feat(helix-org): first alpha — embedded in Helix behind HELIX_ORG_ENABLED + per-user alpha flag

.drone.yml

@@ -194,8 +194,12 @@ steps:
       - git config --global user.email "ci@helix.ml"
       - git config --global user.name "CI"
       - chmod +x ./scripts/run-tests-with-timeout.sh
-      # Run tests excluding GStreamer-dependent packages (tested separately with CGO disabled)
-      - go list ./api/... | grep -v '/desktop' | grep -v '/desktop-bridge' | xargs ./scripts/run-tests-with-timeout.sh -tags ORT -timeout 8m -v
+      # Run tests excluding GStreamer-dependent packages (tested separately with CGO disabled).
+      # First arg "600" sets the script's wall-clock timeout — it parses
+      # the first numeric arg. Without it the script defaults to 300s,
+      # which is shorter than the inner `-timeout 8m` and kills the
+      # suite during pkg/tools (real TogetherAI calls take ~280s).
+      - go list ./api/... | grep -v '/desktop' | grep -v '/desktop-bridge' | xargs ./scripts/run-tests-with-timeout.sh 600 -tags ORT -timeout 8m -v
     when:
       event:
         - push
@@ -268,7 +272,7 @@ steps:
       - which helix && helix version
       - timeout 5 helix serve 2>&1 || echo "Server exited (expected - checking for startup errors)"
       # Run tests
-      - pwd && ./scripts/run-tests-with-timeout.sh -tags ORT -timeout 8m -v ./integration-test/api/...
+      - pwd && ./scripts/run-tests-with-timeout.sh 600 -tags ORT -timeout 8m -v ./integration-test/api/...
     when:
       event:
         - push

.gitignore

@@ -35,12 +35,14 @@ charts/helix-controlplane/charts/*.tgz
 # Source-of-truth is the .tmpl file; the rendered Chart.yaml is build output.
 charts/*/Chart.yaml
 # Anchor helix-runner to repo root so it does not shadow charts/helix-runner/.
-# Other unanchored patterns below (helix, zed-build, tmp) are left as-is to
-# avoid regressing the ignoring of build artifacts in subdirectories such as
-# api/cmd/helix/helix or runner-cmd/helix-runner/helix-runner.
+# `helix` and friends are anchored to specific build-artifact paths because a
+# bare `helix` pattern matches any directory named `helix` at any depth — which
+# accidentally swallowed helix-org/helix/ and helix-org/agent/helix/ entirely.
 /helix-runner
 zed-build
-helix
+/helix
+/api/helix
+/api/cmd/helix/helix
 tmp
 zed-config/development_credentials
 

api/pkg/config/config.go

@@ -55,6 +55,14 @@ type ServerConfig struct {
 	Edition string `envconfig:"HELIX_EDITION" default:""`
 
 	SBMessage string `envconfig:"SB_MESSAGE" default:""`
+
+	// HelixOrgEnabled is the deployment-wide kill switch for the
+	// embedded helix-org alpha. When false (the default), none of
+	// the helix-org init runs and none of its HTTP surfaces
+	// (/api/v1/org/, /ui/, /api/v1/mcp/helix-org/) are mounted —
+	// the per-user alpha feature flag in the DB has no effect.
+	// Set HELIX_ORG_ENABLED=true to opt in.
+	HelixOrgEnabled bool `envconfig:"HELIX_ORG_ENABLED" default:"false"`
 }
 
 // Sandboxes configures the user-facing Sandboxes API.

api/pkg/server/auth.go

@@ -747,6 +747,7 @@ func (s *HelixAPIServer) user(w http.ResponseWriter, r *http.Request) {
 						Admin:               dbUser.Admin,
 						OnboardingCompleted: dbUser.OnboardingCompleted,
 						Waitlisted:          dbUser.Waitlisted,
+						AlphaFeatures:       []string(dbUser.AlphaFeatures),
 					}
 					writeResponse(w, response, http.StatusOK)
 					return
@@ -780,6 +781,7 @@ func (s *HelixAPIServer) user(w http.ResponseWriter, r *http.Request) {
 				Admin:               user.Admin,
 				OnboardingCompleted: user.OnboardingCompleted,
 				Waitlisted:          user.Waitlisted,
+				AlphaFeatures:       []string(user.AlphaFeatures),
 			}
 			writeResponse(w, response, http.StatusOK)
 			return
@@ -863,6 +865,7 @@ func (s *HelixAPIServer) user(w http.ResponseWriter, r *http.Request) {
 		Admin:               user.Admin,
 		OnboardingCompleted: user.OnboardingCompleted,
 		Waitlisted:          user.Waitlisted,
+		AlphaFeatures:       []string(user.AlphaFeatures),
 	}
 	writeResponse(w, response, http.StatusOK)
 }

api/pkg/server/auth_utils.go

@@ -50,6 +50,29 @@ func requireAdmin(next http.Handler) http.Handler {
 	return http.HandlerFunc(f)
 }
 
+// requireFeature returns middleware that gates access on the given
+// alpha-feature flag. The flag must be present in the authenticated
+// user's AlphaFeatures slice; missing returns 403. This is the
+// server-side gate — frontend toggles are cosmetic only.
+func requireFeature(name string) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			user := getRequestUser(r)
+			if !hasUser(user) {
+				http.Error(w, "Unauthorized", http.StatusUnauthorized)
+				return
+			}
+			for _, f := range user.AlphaFeatures {
+				if f == name {
+					next.ServeHTTP(w, r)
+					return
+				}
+			}
+			http.Error(w, "Forbidden", http.StatusForbidden)
+		})
+	}
+}
+
 func requireRunner(next http.Handler) http.Handler {
 	f := func(w http.ResponseWriter, r *http.Request) {
 		user := getRequestUser(r)

api/pkg/server/external_agent_handlers.go

@@ -19,6 +19,7 @@ import (
 	"github.com/gorilla/mux"
 	"github.com/rs/zerolog/log"
 
+	"github.com/helixml/helix/api/pkg/crypto"
 	"github.com/helixml/helix/api/pkg/proxy"
 	"github.com/helixml/helix/api/pkg/types"
 )
@@ -90,6 +91,25 @@ func (apiServer *HelixAPIServer) addUserAPITokenToAgent(ctx context.Context, age
 	tokenEnvVars := types.DesktopAgentAPIEnvVars(apiKey)
 	agent.Env = append(agent.Env, tokenEnvVars...)
 
+	// Subscription-mode claude_code overrides: when the session's
+	// parent app runs Claude Code on the operator's OAuth, the
+	// in-sandbox `claude` process needs CLAUDE_CODE_OAUTH_TOKEN and
+	// an Anthropic-direct ANTHROPIC_BASE_URL — not the Helix proxy
+	// envs DesktopAgentAPIEnvVars sets above. Resolved here at
+	// session-start time so the claude process inherits them, rather
+	// than relying on Zed's `agent_servers.env` to propagate (it
+	// doesn't, for registry-type agents). The setup token lookup
+	// honours session ownership: each Worker session runs under the
+	// hiring user, so test@helix.ml's workers get test@helix.ml's
+	// subscription.
+	if extra := apiServer.subscriptionEnvForSession(ctx, session); len(extra) > 0 {
+		agent.Env = append(agent.Env, extra...)
+		log.Info().
+			Str("session_id", agent.SessionID).
+			Int("count", len(extra)).
+			Msg("✅ Added claude_code subscription env vars to agent (CLAUDE_CODE_OAUTH_TOKEN, ANTHROPIC_BASE_URL override)")
+	}
+
 	log.Info().
 		Str("user_id", userID).
 		Str("session_id", agent.SessionID).
@@ -101,6 +121,69 @@ func (apiServer *HelixAPIServer) addUserAPITokenToAgent(ctx context.Context, age
 	return nil
 }
 
+// subscriptionEnvForSession returns extra container env vars when
+// the session's parent app uses claude_code runtime with subscription
+// credentials. Each var "K=V" appears AFTER DesktopAgentAPIEnvVars in
+// hydra_executor's env list, so process env honours these overrides
+// (last write wins). Empty slice when the runtime is anything else or
+// the lookup fails — callers degrade to the base API-key env.
+func (apiServer *HelixAPIServer) subscriptionEnvForSession(ctx context.Context, session *types.Session) []string {
+	if session.ParentApp == "" {
+		return nil
+	}
+	app, err := apiServer.Store.GetApp(ctx, session.ParentApp)
+	if err != nil || len(app.Config.Helix.Assistants) == 0 {
+		return nil
+	}
+	asst := app.Config.Helix.Assistants[0]
+	if asst.CodeAgentRuntime != types.CodeAgentRuntimeClaudeCode {
+		return nil
+	}
+	if !asst.CodeAgentCredentialType.IsSubscription() {
+		return nil
+	}
+	sub, err := apiServer.Store.GetEffectiveClaudeSubscription(ctx, session.Owner, session.OrganizationID)
+	if err != nil || sub.Status != "active" {
+		log.Warn().Str("session_id", session.ID).Str("owner", session.Owner).
+			Msg("claude_code subscription mode but no active Claude subscription found for session owner")
+		return nil
+	}
+	out := []string{
+		// Anthropic-direct; overrides the helix-proxy URL baked into
+		// the container env list.
+		"ANTHROPIC_BASE_URL=https://api.anthropic.com",
+		// Clear ANTHROPIC_API_KEY so Claude Code falls back to OAuth.
+		"ANTHROPIC_API_KEY=",
+	}
+	encKey, err := crypto.GetEncryptionKey()
+	if err != nil {
+		log.Warn().Err(err).Str("session_id", session.ID).Msg("claude_code subscription mode: encryption key unavailable")
+		return out
+	}
+	plaintext, err := crypto.DecryptAES256GCM(sub.EncryptedCredentials, encKey)
+	if err != nil {
+		log.Warn().Err(err).Str("session_id", session.ID).Msg("claude_code subscription mode: decrypt subscription failed")
+		return out
+	}
+	credType := sub.CredentialType
+	if credType == "" {
+		credType = "oauth"
+	}
+	switch credType {
+	case "setup_token":
+		var tok types.ClaudeSetupTokenCredentials
+		if err := json.Unmarshal(plaintext, &tok); err == nil && tok.SetupToken != "" {
+			out = append(out, "CLAUDE_CODE_OAUTH_TOKEN="+tok.SetupToken)
+		}
+	case "oauth":
+		// OAuth credentials are normally written to
+		// ~/.claude/.credentials.json by settings-sync-daemon on
+		// container start. The daemon path is more correct for OAuth
+		// since it can refresh tokens; we don't duplicate it here.
+	}
+	return out
+}
+
 // RegisterRequestToSessionMapping registers a request_id to session_id mapping for external agent sessions
 // This is used to route initial messages to Zed when it connects via WebSocket
 func (apiServer *HelixAPIServer) RegisterRequestToSessionMapping(requestID, sessionID string) {