@opengeni/core 3.0.1 → 3.1.2

package/src/dependencies.ts

@@ -1,8 +1,8 @@
 import type { Settings } from "@opengeni/config";
 import type {
-  ConnectionCredentialsPort,
   Document,
   DocumentAuthorityKind,
+  EntitlementsPort,
   GitHubAppApiPort,
   ScheduledTask,
   ScheduledTaskTriggerType,
@@ -10,14 +10,18 @@ import type {
   TurnInitiator,
 } from "@opengeni/contracts";
 import type { Database, SessionWorkflowWakeDeliveryResult } from "@opengeni/db";
+import type { VaultConnectionCredentialsPort } from "@opengeni/vaults";
+import type { OnePasswordVaultProviderFactory } from "./domain/vaults/provider-registry";
 import type { DocumentServices } from "@opengeni/documents";
 import type { EventBus } from "@opengeni/events";
 import type { Observability } from "@opengeni/observability";
+import type { UserPresenceRecorder } from "./user-presence";
 import type { createObjectStorage } from "@opengeni/storage";
 import type { ManagedAuth } from "./managed-auth-type";
 import type { ManagedAuthSessionAdapter } from "./managed-auth-session-sets";
 import type { ApiSandboxClient, ResumeBoxByIdInput, ResumedSandboxSession } from "./sandbox-types";
 import type { TranscriptionSegmenter, TranscriptionService } from "./transcription";
+import type { ModelCallService } from "./model-call";
 import type { EditableArtifactApplicationPort } from "./editable-artifact-live";
 import type { ResolvedCatalogSettings } from "./model-catalog";
 import type {
@@ -68,13 +72,23 @@ export type SessionWorkflowClient = {
     workflowId: string;
     workflowWakeRevision: number;
   }) => Promise<void>;
-  syncScheduledTask: (input: { task: ScheduledTask }) => Promise<void>;
+  syncScheduledTask: (input: {
+    task: Pick<ScheduledTask, "id" | "workspaceId" | "temporalScheduleId">;
+    /**
+     * Compensate under the same per-schedule writer lock. Return the error to
+     * throw only after this transaction commits; lock/commit failures bypass
+     * that receipt. A failing compensation must roll back its own savepoint.
+     */
+    onFailure?: (tx: Database, error: unknown) => Promise<Error>;
+  }) => Promise<void>;
   deleteScheduledTaskSchedule: (input: { temporalScheduleId: string }) => Promise<void>;
   triggerScheduledTask: (input: {
     task: ScheduledTask;
     agentRunUsageIdempotencyKey: string;
     triggerWorkflowId: string;
     initiator: TurnInitiator;
+    /** Server-frozen caller ceiling for this run, independent of task ownership. */
+    credentialRestriction?: "developer_setup";
     triggerType?: Extract<
       ScheduledTaskTriggerType,
       "manual" | "initial" | "provider_event" | "retry" | "repair"
@@ -101,7 +115,12 @@ export type DocumentIndexClient = {
 };
 
 export type ManagedEmailMessage = {
-  kind: "email_verification" | "password_reset" | "organization_user_setup";
+  kind:
+    | "email_verification"
+    | "password_reset"
+    | "organization_user_setup"
+    | "sign_in_method_changed"
+    | "site_abuse_notice";
   from: string;
   to: string;
   subject: string;
@@ -140,6 +159,8 @@ export type AppDependencies = {
    */
   catalogSourceSettings?: Settings;
   db: Database;
+  /** Read-only host funding admission; unset uses the standalone billing ledger. */
+  entitlements?: EntitlementsPort | null;
   /**
    * Host-composed editable artifact engine. Standalone startup binds the same
    * native kernel/DB/object-store implementation; embedded hosts may inject an
@@ -165,6 +186,11 @@ export type AppDependencies = {
   documentIndexer?: DocumentIndexClient;
   documentServices?: DocumentServices;
   observability?: Observability;
+  /**
+   * Throttled server-side presence for canonical managed browser sessions
+   * (`createUserPresenceRecorder`). Analytics only; never an authorization input.
+   */
+  userPresence?: UserPresenceRecorder | null;
   readinessChecks?: Partial<Record<"db" | "nats" | "temporal", () => Promise<void> | void>>;
   githubStateSecret?: string;
   /**
@@ -173,14 +199,21 @@ export type AppDependencies = {
    * App credentials; standalone deployments fall back to @opengeni/github.
    */
   githubAppApi?: GitHubAppApiPort;
-  /** Optional provider seam for the separately registered OpenGeni Lens App. */
+  /** Optional provider seam for the separately registered Opengeni Lens App. */
   prReviewGithubAppApi?: GitHubAppApiPort;
   /**
    * Optional host-owned connection credential seam. API-side consumers use
    * the MCP leg for Codemode/Code Mode; worker consumers bind the same port
-   * for model MCP, Git, and sandbox-secret resolution.
+   * for model MCP, Git, and run credentials. `vaultProvider` is the host's
+   * password manager, linked as vaults with `source: "host"` (OP-6).
+   */
+  connectionCredentials?: VaultConnectionCredentialsPort | null;
+  /**
+   * Builds 1Password providers for linked vaults. apps/api and apps/worker
+   * bind it to a dynamic `import("@opengeni/vaults-onepassword")`; unset means
+   * 1Password vaults report `provider_unavailable`.
    */
-  connectionCredentials?: ConnectionCredentialsPort | null;
+  onePasswordVaultProvider?: OnePasswordVaultProviderFactory | null;
   /**
    * Optional embedding-host session ACL. Unset preserves standalone workspace
    * authorization; once bound, every session-addressed surface fails closed on
@@ -194,12 +227,16 @@ export type AppDependencies = {
   managedEmailTransport?: ManagedEmailTransport;
   /** Injectable Codex HTTP transport for deterministic API/provider tests. */
   codexFetch?: typeof fetch;
+  /** Injectable transport for customer OpenAI/Azure connection checks. */
+  directModelFetch?: typeof fetch;
   /** Injectable GitHub transport for deterministic personal-OAuth tests. */
   githubPersonalFetch?: typeof fetch;
   /** Injectable credential-free GitHub transport for public repository verification tests. */
   githubAnonymousFetch?: typeof fetch;
   /** Injectable xAI OAuth/subscription transport for deterministic API/provider tests. */
   xaiFetch?: typeof fetch;
+  /** Injectable Claude usage transport on the shared core, for deterministic API tests. */
+  claudeFetch?: typeof fetch;
   /** Injectable Slack Web API transport for deterministic bot-connection tests. */
   slackFetch?: typeof fetch;
   /** Injectable Google OAuth/Drive transport for deterministic connector tests. */
@@ -210,6 +247,8 @@ export type AppDependencies = {
   apiIntegrationOAuthFetch?: typeof fetch;
   /** Injectable specification/introspection transport, still network-policy checked. */
   apiIntegrationSourceFetch?: typeof fetch;
+  /** Injectable bounded MCP initialization/tools-list probe for Connect tests. */
+  mcpCapabilityProbe?: import("./domain/capabilities").McpCapabilityProbe;
   atlassianFetch?: typeof fetch;
   /** Injectable MCP OAuth setup deadline for deterministic stalled-provider tests. */
   oauthStartDeadlineMs?: number;
@@ -219,6 +258,8 @@ export type AppDependencies = {
   transcription?: TranscriptionService | null;
   /** Optional host-owned long-form audio normalization/segmentation service. */
   transcriptionSegmenter?: TranscriptionSegmenter | null;
+  /** Stateless single model calls (chat completions); built from settings when omitted. */
+  modelCalls?: ModelCallService | null;
   // The API process's OWN agent-loop-free sandbox client (constructed from
   // settings via @opengeni/runtime/sandbox). Undefined when sandboxBackend=none.
   // This is the foundation of the API-direct control plane: the API resumes
@@ -265,6 +306,7 @@ export type AcceptSessionUserMessageDependencies = Pick<
   | "bus"
   | "sessionAuthorization"
   | "schedulePromptPostCommit"
+  | "observability"
 > & {
   workflowClient: Pick<SessionWorkflowClient, "wakeSessionWorkflow">;
   objectStorage: ObjectStorageDependency;

package/src/developer-setup-credential-ceiling.ts

@@ -0,0 +1,60 @@
+import {
+  readTurnExecutionPolicyV1,
+  type AccessGrant,
+  type Permission,
+  type TurnExecutionPolicyV1,
+} from "@opengeni/contracts";
+import { HTTPException } from "hono/http-exception";
+import {
+  isDeveloperSetupAuthorization,
+  isDeveloperSetupGrant,
+  isDeveloperSetupDelegatedPermissionAllowed,
+  type AccessGrantAuthorization,
+} from "./access";
+
+/** The policy must be server-frozen, never supplied as request metadata. */
+export function requireDeveloperSetupDelegatedPermissions(
+  policy: TurnExecutionPolicyV1,
+  permissions: readonly Permission[] | undefined,
+): void {
+  if (policy.credentialRestriction !== "developer_setup") return;
+  const forbidden = permissions?.find(
+    (permission) => !isDeveloperSetupDelegatedPermissionAllowed(permission),
+  );
+  if (forbidden) {
+    throw new HTTPException(403, {
+      message: `Developer setup cannot delegate first-party MCP permission: ${forbidden}`,
+    });
+  }
+}
+
+/** Only pass server-owned persisted session/turn metadata, never request JSON. */
+export function withDeveloperSetupCredentialRestriction(
+  policy: TurnExecutionPolicyV1,
+  source: {
+    grant?: AccessGrant;
+    authorization?: AccessGrantAuthorization | undefined;
+    trustedMetadata?: readonly unknown[];
+  },
+): TurnExecutionPolicyV1 {
+  let restricted =
+    policy.credentialRestriction === "developer_setup" ||
+    isDeveloperSetupAuthorization(source.authorization) ||
+    (source.grant !== undefined && isDeveloperSetupGrant(source.grant));
+  for (const metadata of source.trustedMetadata ?? []) {
+    if (metadata === null || metadata === undefined) continue;
+    let inherited: ReturnType<typeof readTurnExecutionPolicyV1>;
+    try {
+      inherited = readTurnExecutionPolicyV1(metadata);
+    } catch {
+      throw new HTTPException(409, { message: "The frozen session credential ceiling is invalid" });
+    }
+    if (
+      inherited.kind === "valid" &&
+      inherited.policy.credentialRestriction === "developer_setup"
+    ) {
+      restricted = true;
+    }
+  }
+  return restricted ? { ...policy, credentialRestriction: "developer_setup" } : policy;
+}

package/src/domain/agent-config-resolution.ts

@@ -0,0 +1,148 @@
+import {
+  agentConfigDeploymentPolicy,
+  resolveSessionFirstPartyMcpTools,
+  type Settings,
+} from "@opengeni/config";
+import {
+  AgentConfigError,
+  agentConfigFirstPartyMcpTools,
+  agentConfigToolRefs,
+  legacyEffectiveAgentCapabilities,
+  resolveAgentConfig,
+  resolveWorkspaceAgentDefaults,
+  resolveWorkspaceAgentHumanInputEnabled,
+  type AgentConfigCreator,
+  type AgentConfigParent,
+  type AgentConfigRequest,
+  type FirstPartyMcpToolName,
+  type ResolvedAgentCapabilities,
+  type ResolvedAgentConfig,
+  type Session,
+  type SessionToolPolicy,
+  type ToolRef,
+} from "@opengeni/contracts";
+import { HTTPException } from "hono/http-exception";
+
+/**
+ * Run an agent-config resolution step and surface its typed failure as a 422
+ * whose `cause` keeps the `AgentConfigError` (the API renders its code as
+ * `details.code`; MCP and Slack keep the plain message).
+ */
+export function withAgentConfigHttpErrors<T>(fn: () => T): T {
+  try {
+    return fn();
+  } catch (error) {
+    if (error instanceof AgentConfigError) {
+      throw new HTTPException(422, { message: error.message, cause: error });
+    }
+    throw error;
+  }
+}
+
+/** The current effective capabilities of a null-config session (the conversion/child ceiling). */
+export function legacySessionAgentCapabilities(
+  settings: Settings,
+  session: Pick<Session, "firstPartyMcpTools" | "tools" | "toolPolicy">,
+  workspaceSettings: unknown,
+  /** The workspace's current omitted-tools default server ids, when known. */
+  defaultServerIds?: Iterable<string>,
+): ResolvedAgentCapabilities {
+  return legacyEffectiveAgentCapabilities({
+    firstPartyMcpTools: resolveSessionFirstPartyMcpTools(settings, session, workspaceSettings),
+    tools: session.tools,
+    toolPolicy: session.toolPolicy,
+    humanInputEnabled: resolveWorkspaceAgentHumanInputEnabled(workspaceSettings),
+    ...(defaultServerIds ? { defaultServerIds } : {}),
+  });
+}
+
+/** A parent session as a resolution input: its frozen config, or its legacy ceiling. */
+export function agentConfigParentFor(
+  settings: Settings,
+  parent: Session,
+  workspaceSettings: unknown,
+): AgentConfigParent {
+  return parent.agent
+    ? { kind: "configured", config: parent.agent }
+    : {
+        kind: "legacy",
+        ceiling: legacySessionAgentCapabilities(settings, parent, workspaceSettings),
+      };
+}
+
+/**
+ * Resolve the frozen agent configuration for a new session. Every creator
+ * calls this: `createSessionForRequest` (public API, MCP `session_create`,
+ * Slack, drafts), automations, and the scheduled worker. Returns `config:
+ * null` for exact legacy behavior.
+ */
+export function resolveSessionAgentConfigForCreate(input: {
+  settings: Settings;
+  creator: AgentConfigCreator;
+  request: AgentConfigRequest | undefined;
+  instructions: string | undefined;
+  workspaceSettings: unknown;
+  parent: Session | null;
+  goal: boolean;
+}): { config: ResolvedAgentConfig | null; instructions: string | undefined } {
+  return withAgentConfigHttpErrors(() =>
+    resolveAgentConfig({
+      creator: input.creator,
+      request: input.request,
+      instructions: input.instructions,
+      workspace: {
+        defaults: resolveWorkspaceAgentDefaults(input.workspaceSettings),
+        humanInputEnabled: resolveWorkspaceAgentHumanInputEnabled(input.workspaceSettings),
+      },
+      deployment: agentConfigDeploymentPolicy(input.settings),
+      ...(input.parent
+        ? {
+            parent: agentConfigParentFor(input.settings, input.parent, input.workspaceSettings),
+          }
+        : {}),
+      goal: input.goal,
+    }),
+  );
+}
+
+/**
+ * Write a resolved configuration through to the legacy columns the runtime
+ * reads today. `null` returns the inputs unchanged; `"all"` also does.
+ */
+export function applySessionAgentConfigWriteThrough(input: {
+  config: ResolvedAgentConfig | null;
+  firstPartyMcpTools: FirstPartyMcpToolName[];
+  explicitFirstPartyMcpTools?: readonly FirstPartyMcpToolName[] | undefined;
+  tools: ToolRef[];
+  toolPolicy: SessionToolPolicy;
+  productServerIds: Iterable<string>;
+  explicitServerIds?: Iterable<string> | undefined;
+}): {
+  firstPartyMcpTools: FirstPartyMcpToolName[];
+  tools: ToolRef[];
+  toolPolicy: SessionToolPolicy;
+} {
+  const { config } = input;
+  if (!config) {
+    return {
+      firstPartyMcpTools: input.firstPartyMcpTools,
+      tools: input.tools,
+      toolPolicy: input.toolPolicy,
+    };
+  }
+  return withAgentConfigHttpErrors(() => {
+    const firstPartyMcpTools = agentConfigFirstPartyMcpTools(
+      config,
+      input.firstPartyMcpTools,
+      input.explicitFirstPartyMcpTools,
+    );
+    const refs = agentConfigToolRefs({
+      config,
+      tools: input.tools,
+      toolPolicy: input.toolPolicy,
+      productServerIds: new Set(input.productServerIds),
+      ...(input.explicitServerIds ? { explicitServerIds: new Set(input.explicitServerIds) } : {}),
+    });
+    return { firstPartyMcpTools, tools: refs.tools, toolPolicy: refs.toolPolicy };
+  });
+}

package/src/domain/automations.ts

@@ -4,12 +4,71 @@ import {
   AutomationNormalizedEvent,
   AutomationSessionTemplate,
   SignedJsonAutomationEnvelope,
+  readTurnExecutionPolicyV1,
+  type AccessGrant,
+  type Permission,
   type AutomationAdapterId,
   type AutomationSource,
   type AutomationTrigger,
 } from "@opengeni/contracts";
+import { getSession, getSessionTurnForAttempt, type Database } from "@opengeni/db";
+import { HTTPException } from "hono/http-exception";
+import { isDeveloperSetupGrant, isDeveloperSetupDelegatedPermissionAllowed } from "../access";
+import { creationInitiatorForGrant } from "./sessions";
 import { prReviewAutomationAdapter } from "./pr-review";
 
+/** Canonical authenticated grant or exact server-owned originating policy only. */
+export async function automationCredentialRestrictionForGrant(
+  db: Database,
+  grant: AccessGrant,
+): Promise<AutomationSessionTemplate["credentialRestriction"]> {
+  if (isDeveloperSetupGrant(grant)) return "developer_setup";
+  const actor = creationInitiatorForGrant(grant).actor;
+  if (!actor) return undefined;
+  const turn = await getSessionTurnForAttempt(
+    db,
+    grant.workspaceId,
+    actor.sessionId,
+    actor.attemptId,
+  );
+  const session = await getSession(db, grant.workspaceId, actor.sessionId);
+  if (!turn || turn.id !== actor.turnId || !session || session.accountId !== grant.accountId) {
+    throw new HTTPException(403, {
+      message: "the creating automation agent attempt is not available",
+    });
+  }
+  for (const metadata of [turn.metadata, session.metadata]) {
+    let policy: ReturnType<typeof readTurnExecutionPolicyV1>;
+    try {
+      policy = readTurnExecutionPolicyV1(metadata);
+    } catch {
+      throw new HTTPException(409, {
+        message: "The frozen automation creator credential ceiling is invalid",
+      });
+    }
+    if (policy.kind === "valid" && policy.policy.credentialRestriction === "developer_setup") {
+      return "developer_setup";
+    }
+  }
+  return undefined;
+}
+
+/** Explicit delegated scopes must stay within the frozen setup ceiling. */
+export function requireAutomationCredentialRestrictionPermissions(
+  restriction: AutomationSessionTemplate["credentialRestriction"],
+  permissions: readonly Permission[],
+): void {
+  if (restriction !== "developer_setup") return;
+  const forbidden = permissions.find(
+    (permission) => !isDeveloperSetupDelegatedPermissionAllowed(permission),
+  );
+  if (forbidden) {
+    throw new HTTPException(403, {
+      message: `Developer setup cannot delegate automation permission: ${forbidden}`,
+    });
+  }
+}
+
 export type AutomationAdapterRenderResult = {
   initialMessage: string;
   sessionTemplate: AutomationSessionTemplate;
@@ -147,7 +206,19 @@ export function buildAutomationAcceptedExecution(input: {
   eventId: string;
   event: AutomationNormalizedEvent;
   render: AutomationAdapterRenderResult;
+  /** Trusted caller restriction from the immutable stored event, not adapter JSON. */
+  credentialRestriction?: "developer_setup";
 }): AutomationAcceptedExecution {
+  // Adapter output is a rendering, not authority. Reattach the immutable
+  // trigger/event marker even if an adapter rebuilds or strips its template.
+  const { credentialRestriction: _renderRestriction, ...renderTemplate } =
+    AutomationSessionTemplate.parse(input.render.sessionTemplate);
+  const credentialRestriction =
+    input.trigger.sessionTemplate.credentialRestriction ?? input.credentialRestriction;
+  requireAutomationCredentialRestrictionPermissions(
+    credentialRestriction,
+    renderTemplate.firstPartyMcpPermissions,
+  );
   return AutomationAcceptedExecution.parse({
     version: 1,
     accountId: input.accountId,
@@ -160,9 +231,12 @@ export function buildAutomationAcceptedExecution(input: {
     adapterId: input.event.adapterId,
     occurrenceKey: input.event.occurrenceKey,
     initialMessage: input.render.initialMessage,
-    sessionTemplate: input.render.sessionTemplate,
+    sessionTemplate: {
+      ...renderTemplate,
+      ...(credentialRestriction ? { credentialRestriction } : {}),
+    },
     serviceSubjectId: `automation:${input.trigger.id}`,
-    serviceLabel: `OpenGeni automation: ${input.trigger.name}`,
+    serviceLabel: `Opengeni automation: ${input.trigger.name}`,
     provenance: {
       sourceId: input.source.id,
       sourceVersion: input.source.version,