@opengeni/worker-bundle 1.0.0-canary.0 → 1.0.0

package/src/activities/agent-turn/run-credentials.ts

@@ -2,6 +2,7 @@ import { getSessionRootId, resolvePrReviewGitCredential } from "@opengeni/db";
 import { prReviewRegistrationIdFromCredentialBinding } from "@opengeni/core";
 import {
   materializeRunCredentials,
+  repositoryHasExplicitGitConnection,
   clearRunCredentials,
   clearRunCredentialsForAttempt,
   refreshGitCredentialBindingTokenFiles,
@@ -11,6 +12,8 @@ import {
   type NormalizedRunCredentialMaterial,
   type RunCredentialCommandSession,
   type CodemodeTokenWriterSession,
+  RunMcpCredentials,
+  selectedSessionRemoteMcpTargets,
 } from "@opengeni/runtime";
 import { codemodeWorkspaceUrl, type Settings } from "@opengeni/config";
 import {
@@ -25,10 +28,13 @@ import {
   type loadWorkspaceEnvironmentForRunWithCredentials,
 } from "../environment";
 import type { mergeResourceRefs } from "../common";
+import type { withFirstPartyTools } from "../goals";
+import { expandMcpAccountRoutes } from "../mcp-account-routes";
 import { startGitCredentialRenewalLoop } from "../git-credential-renewal";
 import {
   RUN_CREDENTIAL_EXPIRY_LEAD_MS,
   startRunCredentialRenewalLoop,
+  runCredentialRenewalExpiry,
 } from "../run-credential-renewal";
 import {
   CODEMODE_TOKEN_EXPIRY_LEAD_MS,
@@ -59,6 +65,7 @@ import {
   sandboxSettingsForRoute,
 } from "./sandbox-route";
 import type { ClaimTurnOk } from "./claim";
+import { turnCredentialRestriction } from "./credential-restriction";
 import type { GovernanceModelOk } from "./governance-model";
 import type { SandboxTurnRuntime } from "./sandbox-runtime";
 import type {
@@ -69,6 +76,8 @@ import type {
 } from "./turn-context";
 
 export type PrepareRunCredentialsDeps = {
+  localMcpServerIds?: readonly string[];
+  turnTools: ReturnType<typeof withFirstPartyTools>;
   input: RunAgentTurnInput;
   settings: Settings;
   db: ActivityServices["db"];
@@ -83,6 +92,7 @@ export type PrepareRunCredentialsDeps = {
   sandboxRuntime: SandboxTurnRuntime;
   turn: ClaimTurnOk["turn"];
   session: ClaimTurnOk["session"];
+  turnExecutionPolicy: ClaimTurnOk["turnExecutionPolicy"];
   fileAuthoritySubjectId: ClaimTurnOk["fileAuthoritySubjectId"];
   runSettings: GovernanceModelOk["runSettings"];
   workspaceVariableSet: Awaited<ReturnType<typeof loadWorkspaceEnvironmentForRunWithCredentials>>;
@@ -121,6 +131,7 @@ export async function prepareRunCredentials(deps: PrepareRunCredentialsDeps) {
     sandboxState,
     turn,
     session,
+    turnExecutionPolicy,
     fileAuthoritySubjectId,
     runSettings,
     workspaceVariableSet,
@@ -145,14 +156,29 @@ export async function prepareRunCredentials(deps: PrepareRunCredentialsDeps) {
     machinePrimary,
     groupBoxBackend,
   });
+  const platformGitResources = turnResources.filter(
+    (resource) => resource.kind !== "repository" || repositoryHasExplicitGitConnection(resource),
+  );
+  // Credential targets follow the same accepted-account narrowing as execution.
+  // A canonical connection without an accepted account does not execute, and
+  // account-qualified aliases never inherit an attachment's product headers.
+  const accountRoutes = expandMcpAccountRoutes({
+    settings: runSettings,
+    tools: deps.turnTools,
+    bindings: turn.mcpAccountBindings,
+  });
 
   const runCredentialResolver =
-    effectiveRunCredentialBackend === "none"
+    effectiveRunCredentialBackend === "none" || effectiveRunCredentialBackend === "selfhosted"
       ? null
       : await waitForTurnOperation(
           bindRunCredentialResolver({
             db,
+            settings: accountRoutes.settings,
+            initiatingHumanSubjectId: turn.initiatingHumanSubjectId ?? null,
             connectionCredentials: connectionCredentials ?? null,
+            localMcpServerIds: deps.localMcpServerIds ?? [],
+            effectiveTools: accountRoutes.tools,
             accountId: input.accountId,
             workspaceId: input.workspaceId,
             session,
@@ -188,8 +214,9 @@ export async function prepareRunCredentials(deps: PrepareRunCredentialsDeps) {
   // Resolve once before model preparation so partial/auth-needed host state
   // is available as bounded model context and reconnect UI even when an
   // on-demand turn never provisions a box. Resolution alone performs no
-  // sandbox write or renewal; both paths reuse this exact material and the
-  // lazy path materializes it only inside its first-operation single-flight.
+  // sandbox write. The worker-local renewal below supports remote MCPs before
+  // discovery; a lazy sandbox materializes the latest resolved material only
+  // inside its first-operation single-flight.
   const initialRunCredentialMaterial = runCredentialResolver
     ? await waitForTurnOperation(
         runCredentialResolver.resolve({
@@ -200,6 +227,20 @@ export async function prepareRunCredentials(deps: PrepareRunCredentialsDeps) {
         undefined,
       )
     : null;
+  const runMcpCredentials = new RunMcpCredentials(
+    selectedSessionRemoteMcpTargets(
+      accountRoutes.settings,
+      session.mcpServers ?? [],
+      accountRoutes.tools,
+      (deps.localMcpServerIds ?? []).map((id) => ({ id })),
+    ),
+    {
+      ...(cancellationSignal ? { signal: cancellationSignal } : {}),
+    },
+  );
+  renewals.runMcpCredentials = runMcpCredentials;
+  runMcpCredentials.replace(initialRunCredentialMaterial);
+  let currentRunCredentialMaterial = initialRunCredentialMaterial;
   if (initialRunCredentialMaterial) {
     for (const payload of runCredentialAuthNeededPayloads(initialRunCredentialMaterial)) {
       renewals.publishedRunCredentialNotices.add(JSON.stringify(payload));
@@ -287,13 +328,10 @@ export async function prepareRunCredentials(deps: PrepareRunCredentialsDeps) {
   // provider may supply it; unset still self-mints GitHub from settings.
   // gitToken/gitTokens are undefined on the selfhosted skip path (the machine
   // uses its own git creds).
-  // Git and MCP credentials share one lineage snapshot for this turn. A
-  // host that supplies both ports must never see two independently resolved
-  // roots for the same execution merely because the call sites are far apart.
+  // Git credential providers share one lineage snapshot for this turn.
+  // MCP access uses the native accepted connection context independently.
   const needsHostCredentialRoot = Boolean(
-    connectionCredentials?.gitCredentials ||
-    personalGitHubCredentials ||
-    connectionCredentials?.mcpCredentials,
+    connectionCredentials?.gitCredentials || personalGitHubCredentials,
   );
   const hostCredentialRootSessionId = needsHostCredentialRoot
     ? await getSessionRootId(db, input.workspaceId, input.sessionId)
@@ -311,11 +349,13 @@ export async function prepareRunCredentials(deps: PrepareRunCredentialsDeps) {
           turn,
         })
       : undefined;
+  const credentialRestriction = turnCredentialRestriction(turnExecutionPolicy, session.metadata);
   const codemodeAuthority = {
     sessionId: input.sessionId,
     turnId: turn.id,
     attemptId: input.attemptId,
     executionGeneration: turn.executionGeneration,
+    ...(credentialRestriction ? { credentialRestriction } : {}),
   };
   const sandboxArtifactRuntime = sandboxArtifactRuntimeAdmission(
     settings,
@@ -333,7 +373,7 @@ export async function prepareRunCredentials(deps: PrepareRunCredentialsDeps) {
   } = await waitForTurnOperation(
     sandboxEnvironmentForRun(
       sandboxEnvironmentSettings,
-      turnResources,
+      platformGitResources,
       // Rig default sets merged BELOW the session set (session wins); rig-less
       // turns pass exactly workspaceVariableSet?.values (byte-for-byte today).
       sandboxWorkspaceEnvironmentValues,
@@ -394,7 +434,7 @@ export async function prepareRunCredentials(deps: PrepareRunCredentialsDeps) {
       return Promise.resolve(undefined);
     }
     runGitCredentialsMint ??= waitForTurnOperation(
-      mintRunGitCredentials(runSettings, turnResources, {
+      mintRunGitCredentials(runSettings, platformGitResources, {
         scope: connectionScope,
         ...(gitCredentialAuthority ? { authority: gitCredentialAuthority } : {}),
         gitCredentials: connectionCredentials?.gitCredentials,
@@ -428,7 +468,7 @@ export async function prepareRunCredentials(deps: PrepareRunCredentialsDeps) {
         mint: async () => {
           const binding = await mintRunGitCredentialBinding(
             runSettings,
-            turnResources,
+            platformGitResources,
             initialBinding.provider,
             initialBinding.credentialBindingId,
             {
@@ -609,7 +649,7 @@ export async function prepareRunCredentials(deps: PrepareRunCredentialsDeps) {
   }
 
   const attachRunCredentialRenewal = async (
-    credentialSession: RunCredentialCommandSession,
+    credentialSession: RunCredentialCommandSession | undefined,
     initialMaterial: NormalizedRunCredentialMaterial | null,
     initialSandbox?: ResumedTurnSandbox,
   ): Promise<void> => {
@@ -618,7 +658,8 @@ export async function prepareRunCredentials(deps: PrepareRunCredentialsDeps) {
     renewals.runCredentialRenewal = null;
     await previous?.stop();
     if (renewals.runCredentialRenewalClosed) return;
-    renewals.runCredentialSession = credentialSession;
+    renewals.runCredentialSession = credentialSession ?? null;
+    initialMaterial = currentRunCredentialMaterial;
 
     const requireTargetSandbox = (): ResumedTurnSandbox => {
       const targetSandbox = sandboxState.resolvedSandbox ?? initialSandbox;
@@ -628,7 +669,7 @@ export async function prepareRunCredentials(deps: PrepareRunCredentialsDeps) {
       return targetSandbox;
     };
 
-    if (!initialMaterial) {
+    if (!initialMaterial && credentialSession) {
       await runWorkspaceMutationForSandbox(
         requireTargetSandbox(),
         "runCredentialClear",
@@ -645,49 +686,60 @@ export async function prepareRunCredentials(deps: PrepareRunCredentialsDeps) {
       );
       return;
     }
+    if (!initialMaterial) return;
 
     const write = async (
       material: NormalizedRunCredentialMaterial | null,
       pruneOtherAttempts = false,
     ): Promise<void> => {
+      throwIfTurnOperationCancelled(cancellationSignal);
+      const applyMcpCredentials = runMcpCredentials.prepare(material);
       if (!material) {
+        if (credentialSession)
+          await runWorkspaceMutationForSandbox(
+            requireTargetSandbox(),
+            "runCredentialAttemptClear",
+            async () =>
+              await clearRunCredentialsForAttempt(credentialSession, {
+                sessionId: input.sessionId,
+                attemptId: input.attemptId,
+                executionGeneration: attempt.executionGeneration,
+              }),
+          );
+        throwIfTurnOperationCancelled(cancellationSignal);
+        applyMcpCredentials();
+        currentRunCredentialMaterial = material;
+        return;
+      }
+
+      if (credentialSession)
         await runWorkspaceMutationForSandbox(
           requireTargetSandbox(),
-          "runCredentialAttemptClear",
+          "runCredentialMaterialization",
           async () =>
-            await clearRunCredentialsForAttempt(credentialSession, {
+            await materializeRunCredentials(credentialSession, material, {
               sessionId: input.sessionId,
               attemptId: input.attemptId,
               executionGeneration: attempt.executionGeneration,
+              ...(pruneOtherAttempts ? { pruneOtherAttempts: true } : {}),
+              ...(!pruneOtherAttempts ? { pruneSupersededGenerations: true } : {}),
+              ...(material.authNeeded.length > 0 &&
+              Object.keys(material.environment).length === 0 &&
+              material.files.length === 0
+                ? { prunePreviousGenerations: true }
+                : {}),
+              ...(eventing.toolCancellationFenceRef.current
+                ? {
+                    commandRunner: eventing.toolCancellationFenceRef.current.runSandboxCommand.bind(
+                      eventing.toolCancellationFenceRef.current,
+                    ),
+                  }
+                : {}),
             }),
         );
-        return;
-      }
-
-      await runWorkspaceMutationForSandbox(
-        requireTargetSandbox(),
-        "runCredentialMaterialization",
-        async () =>
-          await materializeRunCredentials(credentialSession, material, {
-            sessionId: input.sessionId,
-            attemptId: input.attemptId,
-            executionGeneration: attempt.executionGeneration,
-            ...(pruneOtherAttempts ? { pruneOtherAttempts: true } : {}),
-            ...(!pruneOtherAttempts ? { pruneSupersededGenerations: true } : {}),
-            ...(material.authNeeded.length > 0 &&
-            Object.keys(material.environment).length === 0 &&
-            material.files.length === 0
-              ? { prunePreviousGenerations: true }
-              : {}),
-            ...(eventing.toolCancellationFenceRef.current
-              ? {
-                  commandRunner: eventing.toolCancellationFenceRef.current.runSandboxCommand.bind(
-                    eventing.toolCancellationFenceRef.current,
-                  ),
-                }
-              : {}),
-          }),
-      );
+      throwIfTurnOperationCancelled(cancellationSignal);
+      applyMcpCredentials();
+      currentRunCredentialMaterial = material;
       for (const payload of runCredentialAuthNeededPayloads(material)) {
         const key = JSON.stringify(payload);
         if (renewals.publishedRunCredentialNotices.has(key)) continue;
@@ -696,18 +748,13 @@ export async function prepareRunCredentials(deps: PrepareRunCredentialsDeps) {
       }
     };
 
-    const initialExpiryMs = initialMaterial.expiresAt?.getTime() ?? null;
-    const seed =
-      initialExpiryMs !== null && initialExpiryMs <= Date.now() + RUN_CREDENTIAL_EXPIRY_LEAD_MS
-        ? await runCredentialResolver.resolve({
-            purpose: "provision",
-            forceRefresh: true,
-          })
-        : initialMaterial;
-    await write(seed, true);
+    // Preserve the last good material even when an early refresh fails. Such
+    // refreshes are renewals, not fresh provisions that degrade to empty
+    // auth-needed state on a provider transport failure.
+    await write(initialMaterial, true);
     if (renewals.runCredentialRenewalClosed) return;
     const controller = startRunCredentialRenewalLoop({
-      initialExpiresAt: seed?.expiresAt ?? null,
+      initialExpiresAt: runCredentialRenewalExpiry(initialMaterial),
       resolve: async () =>
         await runCredentialResolver.resolve({
           purpose: "renewal",
@@ -715,6 +762,7 @@ export async function prepareRunCredentials(deps: PrepareRunCredentialsDeps) {
         }),
       write: async (material) => await write(material),
       onSuccess: ({ authNeeded }) => {
+        renewals.runCredentialRenewalOutcome = authNeeded ? "auth_needed" : "completed";
         observability.incrementCounter({
           name: "opengeni_run_credential_renewals_total",
           help: "Host-managed run credential renewal attempts by outcome.",
@@ -722,6 +770,7 @@ export async function prepareRunCredentials(deps: PrepareRunCredentialsDeps) {
         });
       },
       onFailure: ({ retryDelayMs, errorClass }) => {
+        renewals.runCredentialRenewalOutcome = "error";
         observability.incrementCounter({
           name: "opengeni_run_credential_renewals_total",
           help: "Host-managed run credential renewal attempts by outcome.",
@@ -740,15 +789,27 @@ export async function prepareRunCredentials(deps: PrepareRunCredentialsDeps) {
       return;
     }
     renewals.runCredentialRenewal = controller;
+    const initialExpiryMs = runCredentialRenewalExpiry(initialMaterial)?.getTime() ?? null;
+    if (initialExpiryMs !== null && initialExpiryMs <= Date.now() + RUN_CREDENTIAL_EXPIRY_LEAD_MS) {
+      await controller.refreshNow();
+      throwIfTurnOperationCancelled(cancellationSignal);
+    }
   };
 
+  // Remote MCP-only turns may never establish a sandbox. Start the same
+  // single-flight, finalization-owned loop before transport discovery; attaching
+  // a sandbox later replaces its writer, not its credential authority.
+  if (initialRunCredentialMaterial) {
+    await attachRunCredentialRenewal(undefined, initialRunCredentialMaterial);
+  }
+
   return {
+    runMcpCredentials,
     runCredentialResolver,
     establishPolicy,
     initialRunCredentialMaterial,
     runCredentialsNote,
     authorizeGitHubTokenMint,
-    hostCredentialRootSessionId,
     gitCredentialAuthority,
     codemodeAuthority,
     sandboxArtifactRuntime,