@opengeni/core 3.0.1 → 3.1.2

package/src/domain/site-audience.ts

@@ -0,0 +1,130 @@
+import type { AccessGrant, WorkspaceArtifactVisibility } from "@opengeni/contracts";
+import {
+  getVisibleSessionTenancyVisibility,
+  scheduledTaskViewerSubject,
+  type Database,
+  type WorkspaceArtifactViewer,
+} from "@opengeni/db";
+import { HTTPException } from "hono/http-exception";
+import type { PrivacySettings } from "../application/organization-privacy";
+import { mayStartOnlyMe } from "./scheduled-task-audience";
+import { creationInitiatorForGrant } from "./sessions";
+
+/**
+ * A Site has an audience, like a chat and a schedule: the whole workspace, or
+ * only its owner ("Only me"). Everyone with workspace access sees workspace
+ * Sites. An Only me Site is visible to its owner alone; admins cannot see it,
+ * exactly like an Only me chat. Only the owner changes the audience.
+ *
+ * Every surface that reads or changes Sites (HTTP, agent tools, the artifact
+ * library, Site tools and Site conversations) resolves its viewer here and
+ * passes it to the database layer, which filters by it.
+ */
+
+export const SITE_PRIVATE_OWNER_MESSAGE = "Only a person can have an Only me Site.";
+export const SITE_PRIVATE_DISABLED_MESSAGE = "Only me is turned off for this organization.";
+export const SITE_AUDIENCE_HUMAN_MESSAGE =
+  "Only the Site's owner can change who can see it, from Opengeni.";
+
+/**
+ * The person a request reads Sites as: the human caller, or the human an exact
+ * agent attempt acts for. Keys, services and runs without a person see
+ * workspace Sites only.
+ */
+export async function siteViewerForGrant(
+  db: Database,
+  grant: AccessGrant,
+): Promise<WorkspaceArtifactViewer> {
+  const creator = creationInitiatorForGrant(grant);
+  const subjectId = await scheduledTaskViewerSubject(db, {
+    workspaceId: grant.workspaceId,
+    ...(creator.initiator ? { createdBy: creator.initiator } : {}),
+    ...(creator.context ? { createdByContext: creator.context } : {}),
+    createdByActor: creator.actor ?? null,
+  });
+  return { subjectId };
+}
+
+function stored(visibility: WorkspaceArtifactVisibility): "user_private" | "workspace_shared" {
+  return visibility === "private" ? "user_private" : "workspace_shared";
+}
+
+async function requireOnlyMeAllowed(input: {
+  db: Database;
+  settings: PrivacySettings;
+  workspaceId: string;
+  ownerSubjectId: string | null;
+}): Promise<string> {
+  if (!input.ownerSubjectId) throw new HTTPException(422, { message: SITE_PRIVATE_OWNER_MESSAGE });
+  if (!(await mayStartOnlyMe(input.db, input.settings, input.workspaceId, input.ownerSubjectId)))
+    throw new HTTPException(403, { message: SITE_PRIVATE_DISABLED_MESSAGE });
+  return input.ownerSubjectId;
+}
+
+/**
+ * The audience and owner to store for a new Site. An explicit choice wins;
+ * Only me needs a person who may start Only me work here. Without one, a Site
+ * published from a chat starts with that chat's audience, so a Site made in an
+ * Only me chat stays Only me until its owner shares it. Anything else starts
+ * shared with the workspace, as every Site did before audiences existed.
+ */
+export async function resolveNewSiteAudience(input: {
+  db: Database;
+  settings: PrivacySettings;
+  grant: AccessGrant;
+  viewer: WorkspaceArtifactViewer;
+  requested: WorkspaceArtifactVisibility | undefined;
+  sourceSessionId: string | null;
+}): Promise<{
+  visibility: "user_private" | "workspace_shared";
+  ownerSubjectId: string | null;
+}> {
+  const ownerSubjectId = input.viewer.subjectId;
+  if (input.requested === "private") {
+    await requireOnlyMeAllowed({
+      db: input.db,
+      settings: input.settings,
+      workspaceId: input.grant.workspaceId,
+      ownerSubjectId,
+    });
+    return { visibility: "user_private", ownerSubjectId };
+  }
+  if (input.requested === "workspace" || input.sourceSessionId === null || !ownerSubjectId)
+    return { visibility: "workspace_shared", ownerSubjectId };
+  // The chat already is Only me, so this narrows nothing and needs no fresh
+  // permission, like an existing Only me item when Only me is later turned off.
+  const chat = await getVisibleSessionTenancyVisibility(
+    input.db,
+    input.grant.workspaceId,
+    input.sourceSessionId,
+  );
+  return {
+    visibility: chat === "user_private" ? "user_private" : "workspace_shared",
+    ownerSubjectId,
+  };
+}
+
+/**
+ * The stored audience for an owner's change. Sharing with the workspace is
+ * always allowed; limiting to Only me needs Only me to be allowed for them.
+ * Whether the caller owns the Site is checked atomically by the database.
+ */
+export async function resolveSiteAudienceChange(input: {
+  db: Database;
+  settings: PrivacySettings;
+  grant: AccessGrant;
+  viewer: WorkspaceArtifactViewer;
+  requested: WorkspaceArtifactVisibility;
+}): Promise<"user_private" | "workspace_shared"> {
+  // Like a chat's audience, this is a person's own decision, not an agent's.
+  if (input.grant.principalKind === "agent_attempt")
+    throw new HTTPException(403, { message: SITE_AUDIENCE_HUMAN_MESSAGE });
+  if (input.requested === "private")
+    await requireOnlyMeAllowed({
+      db: input.db,
+      settings: input.settings,
+      workspaceId: input.grant.workspaceId,
+      ownerSubjectId: input.viewer.subjectId,
+    });
+  return stored(input.requested);
+}

package/src/domain/skills.ts

@@ -3,6 +3,7 @@ import type {
   SkillInstallInput,
   SkillRevisionInput,
   SkillSaveInput,
+  SkillRemoveInput,
 } from "@opengeni/contracts";
 import { validateSkillTextFiles } from "@opengeni/contracts";
 import { buildPortableSkillArtifact } from "@opengeni/runtime/skill-library";
@@ -30,6 +31,14 @@ export function skillBundleHash(files: readonly SkillFile[]): string {
 }
 
 export const listSkills = listSkillRecords;
+export async function removeSkill(db: Database, input: SkillRemoveInput) {
+  const { accountId, workspaceId, actor, ...request } = input;
+  return applySkillLifecycle(
+    db,
+    { accountId, workspaceId, actor },
+    { ...request, operation: "remove" },
+  );
+}
 export async function readSkill(
   db: Database,
   context: SkillReadContext,

package/src/domain/slack-bot.ts

@@ -3,19 +3,26 @@ import {
   OPENGENI_SLACK_BOT_CREDENTIAL_ROLE,
   OPENGENI_SLACK_BOT_SESSION_METADATA_KEY,
   OpenGeniSlackBotConnectionMetadata,
+  SCHEDULED_SLACK_BOT_POSTING_TOOLS,
   areOpenGeniSlackBotScopesAccepted,
   type AccessGrant,
   type ConnectionMetadata,
+  type FirstPartyMcpToolName,
   type OpenGeniSlackBotConnectionMetadata as OpenGeniSlackBotMetadata,
+  type ScheduledTask,
+  type ScheduledTaskAgentConfig,
   type Session,
 } from "@opengeni/contracts";
 import {
   getConnectionMetadata,
+  availableSlackBotConnectionMetadata,
+  requireWorkspace,
   type ConnectionMetadataWithVerification,
   type Database,
 } from "@opengeni/db";
 import { HTTPException } from "hono/http-exception";
-import { requirePermission } from "../access";
+import { requirePermission, type AccessGrantAuthorization } from "../access";
+import { grantHasAgentAttemptAuthority } from "../session-authorization";
 
 export function openGeniSlackBotMetadata(
   metadata: Record<string, unknown>,
@@ -69,15 +76,22 @@ export async function requireOpenGeniSlackBotConnection(
   workspaceId: string,
   connectionId: string,
 ): Promise<ConnectionMetadata> {
-  const connection = await getConnectionMetadata(db, workspaceId, connectionId, null);
+  const local = await getConnectionMetadata(db, workspaceId, connectionId, null);
+  const workspace = await requireWorkspace(db, workspaceId);
+  const connection =
+    local ??
+    (
+      await availableSlackBotConnectionMetadata(db, { accountId: workspace.accountId, workspaceId })
+    ).find((candidate) => candidate.id === connectionId) ??
+    null;
   if (!connection || !isOpenGeniSlackBotConnection(connection)) {
     throw new HTTPException(422, {
-      message: "slackBotConnectionId must reference an OpenGeni Slack bot connection",
+      message: "slackBotConnectionId must reference an Opengeni Slack bot connection",
     });
   }
   if (connection.status !== "active") {
     throw new HTTPException(422, {
-      message: `OpenGeni Slack bot connection is not active (${connection.status})`,
+      message: `Opengeni Slack bot connection is not active (${connection.status})`,
     });
   }
   return connection;
@@ -126,3 +140,126 @@ export function isTrustedScheduledSlackBotSession(
 function zUuid(value: string): boolean {
   return /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value);
 }
+
+/**
+ * Proves, with the bot's own token, that it may post in the chosen channel:
+ * the bot is a member and the channel is active and not shared with another
+ * organization. Supplied only by the HTTP routes a person uses to edit tasks.
+ */
+export type ScheduledTaskSlackChannelVerifier = (input: {
+  connectionId: string;
+  channelId: string;
+}) => Promise<void>;
+
+/**
+ * Whether this request is a signed-in person acting for themselves: never an
+ * agent attempt, a service, an API key, or a request carrying service
+ * provenance. The same rule gates Agent learning settings.
+ */
+export function isAuthenticatedPersonAuthorization(
+  authorization: AccessGrantAuthorization | undefined,
+): boolean {
+  if (!authorization) return false;
+  const { grant } = authorization;
+  return (
+    grant.principalKind === "human_session" &&
+    authorization.contextIntegrity &&
+    authorization.authenticatedSubjectId === grant.subjectId &&
+    !grant.serviceInitiator &&
+    !grant.serviceInitiatorContext &&
+    grant.metadata?.attemptId === undefined &&
+    grant.metadata?.turnId === undefined &&
+    grant.metadata?.executionGeneration === undefined &&
+    !grantHasAgentAttemptAuthority(grant)
+  );
+}
+
+/**
+ * A scheduled task may post as the Opengeni workspace bot only to the one
+ * Slack channel a person chose on the task. Choosing or changing that channel
+ * therefore needs a signed-in person with `connections:write`, and the bot's
+ * membership is verified at that moment. Keeping or clearing the existing
+ * channel needs neither, so an agent editing other task fields cannot redirect
+ * posts but also does not have to re-prove the person's choice. Clearing is the
+ * safe direction and is never refused, even for a task that continues one chat.
+ */
+export async function validateScheduledTaskSlackChannel(input: {
+  grant: AccessGrant;
+  authorization?: AccessGrantAuthorization | undefined;
+  previous: Pick<ScheduledTaskAgentConfig, "slackBotConnectionId" | "slackBotChannelId"> | null;
+  next: Pick<ScheduledTaskAgentConfig, "slackBotConnectionId" | "slackBotChannelId">;
+  runMode: ScheduledTask["runMode"];
+  /**
+   * Null unless the task already created the reusable chat its runs continue.
+   * Otherwise reports whether that chat was created with the posting tools,
+   * which are fixed at creation.
+   */
+  reusableSessionCanPost: (() => Promise<boolean>) | null;
+  verifySlackChannel?: ScheduledTaskSlackChannelVerifier | undefined;
+}): Promise<void> {
+  const previousChannel = input.previous?.slackBotChannelId ?? null;
+  const nextChannel = input.next.slackBotChannelId ?? null;
+  // Clearing takes effect at once: the tools re-read the task and refuse.
+  if (!nextChannel) return;
+  if (!input.next.slackBotConnectionId) {
+    throw new HTTPException(422, {
+      message: "slackBotChannelId requires slackBotConnectionId",
+    });
+  }
+  if (input.runMode === "existing_session") {
+    throw new HTTPException(422, {
+      message: "Slack channel posting needs a task that starts its own chats",
+    });
+  }
+  if (
+    previousChannel === nextChannel &&
+    (input.previous?.slackBotConnectionId ?? null) === input.next.slackBotConnectionId
+  ) {
+    return;
+  }
+  if (!isAuthenticatedPersonAuthorization(input.authorization)) {
+    throw new HTTPException(403, {
+      message: "Only a person can choose the Slack channel a scheduled task posts to",
+    });
+  }
+  requirePermission(input.grant, "connections:write");
+  // A chat created without the posting tools keeps that tool set, so choosing
+  // a channel for it would silently post nothing.
+  if (input.reusableSessionCanPost && !(await input.reusableSessionCanPost())) {
+    throw new HTTPException(409, {
+      message:
+        "this task continues a chat that was created without Slack posting; recreate the task to post from it",
+    });
+  }
+  if (!input.verifySlackChannel) {
+    throw new HTTPException(422, {
+      message: "Choose the Slack channel in the schedule editor",
+    });
+  }
+  await input.verifySlackChannel({
+    connectionId: input.next.slackBotConnectionId,
+    channelId: nextChannel,
+  });
+}
+
+/**
+ * Add the bot posting tools to a generated scheduled run when, and only when,
+ * a person chose the task's Slack channel. The deployment ceiling still
+ * applies: an operator who disallowed these tools keeps them off.
+ */
+export function withScheduledSlackBotPostingTools(
+  tools: readonly FirstPartyMcpToolName[],
+  agentConfig: Pick<ScheduledTaskAgentConfig, "slackBotConnectionId" | "slackBotChannelId">,
+  allowedTools: readonly FirstPartyMcpToolName[],
+): FirstPartyMcpToolName[] {
+  const posting = new Set<FirstPartyMcpToolName>(SCHEDULED_SLACK_BOT_POSTING_TOOLS);
+  // Ordinary-chat defaults include these tools, but an unattended occurrence
+  // must have its own person-chosen destination before receiving them.
+  const next = tools.filter((tool) => !posting.has(tool));
+  if (!agentConfig.slackBotConnectionId || !agentConfig.slackBotChannelId) return next;
+  const allowed = new Set(allowedTools);
+  for (const tool of SCHEDULED_SLACK_BOT_POSTING_TOOLS) {
+    if (allowed.has(tool) && !next.includes(tool)) next.push(tool);
+  }
+  return next;
+}

package/src/domain/slack-publication-secret-safety.ts

@@ -19,7 +19,7 @@ const CREDENTIAL_URL_PATTERN = /\b([a-z][a-z0-9+.-]*:\/\/[^:\s/@]+:)[^@\s/]+@/gi
  * Deterministic, sink-local protection for text that is about to be persisted
  * as a Slack publication projection or rendered to Slack. It intentionally
  * does not scan or mutate canonical Memory, durable-learning receipts, model
- * context, history, events, or any other internal OpenGeni content path.
+ * context, history, events, or any other internal Opengeni content path.
  */
 export function sanitizeSlackPublicationText(value: string): string {
   let sanitized = value;

package/src/domain/vaults/index.ts

@@ -0,0 +1,19 @@
+/** Vaults and secret references: the only import point for the vault domain. */
+export { buildMissingSecretAskCard } from "@opengeni/contracts";
+export { isVaultError, VaultError, vaultErrorFromDatabase } from "@opengeni/db";
+export {
+  toVaultItem,
+  toVaultItemSummary,
+  toVaultSummary,
+  vaultCanManage,
+  vaultCanWrite,
+  vaultItemReferences,
+  type VaultCallerAuthority,
+} from "./mapping";
+export {
+  chooseSecretCandidate,
+  createSecretResolver,
+  type SecretResolverOptions,
+} from "./secret-resolver";
+export type { VaultRequestActor, VaultServiceDeps } from "./types";
+export { createVaultService, vaultActorIsApiKey, type VaultService } from "./vault-service";

package/src/domain/vaults/mapping.ts

@@ -0,0 +1,190 @@
+/**
+ * Vault rows (encrypted, as the 0739 routines return them) to the public
+ * contract shapes. Only text-kind field values are decrypted for display;
+ * every other kind stays server-side until an audited reveal or a resolve.
+ */
+import {
+  formatSecretReference,
+  secretNameKey,
+  type VaultItem,
+  type VaultItemField,
+  type VaultItemReferences,
+  type VaultItemSummary,
+  type VaultSummary,
+} from "@opengeni/contracts";
+import {
+  decryptEnvironmentValue,
+  type VaultFieldRow,
+  type VaultItemRow,
+  type VaultRow,
+} from "@opengeni/db";
+
+/** What the caller may do beyond reading; decided by the route's grant. */
+export type VaultCallerAuthority = {
+  /** `secrets:write` */
+  write: boolean;
+  /** `account:admin` on the organization */
+  accountAdmin: boolean;
+};
+
+export function vaultCanWrite(row: VaultRow, authority: VaultCallerAuthority): boolean {
+  // Read-write connected vaults are edited through their provider (W5, OP-3).
+  if (row.mode !== "read_write" || !authority.write) return false;
+  if (row.ownerKind === "user") return row.ownedByCaller;
+  return true;
+}
+
+export function vaultCanManage(row: VaultRow, authority: VaultCallerAuthority): boolean {
+  switch (row.ownerKind) {
+    case "task":
+      return false;
+    case "organization":
+      return authority.accountAdmin;
+    case "user":
+      return row.ownedByCaller && authority.write;
+    case "workspace":
+      return authority.write;
+  }
+}
+
+export function toVaultSummary(row: VaultRow, authority: VaultCallerAuthority): VaultSummary {
+  return {
+    id: row.id,
+    workspaceId: row.workspaceId,
+    ownerKind: row.ownerKind,
+    ownerLabel: row.ownerLabel ?? "",
+    rootSessionId: row.rootSessionId,
+    name: row.name,
+    description: row.description,
+    source: row.source,
+    mode: row.mode,
+    syncStatus: row.syncStatus,
+    syncErrorCode: row.syncErrorCode,
+    syncErrorMessage: row.syncErrorMessage,
+    lastSyncedAt: row.lastSyncedAt,
+    rateLimitedUntil: row.rateLimitedUntil,
+    providerConnectionId: row.providerConnectionId,
+    availability: row.availability,
+    isDefault: row.isDefault,
+    itemCount: Number(row.itemCount),
+    canWrite: vaultCanWrite(row, authority),
+    canManage: vaultCanManage(row, authority),
+    generation: Number(row.generation),
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt,
+  };
+}
+
+function decryptOrNull(key: Uint8Array | null, stored: string | null): string | null {
+  if (stored === null || key === null) return null;
+  try {
+    return decryptEnvironmentValue(key, stored);
+  } catch {
+    return null;
+  }
+}
+
+/** A reference string, falling back to the ID form when a name cannot be referenced. */
+function referenceFor(
+  item: Pick<VaultItemRow, "id" | "name" | "vaultName">,
+  field: string | undefined,
+  otp = false,
+): string {
+  const tail = { ...(field !== undefined ? { field } : {}), otp };
+  try {
+    return formatSecretReference({ vault: item.vaultName, item: item.name, ...tail });
+  } catch {
+    return formatSecretReference({ itemId: item.id, ...tail });
+  }
+}
+
+/**
+ * Ready references for an item. Every reference names the vault and the field
+ * (`{{secret:Vault/Item/field}}`), so it cannot become ambiguous when another
+ * reachable vault gains an item with the same name.
+ */
+export function vaultItemReferences(
+  item: Pick<VaultItemRow, "id" | "name" | "vaultName" | "fields" | "primaryFieldId">,
+): VaultItemReferences {
+  const byField: Record<string, string> = {};
+  for (const field of item.fields) byField[field.name] = referenceFor(item, field.name);
+  const primary = item.fields.find((field) => field.id === item.primaryFieldId);
+  const totp = item.fields.find((field) => field.kind === "totp");
+  return {
+    primary: primary ? byField[primary.name]! : null,
+    otp: totp ? referenceFor(item, totp.name, true) : null,
+    byField,
+  };
+}
+
+function usernameOf(row: VaultItemRow, key: Uint8Array | null): string | null {
+  const field = row.fields.find(
+    (candidate) => candidate.kind === "text" && secretNameKey(candidate.name) === "username",
+  );
+  return field ? decryptOrNull(key, field.valueEncrypted) : null;
+}
+
+export function toVaultItemSummary(row: VaultItemRow, key: Uint8Array | null): VaultItemSummary {
+  return {
+    id: row.id,
+    vaultId: row.vaultId,
+    type: row.type,
+    name: row.name,
+    websites: row.websites ?? [],
+    username: usernameOf(row, key),
+    hasTotp: row.fields.some((field) => field.kind === "totp"),
+    hasPasskey: row.type === "passkey",
+    expiresAt: row.expiresAt,
+    archivedAt: row.archivedAt,
+    lastUsedAt: row.lastUsedAt,
+    updatedAt: row.updatedAt,
+    references: vaultItemReferences(row),
+  };
+}
+
+function toVaultItemField(
+  item: VaultItemRow,
+  field: VaultFieldRow,
+  key: Uint8Array | null,
+): VaultItemField {
+  return {
+    id: field.id,
+    name: field.name,
+    kind: field.kind,
+    position: field.position,
+    currentVersion: field.currentVersion,
+    value: field.kind === "text" ? decryptOrNull(key, field.valueEncrypted) : null,
+    fileName: field.fileName,
+    fileSize: field.fileSize,
+    reference: referenceFor(item, field.name),
+    updatedAt: field.updatedAt,
+  };
+}
+
+export function toVaultItem(row: VaultItemRow, key: Uint8Array | null): VaultItem {
+  const textField = (name: string) => {
+    const field = row.fields.find((candidate) => secretNameKey(candidate.name) === name);
+    return field ? decryptOrNull(key, field.valueEncrypted) : null;
+  };
+  const credentialId = row.type === "passkey" ? (textField("credentialid") ?? "") : "";
+  return {
+    ...toVaultItemSummary(row, key),
+    fields: row.fields.map((field) => toVaultItemField(row, field, key)),
+    passkey:
+      row.type === "passkey"
+        ? {
+            rpId: textField("rpid") ?? "",
+            userName: textField("username"),
+            credentialIdSuffix: credentialId.slice(-8),
+            signCount: Number(row.passkeySignCount ?? 0),
+            leasedUntil: row.passkeyLeasedUntil,
+            lastUsedAt: row.lastUsedAt,
+          }
+        : null,
+    aliases: row.aliases ?? [],
+    primaryFieldId: row.primaryFieldId,
+    createdBySubjectId: row.createdBySubjectId,
+    createdAt: row.createdAt,
+    generation: Number(row.generation),
+  };
+}