@opengeni/core 2.7.5-canary.0 → 2.7.5-canary.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/core",
-  "version": "2.7.5-canary.0",
+  "version": "2.7.5-canary.2",
   "description": "OpenGeni framework-agnostic core: the domain, access, and billing layers (neutral access, off-HTTP V2 surface). Behavior-preserving extraction from apps/api — keeps Hono's HTTPException for error throwing (typed-errors cleanup deferred).",
   "license": "Apache-2.0",
   "repository": {
@@ -54,17 +54,17 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/capabilities": "^0.3.2-canary.0",
-    "@opengeni/codex": "^0.2.21-canary.0",
-    "@opengeni/config": "^1.0.0-canary.0",
-    "@opengeni/contracts": "^2.13.0-canary.0",
-    "@opengeni/db": "^4.0.0-canary.0",
-    "@opengeni/documents": "^0.8.19-canary.0",
-    "@opengeni/events": "^0.4.17-canary.0",
-    "@opengeni/network": "^0.3.0-canary.0",
-    "@opengeni/observability": "^0.8.19-canary.0",
-    "@opengeni/runtime": "^2.3.0-canary.0",
-    "@opengeni/storage": "^0.2.120-canary.0",
+    "@opengeni/capabilities": "^0.3.2-canary.2",
+    "@opengeni/codex": "^0.2.21-canary.2",
+    "@opengeni/config": "^1.0.0-canary.2",
+    "@opengeni/contracts": "^2.13.0-canary.2",
+    "@opengeni/db": "^4.0.0-canary.2",
+    "@opengeni/documents": "^0.8.19-canary.2",
+    "@opengeni/events": "^0.4.17-canary.2",
+    "@opengeni/network": "^0.3.0-canary.2",
+    "@opengeni/observability": "^0.8.19-canary.2",
+    "@opengeni/runtime": "^2.3.0-canary.2",
+    "@opengeni/storage": "^0.2.120-canary.2",
     "hono": "^4.12.18",
     "zod": "^4.2.1"
   },

package/src/application/new-session-drafts.ts

@@ -11,6 +11,7 @@ import {
   getSandbox,
   getVariableSet,
   NewSessionDraftAccessError,
+  newSessionDraftSelectedProjectChannelId,
   newSessionDraftToolsProvided,
   newSessionSelectionHistory,
   publicNewSessionDraftOptions,
@@ -41,6 +42,7 @@ function mapNewSessionDraft(
   row: Awaited<ReturnType<typeof getNewSessionDraftInTransaction>>,
 ): NewSessionDraftValue | null {
   if (!row) return null;
+  const selectedProjectChannelId = newSessionDraftSelectedProjectChannelId(row);
   return NewSessionDraft.parse({
     revision: row.revision,
     text: row.text,
@@ -50,6 +52,7 @@ function mapNewSessionDraft(
     model: row.model,
     reasoningEffort: row.reasoningEffort,
     latencyMode: row.latencyMode,
+    ...(selectedProjectChannelId !== undefined ? { selectedProjectChannelId } : {}),
     options: publicNewSessionDraftOptions(row),
     selectionHistory: newSessionSelectionHistory(row),
     updatedAt: row.updatedAt.toISOString(),
@@ -264,6 +267,9 @@ export async function saveActorNewSessionDraft(
           model: input.model,
           reasoningEffort: input.reasoningEffort,
           latencyMode: input.latencyMode,
+          ...(input.selectedProjectChannelId !== undefined
+            ? { selectedProjectChannelId: input.selectedProjectChannelId }
+            : {}),
           options: input.options,
           // Only managed people are removed through removeWorkspaceMember().
           // API keys and delegated service actors (for example the first-party

package/src/domain/github-action-policies.ts

@@ -0,0 +1,169 @@
+import type {
+  GitHubActionPolicyActor,
+  GitHubActionPolicyActorState,
+  GitHubActionPolicyDecision,
+  GitHubActionPolicyEffectiveDecision,
+  GitHubActionPolicyGroup,
+} from "@opengeni/contracts";
+import {
+  listConnectorActionPolicies,
+  resolveConnectorActionPolicy,
+  upsertConnectorActionPolicies,
+  type ConnectorActionPolicySnapshotEntry,
+  type Database,
+} from "@opengeni/db";
+import {
+  GITHUB_REST_MCP_APP_SERVER_ID,
+  GITHUB_REST_MCP_PERSONAL_SERVER_ID,
+  GITHUB_REST_WRITE_TOOL_NAMES,
+} from "@opengeni/runtime/github-rest-mcp";
+
+export const GITHUB_ACTION_POLICY_GROUP_TOOL_NAMES = {
+  routine: GITHUB_REST_WRITE_TOOL_NAMES.filter(
+    (toolName) => toolName !== "pull_request_review_submit" && toolName !== "pull_request_merge",
+  ),
+  review: ["pull_request_review_submit"],
+  merge: ["pull_request_merge"],
+} as const satisfies Record<GitHubActionPolicyGroup, readonly string[]>;
+
+const groupedToolNames = Object.values(GITHUB_ACTION_POLICY_GROUP_TOOL_NAMES).flat();
+if (
+  groupedToolNames.length !== new Set(groupedToolNames).size ||
+  GITHUB_REST_WRITE_TOOL_NAMES.some((toolName) => !groupedToolNames.includes(toolName))
+) {
+  throw new Error("GitHub action policy groups must cover every write tool exactly once");
+}
+
+export type GitHubActionPolicyActorBinding = {
+  actor: GitHubActionPolicyActor;
+  label: string;
+  connectionId: string;
+  serverId: typeof GITHUB_REST_MCP_APP_SERVER_ID | typeof GITHUB_REST_MCP_PERSONAL_SERVER_ID;
+};
+
+function effectiveToolDecision(
+  policies: readonly ConnectorActionPolicySnapshotEntry[],
+  actor: GitHubActionPolicyActorBinding,
+  toolName: string,
+): GitHubActionPolicyDecision {
+  const resolved = resolveConnectorActionPolicy(policies, {
+    connectionId: actor.connectionId,
+    serverId: actor.serverId,
+    toolName,
+    actionName: toolName,
+  });
+  // Match connector_write admission: absent policy inherits repository capability.
+  // This is a policy projection, not a grant of repository or provider access.
+  if (!resolved.managed) return "allow";
+  if (resolved.entry) return resolved.entry.policy;
+  return resolved.decision;
+}
+
+function effectiveGroupDecision(
+  policies: readonly ConnectorActionPolicySnapshotEntry[],
+  actor: GitHubActionPolicyActorBinding,
+  group: GitHubActionPolicyGroup,
+): GitHubActionPolicyEffectiveDecision {
+  const decisions = new Set(
+    GITHUB_ACTION_POLICY_GROUP_TOOL_NAMES[group].map((toolName) =>
+      effectiveToolDecision(policies, actor, toolName),
+    ),
+  );
+  return decisions.size === 1 ? decisions.values().next().value! : "mixed";
+}
+
+export function projectGitHubActionPolicyActor(
+  policies: readonly ConnectorActionPolicySnapshotEntry[],
+  binding: GitHubActionPolicyActorBinding,
+): GitHubActionPolicyActorState {
+  const groups = {
+    routine: effectiveGroupDecision(policies, binding, "routine"),
+    review: effectiveGroupDecision(policies, binding, "review"),
+    merge: effectiveGroupDecision(policies, binding, "merge"),
+  };
+  return binding.actor.kind === "workspace_app"
+    ? {
+        kind: "workspace_app",
+        installationId: binding.actor.installationId,
+        label: binding.label,
+        groups,
+      }
+    : {
+        kind: "personal",
+        connectionId: binding.actor.connectionId,
+        label: binding.label,
+        groups,
+      };
+}
+
+export async function listGitHubActionPolicyActors(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    actors: readonly GitHubActionPolicyActorBinding[];
+  },
+): Promise<GitHubActionPolicyActorState[]> {
+  const policies = await listConnectorActionPolicies(db, {
+    accountId: input.accountId,
+    workspaceId: input.workspaceId,
+    connectionIds: input.actors.map((actor) => actor.connectionId),
+  });
+  return input.actors.map((actor) => projectGitHubActionPolicyActor(policies, actor));
+}
+
+export async function updateGitHubActionPolicyGroup(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    actor: GitHubActionPolicyActorBinding;
+    group: GitHubActionPolicyGroup;
+    decision: GitHubActionPolicyDecision;
+  },
+): Promise<GitHubActionPolicyActorState> {
+  await upsertConnectorActionPolicies(
+    db,
+    GITHUB_ACTION_POLICY_GROUP_TOOL_NAMES[input.group].map((toolName) => ({
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      subjectId: input.subjectId,
+      connectionId: input.actor.connectionId,
+      serverId: input.actor.serverId,
+      toolName,
+      actionName: toolName,
+      policy: input.decision,
+    })),
+  );
+  const policies = await listConnectorActionPolicies(db, {
+    accountId: input.accountId,
+    workspaceId: input.workspaceId,
+    connectionIds: [input.actor.connectionId],
+  });
+  return projectGitHubActionPolicyActor(policies, input.actor);
+}
+
+export function githubAppActionPolicyActor(input: {
+  installationId: number;
+  accountLogin: string | null;
+}): GitHubActionPolicyActorBinding {
+  return {
+    actor: { kind: "workspace_app", installationId: input.installationId },
+    label: input.accountLogin ? `OpenGeni bot on ${input.accountLogin}` : "OpenGeni bot",
+    connectionId: `github-app:${input.installationId}`,
+    serverId: GITHUB_REST_MCP_APP_SERVER_ID,
+  };
+}
+
+export function personalGitHubActionPolicyActor(input: {
+  connectionId: string;
+  githubLogin: string;
+}): GitHubActionPolicyActorBinding {
+  return {
+    actor: { kind: "personal", connectionId: input.connectionId },
+    label: `@${input.githubLogin}`,
+    connectionId: input.connectionId,
+    serverId: GITHUB_REST_MCP_PERSONAL_SERVER_ID,
+  };
+}

package/src/domain/sessions.ts

@@ -1715,8 +1715,9 @@ export async function postUserMessageTurn(
  * `session_create` tool: payload validation, resource/tool/variableSet
  * checks, usage limits, session start, and usage recording. `rawPayload` is
  * the unparsed request body so absent-vs-empty execution-context fields keep
- * their meaning: a child inherits omitted resources/tools/mcpServers from its
- * trusted immediate parent, while explicit arrays (including []) win. A
+ * their meaning: a child inherits repositories (never files), tools, and MCP
+ * servers from its trusted immediate parent when omitted; explicit arrays
+ * (including []) win. A
  * top-level create with omitted tools applies workspace-default capability MCPs.
  */
 export function resolveChildGoalFromAcceptedSnapshot(
@@ -2102,7 +2103,8 @@ export async function createSessionForRequestWithOutcome(
   const resources = normalizeResources(
     hasOwnProperty(rawPayload, "resources")
       ? payload.resources
-      : (parentSession?.resources ?? payload.resources),
+      : (parentSession?.resources.filter((resource) => resource.kind === "repository") ??
+          payload.resources),
   );
   const inheritedOrSubmittedSkills = hasOwnProperty(rawPayload, "skills")
     ? payload.skills

package/src/index.ts

@@ -80,6 +80,7 @@ export * from "./domain/product-integration-pack";
 export * from "./domain/personal-connection-delegations";
 export * from "./domain/resources";
 export * from "./domain/github-repository-bindings";
+export * from "./domain/github-action-policies";
 export * from "./domain/session-tool-policy";
 export * from "./domain/scheduled-tasks";
 export * from "./domain/sessions";