GetHTTPClient returns an HTTP client with auto-refreshing tokens.

GetRoleContext retrieves the role context from the request context

GetToken retrieves OAuth tokens for a user.

GetTokenSource returns a TokenSource that auto-refreshes.

InstallModule installs a module into a workspace

List returns all registered agents. The order of the returned slice is non-deterministic.

ListComputers returns computers visible to the configured MIOSA API key.

New creates a new TaskAgent

NewBaseAgent creates a new base agent with the given configuration

NewOSADeploymentHandler creates a new deployment handler

RegisterRoutes is the top-level route registration entry point. It sets up shared auth middleware and delegates each domain to its own register* metho

Token Management

cacheKey generates a cache key for a request

checkRouteProtection validates changes against protected routes

contains checks if a string contains a substring (case-insensitive helper)

============================================================================ Helpers =================================================================

* Cleanup resources

emitEvent publishes a build event

engineError surfaces upstream failures verbatim. We don't try to categorize 4xx vs 5xx — the engine returns its own status codes and this handler is a

enqueue mirrors a write into the engine. Passes through silently when the sync service isn't wired so modules don't have to nil-check.

Helper function to get auth context

isRemote reports whether the user asked for remote mode.

newTestClientHandler returns a ClientHandler backed by a nil pool.

orgRole returns the caller's role in the org, or "" if not a member.

printPretty emits any value as 2-indented JSON on stdout. We use json marshaling instead of a custom table renderer so the output is always machine-re

requireAuthUser extracts the authenticated user or returns 401

----- helpers ---------------------------------------------------------------

saveContextToDB persists a context to the database

sessionKey generates a secure Redis key for a session token using HMAC-SHA256 This prevents enumeration attacks by hashing the token before using it a

--------------------------------------------------------------------------- Test helpers -------------------------------------------------------------

truncateText truncates text to a maximum length

validatePathSafety checks for path traversal attacks and other malicious patterns. Returns the absolute, cleaned path and an error if the path is unsa

workspaceRole returns the caller's role in a workspace, or "".

AddStep adds a new step to the chain

BuildSignalAnnotation produces a model-agnostic signal annotation for the system prompt. Designed to work with ANY LLM — local 7B models, Groq, Anthro

ChunkMarkdown chunks markdown content respecting structure

CreatePrivateMemory creates a user's private memory

CreateTeamMember creates a new team member.

CreateWorkspaceMemory creates a workspace-level memory (accessible to all members)

DefaultHealthMonitorConfig returns the default health monitor configuration.

Delete removes a session

ExtractAppMetadata parses package.json and infers category/icon It supports both file system paths and bundle content (bundleContent parameter)

URL or icon identifier OAuth

GetCacheStats returns cache statistics

GetCommonImages returns the list of commonly used images

GetGmailAPI returns a Gmail API service for a user.

GetModule retrieves a module by ID

GetSheetsAPI returns a Google Sheets API service for a user.

GetTeamMember returns a single team member.

GetWorkspaceMemories retrieves shared workspace memories

HasFeature checks if a specific feature is enabled.

ID returns the tool's provider ID.

Metrics atomic operations IncrementStarted increments the total started counter

IsConnected checks if a user has active connections

IsEnabled returns whether the cache is currently enabled

IsLoaded returns whether skills have been loaded.

List returns metadata for all registered skills

ListInstalledModules lists all installed modules for a workspace

===================================================================== ROLE MANAGEMENT ================================================================

New creates a new ClientAgent

New creates a new ProjectAgent

New creates a new AnalystAgent

New creates a new DocumentAgent

NewCircuitBreaker creates a new circuit breaker

NewContainerManager creates a new container manager

NewOSAWebhooksHandler creates a new webhooks handler. isProduction must be true when ENVIRONMENT=production; unsigned webhooks are then rejected uncon

NewPatternExtractor creates a new extractor.

NewResilientClient creates a new resilient OSA client

NewStreamProcessor creates a new stream processor

===================================================================== CONSTRUCTOR ====================================================================

RegisterActions registers module actions with sorx engine

RespondBadRequestErr sends a 400 with the user-facing message. msg must be safe to expose — do not pass err.Error() here.

RunOnce checks for persistent failures and adjusts setpoints.

---- Sandbox lifecycle methods ---------------------------------------------- TestExecution runs a single sandbox execution against projectPath.

ValidateAuthToken validates a JWT token from OSA This can be used to validate responses or callbacks from OSA

WithError adds the error message to details

checkOperationProtection validates changes against protected operations

computeDominantMode finds the mode with the most cumulative time. DurationMs measures time spent in the *previous* mode (FromMode), not the destinatio

computeLCS computes the Longest Common Subsequence of two string slices

cookieHeader returns the value of the named cookie from an http.Response.

createOSATestWorkspace creates a test workspace for OSA API tests

* Emit sync event