@opengeni/contracts 0.38.3 → 0.40.0

package/src/index.ts

@@ -6,6 +6,7 @@ import {
   type SessionEventBoundarySurface,
 } from "./event-preview";
 import { WorkspaceInstructionPolicyRoleKeyInput } from "./workspace-instruction-policies";
+import { ClientResumableVoiceInputConfig } from "./transcription-recordings";
 
 export * from "./slack-bot-scopes";
 export * from "./connector-destinations";
@@ -35,6 +36,19 @@ export {
   normalizeWorkspaceArtifactSlug,
 } from "./artifacts";
 
+export {
+  MCP_MUTATION_RECEIPT_MAX_BYTES,
+  MCP_MUTATION_RECEIPT_VERSION,
+  McpMutationReceipt,
+  McpMutationReceiptIdempotencyStatus,
+  McpMutationReceiptOutcome,
+  McpMutationResource,
+  type McpMutationReceipt as McpMutationReceiptType,
+  type McpMutationReceiptIdempotencyStatus as McpMutationReceiptIdempotencyStatusType,
+  type McpMutationReceiptOutcome as McpMutationReceiptOutcomeType,
+  type McpMutationResource as McpMutationResourceType,
+} from "./mcp-receipts";
+
 export {
   SESSION_EVENT_PAYLOAD_MAX_BYTES,
   approximateSessionEventTokens,
@@ -52,6 +66,11 @@ export {
 } from "./event-preview";
 
 export {
+  COMPUTER_SCREENSHOT_MAX_BYTES,
+  COMPUTER_SCREENSHOT_MAX_DIMENSION,
+  COMPUTER_SCREENSHOT_MAX_PIXELS,
+  COMPUTER_SCREENSHOT_RETENTION_MS,
+  COMPUTER_SCREENSHOT_WORKSPACE_QUOTA_BYTES,
   RETAINED_OUTPUT_DEFAULT_PAGE_BYTES,
   RETAINED_OUTPUT_MAX_PAGE_BYTES,
   RETAINED_OUTPUT_RECEIPT_MAX_BYTES,
@@ -62,12 +81,14 @@ export {
   RetainedOutputKind,
   RetainedOutputUnavailableReason,
   retainedArtifactReferenceFromFile,
+  retainedScreenshotReferenceFromFile,
   retainedOutputUnavailable,
   resolveRetainedOutputRange,
   validateRetainedOutputEvidence,
   type RetainedArtifactFileInput,
   type RetainedArtifactMetadata,
   type RetainedArtifactReference,
+  type RetainedScreenshotArtifactInput,
   type RetainedArtifactUnavailable,
   type RetainedOutputAvailableEvidence,
   type RetainedOutputEvidence,
@@ -595,9 +616,9 @@ export const Permission = z.enum([
   "sessions:control",
   // sandbox workspace (sandbox contract §C.3 / crosscut PART 1.2). stream:view is a
   // REAL, distinct permission — strictly BROADER than sessions:read — because the
-  // pixel plane (Channel B) is UN-REDACTED: a viewer of raw pixels can see cloud
-  // creds the agent cat's into a terminal, which the redacted Channel-A event log
-  // never exposes. sessions:read is NOT permission to watch raw pixels.
+  // pixel plane (Channel B) exposes raw pixels: a viewer can see content the
+  // structured Channel-A event log never captured. sessions:read is NOT
+  // permission to watch raw pixels.
   "stream:view",
   // SEPARATE from stream:view: raw input to the desktop (bypasses approvalQueue /
   // interrupt). NEVER granted by default in v1 (the input plane is OFF —
@@ -628,8 +649,14 @@ export const Permission = z.enum([
   "environments:manage",
   /** @deprecated alias of variable-sets:use */
   "environments:use",
+  "variable-sets:list",
+  "variable-sets:read",
+  "variable-sets:write",
   "variable-sets:manage",
   "variable-sets:use",
+  "secrets:list",
+  "secrets:read",
+  "secrets:write",
   // Attach or rotate per-session third-party MCP server credentials. Deliberately
   // not part of the worker's default first-party MCP permission set: a sandboxed
   // agent must not be able to hand itself new bearer credentials.
@@ -714,6 +741,7 @@ export const FIRST_PARTY_MCP_TOOL_NAMES = [
   "sandbox_swap",
   "run_on",
   "sandbox_provision",
+  "connected_machine_remove",
   "rig_list",
   "rig_get",
   "rig_propose_change",
@@ -730,6 +758,7 @@ export const FIRST_PARTY_MCP_TOOL_NAMES = [
   "set_other_session_title",
   "variable_set_list",
   "environment_list",
+  "variable_set_get_variable",
   "variable_set_set_variable",
   "environment_set_variable",
   "github_connect_link",
@@ -1155,6 +1184,7 @@ export const ClientVoiceInputConfig = z
       .positive()
       .max(25 * 1024 * 1024),
     acceptedMimeTypes: z.array(z.string().trim().min(1).max(128)).min(1).max(32),
+    resumable: ClientResumableVoiceInputConfig.optional(),
   })
   .strict();
 export type ClientVoiceInputConfig = z.infer<typeof ClientVoiceInputConfig>;
@@ -1184,6 +1214,8 @@ export const VOICE_INPUT_ACCEPTED_MIME_TYPES = [
   "audio/m4a",
 ] as const;
 
+export * from "./transcription-recordings";
+
 /** Per-session / workspace Codex compaction strategy. */
 export const CodexCompactionMode = z.enum(["remote_v2", "portable"]);
 export type CodexCompactionMode = z.infer<typeof CodexCompactionMode>;
@@ -1258,6 +1290,9 @@ export const WorkspaceSettingsSchema = z
     // Default compaction strategy for NEW Codex sessions created in this
     // workspace. Absent ⇒ remote_v2. Non-Codex sessions always freeze portable.
     codexCompactionDefault: CodexCompactionMode.optional(),
+    // Whether agents may expose and invoke the built-in structured human-input
+    // tool. Absent preserves the historical enabled behavior.
+    agentHumanInputEnabled: z.boolean().optional(),
     // Optional Slack reaction invocation. Absent/invalid fails closed to the
     // disabled default via resolveWorkspaceSlackReactionSummonSettings.
     slackReactionSummon: WorkspaceSlackReactionSummonSettings.optional(),
@@ -1278,6 +1313,12 @@ export function resolveWorkspaceCodexCompactionDefault(settings: unknown): Codex
   return parsed.data.codexCompactionDefault ?? "remote_v2";
 }
 
+/** Whether agents may request structured human input (enabled when unset). */
+export function resolveWorkspaceAgentHumanInputEnabled(settings: unknown): boolean {
+  const parsed = WorkspaceSettingsSchema.safeParse(settings ?? {});
+  return parsed.success ? parsed.data.agentHumanInputEnabled !== false : true;
+}
+
 /**
  * Resolve whether voice input is enabled for a workspace.
  *
@@ -1303,7 +1344,9 @@ export function resolveWorkspaceSlackReactionSummonSettings(
     return {
       enabled: DEFAULT_WORKSPACE_SLACK_REACTION_SUMMON_SETTINGS.enabled,
       emoji: DEFAULT_WORKSPACE_SLACK_REACTION_SUMMON_SETTINGS.emoji,
-      channelPolicy: { ...DEFAULT_WORKSPACE_SLACK_REACTION_SUMMON_SETTINGS.channelPolicy },
+      channelPolicy: {
+        ...DEFAULT_WORKSPACE_SLACK_REACTION_SUMMON_SETTINGS.channelPolicy,
+      },
     };
   }
   return configured.channelPolicy.mode === "allowlist"
@@ -1338,6 +1381,7 @@ export const UpdateWorkspaceSettingsRequest = z
     transcription: WorkspaceTranscriptionPolicy.optional(),
     maxNestedAgentDepth: NestedAgentDepthValue.nullable().optional(),
     codexCompactionDefault: CodexCompactionMode.optional(),
+    agentHumanInputEnabled: z.boolean().optional(),
     slackReactionSummon: WorkspaceSlackReactionSummonSettings.optional(),
   })
   .passthrough();
@@ -1665,6 +1709,11 @@ export const EnrollmentBearerPayload = z.object({
   workspaceId: z.string().uuid(),
   agentId: z.string().uuid(),
   enrollmentId: z.string().uuid(),
+  // Backward-compatible credential-family fence. Generationless bearers minted
+  // before migration 0061 parse ONLY as generation 1, matching the migration's
+  // default for existing rows. signEnrollmentBearer serializes the parsed output,
+  // so every newly signed bearer carries this claim explicitly.
+  credentialGeneration: z.number().int().positive().default(1),
   // The Account-scoped control-plane subject prefix the agent subscribes to.
   subjectPrefix: z.string().min(1),
   exp: z.number().int().positive(),
@@ -1699,7 +1748,13 @@ export async function verifyEnrollmentBearer(
   if (!constantTimeEqual(signature, expected)) {
     return null;
   }
-  const payload = EnrollmentBearerPayload.safeParse(JSON.parse(base64UrlDecode(encodedPayload)));
+  let decoded: unknown;
+  try {
+    decoded = JSON.parse(base64UrlDecode(encodedPayload));
+  } catch {
+    return null;
+  }
+  const payload = EnrollmentBearerPayload.safeParse(decoded);
   if (!payload.success || payload.data.exp < nowSeconds) {
     return null;
   }
@@ -2506,13 +2561,6 @@ export type RunCredentialAuthNeeded = {
   message?: string;
 };
 
-export type RunCredentialRedaction = {
-  /** Bounded diagnostic label used only in the replacement marker. */
-  name: string;
-  /** One atomic secret value that must be removed from streamed/audit output. */
-  value: string;
-};
-
 export type RunCredentialsRequest = {
   accountId: string;
   workspaceId: string;
@@ -2558,12 +2606,6 @@ export type RunCredentialsResolution =
       files?: RunCredentialFile[];
       /** Environment name to one returned relative file path. */
       fileEnvironment?: Record<string, string>;
-      /**
-       * Atomic sensitive values embedded inside credential files or derived
-       * material. Environment values are registered automatically; hosts list
-       * additional file-contained values here so chunked output is redacted.
-       */
-      redactions?: RunCredentialRedaction[];
       /** Earliest material expiry. Null/omitted uses a bounded refresh cadence. */
       expiresAt?: string | null;
       /** Partial degradation: usable material may coexist with reconnect notices. */
@@ -2955,6 +2997,93 @@ export function gitCredentialBindingIdForRepository(
   );
 }
 
+type GitRemotePathSemantics = "dot_git_alias" | "exact";
+
+/**
+ * Provider-declared remote-path behavior. Keeping this exhaustive makes a new
+ * provider choose its semantics instead of inheriting GitHub conventions.
+ */
+const GIT_REMOTE_PATH_SEMANTICS = {
+  github: "dot_git_alias",
+  gitlab: "dot_git_alias",
+  azure_devops: "exact",
+} as const satisfies Record<GitCredentialProvider, GitRemotePathSemantics>;
+
+function gitRemotePathSemantics(
+  provider: GitCredentialProvider | null | undefined,
+): GitRemotePathSemantics {
+  return provider ? GIT_REMOTE_PATH_SEMANTICS[provider] : "exact";
+}
+
+export class RepositoryUriError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "RepositoryUriError";
+  }
+}
+
+/**
+ * Normalize only the safe, provider-neutral parts of an HTTPS clone URI.
+ *
+ * The provider-defined path is opaque: this helper never adds or removes a
+ * `.git` suffix. Embedded user info, query parameters, and fragments are not
+ * durable resource identity and are omitted, matching the existing secret-free
+ * resource contract.
+ */
+export function normalizeRepositoryTransportUri(uri: string): string {
+  let url: URL;
+  try {
+    url = new URL(uri.trim());
+  } catch {
+    throw new RepositoryUriError(`invalid repository URI: ${uri}`);
+  }
+  if (url.protocol !== "https:" || !url.hostname) {
+    throw new RepositoryUriError("repository resources must use HTTPS Git URLs");
+  }
+  const path = url.pathname.replace(/^\/+|\/+$/g, "");
+  if (path.split("/").filter(Boolean).length < 2) {
+    throw new RepositoryUriError("repository URL must include owner and repo");
+  }
+  return `https://${url.host.toLowerCase()}/${path}`;
+}
+
+/**
+ * Return every URI spelling that a provider explicitly declares equivalent.
+ * Exact-path and unqualified providers return only the normalized input URI.
+ */
+export function gitRemoteUriAliases(
+  uri: string,
+  provider: GitCredentialProvider | null | undefined,
+): string[] {
+  const normalizedUri = normalizeRepositoryTransportUri(uri);
+  if (gitRemotePathSemantics(provider) === "exact") {
+    return [normalizedUri];
+  }
+  const base = normalizedUri.replace(/\.git$/, "");
+  return [...new Set([normalizedUri, base, `${base}.git`])];
+}
+
+/** Stable remote identity for deduplication and credential-binding ownership. */
+export function gitRemoteIdentity(
+  uri: string,
+  provider: GitCredentialProvider | null | undefined,
+): string {
+  const normalizedUri = normalizeRepositoryTransportUri(uri);
+  return gitRemotePathSemantics(provider) === "dot_git_alias"
+    ? normalizedUri.replace(/\.git$/, "")
+    : normalizedUri;
+}
+
+/** Provider-aware Git credential-helper path aliases, without a leading slash. */
+export function gitRemotePathAliases(
+  uri: string,
+  provider: GitCredentialProvider | null | undefined,
+): string[] {
+  return gitRemoteUriAliases(uri, provider).map((alias) =>
+    new URL(alias).pathname.replace(/^\/+|\/+$/g, ""),
+  );
+}
+
 export const FileResourceRef = z.object({
   kind: z.literal("file"),
   fileId: z.string().uuid(),
@@ -3035,7 +3164,10 @@ export function resourceMountPathCollisionKey(path: string): string {
  * GitLab, Azure DevOps, or a custom host do not collide. Encoding the host keeps
  * IPv6/custom-port identities inside one portable path segment.
  */
-export function defaultRepositoryMountPath(uri: string): string {
+export function defaultRepositoryMountPath(
+  uri: string,
+  provider?: GitCredentialProvider | null,
+): string {
   let url: URL;
   try {
     url = new URL(uri);
@@ -3045,7 +3177,11 @@ export function defaultRepositoryMountPath(uri: string): string {
   if (url.protocol !== "https:" || !url.host) {
     throw new ResourceMountPathError(`invalid repository URI for mount path: ${uri}`);
   }
-  const repositoryPath = url.pathname.replace(/^\/+|\/+$/g, "").replace(/\.git$/, "");
+  const remotePath = url.pathname.replace(/^\/+|\/+$/g, "");
+  const repositoryPath =
+    gitRemotePathSemantics(provider) === "dot_git_alias"
+      ? remotePath.replace(/\.git$/, "")
+      : remotePath;
   const segments = repositoryPath.split("/").filter(Boolean);
   if (segments.length < 2) {
     throw new ResourceMountPathError(`repository URI must include owner and repo: ${uri}`);
@@ -3062,7 +3198,7 @@ export function resourceMountPath(resource: ResourceRef): string {
   if (resource.mountPath) return normalizeResourceMountPath(resource.mountPath);
   return resource.kind === "file"
     ? normalizeResourceMountPath(`${DEFAULT_FILE_RESOURCE_MOUNT_ROOT}/${resource.fileId}`)
-    : defaultRepositoryMountPath(resource.uri);
+    : defaultRepositoryMountPath(resource.uri, gitCredentialProviderForRepository(resource));
 }
 
 /** Fail before sandbox execution when two resources share a portable path. */
@@ -3753,7 +3889,10 @@ export function resourceIdentityKey(resource: ResourceRef): string {
   if (resource.kind === "file") {
     return `file:${resource.fileId}`;
   }
-  return `repository:${resource.uri}`;
+  return `repository:${gitRemoteIdentity(
+    resource.uri,
+    gitCredentialProviderForRepository(resource),
+  )}`;
 }
 
 function sortJson(value: unknown): unknown {
@@ -4310,6 +4449,7 @@ export const SessionAuthorizationOperation = z.enum([
   "session.viewer.read",
   "session.viewer.control",
   "session.first_party_mcp.call",
+  "session.secret.read",
   "session.toolspace.call",
   "session.pin.write",
   "session.codex_account.write",
@@ -5031,9 +5171,9 @@ function withVariableSetIdAlias<T extends z.ZodRawShape>(shape: T) {
   }, z.object(shape));
 }
 
-// Metadata only by design: no schema in this file ever carries a variable value
-// back to a client. Values are write-only and decrypted exclusively inside the
-// worker at sandbox materialization time.
+// Generic variable-set reads remain metadata-only. Exact plaintext has one
+// dedicated response schema so callers cannot accidentally widen another
+// workspace/session response with secret material.
 export const VariableSetVariableMetadata = z.object({
   name: VariableSetVariableName,
   version: z.number().int().positive(),
@@ -5046,6 +5186,14 @@ export const WorkspaceEnvironmentVariableMetadata = VariableSetVariableMetadata;
 /** @deprecated use VariableSetVariableMetadata */
 export type WorkspaceEnvironmentVariableMetadata = VariableSetVariableMetadata;
 
+export const VariableSetSecret = z.object({
+  variableSetId: z.string().uuid(),
+  name: VariableSetVariableName,
+  version: z.number().int().positive(),
+  value: z.string(),
+});
+export type VariableSetSecret = z.infer<typeof VariableSetSecret>;
+
 export const VariableSet = z.object({
   id: z.string().uuid(),
   accountId: z.string().uuid(),
@@ -5247,7 +5395,11 @@ export type ScheduledTaskStatus = z.infer<typeof ScheduledTaskStatus>;
 export const ScheduledTaskRunStatus = z.enum(["queued", "dispatched", "failed"]);
 export type ScheduledTaskRunStatus = z.infer<typeof ScheduledTaskRunStatus>;
 
-export const ScheduledTaskRunMode = z.enum(["new_session_per_run", "reusable_session"]);
+export const ScheduledTaskRunMode = z.enum([
+  "new_session_per_run",
+  "reusable_session",
+  "existing_session",
+]);
 export type ScheduledTaskRunMode = z.infer<typeof ScheduledTaskRunMode>;
 
 export const ScheduledTaskOverlapPolicy = z.enum(["allow_concurrent", "skip", "buffer_one"]);
@@ -5311,10 +5463,14 @@ export const ScheduledTask = z.object({
   runMode: ScheduledTaskRunMode,
   overlapPolicy: ScheduledTaskOverlapPolicy,
   agentConfig: ScheduledTaskAgentConfig,
-  createdBy: TurnInitiator.default({ kind: "service", subjectId: "unattributed-legacy" }),
+  createdBy: TurnInitiator.default({
+    kind: "service",
+    subjectId: "unattributed-legacy",
+  }),
   createdByContext: TurnInitiatorContext.default({}),
   personalConnections: z.array(McpPersonalConnectionSummary).default([]),
   reusableSessionId: z.string().uuid().nullable(),
+  targetSessionId: z.string().uuid().nullable().default(null),
   variableSetId: z.string().uuid().nullable().default(null),
   /** @deprecated use variableSetId */
   environmentId: z.string().uuid().nullable().default(null),
@@ -5350,6 +5506,7 @@ export const CreateScheduledTaskRequest = withVariableSetIdAlias({
   schedule: ScheduledTaskScheduleSpec,
   runMode: ScheduledTaskRunMode.default("new_session_per_run"),
   overlapPolicy: ScheduledTaskOverlapPolicy.default("allow_concurrent"),
+  targetSessionId: z.string().uuid().nullable().optional(),
   agentConfig: ScheduledTaskAgentConfig,
   status: ScheduledTaskStatus.default("active"),
   variableSetId: z.string().uuid().nullable().optional(),
@@ -5357,6 +5514,28 @@ export const CreateScheduledTaskRequest = withVariableSetIdAlias({
   // The rig each run binds to (M3); its active version is resolved per fire.
   rigId: z.string().uuid().nullable().optional(),
   metadata: z.record(z.string(), z.unknown()).default({}),
+}).superRefine((value, context) => {
+  if (value.runMode === "existing_session" && !value.targetSessionId) {
+    context.addIssue({
+      code: "custom",
+      path: ["targetSessionId"],
+      message: "targetSessionId is required when runMode=existing_session",
+    });
+  }
+  if (value.runMode !== "existing_session" && value.targetSessionId) {
+    context.addIssue({
+      code: "custom",
+      path: ["targetSessionId"],
+      message: "targetSessionId requires runMode=existing_session",
+    });
+  }
+  if (value.runMode === "existing_session" && value.agentConfig.goal) {
+    context.addIssue({
+      code: "custom",
+      path: ["agentConfig", "goal"],
+      message: "agentConfig.goal cannot be used with an existing-session target",
+    });
+  }
 });
 export type CreateScheduledTaskRequest = z.infer<typeof CreateScheduledTaskRequest>;
 
@@ -5365,6 +5544,7 @@ export const UpdateScheduledTaskRequest = withVariableSetIdAlias({
   schedule: ScheduledTaskScheduleSpec.optional(),
   runMode: ScheduledTaskRunMode.optional(),
   overlapPolicy: ScheduledTaskOverlapPolicy.optional(),
+  targetSessionId: z.string().uuid().nullable().optional(),
   agentConfig: ScheduledTaskAgentConfig.optional(),
   status: ScheduledTaskStatus.optional(),
   variableSetId: z.string().uuid().nullable().optional(),
@@ -5373,6 +5553,31 @@ export const UpdateScheduledTaskRequest = withVariableSetIdAlias({
   // resolved per fire, so an update takes effect on the next dispatch.
   rigId: z.string().uuid().nullable().optional(),
   metadata: z.record(z.string(), z.unknown()).optional(),
+}).superRefine((value, context) => {
+  if (value.targetSessionId && value.runMode && value.runMode !== "existing_session") {
+    context.addIssue({
+      code: "custom",
+      path: ["targetSessionId"],
+      message: "targetSessionId requires runMode=existing_session",
+    });
+  }
+  if (value.runMode === "existing_session" && value.targetSessionId === null) {
+    context.addIssue({
+      code: "custom",
+      path: ["targetSessionId"],
+      message: "targetSessionId cannot be null when runMode=existing_session",
+    });
+  }
+  if (
+    value.agentConfig?.goal &&
+    (value.runMode === "existing_session" || Boolean(value.targetSessionId))
+  ) {
+    context.addIssue({
+      code: "custom",
+      path: ["agentConfig", "goal"],
+      message: "agentConfig.goal cannot be used with an existing-session target",
+    });
+  }
 });
 export type UpdateScheduledTaskRequest = z.infer<typeof UpdateScheduledTaskRequest>;
 
@@ -6253,9 +6458,9 @@ export const Session = z.object({
   createIdempotencyKey: z.string().nullable(),
   temporalWorkflowId: z.string().nullable(),
   activeTurnId: z.string().uuid().nullable(),
-  // Actual input tokens of the last model call of the most recent turn; the
-  // pre-turn portable context-compaction trigger reads it as its budget
-  // signal. Null until a turn with usage has completed.
+  // Provider-reported input tokens of the latest authoritative terminal
+  // response. Null after a context transition or whenever that latest response
+  // supplied no usable count, so an older response can never drive compaction.
   lastInputTokens: z.number().int().nonnegative().nullable(),
   queueVersion: z.number().int().nonnegative(),
   queueHeadPosition: z.number().int(),
@@ -6859,8 +7064,8 @@ export const RecordingFailedPayload = z.object({
   recordingId: z.string().uuid(),
   turnId: z.string().uuid().nullable(),
   reason: RecordingFailedReason,
-  // ffmpeg-stderr tail / error detail — agent/ffmpeg-controlled, so the producer
-  // caps + scrubs it before emit (it rides redact() like every payload).
+  // Exact ffmpeg stderr/error detail. Event transport limits must reject or
+  // paginate rather than rewriting this canonical diagnostic.
   detail: z.string().nullable().optional(),
 });
 export type RecordingFailedPayload = z.infer<typeof RecordingFailedPayload>;
@@ -6988,6 +7193,18 @@ export const FsListResponse = z.object({
 });
 export type FsListResponse = z.infer<typeof FsListResponse>;
 
+/** Several independent directory listings served behind one Channel-A lease.
+ * The response order exactly matches `requests`; callers can paint a root and
+ * hydrate a bounded lazy-tree frontier without repeating provider attach work. */
+export const FsListBatchRequest = z.object({
+  requests: z.array(FsListRequest).min(1).max(16),
+});
+export type FsListBatchRequest = z.infer<typeof FsListBatchRequest>;
+export const FsListBatchResponse = z.object({
+  results: z.array(FsListResponse),
+});
+export type FsListBatchResponse = z.infer<typeof FsListBatchResponse>;
+
 export const FsEncoding = z.enum(["utf8", "base64"]);
 export type FsEncoding = z.infer<typeof FsEncoding>;
 export const FsReadRequest = z.object({
@@ -7156,6 +7373,27 @@ export const GitDiffResponse = z.object({
 });
 export type GitDiffResponse = z.infer<typeof GitDiffResponse>;
 
+/** One repository read unit: status metadata plus an optional comparison.
+ * Multiple units execute behind one Channel-A lease and preserve input order. */
+export const GitReadBatchItemRequest = z.object({
+  status: GitStatusRequest,
+  diff: GitDiffRequest.optional(),
+});
+export type GitReadBatchItemRequest = z.infer<typeof GitReadBatchItemRequest>;
+export const GitReadBatchRequest = z.object({
+  requests: z.array(GitReadBatchItemRequest).min(1).max(32),
+});
+export type GitReadBatchRequest = z.infer<typeof GitReadBatchRequest>;
+export const GitReadBatchItemResponse = z.object({
+  status: GitStatusResponse,
+  diff: GitDiffResponse.optional(),
+});
+export type GitReadBatchItemResponse = z.infer<typeof GitReadBatchItemResponse>;
+export const GitReadBatchResponse = z.object({
+  results: z.array(GitReadBatchItemResponse),
+});
+export type GitReadBatchResponse = z.infer<typeof GitReadBatchResponse>;
+
 // ─── Workbench v2 turn-end workspace capture ────────────
 // A capture is a point-in-time snapshot of the session workspace's CHANGES,
 // probed live off the box at turn end (detectRepos → gitStatus/gitDiff → fsRead
@@ -7187,10 +7425,10 @@ export const WorkspaceCaptureFile = z.object({
 });
 export type WorkspaceCaptureFile = z.infer<typeof WorkspaceCaptureFile>;
 
-// One repo discovered in the workspace. `diff` is `git diff HEAD` (combined
-// staged+unstaged tracked changes vs HEAD — the review diff); `status` is the
-// full porcelain file list (drives the rail glyphs incl. untracked, which the
-// HEAD diff omits). root "" = the workspace root repo.
+// One repo discovered in the workspace. `diff` is the working/index surface vs
+// HEAD; `branchDiff`, when available, is the complete current branch vs the
+// remote default branch and therefore retains committed agent work. `status`
+// is the full porcelain file list. root "" = the workspace root repo.
 export const WorkspaceCaptureRepo = z.object({
   root: z.string(),
   head: z.string().nullable(),
@@ -7200,6 +7438,7 @@ export const WorkspaceCaptureRepo = z.object({
   behind: z.number().int().nonnegative().default(0),
   status: z.array(GitFileStatus),
   diff: z.array(GitFileDiff),
+  branchDiff: z.array(GitFileDiff).optional(),
 });
 export type WorkspaceCaptureRepo = z.infer<typeof WorkspaceCaptureRepo>;
 
@@ -9263,9 +9502,26 @@ export type ListEnrollmentsResponse = z.infer<typeof ListEnrollmentsResponse>;
 
 export const RevokeEnrollmentResponse = z.object({
   revoked: z.boolean(),
+  outcome: z.enum(["removed", "already_removed", "blocked"]),
+  enrollmentId: z.string().uuid(),
+  machineName: z.string().nullable(),
+  lastSeenAt: z.string().datetime({ offset: true }).nullable(),
+  revokedAt: z.string().datetime({ offset: true }).nullable(),
+  code: z
+    .enum(["active_route", "active_commands", "active_lease", "recovery_pending", "not_selfhosted"])
+    .nullable(),
+  message: z.string(),
+  action: z.string(),
 });
 export type RevokeEnrollmentResponse = z.infer<typeof RevokeEnrollmentResponse>;
 
+/** POST /v1/workspaces/:workspaceId/enrollments/:id/revoke body. */
+export const RemoveEnrollmentRequest = z.object({
+  expectedUpdatedAt: z.string().datetime({ offset: true }).optional(),
+  idempotencyKey: z.string().trim().min(1).max(200).optional(),
+});
+export type RemoveEnrollmentRequest = z.infer<typeof RemoveEnrollmentRequest>;
+
 // =============================================================================
 // Enrollment UX (self-hosted enrollment UX, design 11): the click-Grant approve
 // page lookup/deny + the headless enroll-token mint/exchange. These sit beside the
@@ -9611,9 +9867,10 @@ export const TurnExecutionReasoningSourceV1 =
   );
 export type TurnExecutionReasoningSourceV1 = z.infer<typeof TurnExecutionReasoningSourceV1>;
 
-export const TurnExecutionLatencyModeSourceV1 = /* @__PURE__ */ defineModelContractSchema(() =>
-  z.enum(["explicit", "session", "deployment", "continuation"]),
-);
+export const TurnExecutionLatencyModeSourceV1 =
+  /* @__PURE__ */ defineModelContractSchema(() =>
+    z.enum(["explicit", "session", "deployment", "continuation"]),
+  );
 export type TurnExecutionLatencyModeSourceV1 = z.infer<typeof TurnExecutionLatencyModeSourceV1>;
 
 /**
@@ -10078,7 +10335,6 @@ export function evaluateWorkspaceModelPolicy(
 }
 
 export * from "./codex-fleet-policy";
-export * from "./secret-redaction";
 export * from "./workspace-instruction-policies";
 export * from "./workspace-state";
 export * from "./preference-registry";