@opengeni/core 3.0.1 → 3.1.2

package/src/domain/session-connection-accounts.ts

@@ -0,0 +1,239 @@
+import type {
+  AccessGrant,
+  ConnectionAccountIntent,
+  McpConnectionAccountBinding,
+  McpConnectionAccountSelection,
+  McpPersonalConnectionDelegation,
+  ResourceRef,
+  ToolRef,
+} from "@opengeni/contracts";
+import { GOOGLE_DRIVE_PUBLICATION_SERVER_ID } from "@opengeni/contracts/google-drive";
+import { PERSONAL_GITHUB_CONNECTION_SURFACE_ID } from "@opengeni/contracts/personal-github";
+import { resolveSessionFirstPartyMcpTools, type Settings } from "@opengeni/config";
+import { requireSession, requireWorkspace, type Database } from "@opengeni/db";
+import { settingsWithEnabledCapabilityMcpServers } from "./capabilities";
+import {
+  ConnectionAccountSelectionError,
+  freezeConnectionAccounts,
+  personalConnectionDelegationSourceForGrant,
+} from "./personal-connection-delegations";
+import { personalGitHubRepositoryResources } from "./resources";
+import {
+  sessionToolsForConnectionAccounts,
+  settingsWithSessionMcpServerMetadata,
+} from "./sessions";
+import { workspaceSessionToolPolicyDefaultServerIdsFor } from "./session-tool-policy";
+
+/** Freeze the authenticated request's eligible accounts before starting voice.
+ * The resulting lease snapshot, not a later participant or ambient connection,
+ * supplies authority to both live delegations and automatic transcript handoff. */
+export async function freezeSessionRealtimeConnectionAccounts(input: {
+  db: Database;
+  settings: Settings;
+  grant: AccessGrant;
+  workspaceId: string;
+  sessionId: string;
+}) {
+  const { db, settings, grant, workspaceId, sessionId } = input;
+  const session = await requireSession(db, workspaceId, sessionId);
+  const workspace = await requireWorkspace(db, workspaceId);
+  const capabilitySettings = await settingsWithEnabledCapabilityMcpServers(
+    db,
+    workspaceId,
+    settings,
+    {
+      subjectId: grant.subjectId,
+    },
+  );
+  const runtimeSettings = settingsWithSessionMcpServerMetadata(
+    capabilitySettings,
+    session.mcpServers,
+  );
+  const tools = sessionToolsForConnectionAccounts({
+    session,
+    runtimeMcpServers: runtimeSettings.mcpServers,
+    defaultMcpServerIds: workspaceSessionToolPolicyDefaultServerIdsFor(
+      capabilitySettings.mcpServers,
+      workspace.settings,
+    ),
+  });
+  const effectiveFirstPartyTools = resolveSessionFirstPartyMcpTools(
+    settings,
+    session,
+    workspace.settings,
+  );
+  return await freezeConnectionAccounts({
+    db,
+    settings: runtimeSettings,
+    accountId: grant.accountId,
+    workspaceId,
+    tools,
+    resources: session.resources,
+    source: personalConnectionDelegationSourceForGrant(grant),
+    targetSessionId: sessionId,
+    googleDrivePublicationEnabled:
+      effectiveFirstPartyTools.includes("editable_artifact_export") &&
+      effectiveFirstPartyTools.includes("editable_artifact_export_status") &&
+      (!session.firstPartyMcpPermissions?.length ||
+        (session.firstPartyMcpPermissions.includes("artifacts:read") &&
+          session.firstPartyMcpPermissions.includes("artifacts:publish"))),
+    atlassianEnabled:
+      effectiveFirstPartyTools.some((tool) => tool.startsWith("atlassian_")) &&
+      (!session.firstPartyMcpPermissions?.length ||
+        session.firstPartyMcpPermissions.includes("connections:read")),
+  });
+}
+
+/** One connector a continued turn runs without, and why. */
+export type ContinuedConnectionAccountGap = {
+  serverId: string;
+  /** The picked account that can no longer be used; null when none was picked. */
+  connectionId: string | null;
+  reason: string;
+};
+
+/**
+ * Accounts for a turn that continues earlier work in this session: a goal
+ * continuation, a wait wake-up, a command or child result, or informational
+ * input delivered into the person's last message. It resolves the carried
+ * intent exactly as that person's next message with the same picks would be
+ * resolved now, against the session's current connectors and the person's
+ * current accounts. Nothing from an earlier turn's accounts is copied.
+ *
+ * A picked account that can no longer be used is never replaced by another
+ * account: its connector is left out of this turn. The same applies to a
+ * connector whose account can no longer be chosen automatically (for example
+ * several accounts now match and none was picked). Every other connector is
+ * unaffected.
+ *
+ * `db` is the claim transaction, so every read runs one at a time.
+ */
+export async function resolveContinuedConnectionAccounts(input: {
+  db: Database;
+  settings: Settings;
+  accountId: string;
+  workspaceId: string;
+  sessionId: string;
+  intent: ConnectionAccountIntent;
+}): Promise<{
+  mcpAccountBindings: McpConnectionAccountBinding[] | null;
+  personalConnectionDelegations: McpPersonalConnectionDelegation[];
+  /** Connectors the turn runs without, because their account cannot be used. */
+  gaps: ContinuedConnectionAccountGap[];
+}> {
+  const { db, settings, accountId, workspaceId, sessionId, intent } = input;
+  const principalSubjectId =
+    intent.principal.kind === "subject" ? intent.principal.subjectId : null;
+  const session = await requireSession(db, workspaceId, sessionId);
+  const workspace = await requireWorkspace(db, workspaceId);
+  const capabilitySettings = await settingsWithEnabledCapabilityMcpServers(
+    db,
+    workspaceId,
+    settings,
+    principalSubjectId
+      ? { subjectId: principalSubjectId, oneReadAtATime: true }
+      : { oneReadAtATime: true },
+  );
+  const runtimeSettings = settingsWithSessionMcpServerMetadata(
+    capabilitySettings,
+    session.mcpServers,
+  );
+  let tools: ToolRef[] = sessionToolsForConnectionAccounts({
+    session,
+    runtimeMcpServers: runtimeSettings.mcpServers,
+    defaultMcpServerIds: workspaceSessionToolPolicyDefaultServerIdsFor(
+      capabilitySettings.mcpServers,
+      workspace.settings,
+    ),
+  });
+  const effectiveFirstPartyTools = resolveSessionFirstPartyMcpTools(
+    settings,
+    session,
+    workspace.settings,
+  );
+  let googleDrivePublicationEnabled =
+    effectiveFirstPartyTools.includes("editable_artifact_export") &&
+    effectiveFirstPartyTools.includes("editable_artifact_export_status") &&
+    (!session.firstPartyMcpPermissions?.length ||
+      (session.firstPartyMcpPermissions.includes("artifacts:read") &&
+        session.firstPartyMcpPermissions.includes("artifacts:publish")));
+  const atlassianEnabled =
+    effectiveFirstPartyTools.some((tool) => tool.startsWith("atlassian_")) &&
+    (!session.firstPartyMcpPermissions?.length ||
+      session.firstPartyMcpPermissions.includes("connections:read"));
+  const withoutPersonalRepositories = (from: ResourceRef[]) => {
+    const personal = new Set<ResourceRef>(personalGitHubRepositoryResources(from));
+    return from.filter((resource) => !personal.has(resource));
+  };
+  // Work without a person behind it never uses a personal repository grant.
+  let resources: ResourceRef[] = principalSubjectId
+    ? session.resources
+    : withoutPersonalRepositories(session.resources);
+  // A pick for a connector the session no longer uses does not apply.
+  const applies = (selection: McpConnectionAccountSelection) =>
+    selection.serverId === GOOGLE_DRIVE_PUBLICATION_SERVER_ID
+      ? googleDrivePublicationEnabled
+      : selection.serverId === PERSONAL_GITHUB_CONNECTION_SURFACE_ID
+        ? personalGitHubRepositoryResources(resources).length > 0
+        : tools.some((tool) => tool.kind === "mcp" && tool.id === selection.serverId);
+  let selections = intent.selections.filter(applies);
+  const gaps: ContinuedConnectionAccountGap[] = [];
+  // Each round removes at least one connector or pick, so this always ends.
+  for (let round = 0; ; round += 1) {
+    try {
+      const resolved = await freezeConnectionAccounts({
+        db,
+        accountId,
+        workspaceId,
+        settings: runtimeSettings,
+        tools,
+        resources,
+        source: principalSubjectId
+          ? { kind: "subject", subjectId: principalSubjectId, accountId }
+          : { kind: "none" },
+        targetSessionId: sessionId,
+        googleDrivePublicationEnabled,
+        atlassianEnabled,
+        authoritySelections: selections,
+      });
+      return {
+        mcpAccountBindings: resolved.mcpAccountBindings,
+        personalConnectionDelegations: resolved.personalConnectionDelegations,
+        gaps,
+      };
+    } catch (error) {
+      if (!(error instanceof ConnectionAccountSelectionError)) throw error;
+      const named = error.diagnostic.accounts.filter(
+        (account) =>
+          account.connectionId === null ||
+          selections.some(
+            (selection) =>
+              selection.serverId === account.serverId &&
+              selection.connectionId === account.connectionId,
+          ),
+      );
+      // The person lost access to this workspace: none of their picks can be used.
+      const unusable =
+        named.length > 0
+          ? named
+          : error.diagnostic.reason === "owner_access_unavailable"
+            ? selections.map((selection) => ({ ...selection, reason: error.diagnostic.reason }))
+            : [];
+      const dropped = new Set(unusable.map((account) => account.serverId));
+      if (dropped.size === 0 || round > intent.selections.length + tools.length + 2) throw error;
+      gaps.push(
+        ...unusable.map((account) => ({
+          serverId: account.serverId,
+          connectionId: account.connectionId,
+          reason: account.reason,
+        })),
+      );
+      selections = selections.filter((selection) => !dropped.has(selection.serverId));
+      tools = tools.filter((tool) => !(tool.kind === "mcp" && dropped.has(tool.id)));
+      if (dropped.has(GOOGLE_DRIVE_PUBLICATION_SERVER_ID)) googleDrivePublicationEnabled = false;
+      if (dropped.has(PERSONAL_GITHUB_CONNECTION_SURFACE_ID)) {
+        resources = withoutPersonalRepositories(resources);
+      }
+    }
+  }
+}

package/src/domain/session-file-access.ts

@@ -0,0 +1,47 @@
+import type { AccessGrant, FileAsset } from "@opengeni/contracts";
+import {
+  getSessionAuthorityProjection,
+  getFilesForSubject,
+  readSessionFileAttachments,
+  withSessionRlsActorContext,
+} from "@opengeni/db";
+import type { SessionAuthorizationDependencies } from "../session-authorization";
+import {
+  requireSessionAuthorization,
+  withResolvedSessionAuthorization,
+} from "../session-authorization";
+
+/** A session attachment grant is never a generic file/Knowledge grant. */
+export async function readSessionAttachmentFiles(
+  deps: SessionAuthorizationDependencies,
+  grant: AccessGrant,
+  sessionId: string,
+  fileIds: readonly string[],
+): Promise<FileAsset[]> {
+  const authority = await getSessionAuthorityProjection(deps.db, grant.workspaceId, sessionId);
+  if (!authority) return [];
+  const authorization = await requireSessionAuthorization(deps, grant, {
+    sessionId,
+    operation: "session.read",
+    surface: "core",
+  });
+  const ordinary = await getFilesForSubject(deps.db, {
+    accountId: grant.accountId,
+    workspaceId: grant.workspaceId,
+    subjectId: grant.subjectId,
+    fileIds,
+  });
+  const missing = fileIds.filter((id) => !ordinary.some((file) => file.id === id));
+  const actor = authorization?.actor ?? { kind: "subject" as const, subjectId: grant.subjectId };
+  const read = () =>
+    readSessionFileAttachments(deps.db, {
+      accountId: grant.accountId,
+      workspaceId: grant.workspaceId,
+      fileIds: missing,
+      access: { sessionId, authorityEpoch: authority.authorityEpoch, actor },
+    });
+  const shared = authorization
+    ? await withResolvedSessionAuthorization(authorization, read)
+    : await withSessionRlsActorContext({ subjectId: grant.subjectId }, read);
+  return [...ordinary, ...shared];
+}

package/src/domain/session-native-connection-replacement.ts

@@ -0,0 +1,64 @@
+import type { ConnectionMetadata, McpServerConnectionRef } from "@opengeni/contracts";
+import { connectionMetadataMatchesBinding } from "@opengeni/db/session-mcp-credential-rotation";
+
+/** Selection is restricted to the caller's already-authorized inventory. This
+ * projection grants no execution authority: subsequent admission and physical
+ * credential use still validate the exact native account normally. */
+export function nativeSessionConnectionReplacement(input: {
+  accountId: string;
+  workspaceId: string;
+  subjectId: string | null;
+  serverUrl: string;
+  replacementServerUrl?: string;
+  currentRef: McpServerConnectionRef | null;
+  nativeConnectionId: string;
+  connections: ConnectionMetadata[];
+}): McpServerConnectionRef {
+  const connection = input.connections.find(
+    (candidate) => candidate.id === input.nativeConnectionId,
+  );
+  if (
+    !connection ||
+    connection.accountId !== input.accountId ||
+    connection.status !== "active" ||
+    (connection.subjectId === null
+      ? connection.workspaceId !== input.workspaceId
+      : !input.subjectId || connection.subjectId !== input.subjectId || !connection.authorityId)
+  ) {
+    throw new Error("native connection unavailable");
+  }
+  const {
+    authoritySource: _authoritySource,
+    hostBinding: _hostBinding,
+    accountSelection: _accountSelection,
+    ...retained
+  } = input.currentRef ?? {};
+  // Preserve provider, resource, scope and selected-resource restrictions.
+  // Retired host identity is never interpreted as a native connection ID.
+  if (
+    input.currentRef &&
+    input.currentRef.providerDomain.toLowerCase() !== connection.providerDomain.toLowerCase()
+  )
+    throw new Error("native connection provider mismatch");
+  const ref: McpServerConnectionRef = {
+    ...retained,
+    ...(!input.currentRef?.resource && typeof connection.metadata.resource === "string"
+      ? { resource: connection.metadata.resource }
+      : {}),
+    connectionId: connection.id,
+    providerDomain: connection.providerDomain,
+    kind: connection.kind,
+    subjectScope: connection.subjectId === null ? "workspace" : "subject",
+  };
+  const destination = input.replacementServerUrl ?? input.serverUrl;
+  // A redirect must be explicitly requested and bound in the account metadata;
+  // the broker's legacy provider-host fallback is insufficient for rebinding.
+  if (
+    input.replacementServerUrl &&
+    (typeof connection.metadata.mcpUrl !== "string" || !connection.metadata.mcpUrl.trim())
+  )
+    throw new Error("native connection destination unavailable");
+  if (!connectionMetadataMatchesBinding(connection, ref, destination))
+    throw new Error("native connection binding mismatch");
+  return ref;
+}

package/src/domain/session-start-timing.ts

@@ -0,0 +1,60 @@
+import { withTraceContext, type Observability, type Span } from "@opengeni/observability";
+
+type SessionStartPhase =
+  | "workspace_read"
+  | "idempotent_replay"
+  | "model_catalog_initial"
+  | "default_model"
+  | "model_catalog_effective"
+  | "capability_settings"
+  | "resource_validation"
+  | "rig_binding"
+  | "model_admission"
+  | "connection_freeze"
+  | "initiator_freeze"
+  | "allowance"
+  | "shell_insert"
+  | "initialize"
+  | "event_fanout"
+  | "workflow_wake"
+  | "session_reload";
+export type SessionStartObservability = Pick<Observability, "startSpan">;
+
+/** Content-free child spans around existing work; export is never joined and
+ * diagnostic failures cannot alter the lifecycle or its exact error. */
+export async function measureSessionStartPhase<T>(
+  observability: SessionStartObservability | null | undefined,
+  phase: SessionStartPhase,
+  work: () => Promise<T>,
+): Promise<T> {
+  let span: Span | undefined;
+  try {
+    span = observability?.startSpan(`core.session_start.${phase}`);
+  } catch {
+    // An unhealthy observer is not session authority.
+  }
+  const end = (outcome: "completed" | "failed") => {
+    try {
+      void Promise.resolve(span?.end({ attributes: { outcome } })).catch(() => undefined);
+    } catch {
+      // Never leak diagnostic errors or user content through an error field.
+    }
+  };
+  try {
+    const result = span ? withTraceContext(span, work) : work();
+    if (!span) return result;
+    return result.then(
+      (value) => {
+        end("completed");
+        return value;
+      },
+      (error) => {
+        end("failed");
+        throw error;
+      },
+    );
+  } catch (error) {
+    end("failed");
+    throw error;
+  }
+}