  */
 export declare function listFleet(services: FleetServices, ctx: FleetContext): Promise<FleetListResult>;
+type FleetResourceContext = Pick<FleetContext, "accountId" | "workspaceId" | "subjectId">;
+export type CreateTimeSandboxTargetPreflight = {
+    ok: true;
+    targetSandboxId: string;
+    workingDir: string | null;
+} | {
+    ok: false;
+    reason: string;
+    code: BackendUnresolvableCode | "invalid_working_directory";
+};
+/**
+ * Validate a named create-time machine target before any session row exists.
+ * The caller still commits the pointer with `setActiveSandbox` inside the
+ * session-create transaction, which rechecks durable ownership/enrollment
+ * authority and closes the remove/revoke race without holding database locks
+ * across the liveness probe.
+ */
+export declare function preflightCreateTimeSandboxTarget(services: FleetServices, ctx: FleetResourceContext, target: string, workingDir: string | null): Promise<CreateTimeSandboxTargetPreflight>;
 /**
  * THE SWAP (and attach — identical mechanic). Validate the target's ownership +
  * liveness, then repoint the session via the epoch-fenced CAS `setActiveSandbox`:
@@ -238,3 +256,4 @@ export declare function provisionSandbox(services: FleetServices, ctx: FleetCont
     kind: "selfhosted" | "modal";
     name?: string;
 }): Promise<ProvisionResult>;
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/core",
-  "version": "2.6.4",
+  "version": "2.7.5-canary.0",
   "description": "OpenGeni framework-agnostic core: the domain, access, and billing layers (neutral access, off-HTTP V2 surface). Behavior-preserving extraction from apps/api — keeps Hono's HTTPException for error throwing (typed-errors cleanup deferred).",
   "license": "Apache-2.0",
   "repository": {
@@ -54,15 +54,17 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/codex": "^0.2.20",
-    "@opengeni/config": "^0.22.5",
-    "@opengeni/contracts": "^2.9.2",
-    "@opengeni/db": "^3.7.4",
-    "@opengeni/documents": "^0.8.14",
-    "@opengeni/events": "^0.4.12",
-    "@opengeni/observability": "^0.8.14",
-    "@opengeni/runtime": "^2.0.1",
-    "@opengeni/storage": "^0.2.115",
+    "@opengeni/capabilities": "^0.3.2-canary.0",
+    "@opengeni/codex": "^0.2.21-canary.0",
+    "@opengeni/config": "^1.0.0-canary.0",
+    "@opengeni/contracts": "^2.13.0-canary.0",
+    "@opengeni/db": "^4.0.0-canary.0",
+    "@opengeni/documents": "^0.8.19-canary.0",
+    "@opengeni/events": "^0.4.17-canary.0",
+    "@opengeni/network": "^0.3.0-canary.0",
+    "@opengeni/observability": "^0.8.19-canary.0",
+    "@opengeni/runtime": "^2.3.0-canary.0",
+    "@opengeni/storage": "^0.2.120-canary.0",
     "hono": "^4.12.18",
     "zod": "^4.2.1"
   },

package/src/access/index.ts

@@ -243,6 +243,31 @@ export function requireAccountAdminAuthorizationStamp(
   });
 }
 
+/**
+ * Verify that an access authorization was minted by the canonical request
+ * resolver for this exact subject and workspace.
+ *
+ * This is the protocol-neutral boundary for request-local services that need
+ * the authenticated grant rather than a caller-supplied grant-shaped object.
+ * Object identity is intentional: matching fields alone are not proof that the
+ * request authenticated the named subject.
+ */
+export function requireResolvedAccessGrantAuthorization(
+  authorization: AccessGrantAuthorization,
+  workspaceId: string,
+): AccessGrant {
+  const { grant } = authorization;
+  if (
+    !resolvedAccessGrantAuthorizations.has(authorization) ||
+    !authorization.contextIntegrity ||
+    authorization.authenticatedSubjectId !== grant.subjectId ||
+    grant.workspaceId !== workspaceId
+  ) {
+    throw new HTTPException(403, { message: "workspace access authorization is invalid" });
+  }
+  return grant;
+}
+
 /**
  * Resolve the exact built-in single-user local administrator for an account.
  *

package/src/application/api-integration-servers.ts

@@ -0,0 +1,215 @@
+import {
+  createGraphqlMcpServer,
+  createOpenApiMcpServer,
+  createPinnedIntegrationTransport,
+  directIntegrationTransport,
+  IntegrationInvocationError,
+  type IntegrationCredentialResolver,
+  type IntegrationInvocationAuthority,
+  type IntegrationTransport,
+} from "@opengeni/capabilities";
+import type { Settings } from "@opengeni/config";
+import type { ToolAuthNeededPayload } from "@opengeni/contracts";
+import type {
+  ApiIntegrationRuntime,
+  ResolveConnectionCredentialInput,
+  ResolveConnectionCredentialResult,
+} from "@opengeni/db";
+import type { FetchLike } from "@opengeni/network";
+import type { LocalMcpServerRegistration } from "@opengeni/runtime";
+
+export type BuildApiIntegrationServersInput = {
+  settings: Settings;
+  integrations: readonly ApiIntegrationRuntime[];
+  authority: Omit<IntegrationInvocationAuthority, "connectionRef">;
+  resolveCredential: (
+    input: ResolveConnectionCredentialInput,
+  ) => Promise<ResolveConnectionCredentialResult>;
+  onAuthNeeded?: (payload: ToolAuthNeededPayload) => Promise<void> | void;
+  fetchImpl?: FetchLike;
+};
+
+/**
+ * Compile active persisted API facets into ordinary in-process MCP providers.
+ * The caller supplies its authority resolver, so agent attempts and current
+ * humans use the same provider assembly without sharing credentials or policy.
+ */
+export function buildApiIntegrationMcpServers(
+  input: BuildApiIntegrationServersInput,
+): LocalMcpServerRegistration[] {
+  const transport = createPinnedIntegrationTransport({
+    network: input.settings,
+    ...(input.fetchImpl ? { fetchImpl: input.fetchImpl } : {}),
+  });
+  return input.integrations.map((integration) => {
+    const authority: IntegrationInvocationAuthority = {
+      ...input.authority,
+      ...(integration.connectionRef?.connectionId
+        ? { connectionRef: integration.connectionRef.connectionId }
+        : {}),
+    };
+    const credentialResolver = integration.connectionRef
+      ? integrationCredentialResolver(input, integration, "execution")
+      : undefined;
+    const buildServer = (
+      serverTransport: IntegrationTransport,
+      serverCredentialResolver = credentialResolver,
+    ) =>
+      integration.revision.protocol === "openapi"
+        ? createOpenApiMcpServer({
+            revision: integration.revision,
+            transport: serverTransport,
+            authority,
+            ...(serverCredentialResolver ? { credentialResolver: serverCredentialResolver } : {}),
+          })
+        : createGraphqlMcpServer({
+            revision: integration.revision,
+            endpoint: integration.baseUrl,
+            transport: serverTransport,
+            authority,
+            ...(serverCredentialResolver ? { credentialResolver: serverCredentialResolver } : {}),
+          });
+    const server = buildServer(transport);
+    const preflightCredentialResolver = integration.connectionRef
+      ? integrationCredentialResolver(input, integration, "preflight")
+      : undefined;
+    const preflightServer = preflightCredentialResolver
+      ? buildServer(providerBlockingPreflightTransport, preflightCredentialResolver)
+      : null;
+    return {
+      id: integration.serverId,
+      server,
+      approvalAuthority: {
+        kind: "api_integration",
+        capabilityId: integration.capabilityId,
+        pluginKey: integration.pluginKey,
+        pluginInstallationId: integration.pluginInstallationId,
+        installationVersion: integration.installationVersion,
+        instanceId: integration.instanceId,
+        instanceKey: integration.instanceKey,
+        instanceVersion: integration.instanceVersion,
+        definitionId: integration.definitionId,
+        definitionProvenance: integration.definitionProvenance,
+        revisionId: integration.revision.id,
+        baseUrl: integration.baseUrl,
+        providerDomain: integration.providerDomain,
+        connectionRef: integration.connectionRef,
+        connectionAuthorityGeneration: integration.connectionAuthorityGeneration,
+      },
+      ...(integration.connectionRef?.connectionId
+        ? { resolvedConnectionId: integration.connectionRef.connectionId }
+        : {}),
+      ...(credentialResolver
+        ? {
+            preflightCall: async (
+              toolName: string,
+              args: Record<string, unknown>,
+              options?: { signal?: AbortSignal },
+            ) => await preflightApiIntegrationCall(preflightServer!, toolName, args, options),
+          }
+        : {}),
+    };
+  });
+}
+
+const providerBlockingPreflightTransport = directIntegrationTransport(async () => {
+  throw new Error("integration provider request blocked by preflight");
+});
+
+async function preflightApiIntegrationCall(
+  server: LocalMcpServerRegistration["server"],
+  toolName: string,
+  args: Record<string, unknown>,
+  options?: { signal?: AbortSignal },
+): Promise<void> {
+  try {
+    await server.callTool(toolName, args, null, options);
+  } catch (error) {
+    if (error instanceof IntegrationInvocationError && error.code === "request_failed") return;
+    throw error;
+  }
+  throw new Error("integration preflight unexpectedly crossed the provider request boundary");
+}
+
+function integrationCredentialResolver(
+  input: BuildApiIntegrationServersInput,
+  integration: ApiIntegrationRuntime,
+  credentialResolutionMode: "execution" | "preflight",
+): IntegrationCredentialResolver {
+  const connectionRef = integration.connectionRef;
+  if (!connectionRef) throw new Error("Integration credential resolver requires a connection");
+  const expectedAuthorityGeneration = integration.connectionAuthorityGeneration;
+  if (expectedAuthorityGeneration === null) {
+    throw new Error("Integration credential resolver requires a connection authority generation");
+  }
+  return {
+    resolve: async (request) => {
+      const result = await input.resolveCredential({
+        workspaceId: input.authority.workspaceId,
+        serverId: integration.serverId,
+        toolName: request.operationKey,
+        connectionRef,
+        destinationUrl: request.destinationUrl,
+        credentialTarget: "http_api",
+        forceRefresh: request.forceRefresh === true,
+        credentialResolutionMode,
+        expectedAuthorityGeneration,
+      });
+      if (result.status === "auth_needed") {
+        await publishAuthNeeded(
+          input,
+          integration.serverId,
+          request.operationKey,
+          result,
+          connectionRef,
+        );
+        return null;
+      }
+      const destination = new URL(request.destinationUrl);
+      return {
+        audience: { origin: destination.origin, pathPrefix: "/" },
+        placements:
+          result.placements ??
+          Object.entries(result.headers).map(([name, value]) => ({
+            carrier: "header" as const,
+            name,
+            value,
+          })),
+        ...(result.authorizeProviderRequest
+          ? { authorizeProviderRequest: result.authorizeProviderRequest }
+          : {}),
+        ...(result.expiresAt ? { expiresAt: result.expiresAt.toISOString() } : {}),
+        ...(connectionRef.scopes ? { scope: [...connectionRef.scopes] } : {}),
+      };
+    },
+  };
+}
+
+async function publishAuthNeeded(
+  input: BuildApiIntegrationServersInput,
+  serverId: string,
+  toolName: string,
+  result: Extract<ResolveConnectionCredentialResult, { status: "auth_needed" }>,
+  connectionRef: NonNullable<ApiIntegrationRuntime["connectionRef"]>,
+): Promise<void> {
+  try {
+    await input.onAuthNeeded?.({
+      serverId,
+      toolName,
+      providerDomain: result.providerDomain,
+      ...(result.provider ? { provider: result.provider } : {}),
+      reason: result.reason,
+      ...(result.connectionId ? { connectionId: result.connectionId } : {}),
+      ...(result.authoritySource === "host" || connectionRef.authoritySource === "host"
+        ? { authoritySource: "host" as const }
+        : {}),
+      ...(result.scopes ? { scopes: result.scopes } : {}),
+      ...(result.resource ? { resource: result.resource } : {}),
+      ...(result.selectedResources ? { selectedResources: result.selectedResources } : {}),
+      ...(result.authorizationUrl ? { authorizationUrl: result.authorizationUrl } : {}),
+    });
+  } catch {
+    // Authentication notices are advisory UI/audit signals. The local tool
+    // still returns the fixed connection-required result when publication fails.
+  }
+}

package/src/application/session-commands.ts

@@ -555,7 +555,7 @@ export async function controlAgentSessionWorkstream(
           wakeRevision: result.workflowWake.wakeRevision,
           shouldSignal: true,
           interruptionCount: result.interruptionCount,
-          controlRequested: true,
+          controlRequested: input.action === "pause",
         });
       },
     },
@@ -928,7 +928,7 @@ export async function controlHumanSessionWorkstreamWithOutcome(
           wakeRevision: result.workflowWake.wakeRevision,
           shouldSignal: true,
           interruptionCount: result.interruptionCount,
-          controlRequested: true,
+          controlRequested: input.action === "pause",
         });
       },
     },

package/src/billing/limits.ts

@@ -1,4 +1,8 @@
-import { configuredStaticUsageLimits, resolveModelProvider } from "@opengeni/config";
+import {
+  configuredStaticUsageLimits,
+  resolveModelProviderForTurn,
+  type Settings,
+} from "@opengeni/config";
 import type {
   LimitAction,
   LimitDecision,
@@ -26,14 +30,35 @@ export type LimitCheckInput = {
   workspaceId?: string;
   action: LimitAction;
   quantity?: number;
-  // The turn's model id, when the action represents an agent turn. Externally
-  // billed models consume ZERO OpenGeni credits, so the credit-balance +
-  // model-cost + token gates are skipped. Connected subscriptions still require
-  // live workspace readiness; an explicitly anonymous deployment route is
-  // statically ready by definition. Non-model infra actions leave this undefined.
+  // The turn's model id, when the action represents an agent turn. The model's
+  // deployment cost controls credit/cost gates; upstream metering independently
+  // controls the token cap. Connected subscriptions still require live workspace
+  // readiness. Non-model infra actions leave this undefined.
   model?: string | null;
 };
 
+export function modelFundingForAdmission(
+  settings: Settings,
+  model: string | null | undefined,
+  codexBilled: boolean,
+): { fundedWithoutCredits: boolean; countsTowardTokenCap: boolean } {
+  const resolvedModel = model ? resolveModelProviderForTurn(settings, model)?.model : null;
+  const codexSubscriptionModel =
+    resolvedModel?.credentialSource.kind === "connected_subscription" &&
+    resolvedModel.credentialSource.provider === "codex";
+  return {
+    // A Codex namespace/definition never bypasses credits by itself: the live
+    // workspace credential predicate above remains authoritative. SuperGrok's
+    // static overlay is likewise secret-free; its worker/provider admission
+    // owns live account selection before any upstream request can occur.
+    fundedWithoutCredits:
+      codexBilled ||
+      (resolvedModel != null && !codexSubscriptionModel && resolvedModel.cost !== "credits"),
+    countsTowardTokenCap:
+      !codexBilled && resolvedModel != null && resolvedModel.billing.upstreamPayer === "deployment",
+  };
+}
+
 export async function requireLimit(deps: LimitDependencies, input: LimitCheckInput): Promise<void> {
   const decision = await checkLimit(deps, input);
   if (decision.allowed) {
@@ -59,25 +84,22 @@ export async function checkLimit(
         model: input.model,
       })
     : false;
-  const credentialFreeExternal = input.model
-    ? (() => {
-        const resolved = resolveModelProvider(deps.settings, input.model);
-        return (
-          resolved?.model.billing.metering === "external" &&
-          resolved.model.credentialSource.kind === "deployment" &&
-          resolved.model.credentialSource.mechanism === "none"
-        );
-      })()
-    : false;
-  const externallyBilled = codexBilled || credentialFreeExternal;
-  const creditDecision = await checkCreditBalance(deps, input, externallyBilled);
+  const { fundedWithoutCredits, countsTowardTokenCap } = modelFundingForAdmission(
+    deps.settings,
+    input.model,
+    codexBilled,
+  );
+  const creditDecision = await checkCreditBalance(deps, input, fundedWithoutCredits);
   if (!creditDecision.allowed) {
     return creditDecision;
   }
   if (deps.settings.usageLimitsMode !== "static" && deps.settings.usageLimitsMode !== "managed") {
     return { allowed: true };
   }
-  return await checkStaticCaps(deps, input, externallyBilled);
+  return await checkStaticCaps(deps, input, {
+    fundedWithoutCredits,
+    countsTowardTokenCap,
+  });
 }
 
 async function checkCreditBalance(
@@ -101,10 +123,14 @@ async function checkCreditBalance(
 async function checkStaticCaps(
   deps: LimitDependencies,
   input: LimitCheckInput,
-  externallyBilled: boolean,
+  funding: { fundedWithoutCredits: boolean; countsTowardTokenCap: boolean },
 ): Promise<LimitDecision> {
   const limits = configuredStaticUsageLimits(deps.settings);
-  if (limits.maxMonthlyCostMicrosPerAccount && isCostlyAction(input.action) && !externallyBilled) {
+  if (
+    limits.maxMonthlyCostMicrosPerAccount &&
+    isCostlyAction(input.action) &&
+    !funding.fundedWithoutCredits
+  ) {
     const used = await sumUsageQuantity(deps.db, {
       accountId: input.accountId,
       eventType: "model.cost",
@@ -185,7 +211,11 @@ async function checkStaticCaps(
           );
     }
     case "tokens:consume": {
-      if (externallyBilled || !limits.maxMonthlyTokensPerWorkspace || !input.workspaceId) {
+      if (
+        !funding.countsTowardTokenCap ||
+        !limits.maxMonthlyTokensPerWorkspace ||
+        !input.workspaceId
+      ) {
         return { allowed: true };
       }
       const used = await sumUsageQuantity(deps.db, {

package/src/dependencies.ts

@@ -19,6 +19,7 @@ import type { ManagedAuthSessionAdapter } from "./managed-auth-session-sets";
 import type { ApiSandboxClient, ResumeBoxByIdInput, ResumedSandboxSession } from "./sandbox-types";
 import type { TranscriptionSegmenter, TranscriptionService } from "./transcription";
 import type { EditableArtifactApplicationPort } from "./editable-artifact-live";
+import type { ResolvedCatalogSettings } from "./model-catalog";
 import type {
   EditableArtifactAgentApplication,
   EditableArtifactDurableExportService,
@@ -129,6 +130,13 @@ export type ManagedEmailTransport = {
 
 export type AppDependencies = {
   settings: Settings;
+  /**
+   * Original deployment settings when `settings` is already overlaid with a
+   * deployment/workspace catalog snapshot. Model-bearing request adapters set
+   * this marker so core admission never feeds a synthetic reviewed provider
+   * back through deployment validation.
+   */
+  catalogSourceSettings?: Settings;
   db: Database;
   /**
    * Host-composed editable artifact engine. Standalone startup binds the same
@@ -186,6 +194,8 @@ export type AppDependencies = {
   codexFetch?: typeof fetch;
   /** Injectable GitHub transport for deterministic personal-OAuth tests. */
   githubPersonalFetch?: typeof fetch;
+  /** Injectable credential-free GitHub transport for public repository verification tests. */
+  githubAnonymousFetch?: typeof fetch;
   /** Injectable xAI OAuth/subscription transport for deterministic API/provider tests. */
   xaiFetch?: typeof fetch;
   /** Injectable Slack Web API transport for deterministic bot-connection tests. */
@@ -225,6 +235,7 @@ export type AppDependencies = {
 export type ObjectStorageDependency = ReturnType<typeof createObjectStorage>;
 
 export type ApiRouteDeps = AppDependencies & {
+  resolveCatalogSettings: () => Promise<ResolvedCatalogSettings>;
   managedEmailTransport: ManagedEmailTransport;
   objectStorage: ObjectStorageDependency;
   githubStateSecret: string;
@@ -244,7 +255,12 @@ export type ApiRouteDeps = AppDependencies & {
  */
 export type AcceptSessionUserMessageDependencies = Pick<
   AppDependencies,
-  "settings" | "db" | "bus" | "sessionAuthorization" | "schedulePromptPostCommit"
+  | "settings"
+  | "catalogSourceSettings"
+  | "db"
+  | "bus"
+  | "sessionAuthorization"
+  | "schedulePromptPostCommit"
 > & {
   workflowClient: Pick<SessionWorkflowClient, "wakeSessionWorkflow">;
   objectStorage: ObjectStorageDependency;

package/src/domain/capabilities.ts

@@ -57,6 +57,7 @@ import { hasPermission } from "../access";
 import { isFikenConnection, preferredFikenConnection } from "./fiken";
 import { listSkillLibraryEntries, type SkillLibraryEntry } from "@opengeni/runtime/skill-library";
 import { listCapabilityPacks, listWorkspaceCapabilityPacks } from "./packs";
+import { assertHostMcpAuthoritySourceAdmissionEnabled } from "./host-mcp-authority-source-admission";
 
 const officialMcpRegistryUrl = "https://registry.modelcontextprotocol.io";
 const firstPartyMcpServerIds = new Set(["opengeni", "files", "docs"]);
@@ -403,7 +404,7 @@ function normalizedMcpCredentialHeaders(
 }
 
 async function validateMcpCapabilityConnectionRef(
-  input: { db: Database; grant: AccessGrant; workspaceId: string },
+  input: { db: Database; grant: AccessGrant; workspaceId: string; settings: Settings },
   item: CapabilityCatalogItem,
   ref: McpServerConnectionRef,
 ): Promise<McpServerConnectionRef> {
@@ -426,6 +427,7 @@ async function validateMcpCapabilityConnectionRef(
     providerDomain: ref.providerDomain.trim(),
     subjectScope,
     ...(ref.connectionId ? { connectionId: ref.connectionId } : {}),
+    ...(ref.authoritySource === "host" ? { authoritySource: "host" as const } : {}),
     ...(ref.provider ? { provider: ref.provider.trim() } : {}),
     ...(ref.kind ? { kind: ref.kind } : {}),
     ...(ref.scopes ? { scopes: uniqueStrings(ref.scopes) } : {}),
@@ -449,6 +451,10 @@ async function validateMcpCapabilityConnectionRef(
         "MCP capabilities need a remote streamable HTTP endpoint before they can use a connectionRef",
     });
   }
+  if (normalized.authoritySource === "host") {
+    assertHostMcpAuthoritySourceAdmissionEnabled(input.settings, normalized);
+    return normalized;
+  }
 
   let connection = normalized.connectionId
     ? await getConnectionMetadata(
@@ -1680,12 +1686,22 @@ function installationConnectionRef(
   if (!ref || typeof ref !== "object") {
     return null;
   }
-  const { connectionId, providerDomain, kind, subjectScope } = ref as Record<string, unknown>;
+  const { authoritySource, connectionId, providerDomain, kind, subjectScope } = ref as Record<
+    string,
+    unknown
+  >;
   if (typeof providerDomain !== "string" || typeof kind !== "string") {
     return null;
   }
+  if (authoritySource === "host") {
+    // The internal installation/runtime ref retains the exact host binding.
+    // Public capability catalogs use the existing null representation for an
+    // enabled capability without a native OpenGeni connection, so indefinitely
+    // open old browser bundles cannot treat a host UUID as native OAuth state.
+    return null;
+  }
   if (subjectScope === "subject") {
-    // Never project a personal connection UUID through workspace-visible
+    // Never project a native personal connection UUID through workspace-visible
     // capability configuration, including legacy rows that still contain one.
     return { providerDomain, kind, subjectScope: "subject" };
   }