@opengeni/core 0.11.2 → 0.11.8

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import { Settings } from '@opengeni/config';
-import { ScheduledTask, Document, GitHubAppApiPort, ConnectionCredentialsPort, SessionAuthorizationPort, Permission, AccessContext, AccessGrant, SessionAuthorizationActor, SessionAuthorizationTarget, SessionAuthorizationOperation, SessionAuthorizationSurface, SessionAuthorizationListScope, LimitAction, LimitDecision, TurnInitiator, TurnInitiatorContext, SessionTurnSource, CapabilityCatalogItem, CapabilityInstallation, CapabilityCatalogResponse, CreateCapabilityCatalogItemRequest, EnableCapabilityRequest, VariableSet, Rig, RigVersion, CreateRigRequest, RigDefinitionEditPayload, RigChange, ProposeRigChangeRequest, UpdateRigRequest, CapabilityPack, SocialConnection, ScheduledTaskAgentConfig, ToolRef, ResourceRef, SessionEffectiveToolPolicy, SessionToolPolicy, Session, CreateScheduledTaskRequest, UpdateScheduledTaskRequest, SessionSpawnDenial, ReasoningEffort, SessionMcpCredentialUpdateInput, SessionEvent, SessionTurn, TurnExecutionPolicyV1, GoalSpec, SessionMcpServerMetadata, CreateSessionResponse, SessionMcpApprovalPolicy, UpdateSessionMcpApprovalPolicyResponse, WorkspaceMember, NewSessionDraft, SessionControlRequest, SessionControlResponse, WorkspaceInferenceControlRequest, WorkspaceInferenceControlResponse, DeleteSessionQueueItemRequest, SessionQueueMutationResponse, EditSessionQueueItemRequest, ComposerDraft, MoveSessionQueueItemRequest, SaveComposerDraftRequest, SteerSessionQueueItemRequest } from '@opengeni/contracts';
+import { ScheduledTask, Document, GitHubAppApiPort, ConnectionCredentialsPort, SessionAuthorizationPort, Permission, AccessContext, AccessGrant, SessionAuthorizationActor, SessionAuthorizationTarget, SessionAuthorizationOperation, SessionAuthorizationSurface, SessionAuthorizationListScope, LimitAction, LimitDecision, TurnInitiator, TurnInitiatorContext, SessionTurnSource, CapabilityCatalogItem, CapabilityInstallation, CapabilityCatalogResponse, CreateCapabilityCatalogItemRequest, EnableCapabilityRequest, VariableSet, Rig, RigVersion, CreateRigRequest, RigDefinitionEditPayload, RigChange, ProposeRigChangeRequest, UpdateRigRequest, CapabilityPack, SocialConnection, ScheduledTaskAgentConfig, ToolRef, ResourceRef, SessionEffectiveToolPolicy, SessionToolPolicy, Session, CreateScheduledTaskRequest, UpdateScheduledTaskRequest, SessionSpawnDenial, ReasoningEffort, SessionMcpCredentialUpdateInput, SessionEvent, SessionTurn, TurnExecutionPolicyV1, GoalSpec, SessionMcpServerMetadata, CreateSessionResponse, SessionMcpApprovalPolicy, UpdateSessionMcpApprovalPolicyResponse, UpdateSessionToolPolicyRequest, WorkspaceMember, NewSessionDraft, SessionControlRequest, SessionControlResponse, WorkspaceInferenceControlRequest, WorkspaceInferenceControlResponse, DeleteSessionQueueItemRequest, SessionQueueMutationResponse, EditSessionQueueItemRequest, ComposerDraft, MoveSessionQueueItemRequest, SaveComposerDraftRequest, SteerSessionQueueItemRequest } from '@opengeni/contracts';
 export { mergeToolRefs, stableJson } from '@opengeni/contracts';
 import * as _opengeni_db from '@opengeni/db';
 import { Database, SandboxRecord, EnabledMcpCapabilityServer, UpdateScheduledTaskInput, SessionCommandActor, CreateSessionMcpServerInput, UpdateSessionMcpServerCredentialsInput } from '@opengeni/db';
@@ -670,6 +670,12 @@ declare function validateGitHubRepositorySelectionShapes(resources: ResourceRef[
 /** @deprecated Use validateGitHubRepositorySelectionShapes for multi-installation sessions. */
 declare function validateGitHubRepositorySelectionShape(resources: ResourceRef[]): number | null;
 declare function validateGitHubRepositorySelection(db: Database, workspaceId: string, resources: ResourceRef[]): Promise<void>;
+/**
+ * A 422 from repository selection validation is an authoritative stale or
+ * revoked identity. Other failures (for example a database/catalog outage)
+ * leave the result unknown and must not cause draft hydration to delete it.
+ */
+declare function isAuthoritativeGitHubRepositorySelectionError(error: unknown): boolean;
 declare function validateFileResources(db: Database, workspaceId: string, resources: ResourceRef[]): Promise<void>;
 
 type ResolvedSessionToolPolicy = {
@@ -693,6 +699,14 @@ type SessionToolPolicyInput = {
  * `defaultMcpServerIds` is the capability-only omitted-tools set.
  */
 declare function resolveSessionToolPolicy(input: SessionToolPolicyInput): ResolvedSessionToolPolicy;
+/**
+ * Native provider tools that belong to the workspace-default capability set
+ * follow the same omission/narrowing fence as deferred MCP tools. A durable
+ * workspace-default policy receives them; fixed historical policies and an
+ * explicit per-turn replacement do not. Provider support remains a separate
+ * runtime gate and must also be true before a native tool is attached.
+ */
+declare function sessionToolPolicyAllowsDefaultNativeTools(policy: SessionEffectiveToolPolicy): boolean;
 /** Current full runtime registry IDs, including configured static servers. */
 declare function workspaceSessionToolPolicyServerIds(db: Database, workspaceId: string, settings: Settings): Promise<string[]>;
 /** Current omitted-tools defaults; this preserves capability-first behavior. */
@@ -985,6 +999,18 @@ declare function updateSessionMcpApprovalPolicy(deps: {
     bus: EventBus;
     sessionAuthorization?: SessionAuthorizationPort | null;
 }, grant: AccessGrant, sessionId: string, serverId: string, requireApproval: SessionMcpApprovalPolicy): Promise<UpdateSessionMcpApprovalPolicyResponse>;
+/**
+ * Replace the durable session tool policy. The target and its parent (when
+ * present) are locked by the DB event-writer helper, and the update/event are
+ * committed under one version-fenced transaction. An already claimed turn
+ * keeps its immutable snapshot; the next attempt observes this policy.
+ */
+declare function updateSessionToolPolicy(deps: {
+    db: Database;
+    bus: EventBus;
+    settings: Settings;
+    sessionAuthorization?: SessionAuthorizationPort | null;
+}, grant: AccessGrant, sessionId: string, request: UpdateSessionToolPolicyRequest): Promise<Session>;
 declare function readSessionLineage(deps: Pick<ApiRouteDeps, "db" | "sessionAuthorization">, grant: AccessGrant, sessionId: string): Promise<_opengeni_db.SessionLineage>;
 
 /** A member can manage other members (directly or via the admin wildcard). */
@@ -1117,4 +1143,4 @@ declare function controlHumanWorkspace(deps: {
 declare function getHumanComposerDraft(deps: SessionAuthorizationCommandDeps, context: HumanSessionCommandContext): Promise<ComposerDraft>;
 declare function saveHumanComposerDraft(deps: SessionAuthorizationCommandDeps, context: HumanSessionCommandContext, input: SaveComposerDraftRequest): Promise<ComposerDraft>;
 
-export { type AcceptSessionUserMessageDependencies, type AccessDeps, type AgentSessionCommandContext, type ApiRouteDeps, type ApiSandboxClient, type ApiSandboxSession, type AppDependencies, type ChannelARoutingServices, type DocumentIndexClient, type FleetContext, type FleetListResult, type FleetLiveness, type FleetReadinessHold, type FleetSandboxEntry, type FleetServices, type FleetSwapResult, type HumanSessionCommandContext, type LimitCheckInput, type LimitDependencies, MARKETING_SOCIAL_PACK_ID, MAX_CHECKS_PER_RIG, MAX_CREDENTIAL_HOOKS_PER_RIG, MAX_DEFAULT_VARIABLE_SETS_PER_RIG, MAX_ENVIRONMENTS_PER_WORKSPACE, MAX_RIGS_PER_WORKSPACE, MAX_VARIABLES_PER_ENVIRONMENT, type ManagedAuth, type McpCapabilityProbe, type McpCapabilityProbeInput, type McpCapabilityProbeResult, type ObjectStorageDependency, type ProvisionResult, type ResolvedSessionAuthorization, type ResolvedSessionToolPolicy, type ResumeBoxByIdInput, type ResumedSandboxSession, type RigServices, type RigVerificationClassification, type RunOnOp, type RunOnResult, SESSION_AUTHORIZATION_DEFAULT_REAUTHORIZE_MS, SESSION_WORKFLOW_WAKE_DISPATCHER_PERIOD_MS, SESSION_WORKFLOW_WAKE_DISPATCHER_SCHEDULE_ID, SESSION_WORKFLOW_WAKE_DISPATCHER_WORKFLOW_TYPE, SessionAuthorizationDeniedError, type SessionAuthorizationDependencies, SessionAuthorizationUnavailableError, SessionSpawnDeniedError, type SessionToolPolicyInput, type SessionWorkflowClient, acceptSessionUserMessage, activateRigVersionForApi, appendRigSetupCommand, applyCapabilityEnablement, assertAllowedEnvironmentVariableName, assertAllowedVariableSetVariableName, assertConfiguredModel, assertPackSandboxImageCompatible, assertToolRefsSubset, assertWorkspaceDeletable, assertWorkspaceMemberRemovable, assertWorkspaceModelPolicyAllows, availableToolRefs, buildCapabilityCatalog, buildFleetContextForSession, buildMarketingDailyAnalysisAgentConfig, canonicalConfiguredModel, checkLimit, classifyRigVerificationOutcome, controlAgentSessionWorkstream, controlHumanSessionWorkstream, controlHumanWorkspace, createAndStartSession, createCatalogItem, createRigForApi, createRigVersionForApi, createSessionForRequest, createValidatedScheduledTask, deleteHumanQueuePrompt, deleteRigForApi, disableCapability, discoverMcpRegistryCapabilities, editHumanQueuePrompt, enableCapability, enabledCapabilityMcpToolRefs, getActorNewSessionDraft, getCapabilityPack, getHumanComposerDraft, hasPermission, isBuiltInCapabilityPack, isUserMember, listCapabilityPacks, listFleet, listRigChangesForApi, listRigVersionsForApi, listWorkspaceCapabilityPacks, manualScheduledTaskTriggerUsageKey, manualScheduledTaskTriggerWorkflowId, memberCanAdminister, mergeResourceRefs, moveHumanQueuePrompt, normalizeResources, officialMcpRegistryUrl, postUserMessageTurn, promoteSetupAppendChange, promoteVerifiedDefinitionEditChangeForApi, proposeRigChangeForApi, provisionSandbox, readSessionLineage, reasoningEffortForSession, recordRigAuditEvent, recordVariableSetAuditEvent, recordWorkspaceUsage, relayConfigFromSettings, relayDialBaseFromSettings, requireAccessContext, requireAccessGrant, requireEnvironmentEncryption, requireLimit, requirePermission, requireQueuedTurnForApi, requireRigChangeForApi, requireRigForApi, requireScheduledTaskForApi, requireSessionAuthorization, requireSessionAuthorizationListScope, requireVariableSetEncryption, requireVariableSetForApi, resolveCapabilityPack, resolveMemberSubjectId, resolveSessionToolPolicy, restoreScheduledTask, rigActorForGrant, routingEnabled, runOnSandbox, saveActorNewSessionDraft, saveHumanComposerDraft, scheduledTaskTemporalScheduleId, scheduledTaskToolsProvided, scheduledTaskTriggerToken, sendAgentSessionMessage, sessionSpawnDenialEnvelope, sessionWithEffectiveToolPolicy, settingsWithEnabledCapabilityMcpServers, settingsWithMcpCapabilityServers, settingsWithSessionMcpServerMetadata, steerAgentSession, steerHumanQueuePrompt, swapActiveSandbox, syncCreatedScheduledTask, syncUpdatedScheduledTask, updateRigForApi, updateSessionMcpApprovalPolicy, updateSessionTitle, validateFileResources, validateGitHubRepositorySelection, validateGitHubRepositorySelectionShape, validateGitHubRepositorySelectionShapes, validateMcpCapabilityConnection, validateToolRefs, validateToolRefsForSessionPolicy, validateVariableSetAttachment, validatedScheduledTaskUpdate, withDefaultEnabledCapabilityMcpTools, workflowIdForSession, workspaceSessionToolPolicyDefaultServerIds, workspaceSessionToolPolicyServerIds, wrapChannelABoxWithRouting };
+export { type AcceptSessionUserMessageDependencies, type AccessDeps, type AgentSessionCommandContext, type ApiRouteDeps, type ApiSandboxClient, type ApiSandboxSession, type AppDependencies, type ChannelARoutingServices, type DocumentIndexClient, type FleetContext, type FleetListResult, type FleetLiveness, type FleetReadinessHold, type FleetSandboxEntry, type FleetServices, type FleetSwapResult, type HumanSessionCommandContext, type LimitCheckInput, type LimitDependencies, MARKETING_SOCIAL_PACK_ID, MAX_CHECKS_PER_RIG, MAX_CREDENTIAL_HOOKS_PER_RIG, MAX_DEFAULT_VARIABLE_SETS_PER_RIG, MAX_ENVIRONMENTS_PER_WORKSPACE, MAX_RIGS_PER_WORKSPACE, MAX_VARIABLES_PER_ENVIRONMENT, type ManagedAuth, type McpCapabilityProbe, type McpCapabilityProbeInput, type McpCapabilityProbeResult, type ObjectStorageDependency, type ProvisionResult, type ResolvedSessionAuthorization, type ResolvedSessionToolPolicy, type ResumeBoxByIdInput, type ResumedSandboxSession, type RigServices, type RigVerificationClassification, type RunOnOp, type RunOnResult, SESSION_AUTHORIZATION_DEFAULT_REAUTHORIZE_MS, SESSION_WORKFLOW_WAKE_DISPATCHER_PERIOD_MS, SESSION_WORKFLOW_WAKE_DISPATCHER_SCHEDULE_ID, SESSION_WORKFLOW_WAKE_DISPATCHER_WORKFLOW_TYPE, SessionAuthorizationDeniedError, type SessionAuthorizationDependencies, SessionAuthorizationUnavailableError, SessionSpawnDeniedError, type SessionToolPolicyInput, type SessionWorkflowClient, acceptSessionUserMessage, activateRigVersionForApi, appendRigSetupCommand, applyCapabilityEnablement, assertAllowedEnvironmentVariableName, assertAllowedVariableSetVariableName, assertConfiguredModel, assertPackSandboxImageCompatible, assertToolRefsSubset, assertWorkspaceDeletable, assertWorkspaceMemberRemovable, assertWorkspaceModelPolicyAllows, availableToolRefs, buildCapabilityCatalog, buildFleetContextForSession, buildMarketingDailyAnalysisAgentConfig, canonicalConfiguredModel, checkLimit, classifyRigVerificationOutcome, controlAgentSessionWorkstream, controlHumanSessionWorkstream, controlHumanWorkspace, createAndStartSession, createCatalogItem, createRigForApi, createRigVersionForApi, createSessionForRequest, createValidatedScheduledTask, deleteHumanQueuePrompt, deleteRigForApi, disableCapability, discoverMcpRegistryCapabilities, editHumanQueuePrompt, enableCapability, enabledCapabilityMcpToolRefs, getActorNewSessionDraft, getCapabilityPack, getHumanComposerDraft, hasPermission, isAuthoritativeGitHubRepositorySelectionError, isBuiltInCapabilityPack, isUserMember, listCapabilityPacks, listFleet, listRigChangesForApi, listRigVersionsForApi, listWorkspaceCapabilityPacks, manualScheduledTaskTriggerUsageKey, manualScheduledTaskTriggerWorkflowId, memberCanAdminister, mergeResourceRefs, moveHumanQueuePrompt, normalizeResources, officialMcpRegistryUrl, postUserMessageTurn, promoteSetupAppendChange, promoteVerifiedDefinitionEditChangeForApi, proposeRigChangeForApi, provisionSandbox, readSessionLineage, reasoningEffortForSession, recordRigAuditEvent, recordVariableSetAuditEvent, recordWorkspaceUsage, relayConfigFromSettings, relayDialBaseFromSettings, requireAccessContext, requireAccessGrant, requireEnvironmentEncryption, requireLimit, requirePermission, requireQueuedTurnForApi, requireRigChangeForApi, requireRigForApi, requireScheduledTaskForApi, requireSessionAuthorization, requireSessionAuthorizationListScope, requireVariableSetEncryption, requireVariableSetForApi, resolveCapabilityPack, resolveMemberSubjectId, resolveSessionToolPolicy, restoreScheduledTask, rigActorForGrant, routingEnabled, runOnSandbox, saveActorNewSessionDraft, saveHumanComposerDraft, scheduledTaskTemporalScheduleId, scheduledTaskToolsProvided, scheduledTaskTriggerToken, sendAgentSessionMessage, sessionSpawnDenialEnvelope, sessionToolPolicyAllowsDefaultNativeTools, sessionWithEffectiveToolPolicy, settingsWithEnabledCapabilityMcpServers, settingsWithMcpCapabilityServers, settingsWithSessionMcpServerMetadata, steerAgentSession, steerHumanQueuePrompt, swapActiveSandbox, syncCreatedScheduledTask, syncUpdatedScheduledTask, updateRigForApi, updateSessionMcpApprovalPolicy, updateSessionTitle, updateSessionToolPolicy, validateFileResources, validateGitHubRepositorySelection, validateGitHubRepositorySelectionShape, validateGitHubRepositorySelectionShapes, validateMcpCapabilityConnection, validateToolRefs, validateToolRefsForSessionPolicy, validateVariableSetAttachment, validatedScheduledTaskUpdate, withDefaultEnabledCapabilityMcpTools, workflowIdForSession, workspaceSessionToolPolicyDefaultServerIds, workspaceSessionToolPolicyServerIds, wrapChannelABoxWithRouting };

package/dist/index.js

@@ -25,10 +25,12 @@ import { HTTPException } from "hono/http-exception";
 import {
   advanceWorkspaceGenerationForDirectRequest,
   advanceWorkspaceGenerationForRetainedProcess,
+  getRetainedProcess,
   getSandbox,
   markWarmLeaseInstanceLost,
   readActiveSandbox,
   retainWorkspaceMutationProcess,
+  retainedProcessSettlementIdentity,
   settleRetainedProcess,
   verifyDirectWorkspaceMutationSettlement,
   verifyRetainedProcessMutationSettlement
@@ -43,7 +45,12 @@ import {
 function relayConfigFromSettings(settings) {
   const raw = settings.selfhostedRelayUrl?.trim();
   if (!raw) {
-    return { host: "relay.opengeni.local", port: 443, tls: true, path: "/stream" };
+    return {
+      host: "relay.opengeni.local",
+      port: 443,
+      tls: true,
+      path: "/stream"
+    };
   }
   try {
     const url = new URL(raw.includes("://") ? raw : `wss://${raw}`);
@@ -185,14 +192,23 @@ function wrapChannelABoxWithRouting(services, ids, established) {
     process,
     proof
   }) => {
-    if (backend.sandboxId !== null || backend.leaseEpoch === void 0 || backend.providerInstanceId === void 0) {
+    if (backend.sandboxId !== null || backend.leaseEpoch === void 0 || backend.providerInstanceId === void 0 || backend.activeEpoch === void 0) {
       return;
     }
+    const durable = await getRetainedProcess(db, {
+      workspaceId: ids.workspaceId,
+      sessionId: ids.sessionId,
+      processId: process.id
+    });
+    if (!durable || durable.providerSessionId !== process.providerSessionId || durable.providerBackend !== backend.kind || durable.providerInstanceId !== backend.providerInstanceId || durable.leaseEpoch !== backend.leaseEpoch || durable.routeKind !== (backend.sandboxId === null ? "home" : "active") || durable.routeTargetId !== backend.sandboxId || durable.routeEpoch !== backend.activeEpoch) {
+      throw new Error("API retained-process settlement lost its exact durable backend identity");
+    }
     await settleRetainedProcess(db, {
       accountId: ids.accountId,
       workspaceId: ids.workspaceId,
       sessionId: ids.sessionId,
       processId: process.id,
+      expected: retainedProcessSettlementIdentity(durable),
       outcome: proof.outcome,
       exitCode: proof.exitCode,
       reason: proof.reason,
@@ -3102,6 +3118,9 @@ async function validateGitHubRepositorySelection(db, workspaceId, resources) {
     }
   }
 }
+function isAuthoritativeGitHubRepositorySelectionError(error) {
+  return error instanceof HTTPException8 && error.status === 422;
+}
 async function validateFileResources(db, workspaceId, resources) {
   const fileIds = /* @__PURE__ */ new Set();
   for (const resource of resources) {
@@ -3202,11 +3221,9 @@ function resolveSessionToolPolicy(input) {
   const configuredIds = effectiveIds.filter((id) => availableIds.has(id));
   const configuredIdSet = new Set(configuredIds);
   const droppedIds = effectiveIds.filter((id) => !configuredIdSet.has(id));
-  const deferredIds = tracksWorkspaceDefaults ? sortedIds(
-    toolRefs.filter(
-      (tool) => tool.optional === true && configuredIdSet.has(tool.id) && !mandatoryIdSet.has(tool.id)
-    ).map((tool) => tool.id)
-  ) : [];
+  const deferredIds = sortedIds(
+    toolRefs.filter((tool) => configuredIdSet.has(tool.id) && !mandatoryIdSet.has(tool.id)).map((tool) => tool.id)
+  );
   const selectedIds = sortedIds(
     selectedRefs.filter(
       (tool) => !mandatoryIdSet.has(tool.id) && !(tracksWorkspaceDefaults && tool.optional === true)
@@ -3229,7 +3246,7 @@ function resolveSessionToolPolicy(input) {
       effectiveIds: projections.effective.ids,
       mandatoryIds: projections.mandatory.ids,
       lazyRouter: {
-        state: tracksWorkspaceDefaults ? "required" : "disabled",
+        state: deferredIds.length > 0 ? "required" : "disabled",
         deferredIds: projections.deferred.ids
       },
       configuredIds: projections.configured.ids,
@@ -3246,6 +3263,9 @@ function resolveSessionToolPolicy(input) {
     }
   };
 }
+function sessionToolPolicyAllowsDefaultNativeTools(policy) {
+  return policy.mode === "workspace_default" && policy.lazyRouter.state === "required";
+}
 async function workspaceSessionToolPolicyServerIds(db, workspaceId, settings) {
   const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(db, workspaceId, settings);
   return sortedIds(runtimeSettings.mcpServers.map((server) => server.id));
@@ -3298,6 +3318,7 @@ import {
   ServiceTurnInitiatorContext,
   evaluateWorkspaceModelPolicy,
   reasoningEffortForMetadata,
+  stableJson as stableJson2,
   SessionMcpApprovalPolicy
 } from "@opengeni/contracts";
 import {
@@ -3330,7 +3351,8 @@ import {
   QueueCommandConflictError,
   AgentCommandAuthorityError,
   SessionSpawnDeniedDbError,
-  SessionControlConflictError
+  SessionControlConflictError,
+  SessionToolPolicyVersionConflictError
 } from "@opengeni/db";
 import {
   appendAndPublishEvents as appendAndPublishEvents2,
@@ -3341,6 +3363,7 @@ import { HTTPException as HTTPException9 } from "hono/http-exception";
 var reservedSessionMcpServerIds = /* @__PURE__ */ new Set(["opengeni", "files", "docs", "codex_apps"]);
 var maxSessionMcpCredentialHeaders = 16;
 var maxSessionMcpCredentialHeaderValueLength = 4096;
+var maxToolPolicyAuditRefs = 40;
 var sessionMcpCredentialHeaderName = /^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/;
 var SessionSpawnDeniedError = class extends Error {
   denial;
@@ -4472,6 +4495,150 @@ async function updateSessionMcpApprovalPolicy(deps, grant, sessionId, serverId,
     effectiveFrom: "next_attempt"
   };
 }
+function toolPolicyAuditSnapshot(session, tools, policy = session.toolPolicy ?? { mode: "legacy", inheritedFromSessionId: null }) {
+  const allToolRefs = mergeToolRefs([], tools).sort((left, right) => {
+    const leftMandatory = left.kind === "mcp" && left.id === "opengeni";
+    const rightMandatory = right.kind === "mcp" && right.id === "opengeni";
+    if (leftMandatory !== rightMandatory) return leftMandatory ? -1 : 1;
+    return `${left.kind}:${left.id}`.localeCompare(`${right.kind}:${right.id}`);
+  }).map((tool) => ({
+    kind: tool.kind,
+    id: tool.id,
+    ...tool.optional === void 0 ? {} : { optional: tool.optional }
+  }));
+  const toolRefs = allToolRefs.slice(0, maxToolPolicyAuditRefs);
+  return {
+    mode: policy.mode,
+    inheritedFromSessionId: policy.inheritedFromSessionId,
+    // IDs only: no MCP URLs, names, headers, credentials, schemas, or args.
+    toolIds: [...toolRefs].sort((left, right) => `${left.kind}:${left.id}`.localeCompare(`${right.kind}:${right.id}`)).map((tool) => tool.id),
+    toolRefs,
+    toolCount: allToolRefs.length,
+    truncated: allToolRefs.length > toolRefs.length
+  };
+}
+async function updateSessionToolPolicy(deps, grant, sessionId, request) {
+  await requireSessionAuthorization(deps, grant, {
+    sessionId,
+    operation: "session.tool_policy.write",
+    surface: "core"
+  });
+  requirePermission(grant, "sessions:control");
+  const existingSession = await requireSession2(deps.db, grant.workspaceId, sessionId);
+  const capabilityRuntimeSettings = await settingsWithEnabledCapabilityMcpServers(
+    deps.db,
+    grant.workspaceId,
+    deps.settings
+  );
+  const runtimeSettings = settingsWithSessionMcpServerMetadata(
+    capabilityRuntimeSettings,
+    existingSession.mcpServers
+  );
+  const explicitRequest = request.mode === "workspace_default" ? null : request;
+  const requestedMode = explicitRequest ? "explicit" : "workspace_default";
+  const explicitRequestedTools = explicitRequest ? (() => {
+    const validatedTools = validateToolRefs(explicitRequest.tools, runtimeSettings);
+    const validatedIds = new Set(validatedTools.map((tool) => `${tool.kind}:${tool.id}`));
+    const unknown = explicitRequest.tools.find(
+      (tool) => !validatedIds.has(`${tool.kind}:${tool.id}`)
+    );
+    if (unknown) {
+      throw new HTTPException9(422, { message: `unknown MCP server id: ${unknown.id}` });
+    }
+    return withFirstPartyTools(validatedTools, runtimeSettings);
+  })() : null;
+  const workspaceDefaultTools = withFirstPartyTools(
+    withDefaultEnabledCapabilityMcpTools([], deps.settings, capabilityRuntimeSettings),
+    runtimeSettings
+  );
+  const events = await appendSessionEventsWithLockedSessionUpdate(
+    deps.db,
+    grant.workspaceId,
+    sessionId,
+    async (session, context) => {
+      const currentVersion = session.toolPolicyVersion ?? 1;
+      if (request.expectedVersion !== currentVersion) {
+        throw new SessionToolPolicyVersionConflictError(currentVersion);
+      }
+      let nextTools;
+      let nextPolicy;
+      if (session.parentSessionId) {
+        const parent = await context.getLockedSession(session.parentSessionId);
+        if (!parent) {
+          throw new HTTPException9(409, { message: "parent session is no longer available" });
+        }
+        const parentTracksWorkspaceDefaults = parent.toolPolicy?.mode === "workspace_default";
+        const parentEffective = withFirstPartyTools(
+          parentTracksWorkspaceDefaults ? withDefaultEnabledCapabilityMcpTools(
+            availableToolRefs(parent.tools, runtimeSettings),
+            deps.settings,
+            runtimeSettings
+          ) : parent.tools,
+          runtimeSettings
+        );
+        if (requestedMode === "workspace_default") {
+          if (!parentTracksWorkspaceDefaults) {
+            throw new HTTPException9(403, {
+              message: "a child may adopt workspace defaults only while its parent tracks workspace defaults"
+            });
+          }
+          nextTools = parentEffective;
+          nextPolicy = {
+            mode: "workspace_default",
+            inheritedFromSessionId: parent.id
+          };
+        } else {
+          nextTools = explicitRequestedTools;
+          assertToolRefsSubset(
+            nextTools,
+            parentEffective,
+            "session tools may only narrow the parent session tool policy"
+          );
+          nextPolicy = {
+            mode: "explicit",
+            inheritedFromSessionId: parent.id
+          };
+        }
+      } else {
+        nextTools = requestedMode === "workspace_default" ? workspaceDefaultTools : explicitRequestedTools;
+        nextPolicy = { mode: requestedMode, inheritedFromSessionId: null };
+      }
+      const currentPolicy = session.toolPolicy ?? {
+        mode: "legacy",
+        inheritedFromSessionId: null
+      };
+      const unchanged = stableJson2({ tools: session.tools, policy: currentPolicy }) === stableJson2({ tools: nextTools, policy: nextPolicy });
+      if (unchanged) {
+        return { events: [] };
+      }
+      const nextVersion = currentVersion + 1;
+      return {
+        events: [
+          {
+            type: "session.tool_policy.updated",
+            payload: {
+              before: toolPolicyAuditSnapshot(session, session.tools, currentPolicy),
+              after: toolPolicyAuditSnapshot(session, nextTools, nextPolicy),
+              version: nextVersion,
+              effectiveFrom: "next_attempt"
+            }
+          }
+        ],
+        update: {
+          tools: nextTools,
+          toolPolicy: nextPolicy,
+          toolPolicyVersion: nextVersion,
+          expectedToolPolicyVersion: request.expectedVersion
+        }
+      };
+    },
+    { lockParentSession: true }
+  );
+  if (events.length > 0) {
+    await publishDurableSessionEvents(deps.bus, grant.workspaceId, sessionId, events);
+  }
+  return await requireSession2(deps.db, grant.workspaceId, sessionId);
+}
 async function readSessionLineage(deps, grant, sessionId) {
   const authorization = await requireSessionAuthorization(deps, grant, {
     sessionId,
@@ -4784,24 +4951,105 @@ import {
 } from "@opengeni/contracts";
 import {
   getNewSessionDraftInTransaction,
+  getEnrollment as getEnrollment3,
+  getRig as getRig4,
+  getSandbox as getSandbox4,
+  getVariableSet as getVariableSet4,
   NewSessionDraftAccessError,
+  newSessionDraftToolsProvided,
+  publicNewSessionDraftOptions,
+  requireFile as requireFile2,
   saveNewSessionDraftInTransaction,
   withWorkspaceSubjectRls as withWorkspaceSubjectRls2
 } from "@opengeni/db";
 import { HTTPException as HTTPException12 } from "hono/http-exception";
+function hasOwn(value, key) {
+  return typeof value === "object" && value !== null && Object.hasOwn(value, key);
+}
 function mapNewSessionDraft(row) {
   if (!row) return null;
   return NewSessionDraft.parse({
     revision: row.revision,
     text: row.text,
     resources: row.resources,
-    tools: row.tools,
+    tools: newSessionDraftToolsProvided(row) ? row.tools : [],
+    toolsProvided: newSessionDraftToolsProvided(row),
     model: row.model,
     reasoningEffort: row.reasoningEffort,
-    options: row.sessionOptions,
+    options: publicNewSessionDraftOptions(row),
     updatedAt: row.updatedAt.toISOString()
   });
 }
+async function hydrateNewSessionDraft(deps, grant, workspaceId, row) {
+  if (!row) return null;
+  const mapped = mapNewSessionDraft(row);
+  if (!mapped) return null;
+  const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(
+    deps.db,
+    workspaceId,
+    deps.settings
+  );
+  const resources = [];
+  for (const resource of mapped.resources) {
+    if (resource.kind === "repository") {
+      try {
+        await validateGitHubRepositorySelection(deps.db, workspaceId, [resource]);
+        resources.push(resource);
+      } catch (error) {
+        if (isAuthoritativeGitHubRepositorySelectionError(error)) {
+          continue;
+        }
+        resources.push(resource);
+      }
+      continue;
+    }
+    try {
+      const file = await requireFile2(deps.db, workspaceId, resource.fileId);
+      if (file.status === "ready") resources.push(resource);
+    } catch {
+    }
+  }
+  const options = { ...mapped.options };
+  if (options.variableSetId) {
+    if (!hasPermission(grant.permissions, "variable-sets:use") || !await getVariableSet4(deps.db, workspaceId, options.variableSetId)) {
+      delete options.variableSetId;
+    }
+  }
+  if (options.rigId) {
+    const rig = await getRig4(deps.db, workspaceId, options.rigId);
+    if (!rig?.activeVersion) delete options.rigId;
+  }
+  if (options.targetSandboxId) {
+    const sandbox = await getSandbox4(deps.db, workspaceId, options.targetSandboxId);
+    const enrollment = sandbox?.enrollmentId ? await getEnrollment3(deps.db, workspaceId, sandbox.enrollmentId) : null;
+    if (!sandbox || sandbox.kind !== "selfhosted" || !enrollment || enrollment.status !== "active") {
+      delete options.targetSandboxId;
+      delete options.workingDir;
+      delete options.sandboxBackend;
+    }
+  }
+  let tools = [];
+  if (mapped.toolsProvided) {
+    try {
+      tools = validateToolRefs(mapped.tools, runtimeSettings);
+    } catch {
+      tools = mapped.tools.filter((tool) => {
+        try {
+          validateToolRefs([tool], runtimeSettings);
+          return true;
+        } catch {
+          return false;
+        }
+      });
+    }
+  }
+  return {
+    ...mapped,
+    resources,
+    tools,
+    options
+  };
+}
 async function getActorNewSessionDraft(deps, grant, workspaceId) {
   const row = await withWorkspaceSubjectRls2(
     deps.db,
@@ -4812,11 +5060,12 @@ async function getActorNewSessionDraft(deps, grant, workspaceId) {
       subjectId: grant.subjectId
     })
   );
-  return mapNewSessionDraft(row) ?? {
+  return await hydrateNewSessionDraft(deps, grant, workspaceId, row) ?? {
     revision: 0,
     text: "",
     resources: [],
     tools: [],
+    toolsProvided: false,
     model: deps.settings.openaiModel,
     reasoningEffort: deps.settings.openaiReasoningEffort,
     options: {},
@@ -4825,13 +5074,14 @@ async function getActorNewSessionDraft(deps, grant, workspaceId) {
 }
 async function saveActorNewSessionDraft(deps, grant, workspaceId, rawInput) {
   const input = SaveNewSessionDraftRequest.parse(rawInput);
+  const toolsProvided = hasOwn(rawInput, "toolsProvided") ? input.toolsProvided : true;
   const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(
     deps.db,
     workspaceId,
     deps.settings
   );
   const resources = normalizeResources(input.resources);
-  const tools = validateToolRefs(input.tools, runtimeSettings);
+  const tools = toolsProvided ? validateToolRefs(input.tools, runtimeSettings) : [];
   await validateGitHubRepositorySelection(deps.db, workspaceId, resources);
   if (resources.some((resource) => resource.kind === "file") && !deps.objectStorage) {
     throw new HTTPException12(503, { message: "object storage is not configured" });
@@ -4853,6 +5103,7 @@ async function saveActorNewSessionDraft(deps, grant, workspaceId, rawInput) {
           text: input.text,
           resources,
           tools,
+          toolsProvided,
           model: input.model,
           reasoningEffort: input.reasoningEffort,
           options: input.options,
@@ -5405,6 +5656,7 @@ export {
   getCapabilityPack,
   getHumanComposerDraft,
   hasPermission,
+  isAuthoritativeGitHubRepositorySelectionError,
   isBuiltInCapabilityPack,
   isUserMember,
   listCapabilityPacks,
@@ -5459,6 +5711,7 @@ export {
   scheduledTaskTriggerToken,
   sendAgentSessionMessage,
   sessionSpawnDenialEnvelope,
+  sessionToolPolicyAllowsDefaultNativeTools,
   sessionWithEffectiveToolPolicy,
   settingsWithEnabledCapabilityMcpServers,
   settingsWithMcpCapabilityServers,
@@ -5472,6 +5725,7 @@ export {
   updateRigForApi,
   updateSessionMcpApprovalPolicy,
   updateSessionTitle,
+  updateSessionToolPolicy,
   validateFileResources,
   validateGitHubRepositorySelection,
   validateGitHubRepositorySelectionShape,