You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Route supported server HTTPS requests through an organization-owned gateway using the existing validated HTTP and connector retry helpers. Keep direct behavior when routing is unconfigured and reject managed-route failures without a direct fallback.
Bind requests to canonical organization ownership across application operations, connector jobs, workflow execution, webhook setup and local Function HTTP callbacks. Preserve native database, remote sandbox and unsupported SDK network paths.
Combine session policies and read-only outbound IPs under Security, using existing settings components, contracts and authorization. Document coverage and exclusions.
Type of Change
New feature
Testing
1,558 focused routing, HTTP security, MCP and ownership tests passed, including real TLS CONNECT under Node and Bun.
Broad connector and execution regression run: 3,768 passed, one existing skip. Additional pre-execution regression run: 377 passed. These runs overlap.
Fresh independent audit added regressions for streaming timeout/status parity, queued enrichment ownership, webhook setup retries and reused worker callback isolation. All focused checks passed.
Type checking, lint, all 46 audits, block-registry and generated docs checks passed after the audit fixes.
Verified the Security page and docs locally, including copying a synthetic IP allowlist entry.
Measured the settings dependency graph against clean staging: 10 modules added; refreshed only that route's baseline.
Rollout
Deploy and verify the gateway before enabling an organization. App and background workers need the private gateway catalog, credentials and matching policy. This change does not activate routing. AWS SDK, native database and remote sandbox connections retain their existing paths; Google Drive, Fireflies, Google Workspace directory discovery and Atlassian OAuth site discovery keep their existing paths; OAuth and other SDK coverage must be verified separately.
Introduces organization network settings and consolidates session policies and outbound IP information under Security.
Documents supported connections, exclusions, availability, and fail-closed behavior.
Diagram
%%{init: {'theme': 'neutral'}}%%
flowchart LR
A[Application or background operation] --> B[Resolve canonical organization ownership]
B --> C{Organization route configured?}
C -->|No| D[Existing direct HTTPS path]
C -->|Yes| E[Organization-owned gateway]
E --> F[Validated HTTPS destination]
E -->|Unavailable or rejected| G[Fail request without direct fallback]
@greptile-apps Please re-review after the query-key finding response. The feature only has a detail query; all → details() → detail(organizationId) matches the repository requirement and existing workspaceHostKeys/linkPreviewKeys.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Summary
Type of Change
Testing
Rollout
Deploy and verify the gateway before enabling an organization. App and background workers need the private gateway catalog, credentials and matching policy. This change does not activate routing. AWS SDK, native database and remote sandbox connections retain their existing paths; Google Drive, Fireflies, Google Workspace directory discovery and Atlassian OAuth site discovery keep their existing paths; OAuth and other SDK coverage must be verified separately.
Checklist