@opengeni/core 2.6.4 → 2.7.5-canary.0

package/src/domain/host-mcp-authority-source-admission.ts

@@ -0,0 +1,25 @@
+import type { Settings } from "@opengeni/config";
+import type { McpServerConnectionRef } from "@opengeni/contracts";
+import { HTTPException } from "hono/http-exception";
+
+/**
+ * Explicit host-owned MCP refs change which credential authority executes an
+ * opaque connection id. Admit new external refs only after the operator has
+ * completed the two-phase fleet rollout. Readers and inheritance remain
+ * tolerant regardless of this switch, and markerless legacy refs retain their
+ * bounded non-UUID compatibility path.
+ */
+export function assertHostMcpAuthoritySourceAdmissionEnabled(
+  settings: Pick<Settings, "hostMcpAuthoritySourceAdmissionEnabled">,
+  connectionRef: McpServerConnectionRef | null | undefined,
+): void {
+  if (
+    connectionRef?.authoritySource === "host" &&
+    !settings.hostMcpAuthoritySourceAdmissionEnabled
+  ) {
+    throw new HTTPException(422, {
+      message:
+        "new host-owned MCP connection refs are not admitted; upgrade the complete API/worker/web fleet, then set OPENGENI_HOST_MCP_AUTHORITY_SOURCE_ADMISSION_ENABLED=true",
+    });
+  }
+}

package/src/domain/insights.ts

@@ -305,6 +305,8 @@ export async function getWorkspaceInsights(
       creditUsd: microsToUsd(row.pricedCostMicros),
       estimatedProviderUsd: microsToUsd(row.estimatedProviderCostMicros),
       estimatedProviderCostKnownCalls: row.estimatedProviderCostKnownCalls,
+      equivalentCreditUsd: microsToUsd(row.equivalentCreditCostMicros),
+      equivalentCreditCostKnownCalls: row.equivalentCreditCostKnownCalls,
     }))
     .sort((a, b) => b.totalTokens - a.totalTokens);
 
@@ -326,6 +328,22 @@ export async function getWorkspaceInsights(
     (sum, row) => sum + row.estimatedProviderCostKnownCalls,
     0,
   );
+  const equivalentCreditCostMicros = modelRows.reduce(
+    (sum, row) => sum + row.equivalentCreditCostMicros,
+    0,
+  );
+  const priorEquivalentCreditCostMicros = priorModelRows.reduce(
+    (sum, row) => sum + row.equivalentCreditCostMicros,
+    0,
+  );
+  const equivalentCreditCostKnownCalls = modelRows.reduce(
+    (sum, row) => sum + row.equivalentCreditCostKnownCalls,
+    0,
+  );
+  const priorEquivalentCreditCostKnownCalls = priorModelRows.reduce(
+    (sum, row) => sum + row.equivalentCreditCostKnownCalls,
+    0,
+  );
   const modelCalls = modelRows.reduce((sum, row) => sum + row.calls, 0);
   const priorInputTokens = priorModelRows.reduce((sum, row) => sum + row.inputTokens, 0);
   const priorTotalTokens = priorModelRows.reduce((sum, row) => sum + row.totalTokens, 0);
@@ -342,6 +360,8 @@ export async function getWorkspaceInsights(
       costMicros: 0,
       estimatedProviderCostMicros: 0,
       estimatedProviderCostKnownCalls: 0,
+      equivalentCreditCostMicros: 0,
+      equivalentCreditCostKnownCalls: 0,
       inputTokens: 0,
       outputTokens: 0,
       cachedTokens: 0,
@@ -361,6 +381,8 @@ export async function getWorkspaceInsights(
       modelCostUsd: microsToUsd(modelCostMicros),
       estimatedProviderUsd: microsToUsd(facts.estimatedProviderCostMicros),
       estimatedProviderCostKnownCalls: facts.estimatedProviderCostKnownCalls,
+      equivalentCreditUsd: microsToUsd(facts.equivalentCreditCostMicros),
+      equivalentCreditCostKnownCalls: facts.equivalentCreditCostKnownCalls,
       warmSeconds: usageBuckets.get(bucket)?.warmSeconds ?? 0,
       inputTokens: facts.inputTokens,
       outputTokens: facts.outputTokens,
@@ -393,6 +415,8 @@ export async function getWorkspaceInsights(
       creditUsd,
       estimatedProviderUsd: microsToUsd(row.estimatedProviderCostMicros),
       estimatedProviderCostKnownCalls: row.estimatedProviderCostKnownCalls,
+      equivalentCreditUsd: microsToUsd(row.equivalentCreditCostMicros),
+      equivalentCreditCostKnownCalls: row.equivalentCreditCostKnownCalls,
       tokens: row.totalTokens,
       cacheHitPct: cacheHitPct(row.cachedTokens, row.cacheInputTokens),
       pctOfCreditUsd:
@@ -414,6 +438,8 @@ export async function getWorkspaceInsights(
       creditUsd: fact ? microsToUsd(fact.pricedCostMicros) : null,
       estimatedProviderUsd: fact ? microsToUsd(fact.estimatedProviderCostMicros) : null,
       estimatedProviderCostKnownCalls: fact ? fact.estimatedProviderCostKnownCalls : null,
+      equivalentCreditUsd: fact ? microsToUsd(fact.equivalentCreditCostMicros) : null,
+      equivalentCreditCostKnownCalls: fact ? fact.equivalentCreditCostKnownCalls : null,
       tokens: fact ? fact.totalTokens : null,
       cacheHitPct: fact ? cacheHitPct(fact.cachedTokens, fact.cacheInputTokens) : null,
       billing: fact ? billingPathOf(fact.billingPath) : null,
@@ -489,6 +515,8 @@ export async function getWorkspaceInsights(
         row.estimatedProviderCostMicros == null
           ? null
           : microsToUsd(row.estimatedProviderCostMicros),
+      equivalentCreditUsd:
+        row.equivalentCreditCostMicros == null ? null : microsToUsd(row.equivalentCreditCostMicros),
       pricingSource: pricingSourceOf(row.pricingSource),
     })),
     promptContributions,
@@ -522,6 +550,10 @@ export async function getWorkspaceInsights(
     priorEstimatedProviderUsd: microsToUsd(priorEstimatedProviderCostMicros),
     estimatedProviderCostKnownCalls,
     priorEstimatedProviderCostKnownCalls,
+    equivalentCreditUsd: microsToUsd(equivalentCreditCostMicros),
+    priorEquivalentCreditUsd: microsToUsd(priorEquivalentCreditCostMicros),
+    equivalentCreditCostKnownCalls,
+    priorEquivalentCreditCostKnownCalls,
     modelCalls,
     priorInputTokens,
     priorTotalTokens,

package/src/domain/packs.ts

@@ -31,6 +31,7 @@ import {
   PR_REVIEW_AUTOMATION_ADAPTER_ID,
   PR_REVIEW_AUTOMATION_TEMPLATE_ID,
 } from "./pr-review";
+import { OPENGENI_PRODUCT_INTEGRATION_PACK } from "./product-integration-pack";
 
 export const MARKETING_SOCIAL_PACK_ID = "marketing-social-daily-analysis";
 
@@ -277,7 +278,11 @@ const openGeniPrReviewPack: CapabilityPack = {
   },
 };
 
-const packs = [marketingSocialPack, openGeniPrReviewPack] satisfies CapabilityPack[];
+const packs = [
+  marketingSocialPack,
+  openGeniPrReviewPack,
+  OPENGENI_PRODUCT_INTEGRATION_PACK,
+] satisfies CapabilityPack[];
 
 export function listCapabilityPacks(): CapabilityPack[] {
   return packs;
@@ -355,6 +360,7 @@ export type InlinePackSkillInstall = {
   sourcePath: string;
   name: string;
   description: string;
+  activationMode: "workspace_managed" | "session_selected";
   contentSha256: string;
   totalBytes: number;
   files: Array<{ path: string; content: string; byteSize: number; contentSha256: string }>;
@@ -372,19 +378,22 @@ export function inlinePackSkillInstall(
     });
   }
   const normalizedName = skill.name.toLowerCase();
+  const activationMode = skill.activationMode ?? "workspace_managed";
+  const activationIdentity = activationMode === "session_selected" ? "session-selected/" : "";
   const encodedSkill = encodeURIComponent(normalizedName);
-  const sourceUrl = `https://opengeni.invalid/pack-inline-skills/${encodedSkill}/${artifact.contentSha256}`;
-  const capabilityId = `skill:pack-inline/${normalizedName}@${artifact.contentSha256}`;
+  const sourceUrl = `https://opengeni.invalid/pack-inline-skills/${activationIdentity}${encodedSkill}/${artifact.contentSha256}`;
+  const capabilityId = `skill:pack-inline/${activationIdentity}${normalizedName}@${artifact.contentSha256}`;
   return {
     componentKey: `inline-skill/${normalizedName}`,
     capabilityId,
-    pluginKey: `pack-skill/${normalizedName}/${artifact.contentSha256}`,
+    pluginKey: `pack-skill/${activationIdentity}${normalizedName}/${artifact.contentSha256}`,
     sourceUrl,
     repositoryUrl: "https://opengeni.invalid/pack-inline-skills",
     sourceCommit: artifact.contentSha256,
     sourcePath: normalizedName,
     name: artifact.name,
     description: artifact.description,
+    activationMode,
     contentSha256: artifact.contentSha256,
     totalBytes: artifact.totalBytes,
     files: artifact.files.map((file) => ({
@@ -405,21 +414,42 @@ export async function previewCapabilityPackInstallation(
   const { workspaceId } = access;
   const installation = await getPackInstallation(db, workspaceId, pack.id);
   const inlineInstalls = pack.skills.map((skill) => inlinePackSkillInstall(pack, skill));
-  const [referencedComponents, inlineComponents] = await Promise.all([
-    resolvePackComponentReferences(db, workspaceId, pack.components),
-    resolvePackInlineSkillReferences(
-      db,
-      workspaceId,
-      inlineInstalls.map((inline) => ({
-        key: inline.componentKey,
-        capabilityId: inline.capabilityId,
-        name: inline.name,
-        contentSha256: inline.contentSha256,
-      })),
-      installation?.id,
-    ),
-  ]);
   const manifestDigest = capabilityPackManifestDigest(pack);
+  const inlineRequirements = inlineInstalls.map((inline) => ({
+    key: inline.componentKey,
+    capabilityId: inline.capabilityId,
+    name: inline.name,
+    activationMode: inline.activationMode,
+    contentSha256: inline.contentSha256,
+  }));
+  const [referencedComponents, plannedInlineComponents, installedSessionSelectedComponents] =
+    await Promise.all([
+      resolvePackComponentReferences(db, workspaceId, pack.components),
+      resolvePackInlineSkillReferences(db, workspaceId, inlineRequirements, installation?.id),
+      installation?.status === "active" && installation.manifestDigest === manifestDigest
+        ? resolvePackInlineSkillReferences(
+            db,
+            workspaceId,
+            inlineRequirements.filter(
+              (requirement) => requirement.activationMode === "session_selected",
+            ),
+          )
+        : Promise.resolve([]),
+    ]);
+  const installedSessionSelectedByKey = new Map(
+    installedSessionSelectedComponents.map((component) => [component.key, component]),
+  );
+  // Installation planning excludes the Pack's own current ownership so an
+  // update can replace old inline content. For launch affordances, preserve an
+  // independently resolved active facet-installation id on an exact installed
+  // manifest. A missing facet retains the future capability id and therefore
+  // cannot be mistaken for something a new session can select right now.
+  const inlineComponents = plannedInlineComponents.map((component) => {
+    const installed = installedSessionSelectedByKey.get(component.key);
+    return installed?.status === "ready" && installed.resolvedId
+      ? { ...component, resolvedId: installed.resolvedId }
+      : component;
+  });
   const components: PackComponentResolution[] = [...referencedComponents, ...inlineComponents];
   const blockers = components
     .filter((component) => component.required && component.status !== "ready")

package/src/domain/personal-connection-delegations.ts

@@ -4,6 +4,7 @@ import type {
   ConnectionMetadata,
   McpConnectionAuthoritySelection,
   McpPersonalConnectionDelegation,
+  McpServerConnectionRef,
   ResourceRef,
   SessionTurn,
   SocialConnection,
@@ -290,10 +291,16 @@ export function selectedPersonalConnectionServers(
 ): McpServerConfig[] {
   const selected = new Set(tools.map((tool) => tool.id));
   return settings.mcpServers.filter(
-    (server) => selected.has(server.id) && server.connectionRef?.subjectScope === "subject",
+    (server) => selected.has(server.id) && isNativeSubjectConnectionRef(server.connectionRef),
   );
 }
 
+function isNativeSubjectConnectionRef(
+  ref: McpServerConnectionRef | null | undefined,
+): ref is McpServerConnectionRef & { subjectScope: "subject" } {
+  return ref?.subjectScope === "subject" && ref.authoritySource !== "host";
+}
+
 function canonicalPersonalConnections(connections: ConnectionMetadata[]): ConnectionMetadata[] {
   return [...connections].sort((left, right) => {
     const active = Number(right.status === "active") - Number(left.status === "active");
@@ -324,7 +331,7 @@ export function personalConnectionDelegationsFromVisibleConnections(input: {
   );
   for (const server of input.servers) {
     const ref = server.connectionRef;
-    if (!ref || ref.subjectScope !== "subject") continue;
+    if (!isNativeSubjectConnectionRef(ref)) continue;
     const selection = selections.get(server.id);
     const eligible = connections.filter(
       (candidate) =>
@@ -400,7 +407,7 @@ export function personalConnectionDelegationsFromParent(input: {
   };
   const mcp = input.servers.flatMap((server) => {
     const ref = server.connectionRef;
-    if (!ref || ref.subjectScope !== "subject") return [];
+    if (!isNativeSubjectConnectionRef(ref)) return [];
     const delegation = input.parentDelegations.find(
       (candidate) =>
         candidate.serverId === server.id &&
@@ -700,7 +707,7 @@ export function personalConnectionDelegationForServer(
   server: Pick<McpServerConfig, "id" | "connectionRef">,
 ): McpPersonalConnectionDelegation | null {
   const ref = server.connectionRef;
-  if (!ref || ref.subjectScope !== "subject") return null;
+  if (!isNativeSubjectConnectionRef(ref)) return null;
   return (
     delegations.find(
       (delegation) =>
@@ -750,7 +757,8 @@ export function withFrozenPersonalConnectionDelegations(input: {
 }): ConnectionCredentialResolver {
   return async (request) => {
     let effectiveRequest = request;
-    if (request.connectionRef.subjectScope === "subject") {
+    const nativeSubjectAuthority = isNativeSubjectConnectionRef(request.connectionRef);
+    if (nativeSubjectAuthority) {
       const config = input.settings.mcpServers.find((server) => server.id === request.serverId);
       const publicationDelegations =
         request.serverId === GOOGLE_DRIVE_PUBLICATION_SERVER_ID &&
@@ -787,7 +795,7 @@ export function withFrozenPersonalConnectionDelegations(input: {
       };
     }
     const result = await input.resolveCredential(effectiveRequest);
-    if (result.status === "ok" || request.connectionRef.subjectScope !== "subject") {
+    if (result.status === "ok" || !nativeSubjectAuthority) {
       return result;
     }
     return personalAuthorityUnavailable(request);