@opengeni/core 2.7.5-canary.0 → 2.7.5-canary.1

package/dist/domain/github-action-policies.d.ts

@@ -0,0 +1,36 @@
+import type { GitHubActionPolicyActor, GitHubActionPolicyActorState, GitHubActionPolicyDecision, GitHubActionPolicyGroup } from "@opengeni/contracts";
+import { type ConnectorActionPolicySnapshotEntry, type Database } from "@opengeni/db";
+import { GITHUB_REST_MCP_APP_SERVER_ID, GITHUB_REST_MCP_PERSONAL_SERVER_ID } from "@opengeni/runtime/github-rest-mcp";
+export declare const GITHUB_ACTION_POLICY_GROUP_TOOL_NAMES: {
+    readonly routine: ("issue_comment" | "issue_create" | "issue_update" | "pull_request_comment" | "pull_request_create" | "pull_request_request_review" | "pull_request_update" | "ref_create")[];
+    readonly review: readonly ["pull_request_review_submit"];
+    readonly merge: readonly ["pull_request_merge"];
+};
+export type GitHubActionPolicyActorBinding = {
+    actor: GitHubActionPolicyActor;
+    label: string;
+    connectionId: string;
+    serverId: typeof GITHUB_REST_MCP_APP_SERVER_ID | typeof GITHUB_REST_MCP_PERSONAL_SERVER_ID;
+};
+export declare function projectGitHubActionPolicyActor(policies: readonly ConnectorActionPolicySnapshotEntry[], binding: GitHubActionPolicyActorBinding): GitHubActionPolicyActorState;
+export declare function listGitHubActionPolicyActors(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    actors: readonly GitHubActionPolicyActorBinding[];
+}): Promise<GitHubActionPolicyActorState[]>;
+export declare function updateGitHubActionPolicyGroup(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    actor: GitHubActionPolicyActorBinding;
+    group: GitHubActionPolicyGroup;
+    decision: GitHubActionPolicyDecision;
+}): Promise<GitHubActionPolicyActorState>;
+export declare function githubAppActionPolicyActor(input: {
+    installationId: number;
+    accountLogin: string | null;
+}): GitHubActionPolicyActorBinding;
+export declare function personalGitHubActionPolicyActor(input: {
+    connectionId: string;
+    githubLogin: string;
+}): GitHubActionPolicyActorBinding;

package/dist/domain/pr-review.d.ts

@@ -80,7 +80,7 @@ export declare const prReviewAutomationAdapter: {
                 eager?: boolean | undefined;
                 optional?: boolean | undefined;
             }[];
-            firstPartyMcpTools: ("artifacts_archive" | "artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_publish" | "artifacts_restore" | "artifacts_rollback" | "atlassian_get" | "atlassian_search" | "atlassian_sources_list" | "browser_act" | "browser_auth" | "browser_clipboard" | "browser_debug" | "browser_identity" | "browser_lifecycle" | "browser_observe" | "browser_open" | "browser_publish" | "browser_tabs" | "capability_authorization_request" | "capability_catalog_search" | "command_wait" | "company_profile_confirm" | "company_profile_propose" | "computer_act" | "computer_clipboard" | "computer_lifecycle" | "computer_observe" | "computer_open" | "computer_targets" | "connected_machine_remove" | "editable_artifact_apply" | "editable_artifact_create" | "editable_artifact_export" | "editable_artifact_export_status" | "editable_artifact_get" | "editable_artifact_import" | "editable_artifact_inspect" | "editable_artifact_list" | "environment_list" | "environment_set_variable" | "fiken_bank_accounts_list" | "fiken_companies_list" | "fiken_contact_create" | "fiken_contacts_list" | "fiken_invoice_draft_create" | "fiken_invoice_get" | "fiken_invoices_list" | "fiken_products_list" | "fiken_purchases_list" | "fiken_sales_list" | "github_connect_link" | "github_repositories_list" | "goal_complete" | "goal_pause" | "goal_progress" | "goal_set" | "goal_update" | "instruction_policy_propose" | "interaction_discover" | "interaction_request_human" | "knowledge_correct" | "knowledge_propose" | "memory_correct" | "memory_save" | "memory_search" | "preference_propose" | "preference_registry_get" | "preference_registry_summary" | "reddit_accounts_list" | "reddit_mentions_live" | "reddit_post_reply" | "reddit_posts_sync" | "reddit_search_live" | "reddit_thread_fetch" | "remember" | "remember_confirm" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_file_publish" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "session_create" | "session_events" | "session_get" | "session_human_input_respond" | "session_pause" | "session_resume" | "session_send_message" | "session_steer" | "session_wait" | "sessions_list" | "set_other_session_title" | "set_session_title" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_search" | "slack_bot_thread_replies" | "social_connections_list" | "social_daily_analysis_context" | "social_mentions_live" | "social_post_reply" | "social_posts_recent" | "social_posts_sync" | "social_search_live" | "social_thread_fetch" | "task_note_archive" | "task_note_promote_instruction_policy" | "task_note_promote_knowledge" | "task_note_promote_preference" | "task_note_replace" | "task_note_save" | "task_notes_list" | "variable_set_get_variable" | "variable_set_list" | "variable_set_set_variable" | "wait_for_input" | "work_claim_release" | "work_claim_upsert" | "x_accounts_list" | "x_mentions_live" | "x_post_reply" | "x_posts_sync" | "x_search_live" | "x_thread_fetch")[];
+            firstPartyMcpTools: ("artifacts_archive" | "artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_prepare_upload" | "artifacts_publish" | "artifacts_restore" | "artifacts_rollback" | "atlassian_get" | "atlassian_search" | "atlassian_sources_list" | "browser_act" | "browser_auth" | "browser_clipboard" | "browser_debug" | "browser_identity" | "browser_lifecycle" | "browser_observe" | "browser_open" | "browser_publish" | "browser_tabs" | "capability_authorization_request" | "capability_catalog_search" | "command_read" | "command_wait" | "company_profile_confirm" | "company_profile_propose" | "computer_act" | "computer_clipboard" | "computer_lifecycle" | "computer_observe" | "computer_open" | "computer_targets" | "connected_machine_remove" | "editable_artifact_apply" | "editable_artifact_create" | "editable_artifact_export" | "editable_artifact_export_status" | "editable_artifact_get" | "editable_artifact_import" | "editable_artifact_inspect" | "editable_artifact_list" | "environment_list" | "environment_set_variable" | "fiken_bank_accounts_list" | "fiken_companies_list" | "fiken_contact_create" | "fiken_contacts_list" | "fiken_invoice_draft_create" | "fiken_invoice_get" | "fiken_invoices_list" | "fiken_products_list" | "fiken_purchases_list" | "fiken_sales_list" | "github_connect_link" | "github_repositories_list" | "goal_complete" | "goal_pause" | "goal_progress" | "goal_resume" | "goal_set" | "goal_update" | "instruction_policy_propose" | "interaction_discover" | "interaction_request_human" | "knowledge_correct" | "knowledge_propose" | "memory_correct" | "memory_save" | "memory_search" | "preference_propose" | "preference_registry_get" | "preference_registry_summary" | "reddit_accounts_list" | "reddit_mentions_live" | "reddit_post_reply" | "reddit_posts_sync" | "reddit_search_live" | "reddit_thread_fetch" | "remember" | "remember_confirm" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_file_publish" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "session_create" | "session_events" | "session_get" | "session_human_input_respond" | "session_pause" | "session_resume" | "session_send_message" | "session_steer" | "session_wait" | "sessions_list" | "set_other_session_title" | "set_session_title" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_search" | "slack_bot_thread_replies" | "social_connections_list" | "social_daily_analysis_context" | "social_mentions_live" | "social_post_reply" | "social_posts_recent" | "social_posts_sync" | "social_search_live" | "social_thread_fetch" | "task_note_archive" | "task_note_promote_instruction_policy" | "task_note_promote_knowledge" | "task_note_promote_preference" | "task_note_replace" | "task_note_save" | "task_notes_list" | "variable_set_get_variable" | "variable_set_list" | "variable_set_set_variable" | "wait_for_input" | "work_claim_release" | "work_claim_upsert" | "x_accounts_list" | "x_mentions_live" | "x_post_reply" | "x_posts_sync" | "x_search_live" | "x_thread_fetch")[];
             firstPartyMcpPermissions: ("account:admin" | "account:read" | "api_keys:manage" | "artifacts:publish" | "artifacts:read" | "billing:manage" | "billing:read" | "capabilities:manage" | "codemode:call" | "connections:read" | "connections:write" | "documents:manage" | "documents:search" | "enrollments:manage" | "enrollments:read" | "environments:manage" | "environments:use" | "files:read" | "files:upload" | "files:write" | "github:manage" | "github:use" | "goals:manage" | "mcp_servers:attach" | "members:manage" | "rigs:manage" | "rigs:use" | "scheduled_tasks:manage" | "scheduled_tasks:run" | "secrets:list" | "secrets:read" | "secrets:write" | "sessions:control" | "sessions:create" | "sessions:read" | "stream:acknowledge" | "stream:control" | "stream:view" | "terminal:attach" | "variable-sets:attach" | "variable-sets:list" | "variable-sets:manage" | "variable-sets:read" | "variable-sets:use" | "variable-sets:write" | "workspace:admin" | "workspace:create" | "workspace:read")[];
             model: string | null;
             reasoningEffort: "high" | "low" | "max" | "medium" | "minimal" | "none" | "xhigh" | null;

package/dist/index.d.ts

@@ -23,6 +23,7 @@ export * from "./domain/product-integration-pack.js";
 export * from "./domain/personal-connection-delegations.js";
 export * from "./domain/resources.js";
 export * from "./domain/github-repository-bindings.js";
+export * from "./domain/github-action-policies.js";
 export * from "./domain/session-tool-policy.js";
 export * from "./domain/scheduled-tasks.js";
 export * from "./domain/sessions.js";

package/dist/index.js

@@ -7942,6 +7942,111 @@ function applyGitHubRepositoryBindings(resources, bindings) {
   });
 }
 
+// src/domain/github-action-policies.ts
+import {
+  listConnectorActionPolicies,
+  resolveConnectorActionPolicy,
+  upsertConnectorActionPolicies
+} from "@opengeni/db";
+import {
+  GITHUB_REST_MCP_APP_SERVER_ID,
+  GITHUB_REST_MCP_PERSONAL_SERVER_ID,
+  GITHUB_REST_WRITE_TOOL_NAMES
+} from "@opengeni/runtime/github-rest-mcp";
+var GITHUB_ACTION_POLICY_GROUP_TOOL_NAMES = {
+  routine: GITHUB_REST_WRITE_TOOL_NAMES.filter(
+    (toolName) => toolName !== "pull_request_review_submit" && toolName !== "pull_request_merge"
+  ),
+  review: ["pull_request_review_submit"],
+  merge: ["pull_request_merge"]
+};
+var groupedToolNames = Object.values(GITHUB_ACTION_POLICY_GROUP_TOOL_NAMES).flat();
+if (groupedToolNames.length !== new Set(groupedToolNames).size || GITHUB_REST_WRITE_TOOL_NAMES.some((toolName) => !groupedToolNames.includes(toolName))) {
+  throw new Error("GitHub action policy groups must cover every write tool exactly once");
+}
+function effectiveToolDecision(policies, actor, toolName) {
+  const resolved = resolveConnectorActionPolicy(policies, {
+    connectionId: actor.connectionId,
+    serverId: actor.serverId,
+    toolName,
+    actionName: toolName
+  });
+  if (!resolved.managed) return "allow";
+  if (resolved.entry) return resolved.entry.policy;
+  return resolved.decision;
+}
+function effectiveGroupDecision(policies, actor, group) {
+  const decisions = new Set(
+    GITHUB_ACTION_POLICY_GROUP_TOOL_NAMES[group].map(
+      (toolName) => effectiveToolDecision(policies, actor, toolName)
+    )
+  );
+  return decisions.size === 1 ? decisions.values().next().value : "mixed";
+}
+function projectGitHubActionPolicyActor(policies, binding) {
+  const groups = {
+    routine: effectiveGroupDecision(policies, binding, "routine"),
+    review: effectiveGroupDecision(policies, binding, "review"),
+    merge: effectiveGroupDecision(policies, binding, "merge")
+  };
+  return binding.actor.kind === "workspace_app" ? {
+    kind: "workspace_app",
+    installationId: binding.actor.installationId,
+    label: binding.label,
+    groups
+  } : {
+    kind: "personal",
+    connectionId: binding.actor.connectionId,
+    label: binding.label,
+    groups
+  };
+}
+async function listGitHubActionPolicyActors(db, input) {
+  const policies = await listConnectorActionPolicies(db, {
+    accountId: input.accountId,
+    workspaceId: input.workspaceId,
+    connectionIds: input.actors.map((actor) => actor.connectionId)
+  });
+  return input.actors.map((actor) => projectGitHubActionPolicyActor(policies, actor));
+}
+async function updateGitHubActionPolicyGroup(db, input) {
+  await upsertConnectorActionPolicies(
+    db,
+    GITHUB_ACTION_POLICY_GROUP_TOOL_NAMES[input.group].map((toolName) => ({
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      subjectId: input.subjectId,
+      connectionId: input.actor.connectionId,
+      serverId: input.actor.serverId,
+      toolName,
+      actionName: toolName,
+      policy: input.decision
+    }))
+  );
+  const policies = await listConnectorActionPolicies(db, {
+    accountId: input.accountId,
+    workspaceId: input.workspaceId,
+    connectionIds: [input.actor.connectionId]
+  });
+  return projectGitHubActionPolicyActor(policies, input.actor);
+}
+function githubAppActionPolicyActor(input) {
+  return {
+    actor: { kind: "workspace_app", installationId: input.installationId },
+    label: input.accountLogin ? `OpenGeni bot on ${input.accountLogin}` : "OpenGeni bot",
+    connectionId: `github-app:${input.installationId}`,
+    serverId: GITHUB_REST_MCP_APP_SERVER_ID
+  };
+}
+function personalGitHubActionPolicyActor(input) {
+  return {
+    actor: { kind: "personal", connectionId: input.connectionId },
+    label: `@${input.githubLogin}`,
+    connectionId: input.connectionId,
+    serverId: GITHUB_REST_MCP_PERSONAL_SERVER_ID
+  };
+}
+
 // src/domain/session-tool-policy.ts
 import {
   SESSION_EFFECTIVE_TOOL_POLICY_ID_LIMIT,
@@ -14922,6 +15027,7 @@ import {
   getSandbox as getSandbox5,
   getVariableSet as getVariableSet4,
   NewSessionDraftAccessError,
+  newSessionDraftSelectedProjectChannelId,
   newSessionDraftToolsProvided,
   newSessionSelectionHistory,
   publicNewSessionDraftOptions,
@@ -14935,6 +15041,7 @@ function hasOwn(value, key) {
 }
 function mapNewSessionDraft(row) {
   if (!row) return null;
+  const selectedProjectChannelId = newSessionDraftSelectedProjectChannelId(row);
   return NewSessionDraft.parse({
     revision: row.revision,
     text: row.text,
@@ -14944,6 +15051,7 @@ function mapNewSessionDraft(row) {
     model: row.model,
     reasoningEffort: row.reasoningEffort,
     latencyMode: row.latencyMode,
+    ...selectedProjectChannelId !== void 0 ? { selectedProjectChannelId } : {},
     options: publicNewSessionDraftOptions(row),
     selectionHistory: newSessionSelectionHistory(row),
     updatedAt: row.updatedAt.toISOString()
@@ -15104,6 +15212,7 @@ async function saveActorNewSessionDraft(deps, grant, workspaceId, rawInput, cano
           model: input.model,
           reasoningEffort: input.reasoningEffort,
           latencyMode: input.latencyMode,
+          ...input.selectedProjectChannelId !== void 0 ? { selectedProjectChannelId: input.selectedProjectChannelId } : {},
           options: input.options,
           // Only managed people are removed through removeWorkspaceMember().
           // API keys and delegated service actors (for example the first-party
@@ -16210,6 +16319,7 @@ export {
   EditableArtifactSnapshotVerificationError,
   EditableArtifactStaleBaseError,
   EditableArtifactUndoTargetError,
+  GITHUB_ACTION_POLICY_GROUP_TOOL_NAMES,
   InMemoryEditableArtifactLiveTicketStore,
   InMemoryEditableArtifactStableIdFactory,
   InMemoryEditableArtifactStore,
@@ -16416,6 +16526,7 @@ export {
   getManagedHumanSessionCreateCapabilities,
   getManagedSession,
   getWorkspaceInsights,
+  githubAppActionPolicyActor,
   googleDrivePublicationDelegationFromVisibleConnections,
   governedLearningEvidenceIsSlackDerived,
   governedLearningSlackImportance,
@@ -16446,6 +16557,7 @@ export {
   legacySandboxRuntimeFromPacks,
   listCapabilityPacks,
   listFleet,
+  listGitHubActionPolicyActors,
   listGitHubRepositoryBindingCandidates,
   listManagedHumanUserResourceAuthorities,
   listRigChangesForApi,
@@ -16493,6 +16605,7 @@ export {
   personalConnectionDelegationsEqual,
   personalConnectionDelegationsFromParent,
   personalConnectionDelegationsFromVisibleConnections,
+  personalGitHubActionPolicyActor,
   personalGitHubRepositoryResources,
   portableSkillCapabilityId,
   portableSkillPluginKey,
@@ -16507,6 +16620,7 @@ export {
   preferredFikenConnection,
   preflightCreateTimeSandboxTarget,
   previewCapabilityPackInstallation,
+  projectGitHubActionPolicyActor,
   promoteSetupAppendChange,
   promoteVerifiedDefinitionEditChangeForApi,
   proposeRigChangeForApi,
@@ -16613,6 +16727,7 @@ export {
   syncCreatedScheduledTask,
   syncUpdatedScheduledTask,
   unboundGitHubRepositoryResources,
+  updateGitHubActionPolicyGroup,
   updateManagedHumanSessionVisibility,
   updateRigForApi,
   updateScheduledTaskForApi,