@ai-matrx/chat 0.7.6 → 0.7.7

package/dist/agents/redux/execution-system/thunks/continue-agent-json.js

@@ -0,0 +1,66 @@
+import { removeContextEntry, setContextEntries } from "../instance-context/instance-context.slice.js";
+import { setUserInputText } from "../instance-user-input/instance-user-input.slice.js";
+import { executeInstance } from "./execute-instance.thunk.js";
+import { loadConversation } from "./load-conversation.thunk.js";
+import {
+  adoptHeadlessAgentJson
+} from "./run-headless-agent-json.js";
+function continuationTurnProblem(opts) {
+  const typed = typeof opts.userInput === "string" && opts.userInput.trim().length > 0;
+  if (typed && opts.hostTurn) return "A turn is the person's words or a host turn, never both.";
+  if (!typed && !opts.hostTurn) return "Nothing to send: the turn has neither the person's words nor a host turn.";
+  if (opts.hostTurn && (!opts.hostTurn.text.trim() || !opts.hostTurn.reason.trim())) return "A host turn needs its text and its reason.";
+  return null;
+}
+async function continueAgentJson(dispatch, getState, opts) {
+  const { conversationId } = opts;
+  const problem = continuationTurnProblem(opts);
+  if (problem) return { success: false, data: null, fullResponse: "", error: problem, conversationId };
+  try {
+    if (!getState().conversations.byConversationId[conversationId]) {
+      await dispatch(loadConversation({ conversationId })).unwrap();
+    }
+    const context = Object.entries(opts.context ?? {});
+    const writes = context.filter(([, value]) => value !== null && value !== void 0);
+    for (const [key] of context.filter(([, value]) => value === null)) dispatch(removeContextEntry({ conversationId, key }));
+    if (writes.length) dispatch(setContextEntries({ conversationId, entries: writes.map(([key, value]) => ({ key, value })) }));
+    if (opts.userInput) dispatch(setUserInputText({ conversationId, text: opts.userInput }));
+    let requestId = null;
+    const sent = await dispatch(
+      executeInstance({
+        conversationId,
+        initiation: opts.initiation ?? (opts.hostTurn ? "auto" : "user"),
+        ...opts.hostTurn ? { hostTurn: opts.hostTurn } : {},
+        onRequestId: (id) => {
+          requestId = id;
+          opts.onRequestId?.(id);
+        }
+      })
+    );
+    if (executeInstance.rejected.match(sent)) {
+      const reason = typeof sent.payload === "string" ? sent.payload : sent.error.message ?? "The turn could not be sent.";
+      return { success: false, data: null, fullResponse: "", error: reason, conversationId, ...requestId ? { requestId } : {} };
+    }
+    return await adoptHeadlessAgentJson(dispatch, getState, {
+      requestId: sent.payload.requestId,
+      conversationId,
+      surfaceKey: opts.surfaceKey,
+      keepInstance: opts.keepInstance ?? true,
+      ...opts.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {},
+      ...opts.pollIntervalMs !== void 0 ? { pollIntervalMs: opts.pollIntervalMs } : {},
+      ...opts.settleMs !== void 0 ? { settleMs: opts.settleMs } : {},
+      ...opts.expect ? { expect: opts.expect } : {},
+      ...opts.onResult ? { onResult: opts.onResult } : {},
+      ...opts.signal ? { signal: opts.signal } : {},
+      ...opts.failureMessages ? { failureMessages: opts.failureMessages } : {}
+    });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    console.error("[continueAgentJson] the turn failed before it ran", { conversationId, err });
+    return { success: false, data: null, fullResponse: "", error: message, conversationId };
+  }
+}
+export {
+  continuationTurnProblem,
+  continueAgentJson
+};

package/dist/agents/redux/execution-system/thunks/execute-instance.thunk.d.ts

@@ -36,6 +36,8 @@ export declare function isEmptyUserInput(userInput: unknown): boolean;
  */
 export declare function refusesEmptyTurn(args: {
     retry: boolean;
+    /** A host-written turn is a message even with no `user_input`. */
+    hostTurn?: boolean;
     hasPriorTurns: boolean;
     cacheOnly: boolean;
     isEphemeral: boolean;
@@ -123,6 +125,24 @@ interface ExecuteInstanceArgs {
      * composer: the person may already be typing the next message in it.
      */
     submission?: FrozenSubmission;
+    /**
+     * A turn the HOST writes on a persisted conversation — never something the
+     * person typed (THE USER-INPUT LAW). Sent as `host_turn` instead of
+     * `user_input`: a short activation line the model reads, plus which host
+     * feature wrote it; the turn's content rides `context`. Only a continuation
+     * (the conversation already has turns). The Applet builder's automatic fix
+     * round is one (lane F6b).
+     */
+    hostTurn?: HostTurnInput;
+}
+/** `ConversationContinueRequest.host_turn` — what a host-written turn carries. */
+export interface HostTurnInput {
+    /** The activation line the model reads. */
+    text: string;
+    /** Which host feature wrote it (≤80 chars). */
+    reason: string;
+    /** Extra stamps for the stored message. */
+    metadata?: Record<string, unknown>;
 }
 interface ExecuteInstanceResult {
     requestId: string;

package/dist/agents/redux/execution-system/thunks/execute-instance.thunk.js

@@ -155,7 +155,7 @@ function isEmptyUserInput(userInput) {
   });
 }
 function refusesEmptyTurn(args) {
-  if (args.retry || !args.hasPriorTurns) return false;
+  if (args.retry || args.hostTurn || !args.hasPriorTurns) return false;
   if (!shouldContinuePersistedConversation(
     args.cacheOnly,
     args.hasPriorTurns,
@@ -254,7 +254,8 @@ const executeInstance = createAsyncThunk(
     initiation,
     onRequestId,
     surfaceRefreshed = false,
-    submission
+    submission,
+    hostTurn
   }, { getState, dispatch, rejectWithValue: reject }) => {
     const requestId = generateRequestId();
     const rejectWithValue = (value, originalErrorName) => reject(
@@ -340,6 +341,7 @@ const executeInstance = createAsyncThunk(
       }
       if (refusesEmptyTurn({
         retry,
+        hostTurn: Boolean(hostTurn),
         hasPriorTurns: selectMessageCount(conversationId)(state) > 0,
         cacheOnly: instance.cacheOnly,
         isEphemeral: instance.isEphemeral === true,
@@ -535,11 +537,16 @@ const executeInstance = createAsyncThunk(
         ).replace("{conversation_id}", encodeURIComponent(conversationId));
         url = `${baseUrl}${convPath}`;
         routedPayload = buildContinuationBody(payload, {
+          hostTurn,
           retry: Boolean(retry),
           debug: Boolean(debug),
           cacheBypass: pendingBypass
         });
       } else {
+        if (hostTurn) {
+          console.error(`[execute-instance] a host turn ("${hostTurn.reason}") was sent on conversation "${conversationId}", which has no persisted turns \u2014 nothing was sent.`);
+          return rejectWithValue("A host turn continues a conversation; this one has no turns yet");
+        }
         const start = resolveStartPath({
           agentId: instance.agentId,
           pinnedVersionId: instance.initialAgentVersionId ?? null,

package/dist/agents/redux/execution-system/thunks/launch-agent-execution.thunk.js

@@ -26,10 +26,7 @@ import { alwaysOnSurfaceKeys } from "../../../../surfaces/utils/always-on-contex
 import {
   fetchAgentRunTier
 } from "../../agent-definition/thunks.js";
-import {
-  isSignedOutVisitor,
-  NotAuthenticatedError
-} from "../../../../host/identity.js";
+import { isSignedOutVisitor, NotAuthenticatedError, selectAccessToken } from "../../../../host/identity.js";
 import { applyLaunchModelOverrides } from "../instance-model-overrides/launch-model-overrides.js";
 import { selectAgentRunTier, selectAgentById } from "../../agent-definition/selectors.js";
 import { getShortcutRecordFromState } from "../../agent-shortcuts/selectors.js";
@@ -84,8 +81,9 @@ import {
   resolvePerLaunchMappings
 } from "./surface-scope-mapping.js";
 import { ensureAgentCatalog } from "../../../identity/agent-identity.js";
+import { selectOrganizationId } from "../../../../host/org.js";
 function hasSignedInSession(state) {
-  return Boolean(state.userAuth?.accessToken);
+  return Boolean(selectAccessToken(state));
 }
 const INTERACTIVE_MODES = /* @__PURE__ */ new Set([
   "modal-full",
@@ -144,7 +142,7 @@ const launchAgentExecution = createAsyncThunk("instances/launch", async (options
       );
     }
     if (!agentId) {
-      const selectedOrganizationId = adminLaneOrganizationId() ?? getState().appContext?.organization_id ?? null;
+      const selectedOrganizationId = adminLaneOrganizationId() ?? selectOrganizationId(getState());
       const questionOrganizationId = organizationId ?? selectedOrganizationId ?? await (await import("../../../../host/org.js")).ensureOrgId(null);
       const displayKey = mandateKey;
       const resolved = await resolveMandate(displayKey, { organizationId: questionOrganizationId });

package/dist/agents/redux/execution-system/thunks/notify-and-play-dispatcher.d.ts

@@ -34,11 +34,7 @@ export interface NotifyAndPlayEntry<S> {
         run: (args: never, ctx: NotifyAndPlayContext<S>) => Promise<unknown>;
     };
 }
-export declare function createNotifyAndPlayDispatcher<S extends {
-    userAuth?: {
-        id?: string | null;
-    } | null;
-}>(options: {
+export declare function createNotifyAndPlayDispatcher<S>(options: {
     /** Redux action type prefix, e.g. "scribeTools/dispatch". */
     typePrefix: string;
     /** Human label used in the unknown-tool message, e.g. "scribe". */

package/dist/agents/redux/execution-system/thunks/notify-and-play-dispatcher.js

@@ -1,12 +1,13 @@
 import { createAsyncThunk } from "@reduxjs/toolkit";
 import { extractErrorMessage } from "@ai-matrx/data/net";
 import { postDelegatedToolOutcome } from "./post-delegated-tool-outcome.js";
+import { selectUserId } from "../../../../host/identity.js";
 function createNotifyAndPlayDispatcher(options) {
   const { typePrefix, family, isToolName, getEntry } = options;
   return createAsyncThunk(
     typePrefix,
     async ({ conversationId, requestId, callId, toolName, args }, { dispatch, getState }) => {
-      const userId = getState().userAuth?.id ?? null;
+      const userId = selectUserId(getState());
       const base = { conversationId, requestId, callId, toolName };
       const fail = (errorType, message, durationMs) => postDelegatedToolOutcome(dispatch, {
         ...base,

package/dist/agents/redux/execution-system/thunks/resolve-base-url.js

@@ -1,5 +1,5 @@
-import { adminLaneHeadersFor, adminLaneOrganizationId } from "../../../../host/server/admin-lane.js";
-import { adminSeatReplyOrganizationId } from "../utils/required-organization.js";
+import { chatRequestHeaders } from "../../../../host/request-headers.js";
+import { conversationRequestOrganizationId } from "../utils/required-organization.js";
 import {
   selectResolvedBaseUrl,
   selectActiveServer
@@ -14,7 +14,6 @@ import {
   getCachedLocalEngine,
   supportsLocalAgentExecution
 } from "../../../../host/server/local-engine.js";
-import { selectOrganizationId } from "../../../../host/org.js";
 import { getChatHost, isChatHostConfigured } from "../../../../host/configure.js";
 import {
   ConfidentialRoutingRefusedError,
@@ -86,21 +85,12 @@ function resolveBackendUnchecked(state, conversationId) {
   const entry = state.instanceUIState?.byConversationId?.[conversationId] ?? null;
   const overrideUrl = entry?.serverOverrideUrl ?? null;
   const headers = {
-    "Content-Type": "application/json"
+    "Content-Type": "application/json",
+    ...chatRequestHeaders(
+      { accessToken: selectAccessToken(state), fingerprintId: selectFingerprintId(state) },
+      conversationRequestOrganizationId(state, conversationId)
+    )
   };
-  const accessToken = selectAccessToken(state);
-  const fingerprintId = selectFingerprintId(state);
-  if (accessToken) {
-    headers["Authorization"] = `Bearer ${accessToken}`;
-  } else if (fingerprintId) {
-    headers["X-Fingerprint-ID"] = fingerprintId;
-  }
-  const conversationOrganizationId = state.conversations?.byConversationId?.[conversationId]?.organizationId ?? null;
-  const organizationId = adminSeatReplyOrganizationId(state, conversationId) ?? conversationOrganizationId ?? adminLaneOrganizationId() ?? selectOrganizationId(state);
-  if (organizationId) {
-    headers["X-Organization-Id"] = organizationId;
-    Object.assign(headers, adminLaneHeadersFor(organizationId));
-  }
   if (overrideUrl) {
     const ref = resolveAgentSandboxRef(state, conversationId);
     if (ref && ref.kind !== "local-pc") {

package/dist/agents/redux/execution-system/thunks/settle-after-stop.thunk.js

@@ -1,5 +1,5 @@
 import { createAsyncThunk } from "@reduxjs/toolkit";
-import { cancelAgentRunRequest } from "../../../../host/server/matrx-transport.js";
+import { cancelConversationRun } from "./call-conversation-api.js";
 import { fetchOperationsByLink } from "../../../runtime-reconnect/api.js";
 import { resolveBackendForConversation } from "./resolve-base-url.js";
 import { loadConversation } from "./load-conversation.thunk.js";
@@ -82,7 +82,7 @@ const settleAfterStop = createAsyncThunk(
       }
       if (op && !op.is_terminal && !cancelSentFor && op.request_id) {
         cancelSentFor = op.request_id;
-        const result = await dispatch(cancelAgentRunRequest(op.request_id));
+        const result = await dispatch(cancelConversationRun(conversationId, op.request_id));
         if (result.error) {
           console.warn("[settle-after-stop] late server cancel failed", {
             conversationId,

package/dist/agents/redux/execution-system/thunks/smart-execute.thunk.js

@@ -37,7 +37,7 @@ import {
   selectInFlightRequestIds,
   settleAfterStop
 } from "./settle-after-stop.thunk.js";
-import { cancelAgentRunRequest } from "../../../../host/server/matrx-transport.js";
+import { cancelConversationRun } from "./call-conversation-api.js";
 import { toast } from "../../../../host/notify.js";
 import { selectHostConversation } from "../host-conversations/host-conversations.selectors.js";
 import { sendToHost, stopHostTurn } from "../host-conversations/host-conversation.thunks.js";
@@ -508,7 +508,7 @@ const cancelExecution = createAsyncThunk(
         serverRequestId
       );
       void dispatch(
-        cancelAgentRunRequest(serverRequestId, "cancel", seenSeq)
+        cancelConversationRun(conversationId, serverRequestId, "cancel", seenSeq)
       ).then((result) => {
         if (result.error) {
           console.warn(
@@ -564,7 +564,7 @@ const interruptAndSend = createAsyncThunk(
         serverRequestId
       );
       void dispatch(
-        cancelAgentRunRequest(serverRequestId, "interrupt", seenSeq)
+        cancelConversationRun(conversationId, serverRequestId, "interrupt", seenSeq)
       ).then(
         (result) => {
           if (result.error) {

package/dist/agents/redux/execution-system/utils/continuation-body.d.ts

@@ -56,11 +56,17 @@ export declare const CONTINUATION_FIELD_ROUTING: {
     readonly max_iterations: "not assembled by this thunk";
     readonly max_retries_per_iteration: "not assembled by this thunk";
     readonly responder_agent_id: "coding-mirror replies only; not assembled by this thunk";
-    readonly host_turn: "host-owned turns only; not assembled by this thunk";
+    readonly host_turn: "set by the builder from the hostTurn option (never copied from the payload)";
 };
 export interface ContinuationBodyOptions {
     retry: boolean;
+    /** A host-written turn: sent as `host_turn`, and `user_input` is omitted (the person said nothing). */
+    hostTurn?: {
+        text: string;
+        reason: string;
+        metadata?: Record<string, unknown>;
+    };
     debug: boolean;
     cacheBypass: unknown;
 }
-export declare function buildContinuationBody(payload: AssembledAgentStartRequest, { retry, debug, cacheBypass }: ContinuationBodyOptions): Record<string, unknown>;
+export declare function buildContinuationBody(payload: AssembledAgentStartRequest, { retry, debug, cacheBypass, hostTurn }: ContinuationBodyOptions): Record<string, unknown>;

package/dist/agents/redux/execution-system/utils/continuation-body.js

@@ -50,12 +50,12 @@ const CONTINUATION_FIELD_ROUTING = {
   max_iterations: "not assembled by this thunk",
   max_retries_per_iteration: "not assembled by this thunk",
   responder_agent_id: "coding-mirror replies only; not assembled by this thunk",
-  host_turn: "host-owned turns only; not assembled by this thunk"
+  host_turn: "set by the builder from the hostTurn option (never copied from the payload)"
 };
 const EMPTY_IS_MEANINGFUL = /* @__PURE__ */ new Set(["tools", "output_kinds"]);
 const FALSE_IS_MEANINGFUL = /* @__PURE__ */ new Set(["memory", "tools_replace", "context_withheld"]);
-function buildContinuationBody(payload, { retry, debug, cacheBypass }) {
-  const body = retry ? { retry: true } : { user_input: payload.user_input };
+function buildContinuationBody(payload, { retry, debug, cacheBypass, hostTurn }) {
+  const body = retry ? { retry: true } : hostTurn ? { host_turn: hostTurn } : { user_input: payload.user_input };
   body.stream = true;
   const source = payload;
   for (const [key, route] of Object.entries(CONTINUATION_FIELD_ROUTING)) {

package/dist/agents/redux/execution-system/utils/required-organization.d.ts

@@ -80,4 +80,22 @@ export declare function launchAsksForOrganizationBeforeOpen(launch: {
     opensWindow: boolean;
 }): boolean;
 export declare function ensureExecutionOrganization(state: ChatRootState, conversationId: string): Promise<string | null>;
+/**
+ * THE ORG RULE (Audit B family 26): which organization a request on this conversation names.
+ * ONE function, read by the turn (`requireExecutionOrganizationId`) and by the conversation door
+ * every conversation-bound call rides (`resolveBackendForConversation`), so a turn and an inbox /
+ * tool-result / pending-calls / memory-cost / cancel call on the same conversation can never name
+ * different organizations. Guard: `__tests__/one-org-rule-per-conversation.test.ts`.
+ *
+ * - Not yet persisted (`cacheOnly !== false`, or not in the store): the organization a launcher
+ *   declared, then the admin seat's platform tenant (only in a host with a database), then the
+ *   app-selected organization.
+ * - Persisted: the row owns its organization forever. The one exception is a platform admin
+ *   replying from the admin seat to a conversation they reach only as an admin: the request names
+ *   the platform tenant (the admin lane admits nothing else); the row's own organization is
+ *   restored server-side and never changes.
+ *
+ * Returns null when nothing names one (the caller decides whether that refuses).
+ */
+export declare function conversationRequestOrganizationId(state: ChatRootState, conversationId: string): string | null;
 export declare function requireExecutionOrganizationId(state: ChatRootState, conversationId: string): string;

package/dist/agents/redux/execution-system/utils/required-organization.js

@@ -33,29 +33,33 @@ async function ensureExecutionOrganization(state, conversationId) {
     return null;
   }
 }
+function conversationRequestOrganizationId(state, conversationId) {
+  const instance = state.conversations?.byConversationId?.[conversationId];
+  if (instance && instance.cacheOnly === false) {
+    return adminSeatReplyOrganizationId(state, conversationId) ?? instance.organizationId ?? null;
+  }
+  return instance?.organizationId ?? // A host with no database has no admin seat to bill (G-DOOR: this door branches on the host).
+  (chatHostHasDatabase() ? adminLaneOrganizationId() : null) ?? selectOrganizationId(state) ?? null;
+}
 function requireExecutionOrganizationId(state, conversationId) {
   const instance = state.conversations.byConversationId[conversationId];
   if (!instance) {
     throw new Error(`Conversation ${conversationId} not found.`);
   }
+  const organizationId = conversationRequestOrganizationId(state, conversationId);
+  if (organizationId) return organizationId;
   if (instance.cacheOnly !== false) {
-    const startOrganizationId = instance.organizationId ?? // A host with no database has no admin seat to bill (G-DOOR: this door branches on the host).
-    (chatHostHasDatabase() ? adminLaneOrganizationId() : void 0) ?? selectOrganizationId(state);
-    if (startOrganizationId) return startOrganizationId;
     throw new Error(
       "Select an organization before sending this message. The request was not sent."
     );
   }
-  const organizationId = adminSeatReplyOrganizationId(state, conversationId) ?? instance.organizationId;
-  if (!organizationId) {
-    throw new Error(
-      "This conversation has no organization. Reload it before sending another message."
-    );
-  }
-  return organizationId;
+  throw new Error(
+    "This conversation has no organization. Reload it before sending another message."
+  );
 }
 export {
   adminSeatReplyOrganizationId,
+  conversationRequestOrganizationId,
   ensureExecutionOrganization,
   executionOrganizationForRequest,
   isFingerprintGuestExecution,

package/dist/agents/services/mcp-connections.service.js

@@ -4,7 +4,7 @@ import {
   readMatrxJsonResponse,
   sendMatrxRequest
 } from "@ai-matrx/agents/matrx";
-import { applyOrganizationContextHeader } from "../../host/server/organization-context.js";
+import { chatRequestHeaders } from "../../host/request-headers.js";
 import { ensureOrganizationForRequest } from "../../host/org.js";
 import { readSessionToken } from "../../host/identity.js";
 function backendBase() {
@@ -17,13 +17,10 @@ async function authHeaders(method, explicitOrganizationId) {
     method,
     organizationId: explicitOrganizationId
   });
-  return applyOrganizationContextHeader(
-    {
-      Authorization: `Bearer ${accessToken}`,
-      "Content-Type": "application/json"
-    },
-    organizationId
-  );
+  return {
+    "Content-Type": "application/json",
+    ...chatRequestHeaders({ accessToken, fingerprintId: null }, organizationId)
+  };
 }
 async function mcpFetch(path, init, explicitOrganizationId) {
   const headers = await authHeaders(init?.method ?? "GET", explicitOrganizationId);

package/dist/agents/ui-first-tools/dispatcher/dispatch-ui-first-tool.thunk.js

@@ -3,11 +3,12 @@ import { extractErrorMessage } from "@ai-matrx/data/net";
 import { submitToolResult } from "../../api/submit-tool-results.js";
 import { upsertToolLifecycle } from "../../redux/execution-system/active-requests/active-requests.slice.js";
 import { getUiFirstToolEntry } from "../tools/registry.js";
+import { selectUserId } from "../../../host/identity.js";
 const dispatchUiFirstTool = createAsyncThunk(
   "uiFirstTools/dispatch",
   async ({ conversationId, requestId, callId, toolName, args }, { dispatch, getState }) => {
     const state = getState();
-    const userId = state.userAuth?.id ?? null;
+    const userId = selectUserId(state);
     if (!userId) {
       dispatch(
         upsertToolLifecycle({

package/dist/host/defaults/files-host.js

@@ -3,6 +3,7 @@ import {
   isFilesHostConfigured
 } from "@ai-matrx/media/files/engine/host/configure";
 import { getStoreSingleton } from "../../store/store-singleton.js";
+import { chatRequestHeaders } from "../request-headers.js";
 const DEFAULT_FILES_SERVICE_URL = "https://files.matrxserver.com";
 const UUID = "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}";
 const FILES_SERVICE_ROUTES = [
@@ -45,7 +46,16 @@ function createDefaultFilesServer(host) {
   async function buildHeaders(opts, includeContentType) {
     const requestId = opts.requestId ?? (globalThis.crypto?.randomUUID?.() ?? `${Date.now()}`);
     const headers = { ...await host().server.headers?.() ?? {}, "X-Request-Id": requestId };
-    if (opts.organizationId) headers["X-Organization-Id"] = opts.organizationId;
+    if (opts.organizationId) {
+      const identity = host().identity;
+      Object.assign(
+        headers,
+        chatRequestHeaders(
+          { accessToken: await identity.getAccessToken(), fingerprintId: identity.current().fingerprintId },
+          opts.organizationId
+        )
+      );
+    }
     if (opts.idempotencyKey) headers["Idempotency-Key"] = opts.idempotencyKey;
     if (includeContentType) headers["Content-Type"] = "application/json";
     return { headers, requestId };

package/dist/host/defaults/server-api.d.ts

@@ -10,7 +10,7 @@
  * values here — no admin lane, no admin door, no endpoint overrides, no local
  * engine, no browser extension (each refusal says so once).
  */
-import { applyOrganizationContextHeader, type MatrxCallError, type MatrxCallResult, type MatrxCancelResponse, type MatrxTransport, type ProviderSessionFailure, type ProviderSessionFailureVerdict } from "@ai-matrx/agents/matrx";
+import { applyOrganizationContextHeader, type MatrxCallError, type MatrxCallResult, type MatrxTransport, type ProviderSessionFailure, type ProviderSessionFailureVerdict } from "@ai-matrx/agents/matrx";
 import type { TypedStreamEvent } from "@ai-matrx/agents/generated/stream-events";
 import type { ApiPaths, ApiSchemas as Schemas, DefaultBrokeredCredential, DefaultRequestOptions, GetResult, PatchBody, PatchResult, PathWith, PostBody, PostResult } from "./typed-paths.js";
 import type { ChatIdentityPort, ChatOrgPort, ChatServerPort } from "../contract.js";
@@ -113,19 +113,6 @@ export declare function createDefaultServerApi(host: () => ServerHostView): {
     resolveScope: (_state?: unknown, overrides?: Partial<DefaultCallScope>) => DefaultCallScope;
     buildRequestBody: (body: unknown, scope: DefaultCallScope) => Record<string, unknown>;
     waitForAuthReady: (_getState?: AnyGetState) => Promise<boolean>;
-    callConversationMemoryCost: (conversationId: string, options?: {
-        signal?: AbortSignal;
-        scopeOverrides?: Partial<DefaultCallScope>;
-    }) => DefaultServerThunk<Promise<DefaultApiCallResult<{
-        conversation_id: string;
-        total_cost: number;
-        total_input_tokens: number;
-        total_output_tokens: number;
-        event_count: number;
-        by_event_type: {
-            [key: string]: import("@ai-matrx/agents/generated/api-types").components["schemas"]["MemoryCostByEventType"];
-        };
-    }>>>;
     callConversationFork: (options: {
         conversationId: string;
         body?: unknown;
@@ -302,7 +289,6 @@ export declare function createDefaultServerApi(host: () => ServerHostView): {
         source?: string;
         expectedErrorStatuses?: readonly number[];
     }) => MatrxTransport;
-    cancelAgentRunRequest: (requestId: string, mode?: "cancel" | "interrupt", seenSeq?: number) => DefaultServerThunk<Promise<DefaultApiCallResult<MatrxCancelResponse>>>;
     peekSelectedOrganizationId: () => string | null;
     waitForOrganizationAdmission: () => Promise<DefaultChatServerTypes["OrganizationAdmission"]>;
     adminLaneOrganizationId: () => string | null;

package/dist/host/defaults/server-api.js

@@ -3,7 +3,6 @@ import {
   applyOrganizationContextHeader,
   buildMatrxRequestBody,
   buildMatrxRequestUrl,
-  cancelAgentRun,
   createMatrxTransport as createPackageTransport,
   executeMatrxCall,
   normalizeMatrxError,
@@ -156,14 +155,6 @@ function createDefaultServerApi(host) {
     resolveScope,
     buildRequestBody,
     waitForAuthReady: async (_getState) => true,
-    callConversationMemoryCost: (conversationId, options) => callApi({
-      path: "/ai/conversations/{conversation_id}/memory_cost",
-      method: "GET",
-      pathParams: { conversation_id: conversationId },
-      stream: false,
-      ...options?.signal ? { signal: options.signal } : {},
-      ...options?.scopeOverrides ? { scopeOverrides: options.scopeOverrides } : {}
-    }),
     callConversationFork: call("POST", "/cx/conversations/{conversation_id}/fork"),
     callConversationForkAndRun: call("POST", "/ai/conversations/{conversation_id}/fork-and-run", true),
     callBatchDeleteMessages: call("POST", "/cx/conversations/{conversation_id}/messages/delete"),
@@ -184,18 +175,6 @@ function createDefaultServerApi(host) {
       ...options.source ? { source: options.source } : {},
       ...options.expectedErrorStatuses ? { expectedErrorStatuses: options.expectedErrorStatuses } : {}
     }),
-    cancelAgentRunRequest: (requestId, mode = "cancel", seenSeq) => async () => {
-      const base = transport();
-      const sender = seenSeq === void 0 ? base : {
-        fetch: (path, init) => base.fetch(`${path}${path.includes("?") ? "&" : "?"}seen_seq=${seenSeq}`, init)
-      };
-      try {
-        const data = await cancelAgentRun(sender, requestId, { mode });
-        return { data, requestId: data.request_id };
-      } catch (error) {
-        return { error: normalizeMatrxError(error) };
-      }
-    },
     // organization admission + the admin seat (none in a bare host)
     peekSelectedOrganizationId: () => host().org.active()?.id ?? null,
     waitForOrganizationAdmission: async () => host().org.active() ? "ready" : "unresolved",

package/dist/host/defaults/server.d.ts

@@ -1,6 +1,7 @@
 /**
  * Default server port: the production AI Dream server; headers carry the
- * bearer token and the active organization.
+ * session credential and the active organization, built by THE ONE header
+ * builder (`../request-headers.ts`).
  */
 import type { ChatIdentityPort, ChatOrgPort, ChatServerPort } from "../contract.js";
 export declare const DEFAULT_CHAT_SERVER_URL = "https://server.app.matrxserver.com";

package/dist/host/defaults/server.js

@@ -1,14 +1,16 @@
+import { chatRequestHeaders } from "../request-headers.js";
 const DEFAULT_CHAT_SERVER_URL = "https://server.app.matrxserver.com";
 function createDefaultServer(identity, org) {
   return {
     baseUrl: () => DEFAULT_CHAT_SERVER_URL,
     async headers() {
-      const headers = {};
-      const token = await identity().getAccessToken();
-      if (token) headers.Authorization = `Bearer ${token}`;
-      const active = org().active();
-      if (active) headers["X-Organization-Id"] = active.id;
-      return headers;
+      return chatRequestHeaders(
+        {
+          accessToken: await identity().getAccessToken(),
+          fingerprintId: identity().current().fingerprintId
+        },
+        org().active()?.id ?? null
+      );
     }
   };
 }

package/dist/host/request-headers.d.ts

@@ -0,0 +1,26 @@
+/**
+ * THE ONE HEADER BUILDER for every request the chat package sends to an AI Matrx server
+ * (Audit B family 8, "the inbox class").
+ *
+ * Who is asking (credential) and which organization the request names, as headers:
+ *   - `Authorization: Bearer <jwt>` for a signed-in session, else `X-Fingerprint-ID` for a guest
+ *     (the platform's one credential mapping, `credentialToHeaders` in `@ai-matrx/data`, which
+ *     `@ai-matrx/api` carries forward unchanged);
+ *   - `X-Organization-Id` when an organization is named;
+ *   - the admin-lane marker when that organization is the platform tenant on the admin seat
+ *     (`adminLaneHeadersFor`, the host's rule; none in a bare host).
+ *
+ * Every request path uses it: the conversation door (`resolveBackendForConversation`, which every
+ * turn and every conversation-bound call rides), the package default server port and the web
+ * app's server port. WHICH organization a conversation request names is a separate, single rule:
+ * `conversationRequestOrganizationId` (`agents/redux/execution-system/utils/required-organization.ts`).
+ * Guard: `host/__tests__/one-header-builder.test.ts` fails when a second builder appears.
+ */
+export interface ChatRequestCredential {
+    /** The session's bearer token, or null. */
+    accessToken: string | null;
+    /** The guest fingerprint a signed-out visitor is known by, or null. */
+    fingerprintId: string | null;
+}
+/** The headers that say who is asking and in which organization. */
+export declare function chatRequestHeaders(credential: ChatRequestCredential, organizationId: string | null | undefined): Record<string, string>;

package/dist/host/request-headers.js

@@ -0,0 +1,15 @@
+import { credentialToHeaders } from "@ai-matrx/data";
+import { adminLaneHeadersFor } from "./server/admin-lane.js";
+function chatRequestHeaders(credential, organizationId) {
+  const presented = credential.accessToken ? { kind: "user", accessToken: credential.accessToken } : credential.fingerprintId ? { kind: "guest", fingerprintId: credential.fingerprintId } : null;
+  const headers = credentialToHeaders(presented);
+  if (!organizationId) return headers;
+  return {
+    ...headers,
+    "X-Organization-Id": organizationId,
+    ...adminLaneHeadersFor(organizationId)
+  };
+}
+export {
+  chatRequestHeaders
+};