@opengeni/core 3.3.0 → 3.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/core",
-  "version": "3.3.0",
+  "version": "3.4.0",
   "description": "Opengeni framework-agnostic core: the domain, access, and billing layers (neutral access, off-HTTP V2 surface). Behavior-preserving extraction from apps/api — keeps Hono's HTTPException for error throwing (typed-errors cleanup deferred).",
   "license": "Apache-2.0",
   "repository": {
@@ -50,18 +50,18 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/capabilities": "3.3.0",
-    "@opengeni/codex": "3.3.0",
-    "@opengeni/config": "3.3.0",
-    "@opengeni/contracts": "3.3.0",
-    "@opengeni/db": "3.3.0",
-    "@opengeni/documents": "3.3.0",
-    "@opengeni/events": "3.3.0",
-    "@opengeni/network": "3.3.0",
-    "@opengeni/observability": "3.3.0",
-    "@opengeni/runtime": "3.3.0",
-    "@opengeni/storage": "3.3.0",
-    "@opengeni/vaults": "3.3.0",
+    "@opengeni/capabilities": "3.4.0",
+    "@opengeni/codex": "3.4.0",
+    "@opengeni/config": "3.4.0",
+    "@opengeni/contracts": "3.4.0",
+    "@opengeni/db": "3.4.0",
+    "@opengeni/documents": "3.4.0",
+    "@opengeni/events": "3.4.0",
+    "@opengeni/network": "3.4.0",
+    "@opengeni/observability": "3.4.0",
+    "@opengeni/runtime": "3.4.0",
+    "@opengeni/storage": "3.4.0",
+    "@opengeni/vaults": "3.4.0",
     "hono": "^4.12.18",
     "zod": "^4.2.1"
   },

package/src/domain/capabilities.ts

@@ -43,6 +43,7 @@ import {
   getCapabilityCatalogItem,
   getCapabilityInstallation,
   getConnectionMetadata,
+  isTransactionHandle,
   readCodexCutoverDisposition,
   resolveSubscriptionCoreCodexAppsDesignation,
   rlsContextForWorkspace,
@@ -93,6 +94,28 @@ export async function buildCapabilityCatalog(input: {
   /** The workspace's organization, when the caller knows it (skips a lookup). */
   accountId?: string;
 }): Promise<CapabilityCatalogResponse> {
+  // Scoped readers use savepoints and transaction-local actor settings. They
+  // must not overlap on a caller's transaction: one reader can otherwise
+  // restore another reader's subject instead of the enclosing caller's.
+  // Independent pool reads keep their existing parallel execution.
+  const serial = isTransactionHandle(input.db);
+  const reads = [
+    () => listCapabilityCatalogItems(input.db, input.workspaceId),
+    () => listCapabilityInstallations(input.db, input.workspaceId),
+    () => listSocialConnections(input.db, input.workspaceId, 500, input.subjectId),
+    () => listConnectionsMetadata(input.db, input.workspaceId, null),
+    () => discoverCuratedSkillLibraryItems(),
+    () => listInstalledSkills(input.db, input.workspaceId),
+    () =>
+      input.settings.codexConnectedAppsEnabled
+        ? resolveCodexAppsDesignationForRun(
+            input.db,
+            input.workspaceId,
+            input.accountId ? { accountId: input.accountId } : {},
+          )
+        : Promise.resolve(null),
+    () => listEnabledMcpCapabilityServers(input.db, input.workspaceId),
+  ] as const;
   const [
     persistedItems,
     capabilityInstallations,
@@ -102,22 +125,27 @@ export async function buildCapabilityCatalog(input: {
     installedSkills,
     codexAppsDesignation,
     runnableMcpServers,
-  ] = await Promise.all([
-    listCapabilityCatalogItems(input.db, input.workspaceId),
-    listCapabilityInstallations(input.db, input.workspaceId),
-    listSocialConnections(input.db, input.workspaceId, 500, input.subjectId),
-    listConnectionsMetadata(input.db, input.workspaceId, null),
-    discoverCuratedSkillLibraryItems(),
-    listInstalledSkills(input.db, input.workspaceId),
-    input.settings.codexConnectedAppsEnabled
-      ? resolveCodexAppsDesignationForRun(
-          input.db,
-          input.workspaceId,
-          input.accountId ? { accountId: input.accountId } : {},
-        )
-      : Promise.resolve(null),
-    listEnabledMcpCapabilityServers(input.db, input.workspaceId),
-  ]);
+  ] = serial
+    ? ([
+        await reads[0](),
+        await reads[1](),
+        await reads[2](),
+        await reads[3](),
+        await reads[4](),
+        await reads[5](),
+        await reads[6](),
+        await reads[7](),
+      ] as const)
+    : await Promise.all([
+        reads[0](),
+        reads[1](),
+        reads[2](),
+        reads[3](),
+        reads[4](),
+        reads[5](),
+        reads[6](),
+        reads[7](),
+      ]);
   const runnableCapabilityIds = new Set(runnableMcpServers.map((server) => server.capabilityId));
   const operatorOAuthClientConfigured = operatorOAuthClientResolver(input.settings);
   const catalogInstallations = capabilityInstallations.filter(

package/src/domain/session-tool-policy.ts

@@ -589,6 +589,9 @@ export function sessionEffectiveToolProjectionInput(
     "request_human_input",
     "list_models",
     ...webSearchPlan.providerTools,
+    // Interaction entry tools stay visible even with progressive disclosure;
+    // the remaining authorized family tools are disclosed after opening.
+    ...firstPartyMcpTools.filter((name) => name === "browser_open" || name === "computer_open"),
     ...(toolRefs.some((ref) => ref.id === "opengeni" && ref.eager === true) ||
     !progressiveDisclosure
       ? firstPartyMcpTools.filter((name) => !interactionNames.has(name) || !progressiveDisclosure)

package/src/session-authorization.ts

@@ -15,13 +15,11 @@ import { AsyncLocalStorage } from "node:async_hooks";
 import {
   currentSessionRlsActorIdentityKey,
   currentSiteViewerRlsContext,
-  getSessionAuthorityProjection,
-  getSessionAuthorizationTargetProjection,
   getSession,
-  getSessionTurnForAttempt,
-  getSlackInteractionSessionAccessForSession,
+  getSessionAuthorizationFacts,
   withSessionRlsActorContext,
   type Database,
+  type SessionAuthorizationFacts,
   type SessionRlsActorContext,
 } from "@opengeni/db";
 import type { AppDependencies } from "./dependencies";
@@ -200,10 +198,6 @@ export function agentAccessListScopeForViewer(
   };
 }
 
-type ResolvedSessionAuthorizationTarget = {
-  target: SessionAuthorizationTarget;
-};
-
 /**
  * Whether a grant acts with live agent-attempt authority: an explicit
  * `agent_attempt` principal kind, or (for legacy tokens without one) any
@@ -261,7 +255,11 @@ export async function requireLiveAgentAttemptAuthorization(
   callerSessionId: string,
 ): Promise<Extract<SessionAuthorizationActor, { kind: "agent_attempt" }>> {
   const reads = claimSessionAuthorizationReads();
-  const { actor } = await resolveSessionAuthorizationActor(db, grant, reads);
+  const claims = agentAttemptClaims(grant);
+  const facts = claims
+    ? await readSessionAuthorizationFacts(db, grant, claims.callerSessionId, claims, reads)
+    : null;
+  const { actor } = resolveSessionAuthorizationActor(grant, claims, facts);
   if (actor.kind !== "agent_attempt" || actor.callerSessionId !== callerSessionId) {
     throw new SessionAuthorizationDeniedError("caller_stale");
   }
@@ -291,18 +289,13 @@ export async function requireSessionAuthorization(
   const reads = claimSessionAuthorizationReads();
   const port = deps.sessionAuthorization;
   const isAgentAttempt = grantHasAgentAttemptAuthority(grant);
-  // Callers can supply a transaction handle. Both reads open nested RLS
-  // savepoints, which must not race on the same PostgreSQL connection.
-  const slackAccess = await getSlackInteractionSessionAccessForSession(deps.db, {
-    accountId: grant.accountId,
-    workspaceId: grant.workspaceId,
-    sessionId: input.sessionId,
-  });
-  const authority = await getSessionAuthorityProjection(
-    deps.db,
-    grant.workspaceId,
-    input.sessionId,
-  );
+  const claims = agentAttemptClaims(grant);
+  // One scoped read returns the target's authority, its Slack ownership and,
+  // for an agent attempt, the caller session and its live turn. Every check
+  // below decides from these facts; none of them reads again.
+  const facts = await readSessionAuthorizationFacts(deps.db, grant, input.sessionId, claims, reads);
+  const authority = facts.target;
+  const slackAccess = authority?.slackAccess ?? null;
 
   // The projection is read under the caller's own RLS context, so a missing
   // session and one the caller may not see (another member's private session)
@@ -318,8 +311,7 @@ export async function requireSessionAuthorization(
   // databases. The request-local viewer proof is never taken from Site JSON.
   if (authority?.siteAccessRootId) {
     const viewer = currentSiteViewerRlsContext();
-    const resolved = await resolveSessionAuthorizationActor(deps.db, grant, reads);
-    const actor = resolved.actor;
+    const actor = resolveSessionAuthorizationActor(grant, claims, facts).actor;
     const allowed =
       actor.kind === "agent_attempt"
         ? (authority.siteOwnerSubjectId !== null &&
@@ -356,15 +348,15 @@ export async function requireSessionAuthorization(
   }
   if (!authority) throw new SessionAuthorizationDeniedError("not_found");
 
-  const resolvedActor = await resolveSessionAuthorizationActor(deps.db, grant, reads);
-  const resolvedTarget = await resolveSessionAuthorizationTarget(
-    deps.db,
-    grant,
-    input.sessionId,
-    reads,
-  );
+  const resolvedActor = resolveSessionAuthorizationActor(grant, claims, facts);
+  if (authority.accountId !== grant.accountId) {
+    throw new SessionAuthorizationDeniedError("not_found");
+  }
   const actor = resolvedActor.actor;
-  const target = resolvedTarget.target;
+  const target: SessionAuthorizationTarget = {
+    sessionId: authority.sessionId,
+    rootSessionId: authority.rootSessionId,
+  };
   const agentRelatedSessionAccess =
     actor.kind === "agent_attempt"
       ? relatedSessionAccessForAgentAttempt(actor, target.sessionId)
@@ -483,7 +475,11 @@ export async function requireSessionAuthorizationListScope(
   const port = deps.sessionAuthorization;
   const isAgentAttempt = grantHasAgentAttemptAuthority(grant);
   if (!port && !isAgentAttempt) return null;
-  const { actor, callerAccess } = await resolveSessionAuthorizationActor(deps.db, grant, reads);
+  const claims = agentAttemptClaims(grant);
+  const facts = claims
+    ? await readSessionAuthorizationFacts(deps.db, grant, claims.callerSessionId, claims, reads)
+    : null;
+  const { actor, callerAccess } = resolveSessionAuthorizationActor(grant, claims, facts);
   // Standalone agents retain compact workspace discovery only while the signed
   // caller attempt is still the exact live attempt, and only within their own
   // declared agent-access reach (migration 0427). The viewer is derived from
@@ -525,36 +521,72 @@ export async function requireSessionAuthorizationListScope(
   return viewer ? agentAccessListScopeForViewer(viewer, hostScope) : hostScope;
 }
 
-async function resolveSessionAuthorizationTarget(
+type AgentAttemptClaims = {
+  callerSessionId: string;
+  turnId: string;
+  attemptId: string;
+  executionGeneration: number;
+};
+
+/**
+ * The signed attempt claims of an agent-attempt grant, or null for any other
+ * principal and for malformed claims (which the actor check then refuses).
+ */
+function agentAttemptClaims(grant: AccessGrant): AgentAttemptClaims | null {
+  if (!grantHasAgentAttemptAuthority(grant)) return null;
+  const callerSessionId = grant.metadata?.["sessionId"];
+  const turnId = grant.metadata?.["turnId"];
+  const attemptId = grant.metadata?.["attemptId"];
+  const executionGeneration = grant.metadata?.["executionGeneration"];
+  if (
+    typeof callerSessionId !== "string" ||
+    typeof turnId !== "string" ||
+    typeof attemptId !== "string" ||
+    typeof executionGeneration !== "number" ||
+    !Number.isSafeInteger(executionGeneration) ||
+    executionGeneration < 1
+  ) {
+    return null;
+  }
+  return { callerSessionId, turnId, attemptId, executionGeneration };
+}
+
+async function readSessionAuthorizationFacts(
   db: Database,
   grant: AccessGrant,
   sessionId: string,
+  claims: AgentAttemptClaims | null,
   reads: SessionAuthorizationReads | null,
-): Promise<ResolvedSessionAuthorizationTarget> {
-  const session = await reusableAuthorizationRead(
+): Promise<SessionAuthorizationFacts> {
+  return await reusableAuthorizationRead(
     reads,
     db,
-    ["target-identity", grant.workspaceId, sessionId],
-    () => getSessionAuthorizationTargetProjection(db, grant.workspaceId, sessionId),
+    [
+      "authorization-facts",
+      grant.accountId,
+      grant.workspaceId,
+      sessionId,
+      claims?.callerSessionId ?? "",
+      claims?.attemptId ?? "",
+    ],
+    () =>
+      getSessionAuthorizationFacts(db, {
+        accountId: grant.accountId,
+        workspaceId: grant.workspaceId,
+        sessionId,
+        caller: claims
+          ? { sessionId: claims.callerSessionId, attemptId: claims.attemptId }
+          : undefined,
+      }),
   );
-  if (!session || session.accountId !== grant.accountId) {
-    throw new SessionAuthorizationDeniedError("not_found");
-  }
-  return {
-    target: { sessionId: session.id, rootSessionId: session.rootSessionId },
-  };
 }
-async function resolveSessionAuthorizationActor(
-  db: Database,
+
+function resolveSessionAuthorizationActor(
   grant: AccessGrant,
-  reads: SessionAuthorizationReads | null,
-): Promise<ResolvedSessionAuthorizationActor> {
-  const callerSessionId = grant.metadata?.["sessionId"];
-  const turnId = grant.metadata?.["turnId"];
-  const attemptId = grant.metadata?.["attemptId"];
-  const executionGeneration = grant.metadata?.["executionGeneration"];
-  const isAgentAttempt = grantHasAgentAttemptAuthority(grant);
-  if (!isAgentAttempt) {
+  claims: AgentAttemptClaims | null,
+  facts: SessionAuthorizationFacts | null,
+): ResolvedSessionAuthorizationActor {
+  if (!grantHasAgentAttemptAuthority(grant)) {
     return {
       actor: SessionAuthorizationActor.parse({
         kind: "subject",
@@ -565,36 +597,15 @@ async function resolveSessionAuthorizationActor(
       callerAccess: null,
     };
   }
+  const callerSession = facts?.caller?.session ?? null;
+  const turn = facts?.caller?.turn ?? null;
   if (
-    typeof callerSessionId !== "string" ||
-    typeof turnId !== "string" ||
-    typeof attemptId !== "string" ||
-    typeof executionGeneration !== "number" ||
-    !Number.isSafeInteger(executionGeneration) ||
-    executionGeneration < 1
-  ) {
-    throw new SessionAuthorizationDeniedError("caller_stale");
-  }
-  // These scoped reads can also open nested savepoints on a transaction handle.
-  const callerSession = await reusableAuthorizationRead(
-    reads,
-    db,
-    ["session", grant.workspaceId, callerSessionId],
-    () => getSession(db, grant.workspaceId, callerSessionId),
-  );
-  const turn = await reusableAuthorizationRead(
-    reads,
-    db,
-    ["turn", grant.workspaceId, callerSessionId, attemptId],
-    () => getSessionTurnForAttempt(db, grant.workspaceId, callerSessionId, attemptId),
-  );
-  if (
+    !claims ||
     !callerSession ||
     callerSession.accountId !== grant.accountId ||
     !turn ||
-    turn.id !== turnId ||
-    turn.executionGeneration !== executionGeneration ||
-    callerSession.activeTurnId !== turn.id
+    turn.id !== claims.turnId ||
+    turn.executionGeneration !== claims.executionGeneration
   ) {
     throw new SessionAuthorizationDeniedError("caller_stale");
   }
@@ -602,11 +613,11 @@ async function resolveSessionAuthorizationActor(
     actor: SessionAuthorizationActor.parse({
       kind: "agent_attempt",
       subjectId: grant.subjectId,
-      callerSessionId,
+      callerSessionId: claims.callerSessionId,
       callerRootSessionId: callerSession.rootSessionId,
-      turnId,
-      attemptId,
-      executionGeneration,
+      turnId: claims.turnId,
+      attemptId: claims.attemptId,
+      executionGeneration: claims.executionGeneration,
       initiator: turn.initiator,
       initiatorContext: turn.initiatorContext,
       initiatingHumanSubjectId: