@opengeni/api-router 3.0.1 → 3.1.2

package/dist/mcp/scheduled-task-view.d.ts

@@ -60,6 +60,7 @@ export declare function projectScheduledTaskSchedule(schedule: ScheduledTaskSche
 export declare function scheduledTaskMcpSummary(task: ScheduledTask): {
     id: string;
     name: string;
+    executionDigest: string;
     status: "active" | "paused";
     schedule: {
         type: "manual";
@@ -82,8 +83,8 @@ export declare function scheduledTaskMcpSummary(task: ScheduledTask): {
     runMode: "existing_session" | "new_session_per_run" | "reusable_session";
     overlapPolicy: "allow_concurrent" | "buffer_one" | "skip";
     action: {
+        readonly sourceId?: never;
         kind: "agent_turn";
-        sourceId?: never;
         sourceGeneration?: never;
         sourceLifecycleGeneration?: never;
         destination?: never;
@@ -135,6 +136,7 @@ export declare function scheduledTaskMcpSummary(task: ScheduledTask): {
     createdAt: string;
     updatedAt: string;
     configuration: {
+        source: string;
         model: string | null;
         reasoningEffort: "high" | "low" | "max" | "medium" | "minimal" | "none" | "xhigh" | null;
         sandboxBackend: "blaxel" | "cloudflare" | "daytona" | "docker" | "e2b" | "local" | "modal" | "none" | "opensandbox" | "runloop" | "selfhosted" | "vercel" | null;
@@ -142,6 +144,7 @@ export declare function scheduledTaskMcpSummary(task: ScheduledTask): {
         promptBytes: number;
         resourceCount: number;
         toolCount: number;
+        connectors: string;
         metadataKeyCount: number;
         taskMetadataKeyCount: number;
     };
@@ -180,9 +183,22 @@ export declare function scheduledTaskMcpSummary(task: ScheduledTask): {
         maxBytes: number;
     };
 };
+/** Exact bounded text; JSON escapes preserve even legacy lone UTF-16 units. */
+export declare function scheduledTaskPromptPage(task: ScheduledTask, offset: number, expectedExecutionDigest?: string): {
+    id: string;
+    executionDigest: string;
+    prompt: {
+        text: string;
+        offset: number;
+        nextOffset: number | null;
+        totalLength: number;
+        unit: "utf16";
+    };
+};
 export declare function boundScheduledTaskDetailMcp(task: ScheduledTask): {
     id: string;
     name: string;
+    executionDigest: string;
     status: "active" | "paused";
     schedule: {
         type: "manual";
@@ -205,8 +221,8 @@ export declare function boundScheduledTaskDetailMcp(task: ScheduledTask): {
     runMode: "existing_session" | "new_session_per_run" | "reusable_session";
     overlapPolicy: "allow_concurrent" | "buffer_one" | "skip";
     action: {
+        readonly sourceId?: never;
         kind: "agent_turn";
-        sourceId?: never;
         sourceGeneration?: never;
         sourceLifecycleGeneration?: never;
         destination?: never;
@@ -258,6 +274,7 @@ export declare function boundScheduledTaskDetailMcp(task: ScheduledTask): {
     createdAt: string;
     updatedAt: string;
     configuration: {
+        source: string;
         model: string | null;
         reasoningEffort: "high" | "low" | "max" | "medium" | "minimal" | "none" | "xhigh" | null;
         sandboxBackend: "blaxel" | "cloudflare" | "daytona" | "docker" | "e2b" | "local" | "modal" | "none" | "opensandbox" | "runloop" | "selfhosted" | "vercel" | null;
@@ -265,6 +282,7 @@ export declare function boundScheduledTaskDetailMcp(task: ScheduledTask): {
         promptBytes: number;
         resourceCount: number;
         toolCount: number;
+        connectors: string;
         metadataKeyCount: number;
         taskMetadataKeyCount: number;
     };
@@ -307,6 +325,7 @@ export declare function boundScheduledTaskDetailMcp(task: ScheduledTask): {
             prompt: string;
             resources: Record<string, unknown>[];
             tools: Record<string, unknown>[];
+            excludedDefaultConnectors?: string[];
             metadataKeys: string[];
             model: string | null;
             reasoningEffort: "high" | "low" | "max" | "medium" | "minimal" | "none" | "xhigh" | null;
@@ -318,6 +337,13 @@ export declare function boundScheduledTaskDetailMcp(task: ScheduledTask): {
             } | null;
         };
         taskMetadataKeys: string[];
+        slackPosting: {
+            identity: string | null;
+            connectionId: string | null;
+            channelId: string | null;
+            configured: boolean;
+            setup: string;
+        };
     };
     detailProjection: {
         bounded: boolean;
@@ -356,6 +382,191 @@ export declare function boundScheduledTaskDetailMcp(task: ScheduledTask): {
         bytes: number;
         maxBytes: number;
     };
+} | {
+    id: string;
+    name: string;
+    executionDigest: string;
+    status: "active" | "paused";
+    schedule: {
+        type: "manual";
+    } | {
+        type: "once";
+        runAt: string;
+        timeZone: string;
+    } | {
+        type: "interval";
+        everySeconds: number;
+        startAt?: string | undefined;
+        endAt?: string | undefined;
+    } | {
+        type: "calendar";
+        timeZone: string;
+        hour: number;
+        minute: number;
+        daysOfWeek?: ("FRIDAY" | "MONDAY" | "SATURDAY" | "SUNDAY" | "THURSDAY" | "TUESDAY" | "WEDNESDAY")[] | undefined;
+    };
+    runMode: "existing_session" | "new_session_per_run" | "reusable_session";
+    overlapPolicy: "allow_concurrent" | "buffer_one" | "skip";
+    action: {
+        readonly sourceId?: never;
+        kind: "agent_turn";
+        sourceGeneration?: never;
+        sourceLifecycleGeneration?: never;
+        destination?: never;
+        initiatingSubjectId?: never;
+        allDescendants?: never;
+        connection?: never;
+        limits?: never;
+    } | {
+        kind: "knowledge_source_sync";
+        sourceId: string;
+        sourceGeneration: number;
+        sourceLifecycleGeneration: number;
+        destination: {
+            kind: "organization";
+            workspaceId: null;
+            subjectId: null;
+        } | {
+            kind: "workspace";
+            workspaceId: string;
+            subjectId: null;
+        } | {
+            kind: "personal";
+            workspaceId: string | null;
+            subjectId: string;
+        };
+        initiatingSubjectId: string;
+        allDescendants: boolean;
+        connection: {
+            connectionId: string;
+            connectionVersion: number;
+            providerDomain: string;
+            kind: "api_key" | "app_install" | "delegated" | "oauth2";
+            ownerSubjectId: string;
+        };
+        limits: {
+            maxItems: number;
+            maxBytes: number;
+            maxFileBytes: number;
+            maxProviderRequests: number;
+            maxElapsedSeconds: number;
+            maxConcurrency: number;
+            maxFailureDetails: number;
+        };
+    };
+    targetSessionId: string | null;
+    reusableSessionId: string | null;
+    variableSetId: string | null;
+    rigId: string | null;
+    createdAt: string;
+    updatedAt: string;
+    configuration: {
+        source: string;
+        model: string | null;
+        reasoningEffort: "high" | "low" | "max" | "medium" | "minimal" | "none" | "xhigh" | null;
+        sandboxBackend: "blaxel" | "cloudflare" | "daytona" | "docker" | "e2b" | "local" | "modal" | "none" | "opensandbox" | "runloop" | "selfhosted" | "vercel" | null;
+        hasGoal: boolean;
+        promptBytes: number;
+        resourceCount: number;
+        toolCount: number;
+        connectors: string;
+        metadataKeyCount: number;
+        taskMetadataKeyCount: number;
+    };
+    projection: {
+        bounded: boolean;
+        name: ScheduledTaskUtf8ProjectionFact;
+        schedule: {
+            type: "manual";
+            truncated: false;
+            fields: Record<string, never>;
+        } | {
+            type: "once";
+            truncated: boolean;
+            fields: {
+                runAt: ScheduledTaskUtf8ProjectionFact;
+                timeZone: ScheduledTaskUtf8ProjectionFact;
+            };
+        } | {
+            type: "interval";
+            truncated: boolean;
+            fields: {
+                startAt: ScheduledTaskUtf8ProjectionFact | null;
+                endAt: ScheduledTaskUtf8ProjectionFact | null;
+            };
+        } | {
+            type: "calendar";
+            truncated: boolean;
+            fields: {
+                timeZone: ScheduledTaskUtf8ProjectionFact;
+            };
+        };
+        model: ScheduledTaskUtf8ProjectionFact | null;
+        createdAt: ScheduledTaskUtf8ProjectionFact;
+        updatedAt: ScheduledTaskUtf8ProjectionFact;
+        bytes: number;
+        maxBytes: number;
+    };
+    entity: {
+        agentConfig: {
+            prompt: string;
+            resources: never[];
+            tools: never[];
+            metadataKeys: never[];
+            model: null;
+            reasoningEffort: "high" | "low" | "max" | "medium" | "minimal" | "none" | "xhigh" | null;
+            sandboxBackend: "blaxel" | "cloudflare" | "daytona" | "docker" | "e2b" | "local" | "modal" | "none" | "opensandbox" | "runloop" | "selfhosted" | "vercel" | null;
+            goal: {
+                text: string;
+                successCriteria: string | null;
+                maxAutoContinuations: number | null;
+            } | null;
+        };
+        taskMetadataKeys: never[];
+    };
+    detailProjection: {
+        bounded: boolean;
+        fullEntityAvailableViaRest: boolean;
+        reducedForBytes: boolean;
+        terminal: boolean;
+        reason: string;
+        nextAction: {
+            surface: string;
+            resourceType: string;
+            resourceId: string;
+        };
+        prompt: ScheduledTaskUtf8ProjectionFact;
+        goalText: ScheduledTaskUtf8ProjectionFact | null;
+        goalSuccessCriteria: ScheduledTaskUtf8ProjectionFact | null;
+        resources: {
+            originalCount: number;
+            deliveredCount: number;
+            originalBytes: number;
+            truncatedIdentityFieldCount: number;
+        };
+        tools: {
+            originalCount: number;
+            deliveredCount: number;
+            originalBytes: number;
+            truncatedIdentityFieldCount: number;
+        };
+        metadata: {
+            originalKeyCount: number;
+            deliveredKeyCount: number;
+            originalBytes: number;
+            truncatedKeyCount: number;
+            valuesIncluded: boolean;
+        };
+        taskMetadata: {
+            originalKeyCount: number;
+            deliveredKeyCount: number;
+            originalBytes: number;
+            truncatedKeyCount: number;
+            valuesIncluded: boolean;
+        };
+        bytes: number;
+        maxBytes: number;
+    };
 };
 export declare function boundScheduledTaskMcpPage(input: {
     tasks: ScheduledTask[];
@@ -367,6 +578,7 @@ export declare function boundScheduledTaskMcpPage(input: {
     tasks: {
         id: string;
         name: string;
+        executionDigest: string;
         status: "active" | "paused";
         schedule: {
             type: "manual";
@@ -389,8 +601,8 @@ export declare function boundScheduledTaskMcpPage(input: {
         runMode: "existing_session" | "new_session_per_run" | "reusable_session";
         overlapPolicy: "allow_concurrent" | "buffer_one" | "skip";
         action: {
+            readonly sourceId?: never;
             kind: "agent_turn";
-            sourceId?: never;
             sourceGeneration?: never;
             sourceLifecycleGeneration?: never;
             destination?: never;
@@ -442,6 +654,7 @@ export declare function boundScheduledTaskMcpPage(input: {
         createdAt: string;
         updatedAt: string;
         configuration: {
+            source: string;
             model: string | null;
             reasoningEffort: "high" | "low" | "max" | "medium" | "minimal" | "none" | "xhigh" | null;
             sandboxBackend: "blaxel" | "cloudflare" | "daytona" | "docker" | "e2b" | "local" | "modal" | "none" | "opensandbox" | "runloop" | "selfhosted" | "vercel" | null;
@@ -449,6 +662,7 @@ export declare function boundScheduledTaskMcpPage(input: {
             promptBytes: number;
             resourceCount: number;
             toolCount: number;
+            connectors: string;
             metadataKeyCount: number;
             taskMetadataKeyCount: number;
         };

package/dist/mcp/secret-tools.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The agent's `secret_*` tools (capability `secrets`). They act with the exact
+ * live attempt's vault reach, return references and metadata, and never echo
+ * a value; `secret_get` is the one plaintext read and needs a literal
+ * `secrets:read` grant. Registration is gated centrally by
+ * FIRST_PARTY_TOOL_AUTHORIZATION and the session's signed tool selection, so
+ * with the capability off none of these tools exist.
+ */
+import { type AccessGrant } from "@opengeni/contracts";
+import { type ApiRouteDeps, type VaultService } from "@opengeni/core";
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export declare function registerSecretTools(server: McpServer, deps: ApiRouteDeps, grant: AccessGrant, sessionId: string, options?: {
+    vaults?: (subjectId: string | null) => VaultService;
+}): void;

package/dist/mcp/server.d.ts

@@ -1,7 +1,9 @@
-import { type AccessGrant, type GitHubRepository, type ResourceRef, type SessionAuthorizationActor, type WorkspaceMemoryPromptMode } from "@opengeni/contracts";
+import { ResourceRef, type AccessGrant, type GitHubRepository, type SessionAuthorizationActor, type WorkspaceMemoryPromptMode } from "@opengeni/contracts";
 import { listSessionDiscoverySummaries, type SessionDiscoveryCursor, type SessionDiscoveryOrderBy, type MemoryAgentScope } from "@opengeni/db";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import type { ApiRouteDeps } from "@opengeni/core";
+import { type OpenGeniSlackBotClient } from "../integrations/slack-bot.js";
+import { type SessionAdminAccessDispatch } from "./session-admin-access-tools.js";
 export type McpServerOptions = {
     requestOrigin?: string | null;
     workspaceMemoryEnabled?: boolean | undefined;
@@ -13,6 +15,106 @@ export type McpServerOptions = {
      * save into that private layer. Omitted/null keeps the workspace layer.
      */
     sessionMemory?: MemoryAgentScope | null | undefined;
+    /**
+     * Set by the route only when the bound session has admin access right now
+     * (allowed by the organization, given by an owner or admin who still is
+     * one). It adds the admin tools whatever the session's tool selection;
+     * each call checks the access again.
+     */
+    sessionAdminAccess?: SessionAdminAccessDispatch | null | undefined;
+};
+type OrchestrationToolName = "session_create" | "session_send_message" | "session_steer";
+export declare function orchestrationFailureEnvelope(tool: OrchestrationToolName, error: unknown): {
+    error: {
+        reason?: never;
+        code: string;
+        message: string;
+        retryable: boolean;
+    };
+} | {
+    error: {
+        code: string;
+        message: string;
+        reason: "SESSION_ARCHIVED_READ_ONLY" | "SESSION_IMPORTED_READ_ONLY";
+        retryable: boolean;
+    };
+} | {
+    error: {
+        code: "allowance_exhausted";
+        scope: "member" | "workspace";
+        resetsAt: string | null;
+        subjectId?: string | undefined;
+        reason?: never;
+        message: string;
+        retryable: boolean;
+    };
+} | {
+    error: {
+        code: "nested_agent_depth_exceeded" | "nested_agent_depth_override_forbidden";
+        details: {
+            readonly denial: {
+                id: string;
+                accountId: string;
+                workspaceId: string;
+                parentSessionId: string | null;
+                rootSessionId: string | null;
+                currentDepth: number;
+                attemptedDepth: number;
+                effectiveMaxNestedAgentDepth: number;
+                requestedMaxNestedAgentDepthOverride: number | null;
+                policySource: "default" | "deployment" | "session" | "workspace";
+                policySessionId: string | null;
+                subjectId: string | null;
+                code: "nested_agent_depth_exceeded" | "nested_agent_depth_override_forbidden";
+                idempotencyKey: string | null;
+                createdAt: string;
+            };
+        };
+        reason?: never;
+        retryable?: never;
+        message: string;
+    };
+} | {
+    error: {
+        reason?: never;
+        retryable?: never;
+        code: string;
+        message: string | undefined;
+    };
+};
+export declare function slackBotFileContentResult(result: Awaited<ReturnType<OpenGeniSlackBotClient["fileContent"]>>): {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    structuredContent: {
+        kind: "text";
+        fileId: string;
+        contentType: string;
+        content: string;
+        sizeBytes: null;
+        nextOffset: number | null;
+    };
+} | {
+    structuredContent: {
+        kind: "image";
+        fileId: string;
+        contentType: "image/jpeg" | "image/png" | "image/webp";
+        content: null;
+        sizeBytes: number;
+        nextOffset: null;
+    };
+    content: ({
+        type: "text";
+        text: string;
+        mimeType?: never;
+        data?: never;
+    } | {
+        text?: never;
+        type: "image";
+        mimeType: "image/jpeg" | "image/png" | "image/webp";
+        data: string;
+    })[];
 };
 export declare function buildOpenGeniMcpServer(deps: ApiRouteDeps, grant: AccessGrant, options?: McpServerOptions): McpServer;
 /** Only a prompt explicitly supplied through the human/API channel may redirect a user-paused goal. */
@@ -199,7 +301,7 @@ export declare function capSessionDiscoveryCompactPage(page: Awaited<ReturnType<
         updatedAt: string;
         queuedPromptCount?: number;
         latestMessage: {
-            type: "agent.message.completed" | "agent.message.delta" | "agent.model.request" | "agent.model.usage" | "agent.reasoning.delta" | "agent.toolCall.created" | "agent.toolCall.output" | "agent.updated" | "artifact.created" | "codex.account.selection.changed" | "codex.account.switched" | "codex.capacity.resumed" | "codex.capacity.superseded" | "codex.capacity.waiting" | "codex.credential.selected" | "codex.fleet.decision" | "credential.auth_needed" | "fs.changed" | "git.changed" | "goal.cleared" | "goal.completed" | "goal.continuation" | "goal.held" | "goal.paused" | "goal.progress" | "goal.resumed" | "goal.rewrite.proposed" | "goal.rewrite.rejected" | "goal.set" | "goal.updated" | "instruction.confirmation.recovered" | "knowledge.confirmation.recovered" | "knowledge.source.failed" | "knowledge.source.prepared" | "machine.link.lost" | "machine.link.restored" | "machine.op.failed" | "machine.op.recovered" | "machine.runner.restarted" | "memory.corrected" | "memory.saved" | "recording.available" | "recording.failed" | "recording.started" | "rig.setup.completed" | "rig.setup.failed" | "rig.setup.skipped" | "rig.setup.started" | "sandbox.box.created" | "sandbox.box.lost" | "sandbox.box.snapshot" | "sandbox.box.terminated" | "sandbox.command.output.delta" | "sandbox.env.drift" | "sandbox.operation.completed" | "sandbox.operation.failed" | "sandbox.operation.started" | "session.command.backgrounded" | "session.command.finished" | "session.context.cleared" | "session.context.compacted" | "session.context.compaction.requested" | "session.context.compaction.skipped" | "session.context.compaction.started" | "session.control.paused" | "session.control.resumed" | "session.control.steer_requested" | "session.created" | "session.event.envelope_omitted" | "session.humanInput.requested" | "session.mcp.approval_policy.updated" | "session.personal_resources.attached" | "session.queue.changed" | "session.queue.history" | "session.queue.prompt.cancelled" | "session.realtime.ended" | "session.realtime.started" | "session.requiresAction" | "session.route.reconciled" | "session.runtime.configured" | "session.status.changed" | "session.title_set" | "session.tool_policy.updated" | "session.variable_sets.updated" | "session.visibility.changed" | "session.wait.finished" | "session.wait.started" | "stream.closed" | "stream.opened" | "stream.revoked" | "stream.url.rotated" | "system.update.cancelled" | "system.update.delivered" | "system.update.pending" | "system.update.settled" | "system.update.superseded" | "terminal.pty.exited" | "terminal.pty.output.delta" | "terminal.pty.started" | "tool.auth_needed" | "turn.cancelled" | "turn.capacity_waiting" | "turn.completed" | "turn.event.rejected_late" | "turn.failed" | "turn.queued" | "turn.recovery.requested" | "turn.started" | "turn.startup.phase.completed" | "turn.startup.phase.failed" | "turn.startup.phase.started" | "turn.superseded" | "user.approvalDecision" | "user.humanInputResponse" | "user.message" | "user.pause" | "workspace.inference.paused" | "workspace.inference.resumed" | "workspace.revision.captured" | "workspace.revision.degraded";
+            type: "agent.message.completed" | "agent.message.delta" | "agent.model.request" | "agent.model.usage" | "agent.reasoning.delta" | "agent.toolCall.created" | "agent.toolCall.output" | "agent.updated" | "artifact.created" | "codex.account.selection.changed" | "codex.account.switched" | "codex.capacity.resumed" | "codex.capacity.superseded" | "codex.capacity.waiting" | "codex.credential.selected" | "codex.fleet.decision" | "credential.auth_needed" | "fs.changed" | "git.changed" | "goal.cleared" | "goal.completed" | "goal.continuation" | "goal.held" | "goal.paused" | "goal.progress" | "goal.resumed" | "goal.rewrite.proposed" | "goal.rewrite.rejected" | "goal.set" | "goal.updated" | "instruction.confirmation.recovered" | "knowledge.confirmation.recovered" | "knowledge.source.failed" | "knowledge.source.prepared" | "machine.link.lost" | "machine.link.restored" | "machine.op.failed" | "machine.op.recovered" | "machine.runner.restarted" | "memory.corrected" | "memory.saved" | "model_account.selection.changed" | "recording.available" | "recording.failed" | "recording.started" | "rig.setup.completed" | "rig.setup.failed" | "rig.setup.skipped" | "rig.setup.started" | "sandbox.box.created" | "sandbox.box.lost" | "sandbox.box.snapshot" | "sandbox.box.terminated" | "sandbox.command.output.delta" | "sandbox.env.drift" | "sandbox.operation.completed" | "sandbox.operation.failed" | "sandbox.operation.started" | "session.agent.updated" | "session.command.backgrounded" | "session.command.finished" | "session.context.cleared" | "session.context.compacted" | "session.context.compaction.requested" | "session.context.compaction.skipped" | "session.context.compaction.started" | "session.control.paused" | "session.control.resumed" | "session.control.steer_requested" | "session.created" | "session.event.envelope_omitted" | "session.humanInput.requested" | "session.mcp.approval_policy.updated" | "session.model_settings.updated" | "session.notification.posted" | "session.notification.withdrawn" | "session.personal_resources.attached" | "session.queue.changed" | "session.queue.history" | "session.queue.prompt.cancelled" | "session.realtime.ended" | "session.realtime.started" | "session.requiresAction" | "session.route.reconciled" | "session.runtime.configured" | "session.skills.updated" | "session.status.changed" | "session.title_set" | "session.tool_policy.updated" | "session.usage_limit.updated" | "session.variable_sets.updated" | "session.visibility.changed" | "session.wait.finished" | "session.wait.started" | "stream.closed" | "stream.opened" | "stream.revoked" | "stream.url.rotated" | "subscription.account.selected" | "subscription.account.switched" | "system.update.cancelled" | "system.update.delivered" | "system.update.pending" | "system.update.settled" | "system.update.superseded" | "terminal.pty.exited" | "terminal.pty.output.delta" | "terminal.pty.started" | "tool.auth_needed" | "turn.cancelled" | "turn.capacity_waiting" | "turn.completed" | "turn.dispatch.expired" | "turn.event.rejected_late" | "turn.failed" | "turn.queued" | "turn.recovery.requested" | "turn.started" | "turn.startup.phase.completed" | "turn.startup.phase.failed" | "turn.startup.phase.started" | "turn.superseded" | "usage.exhausted" | "usage.period_reset" | "usage.threshold_reached" | "user.approvalDecision" | "user.humanInputResponse" | "user.message" | "user.pause" | "workspace.inference.paused" | "workspace.inference.resumed" | "workspace.revision.captured" | "workspace.revision.degraded";
             previewOmitted: boolean;
             previewOmissionReason: "aggregatePreviewBudget";
             previewDrillDownTool: "session_events";
@@ -210,10 +312,10 @@ export declare function capSessionDiscoveryCompactPage(page: Awaited<ReturnType<
                 mode: "monitoring";
                 payloadMode: "summary";
                 sessionId: string;
-                includeTypes: ("agent.message.completed" | "agent.message.delta" | "agent.model.request" | "agent.model.usage" | "agent.reasoning.delta" | "agent.toolCall.created" | "agent.toolCall.output" | "agent.updated" | "artifact.created" | "codex.account.selection.changed" | "codex.account.switched" | "codex.capacity.resumed" | "codex.capacity.superseded" | "codex.capacity.waiting" | "codex.credential.selected" | "codex.fleet.decision" | "credential.auth_needed" | "fs.changed" | "git.changed" | "goal.cleared" | "goal.completed" | "goal.continuation" | "goal.held" | "goal.paused" | "goal.progress" | "goal.resumed" | "goal.rewrite.proposed" | "goal.rewrite.rejected" | "goal.set" | "goal.updated" | "instruction.confirmation.recovered" | "knowledge.confirmation.recovered" | "knowledge.source.failed" | "knowledge.source.prepared" | "machine.link.lost" | "machine.link.restored" | "machine.op.failed" | "machine.op.recovered" | "machine.runner.restarted" | "memory.corrected" | "memory.saved" | "recording.available" | "recording.failed" | "recording.started" | "rig.setup.completed" | "rig.setup.failed" | "rig.setup.skipped" | "rig.setup.started" | "sandbox.box.created" | "sandbox.box.lost" | "sandbox.box.snapshot" | "sandbox.box.terminated" | "sandbox.command.output.delta" | "sandbox.env.drift" | "sandbox.operation.completed" | "sandbox.operation.failed" | "sandbox.operation.started" | "session.command.backgrounded" | "session.command.finished" | "session.context.cleared" | "session.context.compacted" | "session.context.compaction.requested" | "session.context.compaction.skipped" | "session.context.compaction.started" | "session.control.paused" | "session.control.resumed" | "session.control.steer_requested" | "session.created" | "session.event.envelope_omitted" | "session.humanInput.requested" | "session.mcp.approval_policy.updated" | "session.personal_resources.attached" | "session.queue.changed" | "session.queue.history" | "session.queue.prompt.cancelled" | "session.realtime.ended" | "session.realtime.started" | "session.requiresAction" | "session.route.reconciled" | "session.runtime.configured" | "session.status.changed" | "session.title_set" | "session.tool_policy.updated" | "session.variable_sets.updated" | "session.visibility.changed" | "session.wait.finished" | "session.wait.started" | "stream.closed" | "stream.opened" | "stream.revoked" | "stream.url.rotated" | "system.update.cancelled" | "system.update.delivered" | "system.update.pending" | "system.update.settled" | "system.update.superseded" | "terminal.pty.exited" | "terminal.pty.output.delta" | "terminal.pty.started" | "tool.auth_needed" | "turn.cancelled" | "turn.capacity_waiting" | "turn.completed" | "turn.event.rejected_late" | "turn.failed" | "turn.queued" | "turn.recovery.requested" | "turn.started" | "turn.startup.phase.completed" | "turn.startup.phase.failed" | "turn.startup.phase.started" | "turn.superseded" | "user.approvalDecision" | "user.humanInputResponse" | "user.message" | "user.pause" | "workspace.inference.paused" | "workspace.inference.resumed" | "workspace.revision.captured" | "workspace.revision.degraded")[];
+                includeTypes: ("agent.message.completed" | "agent.message.delta" | "agent.model.request" | "agent.model.usage" | "agent.reasoning.delta" | "agent.toolCall.created" | "agent.toolCall.output" | "agent.updated" | "artifact.created" | "codex.account.selection.changed" | "codex.account.switched" | "codex.capacity.resumed" | "codex.capacity.superseded" | "codex.capacity.waiting" | "codex.credential.selected" | "codex.fleet.decision" | "credential.auth_needed" | "fs.changed" | "git.changed" | "goal.cleared" | "goal.completed" | "goal.continuation" | "goal.held" | "goal.paused" | "goal.progress" | "goal.resumed" | "goal.rewrite.proposed" | "goal.rewrite.rejected" | "goal.set" | "goal.updated" | "instruction.confirmation.recovered" | "knowledge.confirmation.recovered" | "knowledge.source.failed" | "knowledge.source.prepared" | "machine.link.lost" | "machine.link.restored" | "machine.op.failed" | "machine.op.recovered" | "machine.runner.restarted" | "memory.corrected" | "memory.saved" | "model_account.selection.changed" | "recording.available" | "recording.failed" | "recording.started" | "rig.setup.completed" | "rig.setup.failed" | "rig.setup.skipped" | "rig.setup.started" | "sandbox.box.created" | "sandbox.box.lost" | "sandbox.box.snapshot" | "sandbox.box.terminated" | "sandbox.command.output.delta" | "sandbox.env.drift" | "sandbox.operation.completed" | "sandbox.operation.failed" | "sandbox.operation.started" | "session.agent.updated" | "session.command.backgrounded" | "session.command.finished" | "session.context.cleared" | "session.context.compacted" | "session.context.compaction.requested" | "session.context.compaction.skipped" | "session.context.compaction.started" | "session.control.paused" | "session.control.resumed" | "session.control.steer_requested" | "session.created" | "session.event.envelope_omitted" | "session.humanInput.requested" | "session.mcp.approval_policy.updated" | "session.model_settings.updated" | "session.notification.posted" | "session.notification.withdrawn" | "session.personal_resources.attached" | "session.queue.changed" | "session.queue.history" | "session.queue.prompt.cancelled" | "session.realtime.ended" | "session.realtime.started" | "session.requiresAction" | "session.route.reconciled" | "session.runtime.configured" | "session.skills.updated" | "session.status.changed" | "session.title_set" | "session.tool_policy.updated" | "session.usage_limit.updated" | "session.variable_sets.updated" | "session.visibility.changed" | "session.wait.finished" | "session.wait.started" | "stream.closed" | "stream.opened" | "stream.revoked" | "stream.url.rotated" | "subscription.account.selected" | "subscription.account.switched" | "system.update.cancelled" | "system.update.delivered" | "system.update.pending" | "system.update.settled" | "system.update.superseded" | "terminal.pty.exited" | "terminal.pty.output.delta" | "terminal.pty.started" | "tool.auth_needed" | "turn.cancelled" | "turn.capacity_waiting" | "turn.completed" | "turn.dispatch.expired" | "turn.event.rejected_late" | "turn.failed" | "turn.queued" | "turn.recovery.requested" | "turn.started" | "turn.startup.phase.completed" | "turn.startup.phase.failed" | "turn.startup.phase.started" | "turn.superseded" | "usage.exhausted" | "usage.period_reset" | "usage.threshold_reached" | "user.approvalDecision" | "user.humanInputResponse" | "user.message" | "user.pause" | "workspace.inference.paused" | "workspace.inference.resumed" | "workspace.revision.captured" | "workspace.revision.degraded")[];
             };
         } | {
-            type: "agent.message.completed" | "agent.message.delta" | "agent.model.request" | "agent.model.usage" | "agent.reasoning.delta" | "agent.toolCall.created" | "agent.toolCall.output" | "agent.updated" | "artifact.created" | "codex.account.selection.changed" | "codex.account.switched" | "codex.capacity.resumed" | "codex.capacity.superseded" | "codex.capacity.waiting" | "codex.credential.selected" | "codex.fleet.decision" | "credential.auth_needed" | "fs.changed" | "git.changed" | "goal.cleared" | "goal.completed" | "goal.continuation" | "goal.held" | "goal.paused" | "goal.progress" | "goal.resumed" | "goal.rewrite.proposed" | "goal.rewrite.rejected" | "goal.set" | "goal.updated" | "instruction.confirmation.recovered" | "knowledge.confirmation.recovered" | "knowledge.source.failed" | "knowledge.source.prepared" | "machine.link.lost" | "machine.link.restored" | "machine.op.failed" | "machine.op.recovered" | "machine.runner.restarted" | "memory.corrected" | "memory.saved" | "recording.available" | "recording.failed" | "recording.started" | "rig.setup.completed" | "rig.setup.failed" | "rig.setup.skipped" | "rig.setup.started" | "sandbox.box.created" | "sandbox.box.lost" | "sandbox.box.snapshot" | "sandbox.box.terminated" | "sandbox.command.output.delta" | "sandbox.env.drift" | "sandbox.operation.completed" | "sandbox.operation.failed" | "sandbox.operation.started" | "session.command.backgrounded" | "session.command.finished" | "session.context.cleared" | "session.context.compacted" | "session.context.compaction.requested" | "session.context.compaction.skipped" | "session.context.compaction.started" | "session.control.paused" | "session.control.resumed" | "session.control.steer_requested" | "session.created" | "session.event.envelope_omitted" | "session.humanInput.requested" | "session.mcp.approval_policy.updated" | "session.personal_resources.attached" | "session.queue.changed" | "session.queue.history" | "session.queue.prompt.cancelled" | "session.realtime.ended" | "session.realtime.started" | "session.requiresAction" | "session.route.reconciled" | "session.runtime.configured" | "session.status.changed" | "session.title_set" | "session.tool_policy.updated" | "session.variable_sets.updated" | "session.visibility.changed" | "session.wait.finished" | "session.wait.started" | "stream.closed" | "stream.opened" | "stream.revoked" | "stream.url.rotated" | "system.update.cancelled" | "system.update.delivered" | "system.update.pending" | "system.update.settled" | "system.update.superseded" | "terminal.pty.exited" | "terminal.pty.output.delta" | "terminal.pty.started" | "tool.auth_needed" | "turn.cancelled" | "turn.capacity_waiting" | "turn.completed" | "turn.event.rejected_late" | "turn.failed" | "turn.queued" | "turn.recovery.requested" | "turn.started" | "turn.startup.phase.completed" | "turn.startup.phase.failed" | "turn.startup.phase.started" | "turn.superseded" | "user.approvalDecision" | "user.humanInputResponse" | "user.message" | "user.pause" | "workspace.inference.paused" | "workspace.inference.resumed" | "workspace.revision.captured" | "workspace.revision.degraded";
+            type: "agent.message.completed" | "agent.message.delta" | "agent.model.request" | "agent.model.usage" | "agent.reasoning.delta" | "agent.toolCall.created" | "agent.toolCall.output" | "agent.updated" | "artifact.created" | "codex.account.selection.changed" | "codex.account.switched" | "codex.capacity.resumed" | "codex.capacity.superseded" | "codex.capacity.waiting" | "codex.credential.selected" | "codex.fleet.decision" | "credential.auth_needed" | "fs.changed" | "git.changed" | "goal.cleared" | "goal.completed" | "goal.continuation" | "goal.held" | "goal.paused" | "goal.progress" | "goal.resumed" | "goal.rewrite.proposed" | "goal.rewrite.rejected" | "goal.set" | "goal.updated" | "instruction.confirmation.recovered" | "knowledge.confirmation.recovered" | "knowledge.source.failed" | "knowledge.source.prepared" | "machine.link.lost" | "machine.link.restored" | "machine.op.failed" | "machine.op.recovered" | "machine.runner.restarted" | "memory.corrected" | "memory.saved" | "model_account.selection.changed" | "recording.available" | "recording.failed" | "recording.started" | "rig.setup.completed" | "rig.setup.failed" | "rig.setup.skipped" | "rig.setup.started" | "sandbox.box.created" | "sandbox.box.lost" | "sandbox.box.snapshot" | "sandbox.box.terminated" | "sandbox.command.output.delta" | "sandbox.env.drift" | "sandbox.operation.completed" | "sandbox.operation.failed" | "sandbox.operation.started" | "session.agent.updated" | "session.command.backgrounded" | "session.command.finished" | "session.context.cleared" | "session.context.compacted" | "session.context.compaction.requested" | "session.context.compaction.skipped" | "session.context.compaction.started" | "session.control.paused" | "session.control.resumed" | "session.control.steer_requested" | "session.created" | "session.event.envelope_omitted" | "session.humanInput.requested" | "session.mcp.approval_policy.updated" | "session.model_settings.updated" | "session.notification.posted" | "session.notification.withdrawn" | "session.personal_resources.attached" | "session.queue.changed" | "session.queue.history" | "session.queue.prompt.cancelled" | "session.realtime.ended" | "session.realtime.started" | "session.requiresAction" | "session.route.reconciled" | "session.runtime.configured" | "session.skills.updated" | "session.status.changed" | "session.title_set" | "session.tool_policy.updated" | "session.usage_limit.updated" | "session.variable_sets.updated" | "session.visibility.changed" | "session.wait.finished" | "session.wait.started" | "stream.closed" | "stream.opened" | "stream.revoked" | "stream.url.rotated" | "subscription.account.selected" | "subscription.account.switched" | "system.update.cancelled" | "system.update.delivered" | "system.update.pending" | "system.update.settled" | "system.update.superseded" | "terminal.pty.exited" | "terminal.pty.output.delta" | "terminal.pty.started" | "tool.auth_needed" | "turn.cancelled" | "turn.capacity_waiting" | "turn.completed" | "turn.dispatch.expired" | "turn.event.rejected_late" | "turn.failed" | "turn.queued" | "turn.recovery.requested" | "turn.started" | "turn.startup.phase.completed" | "turn.startup.phase.failed" | "turn.startup.phase.started" | "turn.superseded" | "usage.exhausted" | "usage.period_reset" | "usage.threshold_reached" | "user.approvalDecision" | "user.humanInputResponse" | "user.message" | "user.pause" | "workspace.inference.paused" | "workspace.inference.resumed" | "workspace.revision.captured" | "workspace.revision.degraded";
             preview: string | null;
             previewTruncated?: boolean;
         };
@@ -298,7 +400,7 @@ export declare function capSessionDiscoveryPage(page: Awaited<ReturnType<typeof
             noAdditionalAccess: true;
         };
         latestMessage?: {
-            type: "agent.message.completed" | "agent.message.delta" | "agent.model.request" | "agent.model.usage" | "agent.reasoning.delta" | "agent.toolCall.created" | "agent.toolCall.output" | "agent.updated" | "artifact.created" | "codex.account.selection.changed" | "codex.account.switched" | "codex.capacity.resumed" | "codex.capacity.superseded" | "codex.capacity.waiting" | "codex.credential.selected" | "codex.fleet.decision" | "credential.auth_needed" | "fs.changed" | "git.changed" | "goal.cleared" | "goal.completed" | "goal.continuation" | "goal.held" | "goal.paused" | "goal.progress" | "goal.resumed" | "goal.rewrite.proposed" | "goal.rewrite.rejected" | "goal.set" | "goal.updated" | "instruction.confirmation.recovered" | "knowledge.confirmation.recovered" | "knowledge.source.failed" | "knowledge.source.prepared" | "machine.link.lost" | "machine.link.restored" | "machine.op.failed" | "machine.op.recovered" | "machine.runner.restarted" | "memory.corrected" | "memory.saved" | "recording.available" | "recording.failed" | "recording.started" | "rig.setup.completed" | "rig.setup.failed" | "rig.setup.skipped" | "rig.setup.started" | "sandbox.box.created" | "sandbox.box.lost" | "sandbox.box.snapshot" | "sandbox.box.terminated" | "sandbox.command.output.delta" | "sandbox.env.drift" | "sandbox.operation.completed" | "sandbox.operation.failed" | "sandbox.operation.started" | "session.command.backgrounded" | "session.command.finished" | "session.context.cleared" | "session.context.compacted" | "session.context.compaction.requested" | "session.context.compaction.skipped" | "session.context.compaction.started" | "session.control.paused" | "session.control.resumed" | "session.control.steer_requested" | "session.created" | "session.event.envelope_omitted" | "session.humanInput.requested" | "session.mcp.approval_policy.updated" | "session.personal_resources.attached" | "session.queue.changed" | "session.queue.history" | "session.queue.prompt.cancelled" | "session.realtime.ended" | "session.realtime.started" | "session.requiresAction" | "session.route.reconciled" | "session.runtime.configured" | "session.status.changed" | "session.title_set" | "session.tool_policy.updated" | "session.variable_sets.updated" | "session.visibility.changed" | "session.wait.finished" | "session.wait.started" | "stream.closed" | "stream.opened" | "stream.revoked" | "stream.url.rotated" | "system.update.cancelled" | "system.update.delivered" | "system.update.pending" | "system.update.settled" | "system.update.superseded" | "terminal.pty.exited" | "terminal.pty.output.delta" | "terminal.pty.started" | "tool.auth_needed" | "turn.cancelled" | "turn.capacity_waiting" | "turn.completed" | "turn.event.rejected_late" | "turn.failed" | "turn.queued" | "turn.recovery.requested" | "turn.started" | "turn.startup.phase.completed" | "turn.startup.phase.failed" | "turn.startup.phase.started" | "turn.superseded" | "user.approvalDecision" | "user.humanInputResponse" | "user.message" | "user.pause" | "workspace.inference.paused" | "workspace.inference.resumed" | "workspace.revision.captured" | "workspace.revision.degraded";
+            type: "agent.message.completed" | "agent.message.delta" | "agent.model.request" | "agent.model.usage" | "agent.reasoning.delta" | "agent.toolCall.created" | "agent.toolCall.output" | "agent.updated" | "artifact.created" | "codex.account.selection.changed" | "codex.account.switched" | "codex.capacity.resumed" | "codex.capacity.superseded" | "codex.capacity.waiting" | "codex.credential.selected" | "codex.fleet.decision" | "credential.auth_needed" | "fs.changed" | "git.changed" | "goal.cleared" | "goal.completed" | "goal.continuation" | "goal.held" | "goal.paused" | "goal.progress" | "goal.resumed" | "goal.rewrite.proposed" | "goal.rewrite.rejected" | "goal.set" | "goal.updated" | "instruction.confirmation.recovered" | "knowledge.confirmation.recovered" | "knowledge.source.failed" | "knowledge.source.prepared" | "machine.link.lost" | "machine.link.restored" | "machine.op.failed" | "machine.op.recovered" | "machine.runner.restarted" | "memory.corrected" | "memory.saved" | "model_account.selection.changed" | "recording.available" | "recording.failed" | "recording.started" | "rig.setup.completed" | "rig.setup.failed" | "rig.setup.skipped" | "rig.setup.started" | "sandbox.box.created" | "sandbox.box.lost" | "sandbox.box.snapshot" | "sandbox.box.terminated" | "sandbox.command.output.delta" | "sandbox.env.drift" | "sandbox.operation.completed" | "sandbox.operation.failed" | "sandbox.operation.started" | "session.agent.updated" | "session.command.backgrounded" | "session.command.finished" | "session.context.cleared" | "session.context.compacted" | "session.context.compaction.requested" | "session.context.compaction.skipped" | "session.context.compaction.started" | "session.control.paused" | "session.control.resumed" | "session.control.steer_requested" | "session.created" | "session.event.envelope_omitted" | "session.humanInput.requested" | "session.mcp.approval_policy.updated" | "session.model_settings.updated" | "session.notification.posted" | "session.notification.withdrawn" | "session.personal_resources.attached" | "session.queue.changed" | "session.queue.history" | "session.queue.prompt.cancelled" | "session.realtime.ended" | "session.realtime.started" | "session.requiresAction" | "session.route.reconciled" | "session.runtime.configured" | "session.skills.updated" | "session.status.changed" | "session.title_set" | "session.tool_policy.updated" | "session.usage_limit.updated" | "session.variable_sets.updated" | "session.visibility.changed" | "session.wait.finished" | "session.wait.started" | "stream.closed" | "stream.opened" | "stream.revoked" | "stream.url.rotated" | "subscription.account.selected" | "subscription.account.switched" | "system.update.cancelled" | "system.update.delivered" | "system.update.pending" | "system.update.settled" | "system.update.superseded" | "terminal.pty.exited" | "terminal.pty.output.delta" | "terminal.pty.started" | "tool.auth_needed" | "turn.cancelled" | "turn.capacity_waiting" | "turn.completed" | "turn.dispatch.expired" | "turn.event.rejected_late" | "turn.failed" | "turn.queued" | "turn.recovery.requested" | "turn.started" | "turn.startup.phase.completed" | "turn.startup.phase.failed" | "turn.startup.phase.started" | "turn.superseded" | "usage.exhausted" | "usage.period_reset" | "usage.threshold_reached" | "user.approvalDecision" | "user.humanInputResponse" | "user.message" | "user.pause" | "workspace.inference.paused" | "workspace.inference.resumed" | "workspace.revision.captured" | "workspace.revision.degraded";
             preview: string | null;
             previewTruncated: boolean;
         } | null;
@@ -334,3 +436,4 @@ export declare function capSessionDiscoveryPage(page: Awaited<ReturnType<typeof
     bytes: number;
     maxBytes: number;
 };
+export {};

package/dist/mcp/session-admin-access-tools.d.ts

@@ -0,0 +1,33 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { type AccessGrant } from "@opengeni/contracts";
+import { type Database } from "@opengeni/db";
+/**
+ * How a session with admin access reaches the organization's actions: the
+ * same actions as the organization MCP server, run in this process as the
+ * owner or admin who gave the session its access.
+ */
+export type SessionAdminAccessDispatch = {
+    /** This API's own origin; calls never leave the process. */
+    origin: string;
+    /**
+     * Runs one request through the API. It must run outside the calling
+     * agent's request context, so nothing of the agent's own database or
+     * billing scope carries into the action.
+     */
+    dispatch: (request: Request) => Promise<Response>;
+    signal?: AbortSignal;
+};
+/**
+ * Register the admin tools. The server admits them only while the session
+ * has admin access; every call checks it again, live, so turning it off,
+ * the organization stopping it, or the person losing their role takes effect
+ * on the very next call.
+ */
+export declare function registerSessionAdminAccessTools(input: {
+    server: McpServer;
+    db: Database;
+    grant: AccessGrant;
+    sessionId: string;
+    access: SessionAdminAccessDispatch;
+    authorize: () => Promise<void>;
+}): void;

package/dist/mcp/session-event-errors.d.ts

@@ -0,0 +1,28 @@
+/**
+ * An actionable refusal for a guessed event type: the nearest registered names
+ * and the dotted family the guess belongs to, so the next call can succeed.
+ * Suggestions are advisory text; the canonical registry still decides validity.
+ */
+export declare function unknownSessionEventTypeMessage(value: string): string;
+/**
+ * Validate an event-type list against the canonical registry. The first few
+ * unknown values carry suggestions; the rest are counted in one issue so a long
+ * list of guesses stays cheap to check and short to read.
+ */
+export declare function addUnknownSessionEventTypeIssues(values: readonly string[], isKnown: (value: string) => boolean, addIssue: (issue: {
+    code: "custom";
+    message: string;
+    path: number[];
+}) => void): void;
+/**
+ * Audit selectors (mode, payloadMode, resultMode, type/class filters, latest)
+ * belong to view=debug. The refusal carries the corrected debug call plus the
+ * content-view call without them, because either may be what the agent meant.
+ */
+export declare function sessionEventAuditSelectorMessage(input: {
+    sessionId: string;
+    view: string | undefined;
+    cursor: string | undefined;
+    audit: Record<string, unknown>;
+    position: Record<string, unknown>;
+}): string;