@ganju/utils 0.0.13 → 0.0.15

package/src/citations.ts

@@ -0,0 +1,127 @@
+import type { Source } from './sources';
+
+// "p. 125", "pp. 123–126", "page 12", "págs. 4-5", "páginas 3 a 5". An
+// abbreviation counts only with its dot and a number has to stand alone, so
+// "p2p", "mp3" and "pp 2026" are not page references. The lookarounds, not \b,
+// mark the edges: \b sees "á" as a word break.
+const PAGE_REFERENCE =
+  /(?<![\p{L}\p{N}])(?:(?:pp?|p[aá]gs?)\.|pages?|p[aá]ginas?)\s*(\d{1,5})(?![\p{L}\p{N}])(?:(?:\s*[-–—]\s*|\s+(?:to|a)\s+)(\d{1,5})(?![\p{L}\p{N}]))?/giu;
+const MAX_PAGE_RANGE = 50;
+
+// Lowercased words only, so "ETag header — HTTP | MDN" in an answer matches the
+// title "ETag header - HTTP | MDN", and "mml-book.pdf" matches "mml-book".
+const normalize = (text: string): string =>
+  ` ${text
+    .toLowerCase()
+    .normalize('NFKD')
+    .replace(/[̀-ͯ]/g, '')
+    .replace(/[^a-z0-9]+/g, ' ')
+    .trim()} `;
+
+// The ways an answer refers to a source: its whole title, the title without a
+// parenthetical or a site suffix ("Northwind Handbook (draft)", "ETag header
+// - HTTP | MDN"), its file name with and without the extension, and its URL.
+const namesFor = (source: Source): string[] => {
+  const names = [source.title, source.title.replace(/\s*\([^)]*\)\s*/g, ' ')];
+  const lead = source.title.split(/\s+[|\-–—:]\s+/)[0];
+  // A one-word lead ("Introduction", "Pricing") names half the corpus.
+  if (lead.trim().split(/\s+/).length >= 2) names.push(lead);
+  if (source.fileName) {
+    names.push(source.fileName, source.fileName.replace(/\.[a-z0-9]+$/i, ''));
+  }
+  return names.map(normalize).filter(name => name.trim().length >= 4);
+};
+
+// The characters that can carry a URL on past the point we matched. Brackets,
+// quotes and whitespace end it — that is how a URL sits inside Markdown links,
+// parentheses and prose.
+const URL_CONTINUATION = /^[^\s<>()[\]{}"'`|]*/;
+// Punctuation that closes a sentence around a URL rather than belonging to it.
+const TRAILING_PUNCTUATION = /[.,;:!?*_]+$/;
+
+/**
+ * Whether the answer cites this exact URL, not merely one that starts with it:
+ * on a crawled docs site the index page is a prefix of every page beneath it,
+ * so a plain substring test kept "/docs" and the site root in the footer of an
+ * answer that cited "/docs/api". A trailing slash and a #fragment still count
+ * as the same page.
+ */
+export const citesUrl = (answer: string, url: string): boolean => {
+  const target = url.replace(/\/+$/, '');
+  if (!target) return false;
+  for (
+    let at = answer.indexOf(target);
+    at !== -1;
+    at = answer.indexOf(target, at + 1)
+  ) {
+    const rest = answer
+      .slice(at + target.length)
+      .match(URL_CONTINUATION)![0]
+      .replace(TRAILING_PUNCTUATION, '');
+    if (/^\/*(#.*)?$/.test(rest)) return true;
+  }
+  return false;
+};
+
+/** Every page number the answer cites, ranges expanded. */
+export const citedPages = (answer: string): Set<number> => {
+  const pages = new Set<number>();
+  for (const match of answer.matchAll(PAGE_REFERENCE)) {
+    const from = Number(match[1]);
+    const to = match[2] ? Number(match[2]) : from;
+    if (to < from || to - from > MAX_PAGE_RANGE) {
+      pages.add(from);
+      continue;
+    }
+    for (let page = from; page <= to; page++) pages.add(page);
+  }
+  return pages;
+};
+
+/**
+ * Narrow a turn's sources to the ones its answer actually cites.
+ *
+ * Every search hit used to become a footer line, so an answer drawn from one
+ * handbook section was followed by eight unrelated pages the search had also
+ * returned. A search hit is kept when the answer names its resource — by title,
+ * file name or URL — and, for a paged file, only the pages the answer cites
+ * (or the best-ranked one, when it cites none). Resources the model read whole
+ * are always kept: reading one is itself the citation.
+ *
+ * An answer that names nothing gets no search sources at all. The model is told
+ * to cite what it uses, so a reply that names nothing is a greeting or "I
+ * couldn't find that" — and a footer under it would claim sources it never
+ * used, just because search runs on every message.
+ */
+export const selectCitedSources = (
+  sources: Source[],
+  answerText: string
+): Source[] => {
+  const searchEntries = sources.filter(s => s.score !== undefined);
+  const readEntries = sources.filter(s => s.score === undefined);
+  if (searchEntries.length === 0) return sources;
+
+  const answer = normalize(answerText);
+  const pages = citedPages(answerText);
+  const citedResources = new Set(
+    searchEntries
+      .filter(
+        s =>
+          citesUrl(answerText, s.uri) ||
+          namesFor(s).some(name => answer.includes(name))
+      )
+      .map(s => s.resourceId)
+  );
+
+  const kept: Source[] = [];
+  for (const resourceId of citedResources) {
+    const entries = searchEntries.filter(s => s.resourceId === resourceId);
+    const onCitedPage = entries.filter(
+      s => s.pageNumber !== undefined && pages.has(s.pageNumber)
+    );
+    kept.push(...(onCitedPage.length > 0 ? onCitedPage : entries.slice(0, 1)));
+  }
+
+  const cited = searchEntries.filter(s => kept.includes(s));
+  return [...cited, ...readEntries];
+};

package/src/constants.ts

@@ -324,6 +324,9 @@ const CRAWL_MAX_PAGES_LIMIT = 1000;
 const CRAWL_DEFAULT_MAX_DEPTH = 3;
 const CRAWL_MAX_DEPTH_LIMIT = 10;
 const CRAWL_PAGE_FETCH_TIMEOUT_MS = 30000;
+// Redirects one crawl fetch may follow. Each hop is screened on its own, so a
+// public URL can't bounce the crawler onto a private address.
+const CRAWL_MAX_REDIRECTS = 5;
 const CRAWL_USER_AGENT =
   'Mozilla/5.0 (compatible; GanjuCrawler/1.0; +https://ganju.ai)';
 const CRAWL_PAGE_QUEUE_BATCH_SIZE = 100;
@@ -597,6 +600,11 @@ const RATE_LIMIT_BACKOFF_SECONDS = 60;
 // / Container reset) so the retried job lands after the object has recovered.
 const TRANSIENT_BACKOFF_SECONDS = 5;
 
+// Retries every resource queue consumer is configured with (`max_retries` in
+// the API worker's wrangler config). A job's last delivery is attempt
+// QUEUE_MAX_RETRIES + 1; only then is its work marked failed.
+const QUEUE_MAX_RETRIES = 3;
+
 const CHANNEL_PLATFORM_TELEGRAM = 'telegram' as 'telegram';
 const CHANNEL_PLATFORM_SLACK = 'slack' as 'slack';
 const CHANNEL_PLATFORM_WHATSAPP = 'whatsapp' as 'whatsapp';
@@ -808,15 +816,39 @@ const TOOL_CONFIRMATION_ASK_INSTRUCTION =
   'confirm, and must not say or suggest that they were done, nor describe ' +
   'or make up any result from them.';
 // For MCP clients, whose chat the server can't see: a sensitive call without a
-// valid confirmation isn't run, and the model is told to ask the user and call
-// again with a token that binds the second call to these exact arguments.
-// How long that token stays good, and the argument that carries it.
+// valid confirmation isn't run. Ordinarily the model is told to ask the user
+// and call again with a token that binds the second call to these exact
+// arguments; once the session has read outside content, the user approves it
+// on a dashboard page instead, and the second call carries that approval's
+// id. How long either stays good, and the argument that carries it.
 const MCP_TOOL_CONFIRMATION_TTL_MS = 10 * 60 * 1000;
 const MCP_TOOL_CONFIRMATION_ARG = 'confirmation';
 const MCP_TOOL_CONFIRMATION_ARG_DESCRIPTION =
   "Leave out on the first call. This action needs the user's yes: the " +
-  'first call returns a token; after the user says yes, call again with the ' +
-  'same arguments and that token here.';
+  'first call returns a code and says how to get that yes; once the user ' +
+  'has given it, call again with the same arguments and that code here.';
+// The same argument where only some calls ask: those made after the session
+// read outside content.
+const MCP_TOOL_CONFIRMATION_ARG_DESCRIPTION_CONDITIONAL =
+  "Leave out on the first call. If this action needs the user's yes, the " +
+  'first call returns a code instead of running and says how to get that ' +
+  'yes; once the user has given it, call again with the same arguments and ' +
+  'that code here.';
+// The dashboard page where a signed-in user approves or denies one such call,
+// as `${TOOL_APPROVAL_PATH}/<approval id>`, and the two answers it sends.
+const TOOL_APPROVAL_PATH = '/tool-approval';
+const TOOL_APPROVAL_DECISION_APPROVE = 'approve';
+const TOOL_APPROVAL_DECISION_DENY = 'deny';
+const TOOL_APPROVAL_DECISIONS = [
+  TOOL_APPROVAL_DECISION_APPROVE,
+  TOOL_APPROVAL_DECISION_DENY
+] as const;
+// Where an approval stands, as the page shows it.
+const TOOL_APPROVAL_STATUS_PENDING = 'pending';
+const TOOL_APPROVAL_STATUS_APPROVED = 'approved';
+const TOOL_APPROVAL_STATUS_DENIED = 'denied';
+const TOOL_APPROVAL_STATUS_USED = 'used';
+const TOOL_APPROVAL_STATUS_EXPIRED = 'expired';
 // The question when the model wrote none, above the runner's own summary.
 const TOOL_CONFIRMATION_FALLBACK_QUESTION =
   'Before I do this, please confirm. Reply yes to go ahead, or no to cancel.';
@@ -841,13 +873,15 @@ const SLACK_MAX_SOURCE_BUTTONS = 10;
 
 // The Slack app configuration Ganju needs, surfaced in the UI when connecting a
 // Slack channel. Required scopes back the runner's calls (mentions, DMs,
-// posting, file upload); recommended scopes only enrich names/titles and
-// degrade gracefully; bot events are what the webhook subscribes to.
+// posting, file upload, downloading a voice clip to transcribe it);
+// recommended scopes only enrich names/titles and degrade gracefully; bot
+// events are what the webhook subscribes to.
 const SLACK_REQUIRED_SCOPES = [
   'app_mentions:read',
   'im:history',
   'chat:write',
-  'files:write'
+  'files:write',
+  'files:read'
 ];
 const SLACK_RECOMMENDED_SCOPES = ['users:read', 'channels:read', 'groups:read'];
 const SLACK_BOT_EVENTS = ['app_mention', 'message.im'];
@@ -964,10 +998,23 @@ const RESOURCE_SEARCH_COMMON_TERM_MIN = 5;
 // call per search; a failure falls back to the fused order.
 const RESOURCE_SEARCH_RERANK_CANDIDATES = 30;
 const RESOURCE_SEARCH_RERANK_MODEL = '@cf/baai/bge-reranker-base';
+// An identifier in the query (a code mixing letters and digits, a snake_case
+// name, or a number, dotted or hyphenated name typed on its own) found in at
+// most this many documents is what the user is after: its chunks go first,
+// whatever the reranker thinks. A cross-encoder reads "86400" or "PGRST116" as noise and
+// would bury the one chunk that contains it under pages that merely look
+// related. Past EXACT_MAX_CHUNKS matching chunks the identifier is common
+// enough that the usual ranking is left to decide, and the scan stops there.
+const RESOURCE_SEARCH_EXACT_MAX_RESOURCES = 5;
+const RESOURCE_SEARCH_EXACT_MAX_CHUNKS = 30;
+// An identifier the index never saw is looked for as plain text, which reads
+// every chunk of the artifact when nothing matches. Past this many chunks that
+// costs more than the rare hit is worth, so a large artifact skips it.
+const RESOURCE_SEARCH_SUBSTRING_MAX_CHUNKS = 20000;
 
 const RESOURCE_HANDLER_SLEEP_AFTER = '10m';
 
-const DOCS_URL = 'https://docs.ganju.ai';
+const DOCS_URL = 'https://ganju.ai/docs/';
 
 const BASE64_DATA_URI_RE =
   /data:image\/[a-zA-Z0-9+\-.]+;base64,[A-Za-z0-9+/=\s]+/g;
@@ -983,6 +1030,12 @@ const CHUNK_SEPARATORS: Array<{ split: string | RegExp; join: string }> = [
 
 const DEFAULT_MAX_TOKENS = 4096;
 
+// One page of `list-resources`. A knowledge base with a crawled site runs to
+// thousands of resources; listed whole, that is one result of several hundred
+// KB in the model's context.
+const LIST_RESOURCES_DEFAULT_LIMIT = 100;
+const LIST_RESOURCES_MAX_LIMIT = 500;
+
 const RESOURCE_TOOL_KEY_LIST_RESOURCES = 'list-resources';
 const RESOURCE_TOOL_KEY_SEARCH_RESOURCES = 'search-resources';
 const RESOURCE_TOOL_KEY_READ_RESOURCE = 'read-resource';
@@ -1514,7 +1567,9 @@ const RESERVED_TOOL_NAMES = [
   TOOL_DEFINITION_KEY_HTTP_ENDPOINT,
   TOOL_DEFINITION_KEY_MCP_PROXY,
   TOOL_DEFINITION_KEY_CUSTOM_CODE,
-  CUSTOM_CODE_HEALTH_TOOL
+  CUSTOM_CODE_HEALTH_TOOL,
+  // The channel runner's own memory tool (PARTICIPANT_MEMORY_TOOL_NAME).
+  'remember-customer'
 ];
 
 // Shared by both write paths so there is one string to translate. It has to
@@ -1781,6 +1836,10 @@ const MCP_SESSION_HEADER = 'mcp-session-id';
 const MCP_INTERNAL_HEADER = 'x-ganju-internal-secret';
 const MCP_CHANNEL_ID_HEADER = 'x-ganju-channel-id';
 const MCP_CHANNEL_PLATFORM_HEADER = 'x-ganju-channel-platform';
+// The conversation a channel turn belongs to. The MCP worker files that turn's
+// calls under one session per conversation, so a call can be traced back to
+// the chat it ran in.
+const MCP_CHANNEL_CONVERSATION_HEADER = 'x-ganju-channel-conversation-id';
 const MCP_CHANNEL_CLIENT_USER_AGENT = 'ganju-channel/0.0.1';
 const JWKS_KV_KEY = 'jwks:v1';
 const JWKS_TTL_SECONDS = 600;
@@ -1882,6 +1941,23 @@ const ACCESS_TOKEN_SCOPE_MESSAGE =
 const CUSTOM_CODE_LOGS_DEFAULT_LIMIT = 20;
 const CUSTOM_CODE_LOGS_MAX_LIMIT = 100;
 
+// Tool observability on the project home. The windows match the activity
+// chart's, and none reaches past `RETENTION_DAYS.mcpRequest`.
+const OBSERVABILITY_RANGE_DAYS = [7, 30, 90];
+// An enabled tool with no call in this many days is offered for disabling.
+const OBSERVABILITY_UNUSED_DAYS = 30;
+// Two calls in one session this close together are one attempt followed by
+// the next: a retry when it's the same tool, a switch when it's another tool
+// after an error.
+const OBSERVABILITY_FOLLOW_UP_SECONDS = 120;
+// How a call rejected by its tool's input schema reads in `error_message`.
+const OBSERVABILITY_SCHEMA_REJECTION_PREFIX = 'Input validation error';
+const OBSERVABILITY_TOP_ERRORS = 8;
+const OBSERVABILITY_CALLS_DEFAULT_LIMIT = 25;
+const OBSERVABILITY_CALLS_MAX_LIMIT = 100;
+// A session timeline is read whole up to this many calls, newest kept.
+const OBSERVABILITY_SESSION_MAX_CALLS = 500;
+
 const BOT_GRANT_TYPE = 'urn:ganju:bot-on-behalf-of';
 const EXTERNAL_LINK_VERIFICATION_PREFIX = 'external_link:';
 const EXTERNAL_LINK_TTL_SECONDS = 600;
@@ -2624,6 +2700,7 @@ export const constants = {
   CRAWL_DEFAULT_MAX_DEPTH,
   CRAWL_MAX_DEPTH_LIMIT,
   CRAWL_PAGE_FETCH_TIMEOUT_MS,
+  CRAWL_MAX_REDIRECTS,
   CRAWL_PAGE_QUEUE_BATCH_SIZE,
   CRAWL_USER_AGENT,
   RESOURCE_ICON_THEME_DARK,
@@ -2641,6 +2718,7 @@ export const constants = {
   TELEGRAM_MAX_FILE_BYTES,
   RATE_LIMIT_BACKOFF_SECONDS,
   TRANSIENT_BACKOFF_SECONDS,
+  QUEUE_MAX_RETRIES,
   ENCODINGS,
   ENCODING_UTF8,
   CHANNEL_PLATFORM_TELEGRAM,
@@ -2682,6 +2760,16 @@ export const constants = {
   MCP_TOOL_CONFIRMATION_TTL_MS,
   MCP_TOOL_CONFIRMATION_ARG,
   MCP_TOOL_CONFIRMATION_ARG_DESCRIPTION,
+  MCP_TOOL_CONFIRMATION_ARG_DESCRIPTION_CONDITIONAL,
+  TOOL_APPROVAL_PATH,
+  TOOL_APPROVAL_DECISION_APPROVE,
+  TOOL_APPROVAL_DECISION_DENY,
+  TOOL_APPROVAL_DECISIONS,
+  TOOL_APPROVAL_STATUS_PENDING,
+  TOOL_APPROVAL_STATUS_APPROVED,
+  TOOL_APPROVAL_STATUS_DENIED,
+  TOOL_APPROVAL_STATUS_USED,
+  TOOL_APPROVAL_STATUS_EXPIRED,
   CHANNEL_DEBOUNCE_DEFAULT_MS,
   CHANNEL_DEBOUNCE_MIN_MS,
   CHANNEL_DEBOUNCE_MAX_MS,
@@ -2754,6 +2842,9 @@ export const constants = {
   RESOURCE_SEARCH_COMMON_TERM_MIN,
   RESOURCE_SEARCH_RERANK_CANDIDATES,
   RESOURCE_SEARCH_RERANK_MODEL,
+  RESOURCE_SEARCH_EXACT_MAX_RESOURCES,
+  RESOURCE_SEARCH_EXACT_MAX_CHUNKS,
+  RESOURCE_SEARCH_SUBSTRING_MAX_CHUNKS,
   RESOURCE_HANDLER_SLEEP_AFTER,
   DOCS_URL,
   BASE64_DATA_URI_RE,
@@ -2761,6 +2852,8 @@ export const constants = {
   CHUNK_SEPARATORS,
   DEFAULT_MAX_TOKENS,
   RESOURCE_TOOL_KEY_LIST_RESOURCES,
+  LIST_RESOURCES_DEFAULT_LIMIT,
+  LIST_RESOURCES_MAX_LIMIT,
   RESOURCE_TOOL_KEY_SEARCH_RESOURCES,
   RESOURCE_TOOL_KEY_READ_RESOURCE,
   RESOURCE_TOOL_KEY_SEND_RESOURCE,
@@ -2934,6 +3027,7 @@ export const constants = {
   MCP_INTERNAL_HEADER,
   MCP_CHANNEL_ID_HEADER,
   MCP_CHANNEL_PLATFORM_HEADER,
+  MCP_CHANNEL_CONVERSATION_HEADER,
   MCP_CHANNEL_CLIENT_USER_AGENT,
   MCP_SESSION_HEADER,
   MCP_REQUEST_METHOD_INITIALIZE,
@@ -2971,6 +3065,14 @@ export const constants = {
   ACCESS_TOKEN_SCOPE_MESSAGE,
   CUSTOM_CODE_LOGS_DEFAULT_LIMIT,
   CUSTOM_CODE_LOGS_MAX_LIMIT,
+  OBSERVABILITY_RANGE_DAYS,
+  OBSERVABILITY_UNUSED_DAYS,
+  OBSERVABILITY_FOLLOW_UP_SECONDS,
+  OBSERVABILITY_SCHEMA_REJECTION_PREFIX,
+  OBSERVABILITY_TOP_ERRORS,
+  OBSERVABILITY_CALLS_DEFAULT_LIMIT,
+  OBSERVABILITY_CALLS_MAX_LIMIT,
+  OBSERVABILITY_SESSION_MAX_CALLS,
   BOT_GRANT_TYPE,
   EXTERNAL_LINK_VERIFICATION_PREFIX,
   EXTERNAL_LINK_TTL_SECONDS,

package/src/index.ts

@@ -98,6 +98,14 @@ import {
 } from './jsonSchemaToZodShape';
 import type { SchemaViolation } from './jsonSchemaToZodShape';
 import { buildProxyToolName } from './mcpProxy';
+import { countInstallTools } from './toolCount';
+import {
+  capText,
+  findNextCursor,
+  paginate,
+  InvalidCursorError,
+  listResourcesPage
+} from './pagination';
 import {
   mintCustomCodeToken,
   verifyCustomCodeToken,
@@ -142,7 +150,7 @@ import type {
   ResolvedAttachment,
   ResolveAttachmentResult
 } from './attachment';
-import { ipv4InPrivateRange, isBlockedHost } from './ssrf';
+import { ipv4InPrivateRange, isBlockedHost, isBlockedUrl } from './ssrf';
 import {
   requiresLlmBaseUrl,
   isAllowedLlmBaseUrl,
@@ -201,8 +209,10 @@ import type { RerankAiBinding } from './resourceRerank';
 import { sleep, isRateLimitError, withRateLimitRetry } from './retry';
 import type { RateLimitRetryOptions } from './retry';
 import { processQueueBatch } from './processQueueBatch';
+import { PermanentJobError, isPermanentJobError } from './queueFailure';
 import type {
   QueueBatchLike,
+  QueueFailureContext,
   QueueMessageLike,
   ProcessQueueBatchHandlers
 } from './processQueueBatch';
@@ -222,6 +232,7 @@ import {
 import type {
   BufferedChannelMessage,
   BufferedChannelCommand,
+  BufferedVoiceNote,
   ChannelBufferEnvelope,
   ChannelBufferFlush
 } from './channelDebounce';
@@ -235,13 +246,79 @@ import {
   annotationsForEffect,
   TOOL_EFFECTS,
   isSensitiveTool,
+  proxiedToolAnnotations,
+  proxiedToolTrust,
+  isSensitiveProxiedTool,
+  keepProxiedToolMarks,
+  toolApprovalStatus,
+  toolApprovalUrl,
   stableJson
 } from './toolConfirmation';
 import type {
   PendingToolConfirmation,
   PendingToolConfirmations,
-  ToolEffect
+  ToolEffect,
+  ToolApprovalStatus,
+  ProxiedToolTrust
 } from './toolConfirmation';
+import {
+  wrapUntrustedContent,
+  unwrapUntrustedContent,
+  isUntrustedToolResult,
+  findInstructionLikeText,
+  UNTRUSTED_CONTENT_TAG,
+  UNTRUSTED_CONTENT_META_KEY,
+  UNTRUSTED_CONTENT_NOTE,
+  INSTRUCTION_WARNING_METADATA_KEY,
+  untrustedToolResult,
+  ownWritingToolResult,
+  labelOwnToolResult,
+  labelProxiedToolResult,
+  untrustedErrorResult,
+  readsLikeInstructions,
+  labelResourceContents
+} from './untrustedContent';
+import type {
+  InstructionWarning,
+  LabelledToolResult
+} from './untrustedContent';
+import {
+  PARTICIPANT_DAILY_LIMIT_DEFAULT,
+  PARTICIPANT_DAILY_LIMIT_MAX,
+  PARTICIPANT_DAILY_LIMIT_OFF,
+  PARTICIPANT_DAILY_LIMIT_WINDOW_MS,
+  PARTICIPANT_LIMIT_METADATA_KEY,
+  resolveParticipantDailyLimit,
+  resolveParticipantMemoryEnabled,
+  VOICE_NOTE_MAX_BYTES,
+  VOICE_NOTE_MAX_SECONDS,
+  audioDurationSeconds,
+  oggDurationSeconds,
+  VOICE_NOTE_TRANSCRIPTION_PROMPT,
+  VOICE_NOTE_METADATA_KEY,
+  VOICE_NOTE_UNREADABLE_METADATA_KEY,
+  PARTICIPANT_MEMORY_TOOL_NAME,
+  PARTICIPANT_MEMORY_MAX_FACTS,
+  PARTICIPANT_MEMORY_TOOL_DESCRIPTION,
+  PARTICIPANT_MEMORY_TOOL_SCHEMA,
+  PARTICIPANT_MEMORY_GROUP_NOTE,
+  readParticipantMemory,
+  applyParticipantMemoryUpdate,
+  redactParticipantMemoryArgs,
+  redactParticipantMemoryConfirmation,
+  participantMemoryUpdateReadsLikeInstructions,
+  CONVERSATION_UNTRUSTED_WINDOW_MS,
+  CONVERSATION_UNTRUSTED_READ_AT_KEY,
+  conversationReadUntrustedRecently,
+  formatParticipantMemoryPrompt,
+  participantLimitNotice,
+  voiceNoteUnreadableNotice,
+  voiceNoteTooLongNotice
+} from './channelCustomer';
+import type {
+  ParticipantMemory,
+  ParticipantMemoryUpdate
+} from './channelCustomer';
 import {
   lintTools,
   TOOL_LINT_RULES,
@@ -263,6 +340,7 @@ import {
   formatSourcesAsButtons
 } from './sources';
 import type { Source, ResourceUrlContext, SourceButton } from './sources';
+import { citesUrl, citedPages, selectCitedSources } from './citations';
 import {
   refreshOAuthToken,
   OAuthReauthRequiredError,
@@ -323,6 +401,12 @@ export const utils = {
   jsonSchemaToZodShape,
   validateAgainstJsonSchema,
   buildProxyToolName,
+  countInstallTools,
+  capText,
+  findNextCursor,
+  paginate,
+  InvalidCursorError,
+  listResourcesPage,
   mintCustomCodeToken,
   verifyCustomCodeToken,
   customCodeScriptName,
@@ -347,6 +431,7 @@ export const utils = {
   validateProjectPath,
   projectPathIssue,
   ipv4InPrivateRange,
+  isBlockedUrl,
   isBlockedHost,
   requiresLlmBaseUrl,
   isAllowedLlmBaseUrl,
@@ -388,6 +473,8 @@ export const utils = {
   isRateLimitError,
   withRateLimitRetry,
   processQueueBatch,
+  PermanentJobError,
+  isPermanentJobError,
   getToolStatusMessage,
   resolveDebounceMs,
   channelBufferKey,
@@ -402,7 +489,59 @@ export const utils = {
   annotationsForEffect,
   TOOL_EFFECTS,
   isSensitiveTool,
+  proxiedToolAnnotations,
+  proxiedToolTrust,
+  isSensitiveProxiedTool,
+  keepProxiedToolMarks,
+  toolApprovalStatus,
+  toolApprovalUrl,
   stableJson,
+  wrapUntrustedContent,
+  unwrapUntrustedContent,
+  isUntrustedToolResult,
+  findInstructionLikeText,
+  UNTRUSTED_CONTENT_TAG,
+  UNTRUSTED_CONTENT_META_KEY,
+  UNTRUSTED_CONTENT_NOTE,
+  INSTRUCTION_WARNING_METADATA_KEY,
+  untrustedToolResult,
+  ownWritingToolResult,
+  labelOwnToolResult,
+  labelProxiedToolResult,
+  untrustedErrorResult,
+  readsLikeInstructions,
+  labelResourceContents,
+  PARTICIPANT_DAILY_LIMIT_DEFAULT,
+  PARTICIPANT_DAILY_LIMIT_MAX,
+  PARTICIPANT_DAILY_LIMIT_OFF,
+  PARTICIPANT_DAILY_LIMIT_WINDOW_MS,
+  PARTICIPANT_LIMIT_METADATA_KEY,
+  resolveParticipantDailyLimit,
+  resolveParticipantMemoryEnabled,
+  VOICE_NOTE_MAX_BYTES,
+  VOICE_NOTE_MAX_SECONDS,
+  audioDurationSeconds,
+  oggDurationSeconds,
+  VOICE_NOTE_TRANSCRIPTION_PROMPT,
+  VOICE_NOTE_METADATA_KEY,
+  VOICE_NOTE_UNREADABLE_METADATA_KEY,
+  PARTICIPANT_MEMORY_TOOL_NAME,
+  PARTICIPANT_MEMORY_MAX_FACTS,
+  PARTICIPANT_MEMORY_TOOL_DESCRIPTION,
+  PARTICIPANT_MEMORY_TOOL_SCHEMA,
+  PARTICIPANT_MEMORY_GROUP_NOTE,
+  readParticipantMemory,
+  applyParticipantMemoryUpdate,
+  redactParticipantMemoryArgs,
+  redactParticipantMemoryConfirmation,
+  participantMemoryUpdateReadsLikeInstructions,
+  CONVERSATION_UNTRUSTED_WINDOW_MS,
+  CONVERSATION_UNTRUSTED_READ_AT_KEY,
+  conversationReadUntrustedRecently,
+  formatParticipantMemoryPrompt,
+  participantLimitNotice,
+  voiceNoteUnreadableNotice,
+  voiceNoteTooLongNotice,
   lintTools,
   TOOL_LINT_RULES,
   TOOL_LINT_MAX_TOOLS,
@@ -413,6 +552,9 @@ export const utils = {
   buildResourceDownloadUrl,
   formatSourcesAsMarkdown,
   formatSourcesAsButtons,
+  citesUrl,
+  citedPages,
+  selectCitedSources,
   refreshOAuthToken,
   OAuthReauthRequiredError,
   buildReauthMetadata,
@@ -429,6 +571,10 @@ export const utils = {
 };
 
 export type {
+  ParticipantMemory,
+  ParticipantMemoryUpdate,
+  InstructionWarning,
+  LabelledToolResult,
   MintedAccessToken,
   CustomCodeProject,
   ProjectPathIssue,
@@ -439,6 +585,8 @@ export type {
   PendingToolConfirmation,
   PendingToolConfirmations,
   ToolEffect,
+  ToolApprovalStatus,
+  ProxiedToolTrust,
   LintableTool,
   ToolLintFinding,
   ToolLintOptions,
@@ -479,12 +627,14 @@ export type {
   RateLimitRetryOptions,
   RerankAiBinding,
   QueueBatchLike,
+  QueueFailureContext,
   QueueMessageLike,
   ProcessQueueBatchHandlers,
   ChannelNotifier,
   ToolStatusEvent,
   BufferedChannelMessage,
   BufferedChannelCommand,
+  BufferedVoiceNote,
   ChannelBufferEnvelope,
   ChannelBufferFlush,
   Source,