@opengeni/core 2.7.2-canary.0 → 2.7.5-canary.0

package/dist/access/index.d.ts

@@ -68,6 +68,16 @@ export declare function accessGrantAuthorizationFromContext(context: AccessConte
  * access resolver are present in `resolvedAccessGrantAuthorizations`.
  */
 export declare function requireAccountAdminAuthorizationStamp(authorization: AccessGrantAuthorization): AccountAdminAuthorizationStamp;
+/**
+ * Verify that an access authorization was minted by the canonical request
+ * resolver for this exact subject and workspace.
+ *
+ * This is the protocol-neutral boundary for request-local services that need
+ * the authenticated grant rather than a caller-supplied grant-shaped object.
+ * Object identity is intentional: matching fields alone are not proof that the
+ * request authenticated the named subject.
+ */
+export declare function requireResolvedAccessGrantAuthorization(authorization: AccessGrantAuthorization, workspaceId: string): AccessGrant;
 /**
  * Resolve the exact built-in single-user local administrator for an account.
  *

package/dist/application/api-integration-servers.d.ts

@@ -0,0 +1,20 @@
+import { type IntegrationInvocationAuthority } from "@opengeni/capabilities";
+import type { Settings } from "@opengeni/config";
+import type { ToolAuthNeededPayload } from "@opengeni/contracts";
+import type { ApiIntegrationRuntime, ResolveConnectionCredentialInput, ResolveConnectionCredentialResult } from "@opengeni/db";
+import type { FetchLike } from "@opengeni/network";
+import type { LocalMcpServerRegistration } from "@opengeni/runtime";
+export type BuildApiIntegrationServersInput = {
+    settings: Settings;
+    integrations: readonly ApiIntegrationRuntime[];
+    authority: Omit<IntegrationInvocationAuthority, "connectionRef">;
+    resolveCredential: (input: ResolveConnectionCredentialInput) => Promise<ResolveConnectionCredentialResult>;
+    onAuthNeeded?: (payload: ToolAuthNeededPayload) => Promise<void> | void;
+    fetchImpl?: FetchLike;
+};
+/**
+ * Compile active persisted API facets into ordinary in-process MCP providers.
+ * The caller supplies its authority resolver, so agent attempts and current
+ * humans use the same provider assembly without sharing credentials or policy.
+ */
+export declare function buildApiIntegrationMcpServers(input: BuildApiIntegrationServersInput): LocalMcpServerRegistration[];

package/dist/domain/pr-review.d.ts

@@ -80,7 +80,7 @@ export declare const prReviewAutomationAdapter: {
                 eager?: boolean | undefined;
                 optional?: boolean | undefined;
             }[];
-            firstPartyMcpTools: ("artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_publish" | "artifacts_rollback" | "atlassian_get" | "atlassian_search" | "atlassian_sources_list" | "browser_act" | "browser_auth" | "browser_clipboard" | "browser_debug" | "browser_identity" | "browser_lifecycle" | "browser_observe" | "browser_open" | "browser_publish" | "browser_tabs" | "capability_authorization_request" | "capability_catalog_search" | "company_profile_confirm" | "company_profile_propose" | "computer_act" | "computer_clipboard" | "computer_lifecycle" | "computer_observe" | "computer_open" | "computer_targets" | "connected_machine_remove" | "editable_artifact_apply" | "editable_artifact_create" | "editable_artifact_export" | "editable_artifact_export_status" | "editable_artifact_get" | "editable_artifact_import" | "editable_artifact_inspect" | "editable_artifact_list" | "environment_list" | "environment_set_variable" | "fiken_bank_accounts_list" | "fiken_companies_list" | "fiken_contact_create" | "fiken_contacts_list" | "fiken_invoice_draft_create" | "fiken_invoice_get" | "fiken_invoices_list" | "fiken_products_list" | "fiken_purchases_list" | "fiken_sales_list" | "github_connect_link" | "github_repositories_list" | "goal_complete" | "goal_pause" | "goal_progress" | "goal_set" | "goal_update" | "goal_wait" | "instruction_policy_propose" | "interaction_discover" | "interaction_request_human" | "knowledge_correct" | "knowledge_propose" | "memory_correct" | "memory_save" | "memory_search" | "preference_propose" | "preference_registry_get" | "preference_registry_summary" | "reddit_accounts_list" | "reddit_mentions_live" | "reddit_post_reply" | "reddit_posts_sync" | "reddit_search_live" | "reddit_thread_fetch" | "remember" | "remember_confirm" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_file_publish" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "session_create" | "session_events" | "session_get" | "session_human_input_respond" | "session_pause" | "session_resume" | "session_send_message" | "session_steer" | "session_wait" | "sessions_list" | "set_other_session_title" | "set_session_title" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_search" | "slack_bot_thread_replies" | "social_connections_list" | "social_daily_analysis_context" | "social_mentions_live" | "social_post_reply" | "social_posts_recent" | "social_posts_sync" | "social_search_live" | "social_thread_fetch" | "task_note_archive" | "task_note_promote_instruction_policy" | "task_note_promote_knowledge" | "task_note_promote_preference" | "task_note_replace" | "task_note_save" | "task_notes_list" | "variable_set_get_variable" | "variable_set_list" | "variable_set_set_variable" | "work_claim_release" | "work_claim_upsert" | "x_accounts_list" | "x_mentions_live" | "x_post_reply" | "x_posts_sync" | "x_search_live" | "x_thread_fetch")[];
+            firstPartyMcpTools: ("artifacts_archive" | "artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_publish" | "artifacts_restore" | "artifacts_rollback" | "atlassian_get" | "atlassian_search" | "atlassian_sources_list" | "browser_act" | "browser_auth" | "browser_clipboard" | "browser_debug" | "browser_identity" | "browser_lifecycle" | "browser_observe" | "browser_open" | "browser_publish" | "browser_tabs" | "capability_authorization_request" | "capability_catalog_search" | "command_wait" | "company_profile_confirm" | "company_profile_propose" | "computer_act" | "computer_clipboard" | "computer_lifecycle" | "computer_observe" | "computer_open" | "computer_targets" | "connected_machine_remove" | "editable_artifact_apply" | "editable_artifact_create" | "editable_artifact_export" | "editable_artifact_export_status" | "editable_artifact_get" | "editable_artifact_import" | "editable_artifact_inspect" | "editable_artifact_list" | "environment_list" | "environment_set_variable" | "fiken_bank_accounts_list" | "fiken_companies_list" | "fiken_contact_create" | "fiken_contacts_list" | "fiken_invoice_draft_create" | "fiken_invoice_get" | "fiken_invoices_list" | "fiken_products_list" | "fiken_purchases_list" | "fiken_sales_list" | "github_connect_link" | "github_repositories_list" | "goal_complete" | "goal_pause" | "goal_progress" | "goal_set" | "goal_update" | "instruction_policy_propose" | "interaction_discover" | "interaction_request_human" | "knowledge_correct" | "knowledge_propose" | "memory_correct" | "memory_save" | "memory_search" | "preference_propose" | "preference_registry_get" | "preference_registry_summary" | "reddit_accounts_list" | "reddit_mentions_live" | "reddit_post_reply" | "reddit_posts_sync" | "reddit_search_live" | "reddit_thread_fetch" | "remember" | "remember_confirm" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_file_publish" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "session_create" | "session_events" | "session_get" | "session_human_input_respond" | "session_pause" | "session_resume" | "session_send_message" | "session_steer" | "session_wait" | "sessions_list" | "set_other_session_title" | "set_session_title" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_search" | "slack_bot_thread_replies" | "social_connections_list" | "social_daily_analysis_context" | "social_mentions_live" | "social_post_reply" | "social_posts_recent" | "social_posts_sync" | "social_search_live" | "social_thread_fetch" | "task_note_archive" | "task_note_promote_instruction_policy" | "task_note_promote_knowledge" | "task_note_promote_preference" | "task_note_replace" | "task_note_save" | "task_notes_list" | "variable_set_get_variable" | "variable_set_list" | "variable_set_set_variable" | "wait_for_input" | "work_claim_release" | "work_claim_upsert" | "x_accounts_list" | "x_mentions_live" | "x_post_reply" | "x_posts_sync" | "x_search_live" | "x_thread_fetch")[];
             firstPartyMcpPermissions: ("account:admin" | "account:read" | "api_keys:manage" | "artifacts:publish" | "artifacts:read" | "billing:manage" | "billing:read" | "capabilities:manage" | "codemode:call" | "connections:read" | "connections:write" | "documents:manage" | "documents:search" | "enrollments:manage" | "enrollments:read" | "environments:manage" | "environments:use" | "files:read" | "files:upload" | "files:write" | "github:manage" | "github:use" | "goals:manage" | "mcp_servers:attach" | "members:manage" | "rigs:manage" | "rigs:use" | "scheduled_tasks:manage" | "scheduled_tasks:run" | "secrets:list" | "secrets:read" | "secrets:write" | "sessions:control" | "sessions:create" | "sessions:read" | "stream:acknowledge" | "stream:control" | "stream:view" | "terminal:attach" | "variable-sets:attach" | "variable-sets:list" | "variable-sets:manage" | "variable-sets:read" | "variable-sets:use" | "variable-sets:write" | "workspace:admin" | "workspace:create" | "workspace:read")[];
             model: string | null;
             reasoningEffort: "high" | "low" | "max" | "medium" | "minimal" | "none" | "xhigh" | null;

package/dist/index.d.ts

@@ -49,5 +49,6 @@ export * from "./application/composer-submit.js";
 export * from "./application/session-commands.js";
 export * from "./application/session-tenancy.js";
 export * from "./application/user-resource-grants.js";
+export * from "./application/api-integration-servers.js";
 export * from "./editable-artifact-live.js";
 export * from "./editable-artifacts.js";

package/dist/index.js

@@ -731,7 +731,6 @@ import {
   verifyDirectWorkspaceMutationSettlement,
   verifyRetainedProcessMutationSettlement
 } from "@opengeni/db";
-import { settleSessionBackgroundCommandForRetainedProcess } from "@opengeni/db/session-background-commands";
 import { appendAndPublishEvents } from "@opengeni/events";
 import {
   isProviderSandboxGoneDuringRoutedOperation,
@@ -965,14 +964,9 @@ function wrapChannelABoxWithRouting(services, ids, established) {
       reason: proof.reason,
       idleGraceMs: settings.sandboxIdleGraceMs
     });
-    const backgroundSettlement = retainedProcessBackgroundSettlement(settlement.process, proof);
-    await settleSessionBackgroundCommandForRetainedProcess(db, {
-      accountId: ids.accountId,
-      workspaceId: ids.workspaceId,
-      sessionId: ids.sessionId,
-      retainedProcessId: process.id,
-      ...backgroundSettlement
-    });
+    if (settlement.backgroundCommandEvents.length > 0 && bus) {
+      await bus.publish(ids.workspaceId, ids.sessionId, settlement.backgroundCommandEvents).catch(() => void 0);
+    }
   } : void 0;
   const resolver = makeActiveBackendResolver({
     workspaceId: ids.workspaceId,
@@ -1027,6 +1021,7 @@ function wrapChannelABoxWithRouting(services, ids, established) {
     } : {}
   });
   const proxy = new RoutingSandboxSession({
+    bindActiveRouteOnFirstResolve: true,
     defaultResolved: {
       session: established.session,
       sandboxId: null,
@@ -2086,6 +2081,13 @@ function requireAccountAdminAuthorizationStamp(authorization) {
     permission: "account:admin"
   });
 }
+function requireResolvedAccessGrantAuthorization(authorization, workspaceId) {
+  const { grant } = authorization;
+  if (!resolvedAccessGrantAuthorizations.has(authorization) || !authorization.contextIntegrity || authorization.authenticatedSubjectId !== grant.subjectId || grant.workspaceId !== workspaceId) {
+    throw new HTTPException(403, { message: "workspace access authorization is invalid" });
+  }
+  return grant;
+}
 async function requireCanonicalLocalAccountAdministrator(c, deps, accountId) {
   if (c.req.header("authorization")) {
     throw new HTTPException(401, { message: "organization administrator session required" });
@@ -15508,7 +15510,7 @@ async function controlAgentSessionWorkstream(deps, context, input) {
           wakeRevision: result.workflowWake.wakeRevision,
           shouldSignal: true,
           interruptionCount: result.interruptionCount,
-          controlRequested: true
+          controlRequested: input.action === "pause"
         });
       }
     }
@@ -15796,7 +15798,7 @@ async function controlHumanSessionWorkstreamWithOutcome(deps, context, input) {
           wakeRevision: result.workflowWake.wakeRevision,
           shouldSignal: true,
           interruptionCount: result.interruptionCount,
-          controlRequested: true
+          controlRequested: input.action === "pause"
         });
       }
     }
@@ -16009,6 +16011,143 @@ async function revokeManagedHumanUserResourceGrant(deps, authorization, workspac
     grantId
   });
 }
+
+// src/application/api-integration-servers.ts
+import {
+  createGraphqlMcpServer,
+  createOpenApiMcpServer,
+  createPinnedIntegrationTransport,
+  directIntegrationTransport,
+  IntegrationInvocationError
+} from "@opengeni/capabilities";
+function buildApiIntegrationMcpServers(input) {
+  const transport = createPinnedIntegrationTransport({
+    network: input.settings,
+    ...input.fetchImpl ? { fetchImpl: input.fetchImpl } : {}
+  });
+  return input.integrations.map((integration) => {
+    const authority = {
+      ...input.authority,
+      ...integration.connectionRef?.connectionId ? { connectionRef: integration.connectionRef.connectionId } : {}
+    };
+    const credentialResolver = integration.connectionRef ? integrationCredentialResolver(input, integration, "execution") : void 0;
+    const buildServer = (serverTransport, serverCredentialResolver = credentialResolver) => integration.revision.protocol === "openapi" ? createOpenApiMcpServer({
+      revision: integration.revision,
+      transport: serverTransport,
+      authority,
+      ...serverCredentialResolver ? { credentialResolver: serverCredentialResolver } : {}
+    }) : createGraphqlMcpServer({
+      revision: integration.revision,
+      endpoint: integration.baseUrl,
+      transport: serverTransport,
+      authority,
+      ...serverCredentialResolver ? { credentialResolver: serverCredentialResolver } : {}
+    });
+    const server = buildServer(transport);
+    const preflightCredentialResolver = integration.connectionRef ? integrationCredentialResolver(input, integration, "preflight") : void 0;
+    const preflightServer = preflightCredentialResolver ? buildServer(providerBlockingPreflightTransport, preflightCredentialResolver) : null;
+    return {
+      id: integration.serverId,
+      server,
+      approvalAuthority: {
+        kind: "api_integration",
+        capabilityId: integration.capabilityId,
+        pluginKey: integration.pluginKey,
+        pluginInstallationId: integration.pluginInstallationId,
+        installationVersion: integration.installationVersion,
+        instanceId: integration.instanceId,
+        instanceKey: integration.instanceKey,
+        instanceVersion: integration.instanceVersion,
+        definitionId: integration.definitionId,
+        definitionProvenance: integration.definitionProvenance,
+        revisionId: integration.revision.id,
+        baseUrl: integration.baseUrl,
+        providerDomain: integration.providerDomain,
+        connectionRef: integration.connectionRef,
+        connectionAuthorityGeneration: integration.connectionAuthorityGeneration
+      },
+      ...integration.connectionRef?.connectionId ? { resolvedConnectionId: integration.connectionRef.connectionId } : {},
+      ...credentialResolver ? {
+        preflightCall: async (toolName, args, options) => await preflightApiIntegrationCall(preflightServer, toolName, args, options)
+      } : {}
+    };
+  });
+}
+var providerBlockingPreflightTransport = directIntegrationTransport(async () => {
+  throw new Error("integration provider request blocked by preflight");
+});
+async function preflightApiIntegrationCall(server, toolName, args, options) {
+  try {
+    await server.callTool(toolName, args, null, options);
+  } catch (error) {
+    if (error instanceof IntegrationInvocationError && error.code === "request_failed") return;
+    throw error;
+  }
+  throw new Error("integration preflight unexpectedly crossed the provider request boundary");
+}
+function integrationCredentialResolver(input, integration, credentialResolutionMode) {
+  const connectionRef = integration.connectionRef;
+  if (!connectionRef) throw new Error("Integration credential resolver requires a connection");
+  const expectedAuthorityGeneration = integration.connectionAuthorityGeneration;
+  if (expectedAuthorityGeneration === null) {
+    throw new Error("Integration credential resolver requires a connection authority generation");
+  }
+  return {
+    resolve: async (request) => {
+      const result = await input.resolveCredential({
+        workspaceId: input.authority.workspaceId,
+        serverId: integration.serverId,
+        toolName: request.operationKey,
+        connectionRef,
+        destinationUrl: request.destinationUrl,
+        credentialTarget: "http_api",
+        forceRefresh: request.forceRefresh === true,
+        credentialResolutionMode,
+        expectedAuthorityGeneration
+      });
+      if (result.status === "auth_needed") {
+        await publishAuthNeeded(
+          input,
+          integration.serverId,
+          request.operationKey,
+          result,
+          connectionRef
+        );
+        return null;
+      }
+      const destination = new URL(request.destinationUrl);
+      return {
+        audience: { origin: destination.origin, pathPrefix: "/" },
+        placements: result.placements ?? Object.entries(result.headers).map(([name, value]) => ({
+          carrier: "header",
+          name,
+          value
+        })),
+        ...result.authorizeProviderRequest ? { authorizeProviderRequest: result.authorizeProviderRequest } : {},
+        ...result.expiresAt ? { expiresAt: result.expiresAt.toISOString() } : {},
+        ...connectionRef.scopes ? { scope: [...connectionRef.scopes] } : {}
+      };
+    }
+  };
+}
+async function publishAuthNeeded(input, serverId, toolName, result, connectionRef) {
+  try {
+    await input.onAuthNeeded?.({
+      serverId,
+      toolName,
+      providerDomain: result.providerDomain,
+      ...result.provider ? { provider: result.provider } : {},
+      reason: result.reason,
+      ...result.connectionId ? { connectionId: result.connectionId } : {},
+      ...result.authoritySource === "host" || connectionRef.authoritySource === "host" ? { authoritySource: "host" } : {},
+      ...result.scopes ? { scopes: result.scopes } : {},
+      ...result.resource ? { resource: result.resource } : {},
+      ...result.selectedResources ? { selectedResources: result.selectedResources } : {},
+      ...result.authorizationUrl ? { authorizationUrl: result.authorizationUrl } : {}
+    });
+  } catch {
+  }
+}
 export {
   CODEX_COMPACTION_V2_PROVIDER_LOCKED,
   CONVERSATION_ATTACHMENT_MAX_COUNT,
@@ -16168,6 +16307,7 @@ export {
   authorizedSocialConnectionsForGrant,
   automationRequestDigest,
   availableToolRefs,
+  buildApiIntegrationMcpServers,
   buildAutomationAcceptedExecution,
   buildCapabilityCatalog,
   buildFleetContextForSession,
@@ -16399,6 +16539,7 @@ export {
   requireOpenGeniSlackBotConnection,
   requirePermission,
   requireQueuedTurnForApi,
+  requireResolvedAccessGrantAuthorization,
   requireRigChangeForApi,
   requireRigForApi,
   requireScheduledTaskForApi,