@opengeni/contracts 2.6.0-canary.0 → 2.9.2-canary.0

package/src/index.ts

@@ -13,6 +13,12 @@ import { ClientResumableVoiceInputConfig } from "./transcription-recordings";
 import { MediaGenerationResult } from "./video-generation";
 import { KnowledgeProviderCitation } from "./knowledge";
 import { XaiProviderAccountAuthoritySnapshotV1 } from "./xai-provider-account-authority";
+import {
+  MAX_NESTED_AGENT_DEPTH,
+  NestedAgentDepthValue,
+  SessionGoalStatus,
+  SessionStatus,
+} from "./session-topology-primitives";
 
 export * from "./slack-bot-scopes";
 export * from "./slack-task-policy";
@@ -31,6 +37,9 @@ export * from "./interaction";
 export * from "./sandbox-file-artifacts";
 export * from "./permissions";
 export * from "./session-titles";
+export * from "./session-topology-primitives";
+export * from "./agent-topology";
+export * from "./work-claims";
 
 export {
   CreateWorkspaceArtifactRequest,
@@ -149,18 +158,6 @@ export {
   type ModalCheckpointProviderBinding,
 } from "./checkpoint-provider-bindings";
 
-export const SessionStatus = z.enum([
-  "queued",
-  "running",
-  "idle",
-  "requires_action",
-  "recovering",
-  "waiting_capacity",
-  "failed",
-  "cancelled",
-]);
-export type SessionStatus = z.infer<typeof SessionStatus>;
-
 // 12 backends; 3-way enum parity (contracts / sdk / deployment) is pinned by
 // `packages/sdk/test/contract-parity.test.ts`. Every member is ADDITIVE AT THE
 // END (the parity test pins positions): the original four, then the six cloud
@@ -680,10 +677,6 @@ export const ErrorEnvelope = z.object({
 });
 export type ErrorEnvelope = z.infer<typeof ErrorEnvelope>;
 
-/** Physical ceiling of the PostgreSQL integer columns that persist depth policy. */
-export const MAX_NESTED_AGENT_DEPTH = 2_147_483_647;
-export const NestedAgentDepthValue = z.number().int().nonnegative().max(MAX_NESTED_AGENT_DEPTH);
-export type NestedAgentDepthValue = z.infer<typeof NestedAgentDepthValue>;
 /** A denied child can be one greater than the persisted PostgreSQL int ceiling. */
 export const NestedAgentDepthAttemptValue = z
   .number()
@@ -779,6 +772,8 @@ export const FIRST_PARTY_MCP_TOOL_NAMES = [
   "task_note_save",
   "task_note_archive",
   "task_note_replace",
+  "work_claim_upsert",
+  "work_claim_release",
   "knowledge_propose",
   "knowledge_correct",
   "task_note_promote_knowledge",
@@ -947,15 +942,8 @@ const FIRST_PARTY_IN_PROCESS_TOOL_NAME_SET = new Set<FirstPartyMcpToolName>(
  * trustworthy logical-delivery identity. Server-owned Slack delivery paths
  * call the internal client directly with their own durable operation IDs.
  */
-// Names kept so previously written data still parses - immutable scheduled-task
-// execution snapshots recorded the tool set that was default at the time, and
-// they are strictly re-parsed on replay. Retiring a tool must not strand an
-// accepted occurrence. These are never registered, never default, and never
-// authorized; they exist so history stays readable.
 const FIRST_PARTY_COMPATIBILITY_ONLY_TOOL_NAMES = [
   "slack_bot_post_message",
-  "memory_save",
-  "memory_correct",
 ] as const satisfies readonly FirstPartyMcpToolName[];
 
 const FIRST_PARTY_COMPATIBILITY_ONLY_TOOL_NAME_SET = new Set<FirstPartyMcpToolName>(
@@ -988,10 +976,6 @@ export const EDITABLE_ARTIFACT_MCP_CODEMODE_PATHS = {
  */
 export const DEFAULT_FIRST_PARTY_MCP_TOOLS = FIRST_PARTY_MCP_TOOL_NAMES.filter(
   (name) =>
-    // Memory V1 writes are retired entirely; `remember` and task-note
-    // promotion own durable agent writes.
-    name !== "memory_save" &&
-    name !== "memory_correct" &&
     !name.startsWith("social_") &&
     !name.startsWith("x_") &&
     !name.startsWith("reddit_") &&
@@ -2965,6 +2949,28 @@ export const CreateWorkspaceRequest = z.object({
 });
 export type CreateWorkspaceRequest = z.infer<typeof CreateWorkspaceRequest>;
 
+export const EnsureWorkspaceRequest = z
+  .object({
+    accountId: z.string().uuid(),
+    externalSource: z.string().trim().min(1).max(200),
+    externalId: z.string().trim().min(1).max(1024),
+    name: z.string().trim().min(1).max(200),
+    slug: z.string().trim().min(1).max(200).optional(),
+    // White-label persona override for this workspace's agent. null/omitted uses
+    // the deployment default template.
+    agentInstructions: z.string().min(1).nullable().optional(),
+  })
+  .strict();
+export type EnsureWorkspaceRequest = z.infer<typeof EnsureWorkspaceRequest>;
+
+export const EnsureWorkspaceResponse = z
+  .object({
+    workspace: Workspace,
+    created: z.boolean(),
+  })
+  .strict();
+export type EnsureWorkspaceResponse = z.infer<typeof EnsureWorkspaceResponse>;
+
 export const UpdateWorkspaceRequest = z
   .object({
     name: z.string().min(1).optional(),
@@ -3007,6 +3013,15 @@ export const CreateApiKeyResponse = z.object({
 });
 export type CreateApiKeyResponse = z.infer<typeof CreateApiKeyResponse>;
 
+export const CreateOrganizationApiKeyRequest = z
+  .object({
+    name: z.string().trim().min(1).max(200),
+    description: z.string().trim().min(1).max(500).optional(),
+    expiresAt: z.string().datetime({ offset: true }).optional(),
+  })
+  .strict();
+export type CreateOrganizationApiKeyRequest = z.infer<typeof CreateOrganizationApiKeyRequest>;
+
 // A person (or API key) with access to a workspace: one workspace_memberships
 // row. `subjectId` is `user:<betterAuthUserId>` or `api_key:<id>`; the People
 // surface lists the `user:` subjects (api_key subjects belong to API keys).
@@ -3024,10 +3039,26 @@ export const ListWorkspaceMembersResponse = z.object({
 });
 export type ListWorkspaceMembersResponse = z.infer<typeof ListWorkspaceMembersResponse>;
 
+export const WorkspaceMemberCandidate = z.object({
+  organizationMembershipId: z.string().uuid(),
+  subjectId: z.string().min(1),
+  name: z.string().min(1).max(1024).nullable(),
+  email: z.string().email().max(320).nullable(),
+  organizationRole: z.enum(["owner", "admin", "member"]),
+});
+export type WorkspaceMemberCandidate = z.infer<typeof WorkspaceMemberCandidate>;
+
+export const ListWorkspaceMemberCandidatesResponse = z.object({
+  members: z.array(WorkspaceMemberCandidate).max(1000),
+});
+export type ListWorkspaceMemberCandidatesResponse = z.infer<
+  typeof ListWorkspaceMemberCandidatesResponse
+>;
+
 export const AddWorkspaceMemberRequest = z.object({
-  // Resolved against the managed (Better Auth) users; email invites for
-  // not-yet-registered users are deferred, so an unknown email returns 404.
-  email: z.string().email(),
+  // The candidate inventory exposes this opaque organization-local identifier.
+  // Organization invitations stay in the organization-admin lifecycle.
+  organizationMembershipId: z.string().uuid(),
   role: z.string().min(1).optional(),
   permissions: z.array(Permission),
 });
@@ -5563,9 +5594,6 @@ export type SessionControlState = z.infer<typeof SessionControlState>;
 export const WorkspaceInferenceState = z.enum(["active", "paused"]);
 export type WorkspaceInferenceState = z.infer<typeof WorkspaceInferenceState>;
 
-export const SessionGoalStatus = z.enum(["active", "paused", "completed"]);
-export type SessionGoalStatus = z.infer<typeof SessionGoalStatus>;
-
 export const SessionGoalCreatedBy = z.enum(["api", "agent", "scheduled_task"]);
 export type SessionGoalCreatedBy = z.infer<typeof SessionGoalCreatedBy>;
 
@@ -7633,17 +7661,74 @@ export function renderSessionSystemUpdateBatch(
   ].join("\n");
 }
 
+export const SCHEDULED_OCCURRENCE_TASK_LABEL = "[OpenGeni scheduled task occurrence]" as const;
+
+/**
+ * A pure scheduled-occurrence batch is a new task boundary for the model, not
+ * merely background context. The user role here is conversational only: the
+ * owning turn retains its immutable scheduler/service initiator and frozen
+ * execution authority in the database.
+ *
+ * Malformed or mixed legacy batches fall back to the generic system envelope
+ * so this renderer never invents task identity from inconsistent payloads.
+ */
+function renderScheduledOccurrenceTaskBatch(
+  updates: Parameters<typeof renderSessionSystemUpdateBatch>[0],
+): string | null {
+  if (updates.length === 0 || updates.some((update) => update.kind !== "scheduled_occurrence")) {
+    return null;
+  }
+  const occurrences = updates.map((update) => {
+    const parsed = SessionSystemUpdatePayload.safeParse(update.payload);
+    if (
+      !parsed.success ||
+      parsed.data.type !== "scheduled_occurrence" ||
+      parsed.data.scheduledTaskRunId !== update.sourceId
+    ) {
+      return null;
+    }
+    return { update, payload: parsed.data };
+  });
+  if (occurrences.some((occurrence) => occurrence === null)) return null;
+
+  const introduction =
+    occurrences.length === 1
+      ? "A new scheduled occurrence has started. Execute the instructions below for this occurrence now."
+      : `${occurrences.length} new scheduled occurrences have started. Execute every instruction set below for this turn now.`;
+  return [
+    SCHEDULED_OCCURRENCE_TASK_LABEL,
+    introduction,
+    "The scheduled instructions below are the task for this turn. Earlier completed goals, occurrences, conversation, and tool outputs are historical context and do not complete this occurrence. When the task depends on mutable external state, query that state during this occurrence instead of reusing an earlier result.",
+    ...occurrences.flatMap((occurrence, index) => {
+      if (!occurrence) return [];
+      return [
+        "",
+        ...(occurrences.length > 1 ? [`Occurrence ${index + 1}:`] : []),
+        `Scheduled task ID: ${occurrence.payload.scheduledTaskId}`,
+        `Scheduled task run ID: ${occurrence.payload.scheduledTaskRunId}`,
+        `Update ID: ${occurrence.update.id}`,
+        "Instructions:",
+        occurrence.payload.text,
+      ];
+    }),
+  ].join("\n");
+}
+
 export function sessionSystemUpdateBatchHistoryItem(
   updates: Parameters<typeof renderSessionSystemUpdateBatch>[0],
   goalSnapshot?: SessionGoalSnapshot,
-): { type: "message"; role: "system"; content: string } {
+  options: { promoteScheduledOccurrenceToUser?: boolean } = {},
+): { type: "message"; role: "system" | "user"; content: string } {
   const goalContext = renderSessionGoalContext(goalSnapshot);
+  const scheduledTask = options.promoteScheduledOccurrenceToUser
+    ? renderScheduledOccurrenceTaskBatch(updates)
+    : null;
   return {
     type: "message",
-    role: "system",
+    role: scheduledTask ? "user" : "system",
     content: [
       ...(goalContext ? [`${SESSION_GOAL_CONTEXT_LABEL}\n${goalContext}`] : []),
-      renderSessionSystemUpdateBatch(updates),
+      scheduledTask ?? renderSessionSystemUpdateBatch(updates),
     ].join("\n\n"),
   };
 }
@@ -7654,6 +7739,48 @@ export const VariableSetVariableName = z
   .max(128);
 export type VariableSetVariableName = z.infer<typeof VariableSetVariableName>;
 
+export const VARIABLE_SET_RESERVED_EXACT_NAMES = [
+  "HOME",
+  "PATH",
+  "SHELL",
+  "USER",
+  "LOGNAME",
+  "TMPDIR",
+  "IFS",
+  "ENV",
+  "BASH_ENV",
+  "NODE_OPTIONS",
+  "PYTHONPATH",
+  "PYTHONSTARTUP",
+  "PERL5OPT",
+  "PERL5LIB",
+  "GH_TOKEN",
+  "GITHUB_TOKEN",
+  "GITLAB_TOKEN",
+  "AZURE_DEVOPS_EXT_PAT",
+  "GIT_ASKPASS",
+  "GIT_TERMINAL_PROMPT",
+] as const;
+
+export const VARIABLE_SET_RESERVED_PREFIXES = [
+  "OPENGENI_",
+  "GIT_CONFIG_",
+  "GIT_AUTHOR_",
+  "GIT_COMMITTER_",
+  "LD_",
+  "DYLD_",
+] as const;
+
+export function variableSetVariableNameReservation(
+  name: string,
+): { kind: "exact" | "prefix"; value: string } | null {
+  if ((VARIABLE_SET_RESERVED_EXACT_NAMES as readonly string[]).includes(name)) {
+    return { kind: "exact", value: name };
+  }
+  const prefix = VARIABLE_SET_RESERVED_PREFIXES.find((candidate) => name.startsWith(candidate));
+  return prefix ? { kind: "prefix", value: prefix } : null;
+}
+
 function withVariableSetIdAlias<T extends z.ZodRawShape>(
   shape: T,
   options: { rejectKeys?: readonly string[] } = {},
@@ -8491,17 +8618,24 @@ function scheduledTaskBoundedString(maxBytes: number, label: string) {
 }
 
 /** Ingress-bounded task name for create/update requests. */
-export const ScheduledTaskNameInput = /* @__PURE__ */ scheduledTaskBoundedString(
-  SCHEDULED_TASK_NAME_MAX_BYTES,
-  "scheduled task name",
-);
+export const ScheduledTaskNameInput =
+  /* @__PURE__ */ scheduledTaskBoundedString(SCHEDULED_TASK_NAME_MAX_BYTES, "scheduled task name");
 /** Ingress-bounded task metadata for create/update requests. */
-export const ScheduledTaskMetadataInput = /* @__PURE__ */ scheduledTaskBoundedJsonObject(
-  SCHEDULED_TASK_METADATA_MAX_BYTES,
-  "scheduled task metadata",
-);
+export const ScheduledTaskMetadataInput =
+  /* @__PURE__ */ scheduledTaskBoundedJsonObject(
+    SCHEDULED_TASK_METADATA_MAX_BYTES,
+    "scheduled task metadata",
+  );
 
 function scheduledTaskAgentConfigShape(bounded: boolean) {
+  const machineTarget = z
+    .object({
+      targetSandboxId: z.string().uuid(),
+      workingDir: bounded
+        ? z.string().trim().min(1).max(4096).optional()
+        : z.string().min(1).optional(),
+    })
+    .strict();
   return {
     prompt: bounded
       ? scheduledTaskBoundedString(SCHEDULED_TASK_PROMPT_MAX_BYTES, "scheduled task prompt")
@@ -8527,6 +8661,10 @@ function scheduledTaskAgentConfigShape(bounded: boolean) {
       : z.string().min(1).optional(),
     reasoningEffort: ReasoningEffort.optional(),
     sandboxBackend: SandboxBackend.optional(),
+    // Connected Machines are a concrete execution target, not a generic
+    // sandbox backend. Persist the exact machine + optional cwd so every
+    // generated session can seed its active route before its first turn.
+    machineTarget: machineTarget.optional(),
     goal: GoalSpec.optional(),
     // Incident telemetry is the only special execution class. Omission keeps
     // every existing task on the byte-compatible ordinary dispatch path.
@@ -8568,6 +8706,20 @@ export type ScheduledTaskAgentConfig = z.infer<typeof ScheduledTaskAgentConfig>;
 export const ScheduledTaskAgentConfigInput = /* @__PURE__ */ z
   .object(scheduledTaskAgentConfigShape(true))
   .superRefine((value, context) => {
+    if (value.machineTarget && value.sandboxBackend !== undefined) {
+      context.addIssue({
+        code: "custom",
+        path: ["machineTarget"],
+        message: "machineTarget cannot be combined with sandboxBackend",
+      });
+    }
+    if (value.sandboxBackend === "selfhosted") {
+      context.addIssue({
+        code: "custom",
+        path: ["sandboxBackend"],
+        message: "selfhosted scheduled tasks require machineTarget",
+      });
+    }
     if (scheduledTaskJsonUtf8Bytes(value) > SCHEDULED_TASK_AGENT_CONFIG_MAX_BYTES) {
       context.addIssue({
         code: "custom",
@@ -8892,6 +9044,13 @@ const CreateAgentScheduledTaskRequest = /* @__PURE__ */ withVariableSetIdAlias({
       message: "agentConfig.goal cannot be used with an existing-session target",
     });
   }
+  if (value.runMode === "existing_session" && value.agentConfig.machineTarget) {
+    context.addIssue({
+      code: "custom",
+      path: ["agentConfig", "machineTarget"],
+      message: "machineTarget cannot be used with an existing-session target",
+    });
+  }
 });
 
 const CreateKnowledgeSourceSyncScheduledTaskRequest = /* @__PURE__ */ z
@@ -8926,48 +9085,59 @@ export const CreateScheduledTaskRequest = /* @__PURE__ */ z.union([
 ]);
 export type CreateScheduledTaskRequest = z.infer<typeof CreateScheduledTaskRequest>;
 
-export const UpdateScheduledTaskRequest = /* @__PURE__ */ withVariableSetIdAlias({
-  name: ScheduledTaskNameInput.optional(),
-  schedule: ScheduledTaskScheduleSpec.optional(),
-  runMode: ScheduledTaskRunMode.optional(),
-  overlapPolicy: ScheduledTaskOverlapPolicy.optional(),
-  action: ScheduledTaskAction.optional(),
-  targetSessionId: z.string().uuid().nullable().optional(),
-  connectionAuthorities: McpConnectionAuthoritySelections.optional(),
-  agentConfig: ScheduledTaskAgentConfigInput.optional(),
-  status: ScheduledTaskStatus.optional(),
-  variableSetId: z.string().uuid().nullable().optional(),
-  environmentId: z.string().uuid().nullable().optional(),
-  // The rig each run binds to (M3); null clears it. Its active version is
-  // resolved per fire, so an update takes effect on the next dispatch.
-  rigId: z.string().uuid().nullable().optional(),
-  metadata: z.record(z.string(), z.unknown()).optional(),
-}).superRefine((value, context) => {
-  if (value.targetSessionId && value.runMode && value.runMode !== "existing_session") {
-    context.addIssue({
-      code: "custom",
-      path: ["targetSessionId"],
-      message: "targetSessionId requires runMode=existing_session",
-    });
-  }
-  if (value.runMode === "existing_session" && value.targetSessionId === null) {
-    context.addIssue({
-      code: "custom",
-      path: ["targetSessionId"],
-      message: "targetSessionId cannot be null when runMode=existing_session",
-    });
-  }
-  if (
-    value.agentConfig?.goal &&
-    (value.runMode === "existing_session" || Boolean(value.targetSessionId))
-  ) {
-    context.addIssue({
-      code: "custom",
-      path: ["agentConfig", "goal"],
-      message: "agentConfig.goal cannot be used with an existing-session target",
-    });
-  }
-});
+export const UpdateScheduledTaskRequest =
+  /* @__PURE__ */ withVariableSetIdAlias({
+    name: ScheduledTaskNameInput.optional(),
+    schedule: ScheduledTaskScheduleSpec.optional(),
+    runMode: ScheduledTaskRunMode.optional(),
+    overlapPolicy: ScheduledTaskOverlapPolicy.optional(),
+    action: ScheduledTaskAction.optional(),
+    targetSessionId: z.string().uuid().nullable().optional(),
+    connectionAuthorities: McpConnectionAuthoritySelections.optional(),
+    agentConfig: ScheduledTaskAgentConfigInput.optional(),
+    status: ScheduledTaskStatus.optional(),
+    variableSetId: z.string().uuid().nullable().optional(),
+    environmentId: z.string().uuid().nullable().optional(),
+    // The rig each run binds to (M3); null clears it. Its active version is
+    // resolved per fire, so an update takes effect on the next dispatch.
+    rigId: z.string().uuid().nullable().optional(),
+    metadata: z.record(z.string(), z.unknown()).optional(),
+  }).superRefine((value, context) => {
+    if (value.targetSessionId && value.runMode && value.runMode !== "existing_session") {
+      context.addIssue({
+        code: "custom",
+        path: ["targetSessionId"],
+        message: "targetSessionId requires runMode=existing_session",
+      });
+    }
+    if (value.runMode === "existing_session" && value.targetSessionId === null) {
+      context.addIssue({
+        code: "custom",
+        path: ["targetSessionId"],
+        message: "targetSessionId cannot be null when runMode=existing_session",
+      });
+    }
+    if (
+      value.agentConfig?.goal &&
+      (value.runMode === "existing_session" || Boolean(value.targetSessionId))
+    ) {
+      context.addIssue({
+        code: "custom",
+        path: ["agentConfig", "goal"],
+        message: "agentConfig.goal cannot be used with an existing-session target",
+      });
+    }
+    if (
+      value.agentConfig?.machineTarget &&
+      (value.runMode === "existing_session" || Boolean(value.targetSessionId))
+    ) {
+      context.addIssue({
+        code: "custom",
+        path: ["agentConfig", "machineTarget"],
+        message: "machineTarget cannot be used with an existing-session target",
+      });
+    }
+  });
 export type UpdateScheduledTaskRequest = z.infer<typeof UpdateScheduledTaskRequest>;
 
 /**
@@ -11672,8 +11842,11 @@ export const Session = z.object({
       queuedDescendants: z.number().int().nonnegative(),
       attentionDescendants: z.number().int().nonnegative(),
       pausedDescendants: z.number().int().nonnegative(),
+      /** Historical failed lifecycle states, including already-reviewed failures. */
       failedDescendants: z.number().int().nonnegative(),
       unreadDescendants: z.number().int().nonnegative().optional(),
+      /** Failed descendants whose latest durable event this viewer has not acknowledged. */
+      unreadFailedDescendants: z.number().int().nonnegative().optional(),
       activelyWorkingDescendants: z.number().int().nonnegative().optional(),
       /**
        * Earliest moment one of the counted `attentionDescendants` entered
@@ -11725,57 +11898,6 @@ export const SessionListResponse = z.object({
 });
 export type SessionListResponse = z.infer<typeof SessionListResponse>;
 
-/** Compact, bounded session projection for workspace agent-topology browsers. */
-export const AgentTopologySession = z.object({
-  id: z.string().uuid(),
-  title: z.string().nullable(),
-  titleTruncated: z.boolean(),
-  parentSessionId: z.string().uuid().nullable(),
-  rootSessionId: z.string().uuid(),
-  nestedAgentDepth: NestedAgentDepthValue,
-  ancestorPath: z.array(
-    z.object({
-      id: z.string().uuid(),
-      title: z.string().nullable(),
-      titleTruncated: z.boolean(),
-    }),
-  ),
-  status: SessionStatus,
-  pause: z.object({
-    state: z.enum(["active", "paused"]),
-    additionalBlockerCount: z.number().int().nonnegative(),
-    source: z
-      .object({
-        kind: z.enum(["session", "workspace"]),
-        sessionId: z.string().uuid().optional(),
-        displayName: z.string(),
-        displayNameTruncated: z.boolean(),
-      })
-      .nullable(),
-  }),
-  children: z.object({
-    directChildren: z.number().int().nonnegative(),
-    totalDescendants: z.number().int().nonnegative(),
-    runningDescendants: z.number().int().nonnegative(),
-    queuedDescendants: z.number().int().nonnegative(),
-    attentionDescendants: z.number().int().nonnegative(),
-    pausedDescendants: z.number().int().nonnegative(),
-    failedDescendants: z.number().int().nonnegative(),
-    truncated: z.boolean(),
-  }),
-  createdAt: z.string(),
-  updatedAt: z.string(),
-});
-export type AgentTopologySession = z.infer<typeof AgentTopologySession>;
-
-export const AgentTopologyPageResponse = z.object({
-  sessions: z.array(AgentTopologySession),
-  total: z.number().int().nonnegative(),
-  hasMore: z.boolean(),
-  nextCursor: z.string().nullable(),
-});
-export type AgentTopologyPageResponse = z.infer<typeof AgentTopologyPageResponse>;
-
 // Recursive: the TS type is declared first so the schema annotation can carry
 // the FULL recursive shape (a shallow annotation loses type information for
 // contracts consumers after one level of nesting).
@@ -14557,6 +14679,10 @@ export const ClientAuthConfig = z.discriminatedUnion("mode", [
     mode: z.literal("managedSession"),
     session: z.literal("cookie"),
     emailVerificationRequired: z.boolean().default(true),
+    socialProviders: z
+      .array(z.enum(["google", "github"]))
+      .max(2)
+      .default([]),
   }),
 ]);
 export type ClientAuthConfig = z.infer<typeof ClientAuthConfig>;
@@ -14655,10 +14781,10 @@ export const SessionCapabilities = z.object({
     codecs: z.array(z.enum(["h264-mp4", "vp9-webm"])),
     reason: CapabilityUnavailableReason.nullable(),
   }),
-  // The AGENT drives the SAME :0 (xdotool/XTEST + scrot) the human watches; the
-  // human viewer plane is read-only by default (§6). `available` == desktop-
-  // capable backend && computerUseEnabled; `readOnly` reports whether the agent
-  // driver itself is gated to no-op input (v1 default false — the agent clicks).
+  // Deprecated compatibility cell for clients that predate managed
+  // ComputerSession interaction tools. Newly negotiated documents report this
+  // unavailable/read-only with `disabled_by_policy`; the shape remains so older
+  // clients and persisted payloads still parse.
   ComputerUse: z.object({
     available: z.boolean(),
     readOnly: z.boolean(),
@@ -15338,9 +15464,8 @@ function defineModelContractSchema<Schema>(factory: () => Schema): Schema {
   return factory();
 }
 
-export const ModelCapabilitySupportV1 = /* @__PURE__ */ defineModelContractSchema(() =>
-  z.enum(["supported", "unsupported", "unknown"]),
-);
+export const ModelCapabilitySupportV1 =
+  /* @__PURE__ */ defineModelContractSchema(() => z.enum(["supported", "unsupported", "unknown"]));
 export type ModelCapabilitySupportV1 = z.infer<typeof ModelCapabilitySupportV1>;
 
 export const ModelCapabilityStateV1 = /* @__PURE__ */ defineModelContractSchema(() =>
@@ -15388,28 +15513,29 @@ export const ModelCapabilitiesV1 = /* @__PURE__ */ defineModelContractSchema(()
 );
 export type ModelCapabilitiesV1 = z.infer<typeof ModelCapabilitiesV1>;
 
-export const ModelCredentialSourceV1 = /* @__PURE__ */ defineModelContractSchema(() =>
-  z.union([
-    z
-      .object({
-        kind: z.literal("deployment"),
-        mechanism: z.enum(["api_key", "azure_ad_bearer"]),
-      })
-      .strict(),
-    z
-      .object({
-        kind: z.literal("connected_subscription"),
-        provider: z.enum(["codex", "xai"]),
-      })
-      .strict(),
-    z
-      .object({
-        kind: z.literal("workspace_connection"),
-        mechanism: z.literal("api_key"),
-      })
-      .strict(),
-  ]),
-);
+export const ModelCredentialSourceV1 =
+  /* @__PURE__ */ defineModelContractSchema(() =>
+    z.union([
+      z
+        .object({
+          kind: z.literal("deployment"),
+          mechanism: z.enum(["api_key", "azure_ad_bearer"]),
+        })
+        .strict(),
+      z
+        .object({
+          kind: z.literal("connected_subscription"),
+          provider: z.enum(["codex", "xai"]),
+        })
+        .strict(),
+      z
+        .object({
+          kind: z.literal("workspace_connection"),
+          mechanism: z.literal("api_key"),
+        })
+        .strict(),
+    ]),
+  );
 export type ModelCredentialSourceV1 = z.infer<typeof ModelCredentialSourceV1>;
 
 const TurnExecutionCredentialSourceV1 = z.union([
@@ -15422,31 +15548,35 @@ const TurnExecutionCredentialSourceV1 = z.union([
     .strict(),
 ]);
 
-export const ModelBillingAttributionV1 = /* @__PURE__ */ defineModelContractSchema(() =>
-  z
-    .object({
-      upstreamPayer: z.enum(["deployment", "workspace", "connected_subscription"]),
-      metering: z.enum(["opengeni_credits", "external"]),
-    })
-    .strict(),
-);
+export const ModelBillingAttributionV1 =
+  /* @__PURE__ */ defineModelContractSchema(() =>
+    z
+      .object({
+        upstreamPayer: z.enum(["deployment", "workspace", "connected_subscription"]),
+        metering: z.enum(["opengeni_credits", "external"]),
+      })
+      .strict(),
+  );
 export type ModelBillingAttributionV1 = z.infer<typeof ModelBillingAttributionV1>;
 
 export const TURN_EXECUTION_POLICY_METADATA_KEY = "turnExecutionPolicyV1" as const;
 
-export const TurnExecutionModelSourceV1 = /* @__PURE__ */ defineModelContractSchema(() =>
-  z.enum(["explicit", "session", "deployment", "continuation"]),
-);
+export const TurnExecutionModelSourceV1 =
+  /* @__PURE__ */ defineModelContractSchema(() =>
+    z.enum(["explicit", "session", "deployment", "continuation"]),
+  );
 export type TurnExecutionModelSourceV1 = z.infer<typeof TurnExecutionModelSourceV1>;
 
-export const TurnExecutionReasoningSourceV1 = /* @__PURE__ */ defineModelContractSchema(() =>
-  z.enum(["explicit", "session", "deployment", "continuation"]),
-);
+export const TurnExecutionReasoningSourceV1 =
+  /* @__PURE__ */ defineModelContractSchema(() =>
+    z.enum(["explicit", "session", "deployment", "continuation"]),
+  );
 export type TurnExecutionReasoningSourceV1 = z.infer<typeof TurnExecutionReasoningSourceV1>;
 
-export const TurnExecutionLatencyModeSourceV1 = /* @__PURE__ */ defineModelContractSchema(() =>
-  z.enum(["explicit", "session", "deployment", "continuation"]),
-);
+export const TurnExecutionLatencyModeSourceV1 =
+  /* @__PURE__ */ defineModelContractSchema(() =>
+    z.enum(["explicit", "session", "deployment", "continuation"]),
+  );
 export type TurnExecutionLatencyModeSourceV1 = z.infer<typeof TurnExecutionLatencyModeSourceV1>;
 
 /**
@@ -15648,59 +15778,60 @@ export const ClientModel = /* @__PURE__ */ defineModelContractSchema(() =>
 );
 export type ClientModel = z.infer<typeof ClientModel>;
 
-export const ModelCredentialReadinessV1 = /* @__PURE__ */ defineModelContractSchema(() =>
-  z
-    .object({
-      status: z.enum(["ready", "not_ready", "error"]),
-      reason: z
-        .enum([
-          "missing_credential",
-          "needs_reauth",
-          "prerequisites_missing",
-          "resolver_error",
-          "observation_stale",
-        ])
-        .nullable(),
-      basis: z.enum(["configuration", "connection", "resolver"]),
-      checkedAt: z.string().datetime().nullable(),
-    })
-    .strict()
-    .superRefine((readiness, context) => {
-      if ((readiness.status === "ready") !== (readiness.reason === null)) {
-        context.addIssue({
-          code: "custom",
-          path: ["reason"],
-          message: "ready credential state requires no reason; non-ready state requires a reason",
-        });
-      }
-      if ((readiness.status === "error") !== (readiness.reason === "resolver_error")) {
-        context.addIssue({
-          code: "custom",
-          path: ["reason"],
-          message:
-            "credential errors require resolver_error and resolver_error requires error status",
-        });
-      }
-      if (
-        readiness.basis === "resolver" &&
-        readiness.status === "ready" &&
-        readiness.checkedAt === null
-      ) {
-        context.addIssue({
-          code: "custom",
-          path: ["checkedAt"],
-          message: "resolver readiness requires an observation timestamp",
-        });
-      }
-      if (readiness.reason === "observation_stale" && readiness.checkedAt === null) {
-        context.addIssue({
-          code: "custom",
-          path: ["checkedAt"],
-          message: "a stale observation requires its observation timestamp",
-        });
-      }
-    }),
-);
+export const ModelCredentialReadinessV1 =
+  /* @__PURE__ */ defineModelContractSchema(() =>
+    z
+      .object({
+        status: z.enum(["ready", "not_ready", "error"]),
+        reason: z
+          .enum([
+            "missing_credential",
+            "needs_reauth",
+            "prerequisites_missing",
+            "resolver_error",
+            "observation_stale",
+          ])
+          .nullable(),
+        basis: z.enum(["configuration", "connection", "resolver"]),
+        checkedAt: z.string().datetime().nullable(),
+      })
+      .strict()
+      .superRefine((readiness, context) => {
+        if ((readiness.status === "ready") !== (readiness.reason === null)) {
+          context.addIssue({
+            code: "custom",
+            path: ["reason"],
+            message: "ready credential state requires no reason; non-ready state requires a reason",
+          });
+        }
+        if ((readiness.status === "error") !== (readiness.reason === "resolver_error")) {
+          context.addIssue({
+            code: "custom",
+            path: ["reason"],
+            message:
+              "credential errors require resolver_error and resolver_error requires error status",
+          });
+        }
+        if (
+          readiness.basis === "resolver" &&
+          readiness.status === "ready" &&
+          readiness.checkedAt === null
+        ) {
+          context.addIssue({
+            code: "custom",
+            path: ["checkedAt"],
+            message: "resolver readiness requires an observation timestamp",
+          });
+        }
+        if (readiness.reason === "observation_stale" && readiness.checkedAt === null) {
+          context.addIssue({
+            code: "custom",
+            path: ["checkedAt"],
+            message: "a stale observation requires its observation timestamp",
+          });
+        }
+      }),
+  );
 export type ModelCredentialReadinessV1 = z.infer<typeof ModelCredentialReadinessV1>;
 
 export const ModelAvailabilityV1 = /* @__PURE__ */ defineModelContractSchema(() =>
@@ -15723,21 +15854,23 @@ export const ModelAvailabilityV1 = /* @__PURE__ */ defineModelContractSchema(()
 );
 export type ModelAvailabilityV1 = z.infer<typeof ModelAvailabilityV1>;
 
-export const WorkspaceModelCatalogModel = /* @__PURE__ */ defineModelContractSchema(() =>
-  ClientModel.extend({
-    credentialReadiness: ModelCredentialReadinessV1,
-    /** Exact workspace-policy verdict without exposing provider identity. */
-    policyAllowed: z.boolean().optional(),
-    availability: ModelAvailabilityV1,
-  }),
-);
+export const WorkspaceModelCatalogModel =
+  /* @__PURE__ */ defineModelContractSchema(() =>
+    ClientModel.extend({
+      credentialReadiness: ModelCredentialReadinessV1,
+      /** Exact workspace-policy verdict without exposing provider identity. */
+      policyAllowed: z.boolean().optional(),
+      availability: ModelAvailabilityV1,
+    }),
+  );
 export type WorkspaceModelCatalogModel = z.infer<typeof WorkspaceModelCatalogModel>;
 
-export const WorkspaceModelCatalogResponse = /* @__PURE__ */ defineModelContractSchema(() =>
-  z.object({
-    models: z.array(WorkspaceModelCatalogModel),
-  }),
-);
+export const WorkspaceModelCatalogResponse =
+  /* @__PURE__ */ defineModelContractSchema(() =>
+    z.object({
+      models: z.array(WorkspaceModelCatalogModel),
+    }),
+  );
 export type WorkspaceModelCatalogResponse = z.infer<typeof WorkspaceModelCatalogResponse>;
 
 /**
@@ -15768,6 +15901,9 @@ export const ClientConfig = /* @__PURE__ */ defineModelContractSchema(() =>
     models: z.array(ClientModel).default([]),
     defaultReasoningEffort: ReasoningEffort,
     allowedReasoningEfforts: z.array(ReasoningEffort).min(1),
+    // Client-safe execution default. The schedule editor uses this to avoid
+    // presenting a targetless "managed" choice on self-hosted deployments.
+    defaultSandboxBackend: SandboxBackend.default("modal"),
     mcpServers: z
       .array(
         z.object({