"Google Calendar", "Slack"

ChunkDocument intelligently chunks a document based on its type

CreateWorkspace creates an isolated directory for an app generation Returns the absolute path to the workspace

DefaultLLMOptions returns sensible defaults

DefaultRateLimitConfig returns production-safe defaults

Flush flushes any remaining content

GenerateAuthToken generates a JWT token for OSA API authentication

GetAccessibleMemories retrieves all memories accessible to user (workspace + private + shared)

GetActiveContextCount returns the number of active contexts in memory

GetAppStatus retrieves status of a deployed app GET /api/osa/deployment/:app_id/status

GetChunkStatistics returns statistics about chunks

GetEffectiveSettings retrieves merged focus settings for a user and mode

============================================================================= RAG EMBEDDING CACHING (Critical - 90%+ hit rate target) ================

GetOrCreateFilesystemContainer gets an existing or creates a new lightweight container for filesystem operations. Unlike terminal containers, these ar

GetPermissions gets user's permissions in project

GetProject returns a single project with notes.

GetRateLimiter returns the global rate limiter instance

GetSanitizer returns the singleton sanitizer instance

GetSession retrieves a session by ID

GetSlidesAPI returns a Google Slides API service for a user.

GetSubscriberCountForApp returns the number of subscribers for a specific app

GetTemplateInfo returns information about a template (for UI/API)

GetTokenUsageStats returns statistics about token usage

GetUserQuota retrieves the quota limits for a user. Returns admin overrides if set, otherwise returns default quota.

GetWorkflowFiles returns all files for a workflow. GET /api/osa/workflows/:id/files

InternalAuthMiddleware verifies internal service-to-service requests with either an allowlisted source IP or an HMAC signature over: timestamp + met

InvalidateUserSessions removes all cached sessions for a user This uses the user->sessions index for efficient O(N) operation where N = user's session

IsAvailable checks if a specific port is available for allocation.

IsConnected checks if Google Docs is connected for a user.

IsExpired returns true if the session has exceeded its maximum duration

IsValidEnvVarValue validates environment variable values. Prevents shell injection by checking for dangerous characters.

ListArtifacts returns all artifacts for the current user.

ListProjects returns all projects for the current user. Results are cached in Redis for 5 minutes with user-specific keys.

ListTasks returns paginated tasks. Query params: limit (1-50), cursor, status, due (today|week|overdue), fields

LogWithFields logs a message with structured fields

NewProjectAgent creates a new project/planning agent

NewSSEBroadcasterWithConfig creates a broadcaster with custom configuration

NewSandboxEnvService creates a new sandbox environment variable service.

NewTaskAgent creates a new task management agent

Pool returns the database pool.

Rate returns the rolling bounce rate over the given window.

RateLimitMiddleware returns a Gin middleware that enforces rate limiting

Register adds a hook for a specific event

RemoveConnection decrements connection count for a user

RequireAuth ensures a user is authenticated, aborting with 401 if not. MUST be used AFTER AuthMiddleware or CachedAuthMiddleware in the middleware cha

RestoreSnapshot restores a workspace to a specific version

SanitizeInput escapes HTML special characters to prevent XSS

SecurityHeaders returns a middleware that sets security-related HTTP headers. These headers protect against common web vulnerabilities: - Clickjacking

For role-based permission context (Feature 1)

Stream handles SSE connection for real-time notifications GET /api/notifications/stream

UpdateNode updates a node

UpdateQValue performs a Bellman-equation update for the given state-action pair: Q(s,a) ← Q(s,a) + α·(r + γ·maxQ(s,·) - Q(s,a))

* Add a listener for sync events

appendLine appends a line to content, respecting MaxBlockContentLength.

Ask the second brain. Wiki-first, hybrid-fallback, hot-cited envelope. Sends ``POST /api/rag``. Returns the rendered answer plus the

buildDashboard returns a populated sqlc.UserDashboard for use in response assertions.

Helper function to compute HMAC for tests

contains checks if a string contains any of the given substrings

countNewApps counts apps in 'to' that are not in 'from' (by app name)

createIntTestConversation creates a conversation for integration tests

decrypt decrypts a value using AES-GCM.

deriveKey derives a 32-byte AES key from a passphrase using SHA-256.

----- low-level --------------------------------------------------------------

drainEvents reads events from subscriber channel with timeout

evictLRUIfNeeded removes least recently used contexts if cache is full

extractKeywordsFromText extracts meaningful words from text (filters stop words)

extractSubnet extracts the subnet prefix from an IP address For IPv4: returns first 3 octets (e.g., "192.168.1" from "192.168.1.100") For IPv6: return

generateChunkID generates a unique ID for a chunk

Fetch a single workspace by id.

getInstallationStatus safely extracts installation status from nullable field

============================================================================= HELPER FUNCTIONS =======================================================

* Insert a record