@opengeni/core 0.11.2 → 0.12.0

package/dist/index.js

@@ -25,10 +25,12 @@ import { HTTPException } from "hono/http-exception";
 import {
   advanceWorkspaceGenerationForDirectRequest,
   advanceWorkspaceGenerationForRetainedProcess,
+  getRetainedProcess,
   getSandbox,
   markWarmLeaseInstanceLost,
   readActiveSandbox,
   retainWorkspaceMutationProcess,
+  retainedProcessSettlementIdentity,
   settleRetainedProcess,
   verifyDirectWorkspaceMutationSettlement,
   verifyRetainedProcessMutationSettlement
@@ -43,7 +45,12 @@ import {
 function relayConfigFromSettings(settings) {
   const raw = settings.selfhostedRelayUrl?.trim();
   if (!raw) {
-    return { host: "relay.opengeni.local", port: 443, tls: true, path: "/stream" };
+    return {
+      host: "relay.opengeni.local",
+      port: 443,
+      tls: true,
+      path: "/stream"
+    };
   }
   try {
     const url = new URL(raw.includes("://") ? raw : `wss://${raw}`);
@@ -76,7 +83,8 @@ function routingEnabled(settings) {
 }
 function wrapChannelABoxWithRouting(services, ids, established) {
   const { db, settings, bus } = services;
-  const beforeMutation = async ({
+  const homeLease = ids.homeLease;
+  const beforeMutation = homeLease ? async ({
     op,
     backend
   }) => {
@@ -92,15 +100,15 @@ function wrapChannelABoxWithRouting(services, ids, established) {
       sessionId: ids.sessionId,
       requestId: ids.directRequest.requestId,
       holderId: ids.directRequest.holderId,
-      sandboxGroupId: ids.homeLease.sandboxGroupId,
+      sandboxGroupId: homeLease.sandboxGroupId,
       expectedEpoch: backend.leaseEpoch,
       expectedInstanceId: backend.providerInstanceId,
       routeTargetId: backend.sandboxId,
       routeEpoch: backend.activeEpoch,
       operation: op
     });
-  };
-  const afterMutation = async ({
+  } : void 0;
+  const afterMutation = homeLease ? async ({
     op,
     backend,
     admission,
@@ -126,7 +134,7 @@ function wrapChannelABoxWithRouting(services, ids, established) {
           kind: "direct",
           requestId: ids.directRequest.requestId,
           holderId: ids.directRequest.holderId,
-          sandboxGroupId: ids.homeLease.sandboxGroupId,
+          sandboxGroupId: homeLease.sandboxGroupId,
           expectedEpoch: backend.leaseEpoch,
           expectedInstanceId: backend.providerInstanceId,
           routeTargetId: exactAdmission.routeTargetId,
@@ -141,7 +149,7 @@ function wrapChannelABoxWithRouting(services, ids, established) {
       sessionId: ids.sessionId,
       requestId: ids.directRequest.requestId,
       holderId: ids.directRequest.holderId,
-      sandboxGroupId: ids.homeLease.sandboxGroupId,
+      sandboxGroupId: homeLease.sandboxGroupId,
       expectedEpoch: backend.leaseEpoch,
       expectedInstanceId: backend.providerInstanceId,
       routeTargetId: exactAdmission.routeTargetId,
@@ -150,8 +158,8 @@ function wrapChannelABoxWithRouting(services, ids, established) {
       operation: op,
       outcome
     });
-  };
-  const beforeProcessMutation = async ({
+  } : void 0;
+  const beforeProcessMutation = homeLease ? async ({
     op,
     process
   }) => await advanceWorkspaceGenerationForRetainedProcess(db, {
@@ -160,8 +168,8 @@ function wrapChannelABoxWithRouting(services, ids, established) {
     sessionId: ids.sessionId,
     processId: process.id,
     operation: op
-  });
-  const afterProcessMutation = async ({
+  }) : void 0;
+  const afterProcessMutation = homeLease ? async ({
     op,
     process,
     admission,
@@ -179,26 +187,37 @@ function wrapChannelABoxWithRouting(services, ids, established) {
       operation: op,
       outcome
     });
-  };
-  const settleProcess = async ({
+  } : void 0;
+  const settleProcess = homeLease ? async ({
     backend,
     process,
     proof
   }) => {
-    if (backend.sandboxId !== null || backend.leaseEpoch === void 0 || backend.providerInstanceId === void 0) {
+    if (backend.sandboxId !== null || backend.leaseEpoch === void 0 || backend.providerInstanceId === void 0 || backend.activeEpoch === void 0) {
       return;
     }
+    const durable = await getRetainedProcess(db, {
+      workspaceId: ids.workspaceId,
+      sessionId: ids.sessionId,
+      processId: process.id
+    });
+    if (!durable || durable.providerSessionId !== process.providerSessionId || durable.providerBackend !== backend.kind || durable.providerInstanceId !== backend.providerInstanceId || durable.leaseEpoch !== backend.leaseEpoch || durable.routeKind !== (backend.sandboxId === null ? "home" : "active") || durable.routeTargetId !== backend.sandboxId || durable.routeEpoch !== backend.activeEpoch) {
+      throw new Error(
+        "API retained-process settlement lost its exact durable backend identity"
+      );
+    }
     await settleRetainedProcess(db, {
       accountId: ids.accountId,
       workspaceId: ids.workspaceId,
       sessionId: ids.sessionId,
       processId: process.id,
+      expected: retainedProcessSettlementIdentity(durable),
       outcome: proof.outcome,
       exitCode: proof.exitCode,
       reason: proof.reason,
       idleGraceMs: settings.sandboxIdleGraceMs
     });
-  };
+  } : void 0;
   const resolver = makeActiveBackendResolver({
     workspaceId: ids.workspaceId,
     defaultBackend: established.session,
@@ -214,21 +233,34 @@ function wrapChannelABoxWithRouting(services, ids, established) {
     },
     controlRpcFactory: controlRpcFactory(bus),
     relay: relayConfigFromSettings(settings),
-    resolveDefaultBackend: async () => ({
-      session: established.session,
-      sandboxId: null,
-      kind: established.backendId,
-      leaseEpoch: ids.homeLease.leaseEpoch,
-      providerInstanceId: ids.homeLease.instanceId
-    })
+    selfhostedTimeoutMs: settings.sandboxSelfhostedControlTimeoutMs,
+    selfhostedExecTimeoutMs: settings.sandboxSelfhostedExecTimeoutMs,
+    ...ids.pinnedSelfhosted ? {
+      pinnedSelfhosted: {
+        sandboxId: ids.pinnedSelfhosted.sandboxId,
+        epoch: ids.pinnedSelfhosted.epoch,
+        session: established.session
+      }
+    } : {},
+    ...homeLease ? {
+      resolveDefaultBackend: async () => ({
+        session: established.session,
+        sandboxId: null,
+        kind: established.backendId,
+        leaseEpoch: homeLease.leaseEpoch,
+        providerInstanceId: homeLease.instanceId
+      })
+    } : {}
   });
   const proxy = new RoutingSandboxSession({
     defaultResolved: {
       session: established.session,
       sandboxId: null,
       kind: established.backendId,
-      leaseEpoch: ids.homeLease.leaseEpoch,
-      providerInstanceId: ids.homeLease.instanceId
+      ...homeLease ? {
+        leaseEpoch: homeLease.leaseEpoch,
+        providerInstanceId: homeLease.instanceId
+      } : {}
     },
     readPointer: async () => {
       if (!routingEnabled(settings)) {
@@ -238,36 +270,38 @@ function wrapChannelABoxWithRouting(services, ids, established) {
       return pointer ?? { activeSandboxId: null, activeEpoch: 0 };
     },
     resolveActiveBackend: resolver,
-    beforeMutation,
-    afterMutation,
-    beforeProcessMutation,
-    afterProcessMutation,
-    settleProcess,
-    onDefaultBackendError: async ({ error }) => {
-      if (!isProviderSandboxGoneDuringRoutedOperation(ids.homeLease.backend, error)) return null;
-      const marked = await markWarmLeaseInstanceLost(db, {
-        accountId: ids.accountId,
-        workspaceId: ids.workspaceId,
-        sandboxGroupId: ids.homeLease.sandboxGroupId,
-        expectedEpoch: ids.homeLease.leaseEpoch,
-        expectedInstanceId: ids.homeLease.instanceId,
-        diagnostic: "provider_not_found_during_routed_operation"
-      });
-      if (marked.status === "marked" && bus) {
-        await appendAndPublishEvents(db, bus, ids.workspaceId, ids.sessionId, [
-          {
-            type: "sandbox.box.lost",
-            payload: { sandboxId: ids.homeLease.instanceId }
-          }
-        ]).catch(() => void 0);
+    ...beforeMutation ? { beforeMutation } : {},
+    ...afterMutation ? { afterMutation } : {},
+    ...beforeProcessMutation ? { beforeProcessMutation } : {},
+    ...afterProcessMutation ? { afterProcessMutation } : {},
+    ...settleProcess ? { settleProcess } : {},
+    ...homeLease ? {
+      onDefaultBackendError: async ({ error }) => {
+        if (!isProviderSandboxGoneDuringRoutedOperation(homeLease.backend, error)) return null;
+        const marked = await markWarmLeaseInstanceLost(db, {
+          accountId: ids.accountId,
+          workspaceId: ids.workspaceId,
+          sandboxGroupId: homeLease.sandboxGroupId,
+          expectedEpoch: homeLease.leaseEpoch,
+          expectedInstanceId: homeLease.instanceId,
+          diagnostic: "provider_not_found_during_routed_operation"
+        });
+        if (marked.status === "marked" && bus) {
+          await appendAndPublishEvents(db, bus, ids.workspaceId, ids.sessionId, [
+            {
+              type: "sandbox.box.lost",
+              payload: { sandboxId: homeLease.instanceId }
+            }
+          ]).catch(() => void 0);
+        }
+        const lease = marked.lease;
+        const restore = lease?.recovery.restore.status;
+        return {
+          leaseEpoch: lease?.leaseEpoch ?? homeLease.leaseEpoch,
+          recovery: marked.status === "stale" ? "superseded" : restore === "pending" ? "pending" : restore === "degraded" ? "degraded" : "unrecoverable"
+        };
       }
-      const lease = marked.lease;
-      const restore = lease?.recovery.restore.status;
-      return {
-        leaseEpoch: lease?.leaseEpoch ?? ids.homeLease.leaseEpoch,
-        recovery: marked.status === "stale" ? "superseded" : restore === "pending" ? "pending" : restore === "degraded" ? "degraded" : "unrecoverable"
-      };
-    }
+    } : {}
   });
   return { ...established, session: proxy };
 }
@@ -3102,6 +3136,9 @@ async function validateGitHubRepositorySelection(db, workspaceId, resources) {
     }
   }
 }
+function isAuthoritativeGitHubRepositorySelectionError(error) {
+  return error instanceof HTTPException8 && error.status === 422;
+}
 async function validateFileResources(db, workspaceId, resources) {
   const fileIds = /* @__PURE__ */ new Set();
   for (const resource of resources) {
@@ -3202,11 +3239,9 @@ function resolveSessionToolPolicy(input) {
   const configuredIds = effectiveIds.filter((id) => availableIds.has(id));
   const configuredIdSet = new Set(configuredIds);
   const droppedIds = effectiveIds.filter((id) => !configuredIdSet.has(id));
-  const deferredIds = tracksWorkspaceDefaults ? sortedIds(
-    toolRefs.filter(
-      (tool) => tool.optional === true && configuredIdSet.has(tool.id) && !mandatoryIdSet.has(tool.id)
-    ).map((tool) => tool.id)
-  ) : [];
+  const deferredIds = sortedIds(
+    toolRefs.filter((tool) => configuredIdSet.has(tool.id) && !mandatoryIdSet.has(tool.id)).map((tool) => tool.id)
+  );
   const selectedIds = sortedIds(
     selectedRefs.filter(
       (tool) => !mandatoryIdSet.has(tool.id) && !(tracksWorkspaceDefaults && tool.optional === true)
@@ -3229,7 +3264,7 @@ function resolveSessionToolPolicy(input) {
       effectiveIds: projections.effective.ids,
       mandatoryIds: projections.mandatory.ids,
       lazyRouter: {
-        state: tracksWorkspaceDefaults ? "required" : "disabled",
+        state: deferredIds.length > 0 ? "required" : "disabled",
         deferredIds: projections.deferred.ids
       },
       configuredIds: projections.configured.ids,
@@ -3246,6 +3281,9 @@ function resolveSessionToolPolicy(input) {
     }
   };
 }
+function sessionToolPolicyAllowsDefaultNativeTools(policy) {
+  return policy.mode === "workspace_default" && policy.lazyRouter.state === "required";
+}
 async function workspaceSessionToolPolicyServerIds(db, workspaceId, settings) {
   const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(db, workspaceId, settings);
   return sortedIds(runtimeSettings.mcpServers.map((server) => server.id));
@@ -3271,6 +3309,7 @@ function sessionWithEffectiveToolPolicy(session, workspaceServerIds, workspaceDe
 }
 
 // src/domain/scheduled-tasks.ts
+import { OPENGENI_SLACK_BOT_SESSION_METADATA_KEY as OPENGENI_SLACK_BOT_SESSION_METADATA_KEY3 } from "@opengeni/contracts";
 import {
   createScheduledTask,
   deleteScheduledTask,
@@ -3280,7 +3319,7 @@ import {
   requireWorkspace as requireWorkspace2,
   updateScheduledTask
 } from "@opengeni/db";
-import { HTTPException as HTTPException10 } from "hono/http-exception";
+import { HTTPException as HTTPException11 } from "hono/http-exception";
 
 // src/domain/sessions.ts
 import { CODEX_MODEL_ID_PREFIX } from "@opengeni/codex";
@@ -3293,11 +3332,13 @@ import {
 import {
   CreateSessionRequest,
   DEFAULT_FIRST_PARTY_MCP_PERMISSIONS,
+  OPENGENI_SLACK_BOT_SESSION_METADATA_KEY as OPENGENI_SLACK_BOT_SESSION_METADATA_KEY2,
   SessionSpawnDenial,
   ServiceTurnInitiator,
   ServiceTurnInitiatorContext,
   evaluateWorkspaceModelPolicy,
   reasoningEffortForMetadata,
+  stableJson as stableJson2,
   SessionMcpApprovalPolicy
 } from "@opengeni/contracts";
 import {
@@ -3330,17 +3371,80 @@ import {
   QueueCommandConflictError,
   AgentCommandAuthorityError,
   SessionSpawnDeniedDbError,
-  SessionControlConflictError
+  SessionControlConflictError,
+  SessionToolPolicyVersionConflictError
 } from "@opengeni/db";
 import {
   appendAndPublishEvents as appendAndPublishEvents2,
   publishDurableSessionEvents,
   publishDurableWorkspaceControlEvent
 } from "@opengeni/events";
+import { HTTPException as HTTPException10 } from "hono/http-exception";
+
+// src/domain/slack-bot.ts
+import {
+  OPENGENI_SLACK_BOT_CREDENTIAL_LABEL,
+  OPENGENI_SLACK_BOT_REQUIRED_SCOPES,
+  OPENGENI_SLACK_BOT_CREDENTIAL_ROLE,
+  OPENGENI_SLACK_BOT_SESSION_METADATA_KEY,
+  OpenGeniSlackBotConnectionMetadata
+} from "@opengeni/contracts";
+import {
+  getConnectionMetadata as getConnectionMetadata2
+} from "@opengeni/db";
 import { HTTPException as HTTPException9 } from "hono/http-exception";
+function openGeniSlackBotMetadata(metadata) {
+  const parsed = OpenGeniSlackBotConnectionMetadata.safeParse(metadata);
+  return parsed.success ? parsed.data : null;
+}
+function isOpenGeniSlackBotConnection(connection) {
+  const granted = new Set(connection.grantedScopes);
+  return connection.verifiedInstallAt != null && connection.verifiedInstallVersion === connection.version && connection.subjectId === null && connection.providerDomain === "slack.com" && connection.kind === "app_install" && granted.size === OPENGENI_SLACK_BOT_REQUIRED_SCOPES.length && OPENGENI_SLACK_BOT_REQUIRED_SCOPES.every((scope) => granted.has(scope)) && openGeniSlackBotMetadata(connection.metadata)?.credentialRole === OPENGENI_SLACK_BOT_CREDENTIAL_ROLE;
+}
+function hasReservedOpenGeniSlackBotMetadata(metadata) {
+  return metadata?.credentialRole === OPENGENI_SLACK_BOT_CREDENTIAL_ROLE || metadata?.credentialLabel === OPENGENI_SLACK_BOT_CREDENTIAL_LABEL;
+}
+function hasReservedOpenGeniSlackBotSessionMetadata(metadata) {
+  return Boolean(
+    metadata && Object.prototype.hasOwnProperty.call(metadata, OPENGENI_SLACK_BOT_SESSION_METADATA_KEY)
+  );
+}
+async function requireOpenGeniSlackBotConnection(db, workspaceId, connectionId) {
+  const connection = await getConnectionMetadata2(db, workspaceId, connectionId, null);
+  if (!connection || !isOpenGeniSlackBotConnection(connection)) {
+    throw new HTTPException9(422, {
+      message: "slackBotConnectionId must reference an OpenGeni Slack bot connection"
+    });
+  }
+  if (connection.status !== "active") {
+    throw new HTTPException9(422, {
+      message: `OpenGeni Slack bot connection is not active (${connection.status})`
+    });
+  }
+  return connection;
+}
+async function validateOpenGeniSlackBotConnectionSelection(db, grant, workspaceId, connectionId) {
+  requirePermission(grant, "connections:read");
+  return await requireOpenGeniSlackBotConnection(db, workspaceId, connectionId);
+}
+function scheduledSlackBotConnectionId(metadata) {
+  const value = metadata?.[OPENGENI_SLACK_BOT_SESSION_METADATA_KEY];
+  return typeof value === "string" && zUuid(value) ? value : null;
+}
+function isTrustedScheduledSlackBotSession(session) {
+  const scheduledTaskId = session.metadata.scheduledTaskId;
+  const scheduledTaskRunId = session.metadata.scheduledTaskRunId;
+  return session.createdBy?.kind === "service" && session.createdBy.subjectId === "scheduler" && typeof scheduledTaskId === "string" && zUuid(scheduledTaskId) && typeof scheduledTaskRunId === "string" && zUuid(scheduledTaskRunId) && session.createdByContext.scheduledTaskId === scheduledTaskId && session.createdByContext.scheduledTaskRunId === scheduledTaskRunId && scheduledSlackBotConnectionId(session.metadata) !== null;
+}
+function zUuid(value) {
+  return /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value);
+}
+
+// src/domain/sessions.ts
 var reservedSessionMcpServerIds = /* @__PURE__ */ new Set(["opengeni", "files", "docs", "codex_apps"]);
 var maxSessionMcpCredentialHeaders = 16;
 var maxSessionMcpCredentialHeaderValueLength = 4096;
+var maxToolPolicyAuditRefs = 40;
 var sessionMcpCredentialHeaderName = /^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/;
 var SessionSpawnDeniedError = class extends Error {
   denial;
@@ -3368,7 +3472,7 @@ function sessionSpawnDenialEnvelope(error) {
 function serviceInitiatorForGrant(grant) {
   if (!grant.serviceInitiator) {
     if (grant.serviceInitiatorContext) {
-      throw new HTTPException9(403, {
+      throw new HTTPException10(403, {
         message: "service initiator context requires a signed service initiator"
       });
     }
@@ -3376,13 +3480,13 @@ function serviceInitiatorForGrant(grant) {
   }
   const initiator = ServiceTurnInitiator.safeParse(grant.serviceInitiator);
   if (!initiator.success) {
-    throw new HTTPException9(403, {
+    throw new HTTPException10(403, {
       message: "a delegated command initiator must be a bounded service principal"
     });
   }
   const context = ServiceTurnInitiatorContext.safeParse(grant.serviceInitiatorContext ?? {});
   if (!context.success) {
-    throw new HTTPException9(403, {
+    throw new HTTPException10(403, {
       message: "delegated service initiator context is invalid or reserved"
     });
   }
@@ -3390,7 +3494,7 @@ function serviceInitiatorForGrant(grant) {
   const callerAttemptId = grant.metadata?.["attemptId"];
   const callerExecutionGeneration = grant.metadata?.["executionGeneration"];
   if (callerTurnId !== void 0 || callerAttemptId !== void 0 || callerExecutionGeneration !== void 0) {
-    throw new HTTPException9(403, {
+    throw new HTTPException10(403, {
       message: "a service initiator cannot replace an exact agent-attempt initiator"
     });
   }
@@ -3408,7 +3512,7 @@ function creationInitiatorForGrant(grant) {
   const hasCallerTurnClaim = callerTurnId !== void 0 || callerAttemptId !== void 0 || callerExecutionGeneration !== void 0;
   if (hasCallerTurnClaim) {
     if (typeof callerSessionId !== "string" || typeof callerTurnId !== "string" || typeof callerAttemptId !== "string" || typeof callerExecutionGeneration !== "number" || !Number.isSafeInteger(callerExecutionGeneration) || callerExecutionGeneration < 1) {
-      throw new HTTPException9(403, { message: "caller attempt claims are incomplete" });
+      throw new HTTPException10(403, { message: "caller attempt claims are incomplete" });
     }
     const actor = {
       type: "agent_attempt",
@@ -3437,27 +3541,27 @@ function normalizedSessionMcpCredentialHeaders(headers) {
   }
   const entries = Object.entries(headers).map(([name, value]) => [name.trim(), value]).filter(([name]) => name.length > 0);
   if (entries.length > maxSessionMcpCredentialHeaders) {
-    throw new HTTPException9(422, {
+    throw new HTTPException10(422, {
       message: `a session MCP server supports at most ${maxSessionMcpCredentialHeaders} credential headers`
     });
   }
   const seen = /* @__PURE__ */ new Set();
   for (const [name, value] of entries) {
     if (!sessionMcpCredentialHeaderName.test(name)) {
-      throw new HTTPException9(422, { message: `invalid credential header name: ${name}` });
+      throw new HTTPException10(422, { message: `invalid credential header name: ${name}` });
     }
     const lower = name.toLowerCase();
     if (seen.has(lower)) {
-      throw new HTTPException9(422, { message: `duplicate credential header name: ${name}` });
+      throw new HTTPException10(422, { message: `duplicate credential header name: ${name}` });
     }
     seen.add(lower);
     if (value.length === 0 || value.length > maxSessionMcpCredentialHeaderValueLength) {
-      throw new HTTPException9(422, {
+      throw new HTTPException10(422, {
         message: `credential header ${name} must be 1-${maxSessionMcpCredentialHeaderValueLength} characters`
       });
     }
     if (/[\u0000-\u0008\u000A-\u001F\u007F]/.test(value)) {
-      throw new HTTPException9(422, {
+      throw new HTTPException10(422, {
         message: `credential header ${name} contains forbidden control characters`
       });
     }
@@ -3524,11 +3628,11 @@ function validateSessionMcpServersForCreate(settings, grant, servers) {
   const metadata = [];
   for (const server of servers) {
     if (seenIds.has(server.id)) {
-      throw new HTTPException9(422, { message: `duplicate session MCP server id: ${server.id}` });
+      throw new HTTPException10(422, { message: `duplicate session MCP server id: ${server.id}` });
     }
     seenIds.add(server.id);
     if (reservedSessionMcpServerIds.has(server.id) || existingIds.has(server.id)) {
-      throw new HTTPException9(422, { message: `MCP server id already exists: ${server.id}` });
+      throw new HTTPException10(422, { message: `MCP server id already exists: ${server.id}` });
     }
     const headers = normalizedSessionMcpCredentialHeaders(server.headers);
     const headersEncrypted = Object.fromEntries(
@@ -3568,13 +3672,13 @@ function validateInheritedSessionMcpServersForCreate(servers) {
   const seenIds = /* @__PURE__ */ new Set();
   for (const server of servers) {
     if (seenIds.has(server.id)) {
-      throw new HTTPException9(422, {
+      throw new HTTPException10(422, {
         message: `duplicate inherited session MCP server id: ${server.id}`
       });
     }
     seenIds.add(server.id);
     if (reservedSessionMcpServerIds.has(server.id)) {
-      throw new HTTPException9(422, {
+      throw new HTTPException10(422, {
         message: `reserved inherited session MCP server id: ${server.id}`
       });
     }
@@ -3606,13 +3710,13 @@ function validateSessionMcpCredentialUpdates(input) {
   const seenIds = /* @__PURE__ */ new Set();
   const encryptedUpdates = input.updates.map((update) => {
     if (seenIds.has(update.id)) {
-      throw new HTTPException9(422, {
+      throw new HTTPException10(422, {
         message: `duplicate session MCP credential update id: ${update.id}`
       });
     }
     seenIds.add(update.id);
     if (!knownIds.has(update.id)) {
-      throw new HTTPException9(422, { message: `unknown session MCP server id: ${update.id}` });
+      throw new HTTPException10(422, { message: `unknown session MCP server id: ${update.id}` });
     }
     const headers = normalizedSessionMcpCredentialHeaders(update.headers);
     return {
@@ -3716,7 +3820,7 @@ async function createAndStartSession(input) {
 async function finishStartSession(input, session) {
   if (input.seedTargetSandbox) {
     if (session.sandboxBackend === "none") {
-      throw new HTTPException9(422, {
+      throw new HTTPException10(422, {
         message: "cannot target a machine for a session with no sandbox (backend: none)"
       });
     }
@@ -3736,7 +3840,7 @@ async function finishStartSession(input, session) {
       input.seedTargetSandbox.workingDir ?? null
     );
     if (!seeded.swapped) {
-      throw new HTTPException9(422, {
+      throw new HTTPException10(422, {
         message: `cannot target sandbox ${input.seedTargetSandbox.sandboxId}: ${seeded.reason ?? "target is not attachable"}`
       });
     }
@@ -3788,7 +3892,7 @@ function canonicalConfiguredModel(settings, model) {
   if (settings.codexSubscriptionEnabled && canonicalModel.startsWith(CODEX_MODEL_ID_PREFIX)) {
     return canonicalModel;
   }
-  throw new HTTPException9(422, { message: `model is not available: ${model}` });
+  throw new HTTPException10(422, { message: `model is not available: ${model}` });
 }
 function assertConfiguredModel(settings, model) {
   canonicalConfiguredModel(settings, model);
@@ -3811,7 +3915,7 @@ async function assertWorkspaceModelPolicyAllows(db, settings, workspaceId, model
     modelId: canonicalModel
   });
   if (!verdict.allowed) {
-    throw new HTTPException9(422, {
+    throw new HTTPException10(422, {
       message: verdict.reason === "provider" ? `model "${canonicalModel}" is not allowed by this workspace's model policy: provider "${providerId}" is not in the allowed providers` : `model "${canonicalModel}" is not allowed by this workspace's model policy`
     });
   }
@@ -3819,10 +3923,10 @@ async function assertWorkspaceModelPolicyAllows(db, settings, workspaceId, model
 async function requireQueuedTurnForApi(db, workspaceId, sessionId, turnId) {
   const turn = await getSessionTurn(db, workspaceId, turnId);
   if (!turn || turn.sessionId !== sessionId) {
-    throw new HTTPException9(404, { message: "session turn not found" });
+    throw new HTTPException10(404, { message: "session turn not found" });
   }
   if (turn.status !== "queued") {
-    throw new HTTPException9(409, {
+    throw new HTTPException10(409, {
       message: `turn is ${turn.status}; only queued turns can be changed`
     });
   }
@@ -3875,13 +3979,13 @@ async function postUserMessageTurn(input) {
     );
   } catch (error) {
     if (error instanceof QueueCommandConflictError || error instanceof SessionControlConflictError) {
-      throw new HTTPException9(409, { message: error.message });
+      throw new HTTPException10(409, { message: error.message });
     }
     if (error instanceof Error && error.message.includes("cancelled")) {
-      throw new HTTPException9(409, { message: error.message });
+      throw new HTTPException10(409, { message: error.message });
     }
     if (error instanceof Error && error.message.startsWith("Unknown session MCP server")) {
-      throw new HTTPException9(422, { message: error.message });
+      throw new HTTPException10(422, { message: error.message });
     }
     throw error;
   }
@@ -3934,6 +4038,11 @@ async function postUserMessageTurn(input) {
 async function createSessionForRequest(deps, grant, workspaceId, rawPayload) {
   const { settings, db, bus, workflowClient, objectStorage } = deps;
   const payload = CreateSessionRequest.parse(rawPayload);
+  if (hasReservedOpenGeniSlackBotSessionMetadata(payload.metadata)) {
+    throw new HTTPException10(422, {
+      message: `${OPENGENI_SLACK_BOT_SESSION_METADATA_KEY2} is reserved for scheduler routing`
+    });
+  }
   if (payload.idempotencyKey) {
     const denial = await getSessionSpawnDenialByIdempotencyKey(
       db,
@@ -3954,7 +4063,7 @@ async function createSessionForRequest(deps, grant, workspaceId, rawPayload) {
   }
   const parentSession = parentSessionId ? await getSession2(db, workspaceId, parentSessionId) : null;
   if (parentSessionId && !parentSession) {
-    throw new HTTPException9(404, {
+    throw new HTTPException10(404, {
       message: `parent session not found in workspace: ${parentSessionId}`
     });
   }
@@ -4019,7 +4128,7 @@ async function createSessionForRequest(deps, grant, workspaceId, rawPayload) {
   const tools = withFirstPartyTools(selectedTools, runtimeSettings);
   await validateGitHubRepositorySelection(db, workspaceId, resources);
   if (resources.some((resource) => resource.kind === "file") && !objectStorage) {
-    throw new HTTPException9(503, { message: "object storage is not configured" });
+    throw new HTTPException10(503, { message: "object storage is not configured" });
   }
   await validateFileResources(db, workspaceId, resources);
   const variableSet = payload.variableSetId ? await validateVariableSetAttachment(
@@ -4035,7 +4144,7 @@ async function createSessionForRequest(deps, grant, workspaceId, rawPayload) {
     const rig = await getRig2(db, workspaceId, requestedRigId);
     if (!rig || !rig.activeVersion) {
       if (payload.rigId) {
-        throw new HTTPException9(422, {
+        throw new HTTPException10(422, {
           message: rig ? `rig ${payload.rigId} has no active version to bind` : `unknown rigId: ${payload.rigId}`
         });
       }
@@ -4061,7 +4170,7 @@ async function createSessionForRequest(deps, grant, workspaceId, rawPayload) {
   if (parentFirstPartyMcpPermissions && payload.firstPartyMcpPermissions?.some(
     (permission) => !hasPermission(parentFirstPartyMcpPermissions, permission)
   )) {
-    throw new HTTPException9(403, {
+    throw new HTTPException10(403, {
       message: "child first-party MCP permissions may only narrow the parent session grant"
     });
   }
@@ -4069,19 +4178,19 @@ async function createSessionForRequest(deps, grant, workspaceId, rawPayload) {
     (permission) => hasPermission(grant.permissions, permission)
   ) : null);
   if (firstPartyMcpPermissions && firstPartyMcpPermissions.length === 0) {
-    throw new HTTPException9(422, {
+    throw new HTTPException10(422, {
       message: "firstPartyMcpPermissions must not be empty; omit it for the default worker permission set"
     });
   }
   for (const permission of firstPartyMcpPermissions ?? []) {
     if (!hasPermission(grant.permissions, permission)) {
-      throw new HTTPException9(403, {
+      throw new HTTPException10(403, {
         message: `cannot grant first-party MCP permission beyond the creating grant: ${permission}`
       });
     }
   }
   if (payload.goal && firstPartyMcpPermissions && !firstPartyMcpPermissions.includes("goals:manage")) {
-    throw new HTTPException9(422, {
+    throw new HTTPException10(422, {
       message: "goal-bearing sessions require goals:manage in the resulting first-party MCP permission set"
     });
   }
@@ -4093,7 +4202,7 @@ async function createSessionForRequest(deps, grant, workspaceId, rawPayload) {
   const rigVersionMatchesGroup = (memberRigVersionId) => memberRigVersionId === frozenRigVersionId;
   if (sandboxChoice === "shared") {
     if (!parentSessionId) {
-      throw new HTTPException9(422, {
+      throw new HTTPException10(422, {
         message: "sandbox:'shared' requires a parent session (spawn from inside a session); use 'new' for a top-level create."
       });
     }
@@ -4116,7 +4225,7 @@ async function createSessionForRequest(deps, grant, workspaceId, rawPayload) {
     }
     if (variableSetMismatch || rigMismatch) {
       if (payload.sandbox === "shared") {
-        throw new HTTPException9(422, {
+        throw new HTTPException10(422, {
           message: variableSetMismatch ? "sandbox:'shared' requires the same variableSet / same environment as the creator's box (the box variable set/environment is fixed at creation); omit sandbox or pass 'new' when attaching a different variableSet/environment." : "sandbox:'shared' requires the same rig as the creator's box (the box's rig setup is fixed at creation); omit sandbox or pass 'new' when binding a different rig."
         });
       }
@@ -4127,7 +4236,7 @@ async function createSessionForRequest(deps, grant, workspaceId, rawPayload) {
   } else if (typeof sandboxChoice === "object") {
     const member = await getAnySessionInGroup(db, workspaceId, sandboxChoice.groupId);
     if (!member) {
-      throw new HTTPException9(404, {
+      throw new HTTPException10(404, {
         message: `sandbox group not found in workspace: ${sandboxChoice.groupId}`
       });
     }
@@ -4140,7 +4249,7 @@ async function createSessionForRequest(deps, grant, workspaceId, rawPayload) {
       if (!memberVariableSetIds.every(
         (memberVariableSetId) => variableSetMatchesGroup(memberVariableSetId)
       )) {
-        throw new HTTPException9(422, {
+        throw new HTTPException10(422, {
           message: `sandbox group ${sandboxChoice.groupId} runs a different variableSet / different environment (the box variable set/environment is fixed at creation); create with the group's variableSet/environment or omit sandbox for an own box.`
         });
       }
@@ -4152,7 +4261,7 @@ async function createSessionForRequest(deps, grant, workspaceId, rawPayload) {
       if (!memberRigVersionIds.every(
         (memberRigVersionId) => rigVersionMatchesGroup(memberRigVersionId)
       )) {
-        throw new HTTPException9(422, {
+        throw new HTTPException10(422, {
           message: `sandbox group ${sandboxChoice.groupId} runs a different rig (the box's rig setup is fixed at creation); create with the group's rig or omit sandbox for an own box.`
         });
       }
@@ -4161,7 +4270,7 @@ async function createSessionForRequest(deps, grant, workspaceId, rawPayload) {
     inheritedBackend = member.sandboxBackend;
   }
   if (payload.workingDir !== void 0 && !payload.targetSandboxId) {
-    throw new HTTPException9(422, {
+    throw new HTTPException10(422, {
       message: "workingDir requires targetSandboxId (it is the targeted machine's working directory)"
     });
   }
@@ -4249,10 +4358,10 @@ async function createSessionForRequest(deps, grant, workspaceId, rawPayload) {
     });
   } catch (error) {
     if (error instanceof AgentCommandAuthorityError) {
-      throw new HTTPException9(403, { message: error.message });
+      throw new HTTPException10(403, { message: error.message });
     }
     if (error instanceof SessionIdConflictError) {
-      throw new HTTPException9(409, {
+      throw new HTTPException10(409, {
         message: "requested session id is already in use"
       });
     }
@@ -4277,7 +4386,7 @@ async function createSessionForRequest(deps, grant, workspaceId, rawPayload) {
 }
 async function acceptSessionUserMessage(deps, grant, workspaceId, sessionId, input) {
   if (input.toolsProvided && !deps.settings.sessionTurnToolReplacementEnabled) {
-    throw new HTTPException9(503, {
+    throw new HTTPException10(503, {
       message: "explicit follow-up tool replacement is temporarily unavailable until provenance-aware turn workers finish rolling out; omit tools to inherit the session policy and retry"
     });
   }
@@ -4339,7 +4448,7 @@ async function acceptSessionUserMessage(deps, grant, workspaceId, sessionId, inp
     model: effectiveModel
   });
   if (requestedResources.some((resource) => resource.kind === "file") && !objectStorage) {
-    throw new HTTPException9(503, { message: "object storage is not configured" });
+    throw new HTTPException10(503, { message: "object storage is not configured" });
   }
   await validateFileResources(db, workspaceId, requestedResources);
   await validateGitHubRepositorySelection(db, workspaceId, [
@@ -4446,7 +4555,7 @@ async function updateSessionMcpApprovalPolicy(deps, grant, sessionId, serverId,
     async (_session, context) => {
       const result = await context.updateSessionMcpApprovalPolicy(serverId, normalizedPolicy);
       if (!result.server) {
-        throw new HTTPException9(404, { message: "session MCP server not found" });
+        throw new HTTPException10(404, { message: "session MCP server not found" });
       }
       outcome.server = result.server;
       return {
@@ -4472,6 +4581,150 @@ async function updateSessionMcpApprovalPolicy(deps, grant, sessionId, serverId,
     effectiveFrom: "next_attempt"
   };
 }
+function toolPolicyAuditSnapshot(session, tools, policy = session.toolPolicy ?? { mode: "legacy", inheritedFromSessionId: null }) {
+  const allToolRefs = mergeToolRefs([], tools).sort((left, right) => {
+    const leftMandatory = left.kind === "mcp" && left.id === "opengeni";
+    const rightMandatory = right.kind === "mcp" && right.id === "opengeni";
+    if (leftMandatory !== rightMandatory) return leftMandatory ? -1 : 1;
+    return `${left.kind}:${left.id}`.localeCompare(`${right.kind}:${right.id}`);
+  }).map((tool) => ({
+    kind: tool.kind,
+    id: tool.id,
+    ...tool.optional === void 0 ? {} : { optional: tool.optional }
+  }));
+  const toolRefs = allToolRefs.slice(0, maxToolPolicyAuditRefs);
+  return {
+    mode: policy.mode,
+    inheritedFromSessionId: policy.inheritedFromSessionId,
+    // IDs only: no MCP URLs, names, headers, credentials, schemas, or args.
+    toolIds: [...toolRefs].sort((left, right) => `${left.kind}:${left.id}`.localeCompare(`${right.kind}:${right.id}`)).map((tool) => tool.id),
+    toolRefs,
+    toolCount: allToolRefs.length,
+    truncated: allToolRefs.length > toolRefs.length
+  };
+}
+async function updateSessionToolPolicy(deps, grant, sessionId, request) {
+  await requireSessionAuthorization(deps, grant, {
+    sessionId,
+    operation: "session.tool_policy.write",
+    surface: "core"
+  });
+  requirePermission(grant, "sessions:control");
+  const existingSession = await requireSession2(deps.db, grant.workspaceId, sessionId);
+  const capabilityRuntimeSettings = await settingsWithEnabledCapabilityMcpServers(
+    deps.db,
+    grant.workspaceId,
+    deps.settings
+  );
+  const runtimeSettings = settingsWithSessionMcpServerMetadata(
+    capabilityRuntimeSettings,
+    existingSession.mcpServers
+  );
+  const explicitRequest = request.mode === "workspace_default" ? null : request;
+  const requestedMode = explicitRequest ? "explicit" : "workspace_default";
+  const explicitRequestedTools = explicitRequest ? (() => {
+    const validatedTools = validateToolRefs(explicitRequest.tools, runtimeSettings);
+    const validatedIds = new Set(validatedTools.map((tool) => `${tool.kind}:${tool.id}`));
+    const unknown = explicitRequest.tools.find(
+      (tool) => !validatedIds.has(`${tool.kind}:${tool.id}`)
+    );
+    if (unknown) {
+      throw new HTTPException10(422, { message: `unknown MCP server id: ${unknown.id}` });
+    }
+    return withFirstPartyTools(validatedTools, runtimeSettings);
+  })() : null;
+  const workspaceDefaultTools = withFirstPartyTools(
+    withDefaultEnabledCapabilityMcpTools([], deps.settings, capabilityRuntimeSettings),
+    runtimeSettings
+  );
+  const events = await appendSessionEventsWithLockedSessionUpdate(
+    deps.db,
+    grant.workspaceId,
+    sessionId,
+    async (session, context) => {
+      const currentVersion = session.toolPolicyVersion ?? 1;
+      if (request.expectedVersion !== currentVersion) {
+        throw new SessionToolPolicyVersionConflictError(currentVersion);
+      }
+      let nextTools;
+      let nextPolicy;
+      if (session.parentSessionId) {
+        const parent = await context.getLockedSession(session.parentSessionId);
+        if (!parent) {
+          throw new HTTPException10(409, { message: "parent session is no longer available" });
+        }
+        const parentTracksWorkspaceDefaults = parent.toolPolicy?.mode === "workspace_default";
+        const parentEffective = withFirstPartyTools(
+          parentTracksWorkspaceDefaults ? withDefaultEnabledCapabilityMcpTools(
+            availableToolRefs(parent.tools, runtimeSettings),
+            deps.settings,
+            runtimeSettings
+          ) : parent.tools,
+          runtimeSettings
+        );
+        if (requestedMode === "workspace_default") {
+          if (!parentTracksWorkspaceDefaults) {
+            throw new HTTPException10(403, {
+              message: "a child may adopt workspace defaults only while its parent tracks workspace defaults"
+            });
+          }
+          nextTools = parentEffective;
+          nextPolicy = {
+            mode: "workspace_default",
+            inheritedFromSessionId: parent.id
+          };
+        } else {
+          nextTools = explicitRequestedTools;
+          assertToolRefsSubset(
+            nextTools,
+            parentEffective,
+            "session tools may only narrow the parent session tool policy"
+          );
+          nextPolicy = {
+            mode: "explicit",
+            inheritedFromSessionId: parent.id
+          };
+        }
+      } else {
+        nextTools = requestedMode === "workspace_default" ? workspaceDefaultTools : explicitRequestedTools;
+        nextPolicy = { mode: requestedMode, inheritedFromSessionId: null };
+      }
+      const currentPolicy = session.toolPolicy ?? {
+        mode: "legacy",
+        inheritedFromSessionId: null
+      };
+      const unchanged = stableJson2({ tools: session.tools, policy: currentPolicy }) === stableJson2({ tools: nextTools, policy: nextPolicy });
+      if (unchanged) {
+        return { events: [] };
+      }
+      const nextVersion = currentVersion + 1;
+      return {
+        events: [
+          {
+            type: "session.tool_policy.updated",
+            payload: {
+              before: toolPolicyAuditSnapshot(session, session.tools, currentPolicy),
+              after: toolPolicyAuditSnapshot(session, nextTools, nextPolicy),
+              version: nextVersion,
+              effectiveFrom: "next_attempt"
+            }
+          }
+        ],
+        update: {
+          tools: nextTools,
+          toolPolicy: nextPolicy,
+          toolPolicyVersion: nextVersion,
+          expectedToolPolicyVersion: request.expectedVersion
+        }
+      };
+    },
+    { lockParentSession: true }
+  );
+  if (events.length > 0) {
+    await publishDurableSessionEvents(deps.bus, grant.workspaceId, sessionId, events);
+  }
+  return await requireSession2(deps.db, grant.workspaceId, sessionId);
+}
 async function readSessionLineage(deps, grant, sessionId) {
   const authorization = await requireSessionAuthorization(deps, grant, {
     sessionId,
@@ -4481,13 +4734,13 @@ async function readSessionLineage(deps, grant, sessionId) {
   if (authorization?.relatedSessionAccess === "target") {
     const session = await getSession2(deps.db, grant.workspaceId, sessionId);
     if (!session) {
-      throw new HTTPException9(404, { message: "session not found" });
+      throw new HTTPException10(404, { message: "session not found" });
     }
     return { ancestors: [], children: [], truncated: false };
   }
   const lineage = await getSessionLineage(deps.db, grant.workspaceId, sessionId);
   if (!lineage) {
-    throw new HTTPException9(404, { message: "session not found" });
+    throw new HTTPException10(404, { message: "session not found" });
   }
   return lineage;
 }
@@ -4551,7 +4804,7 @@ async function createValidatedScheduledTask(input) {
 async function requireScheduledTaskRig(db, workspaceId, rigId) {
   const rig = await getRig3(db, workspaceId, rigId);
   if (!rig) {
-    throw new HTTPException10(422, { message: `unknown rigId: ${rigId}` });
+    throw new HTTPException11(422, { message: `unknown rigId: ${rigId}` });
   }
 }
 async function validatedScheduledTaskUpdate(input) {
@@ -4578,7 +4831,7 @@ async function validatedScheduledTaskUpdate(input) {
   if (input.payload.variableSetId !== void 0) {
     const nextVariableSetId = input.payload.variableSetId;
     if ((input.existing.variableSetId ?? null) !== (nextVariableSetId ?? null) && input.existing.runMode === "reusable_session" && input.existing.reusableSessionId) {
-      throw new HTTPException10(409, {
+      throw new HTTPException11(409, {
         message: "cannot change variableSet of a task with a live reusable session; recreate the task"
       });
     }
@@ -4608,7 +4861,7 @@ async function validatedScheduledTaskUpdate(input) {
     if (willHaveVariableSet) {
       requirePermission(input.grant, "variable-sets:use");
     }
-    update.agentConfig = await validateScheduledTaskAgentConfig({
+    const nextAgentConfig = await validateScheduledTaskAgentConfig({
       settings: input.settings,
       db: input.db,
       objectStorage: input.objectStorage,
@@ -4617,13 +4870,19 @@ async function validatedScheduledTaskUpdate(input) {
       payload: { agentConfig: input.payload.agentConfig },
       ...input.toolsProvided !== void 0 ? { toolsProvided: input.toolsProvided } : {}
     });
+    if (input.existing.reusableSessionId && input.existing.runMode === "reusable_session" && (input.existing.agentConfig.slackBotConnectionId ?? null) !== (nextAgentConfig.slackBotConnectionId ?? null)) {
+      throw new HTTPException11(409, {
+        message: "cannot change the OpenGeni Slack bot connection of a task with a live reusable session; recreate the task"
+      });
+    }
+    update.agentConfig = nextAgentConfig;
   }
   return update;
 }
 async function requireScheduledTaskForApi(db, workspaceId, taskId) {
   const task = await getScheduledTask(db, workspaceId, taskId);
   if (!task) {
-    throw new HTTPException10(404, { message: "scheduled task not found" });
+    throw new HTTPException11(404, { message: "scheduled task not found" });
   }
   return task;
 }
@@ -4688,13 +4947,26 @@ async function validateScheduledTaskAgentConfig(input) {
   const tools = input.toolsProvided ?? true ? requestedTools : withDefaultEnabledCapabilityMcpTools(requestedTools, input.settings, runtimeSettings);
   const prompt = input.payload.agentConfig.prompt.trim();
   if (!prompt) {
-    throw new HTTPException10(422, { message: "scheduled task prompt is required" });
+    throw new HTTPException11(422, { message: "scheduled task prompt is required" });
+  }
+  if (hasReservedOpenGeniSlackBotSessionMetadata(input.payload.agentConfig.metadata)) {
+    throw new HTTPException11(422, {
+      message: `${OPENGENI_SLACK_BOT_SESSION_METADATA_KEY3} is reserved for scheduler routing`
+    });
   }
   await validateGitHubRepositorySelection(input.db, input.workspaceId, resources);
   if (resources.some((resource) => resource.kind === "file") && !input.objectStorage) {
-    throw new HTTPException10(503, { message: "object storage is not configured" });
+    throw new HTTPException11(503, { message: "object storage is not configured" });
   }
   await validateFileResources(input.db, input.workspaceId, resources);
+  if (input.payload.agentConfig.slackBotConnectionId) {
+    await validateOpenGeniSlackBotConnectionSelection(
+      input.db,
+      input.grant,
+      input.workspaceId,
+      input.payload.agentConfig.slackBotConnectionId
+    );
+  }
   const requestedMaxDepth = input.payload.agentConfig.maxNestedAgentDepth;
   if (requestedMaxDepth !== void 0) {
     const workspace = await requireWorkspace2(input.db, input.workspaceId);
@@ -4702,7 +4974,7 @@ async function validateScheduledTaskAgentConfig(input) {
     const deploymentPolicy = await getNestedAgentDepthDeploymentPolicy(input.db);
     const inheritedMaxDepth = typeof workspaceMaxDepth === "number" ? workspaceMaxDepth : deploymentPolicy.maxNestedAgentDepth;
     if (requestedMaxDepth > inheritedMaxDepth && !hasPermission(input.grant.permissions, "workspace:admin")) {
-      throw new HTTPException10(403, {
+      throw new HTTPException11(403, {
         message: `scheduled task maxNestedAgentDepth ${requestedMaxDepth} exceeds inherited limit ${inheritedMaxDepth}; workspace:admin is required to increase it`
       });
     }
@@ -4720,19 +4992,19 @@ function validateScheduledTaskSchedule(schedule) {
     return;
   }
   if (new Date(schedule.startAt).getTime() >= new Date(schedule.endAt).getTime()) {
-    throw new HTTPException10(422, { message: "interval schedule endAt must be after startAt" });
+    throw new HTTPException11(422, { message: "interval schedule endAt must be after startAt" });
   }
 }
 function trimmedScheduledTaskName(name) {
   const trimmed = name.trim();
   if (!trimmed) {
-    throw new HTTPException10(422, { message: "scheduled task name is required" });
+    throw new HTTPException11(422, { message: "scheduled task name is required" });
   }
   return trimmed;
 }
 
 // src/domain/workspace-members.ts
-import { HTTPException as HTTPException11 } from "hono/http-exception";
+import { HTTPException as HTTPException12 } from "hono/http-exception";
 var MEMBER_ADMIN_PERMISSIONS = ["workspace:admin", "members:manage"];
 function memberCanAdminister(member) {
   return member.permissions.some((permission) => MEMBER_ADMIN_PERMISSIONS.includes(permission));
@@ -4742,25 +5014,25 @@ function isUserMember(member) {
 }
 function resolveMemberSubjectId(userId) {
   if (!userId) {
-    throw new HTTPException11(404, { message: "user is not registered" });
+    throw new HTTPException12(404, { message: "user is not registered" });
   }
   return `user:${userId}`;
 }
 function assertWorkspaceMemberRemovable(input) {
   const { members, subjectId, callerSubjectId } = input;
   if (subjectId === callerSubjectId) {
-    throw new HTTPException11(409, { message: "you cannot remove your own membership" });
+    throw new HTTPException12(409, { message: "you cannot remove your own membership" });
   }
   const target = members.find((member) => member.subjectId === subjectId);
   if (!target) {
-    throw new HTTPException11(404, { message: "member not found" });
+    throw new HTTPException12(404, { message: "member not found" });
   }
   if (memberCanAdminister(target)) {
     const remainingAdmins = members.filter(
       (member) => member.subjectId !== subjectId && memberCanAdminister(member)
     );
     if (remainingAdmins.length === 0) {
-      throw new HTTPException11(409, {
+      throw new HTTPException12(409, {
         message: "cannot remove the last member who can manage this workspace"
       });
     }
@@ -4768,10 +5040,10 @@ function assertWorkspaceMemberRemovable(input) {
 }
 function assertWorkspaceDeletable(input) {
   if (input.workspaceCountForAccount <= 1) {
-    throw new HTTPException11(409, { message: "cannot delete the account's only workspace" });
+    throw new HTTPException12(409, { message: "cannot delete the account's only workspace" });
   }
   if (input.activeSessionCount > 0) {
-    throw new HTTPException11(409, {
+    throw new HTTPException12(409, {
       message: "stop the workspace's running sessions before deleting it"
     });
   }
@@ -4784,24 +5056,105 @@ import {
 } from "@opengeni/contracts";
 import {
   getNewSessionDraftInTransaction,
+  getEnrollment as getEnrollment3,
+  getRig as getRig4,
+  getSandbox as getSandbox4,
+  getVariableSet as getVariableSet4,
   NewSessionDraftAccessError,
+  newSessionDraftToolsProvided,
+  publicNewSessionDraftOptions,
+  requireFile as requireFile2,
   saveNewSessionDraftInTransaction,
   withWorkspaceSubjectRls as withWorkspaceSubjectRls2
 } from "@opengeni/db";
-import { HTTPException as HTTPException12 } from "hono/http-exception";
+import { HTTPException as HTTPException13 } from "hono/http-exception";
+function hasOwn(value, key) {
+  return typeof value === "object" && value !== null && Object.hasOwn(value, key);
+}
 function mapNewSessionDraft(row) {
   if (!row) return null;
   return NewSessionDraft.parse({
     revision: row.revision,
     text: row.text,
     resources: row.resources,
-    tools: row.tools,
+    tools: newSessionDraftToolsProvided(row) ? row.tools : [],
+    toolsProvided: newSessionDraftToolsProvided(row),
     model: row.model,
     reasoningEffort: row.reasoningEffort,
-    options: row.sessionOptions,
+    options: publicNewSessionDraftOptions(row),
     updatedAt: row.updatedAt.toISOString()
   });
 }
+async function hydrateNewSessionDraft(deps, grant, workspaceId, row) {
+  if (!row) return null;
+  const mapped = mapNewSessionDraft(row);
+  if (!mapped) return null;
+  const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(
+    deps.db,
+    workspaceId,
+    deps.settings
+  );
+  const resources = [];
+  for (const resource of mapped.resources) {
+    if (resource.kind === "repository") {
+      try {
+        await validateGitHubRepositorySelection(deps.db, workspaceId, [resource]);
+        resources.push(resource);
+      } catch (error) {
+        if (isAuthoritativeGitHubRepositorySelectionError(error)) {
+          continue;
+        }
+        resources.push(resource);
+      }
+      continue;
+    }
+    try {
+      const file = await requireFile2(deps.db, workspaceId, resource.fileId);
+      if (file.status === "ready") resources.push(resource);
+    } catch {
+    }
+  }
+  const options = { ...mapped.options };
+  if (options.variableSetId) {
+    if (!hasPermission(grant.permissions, "variable-sets:use") || !await getVariableSet4(deps.db, workspaceId, options.variableSetId)) {
+      delete options.variableSetId;
+    }
+  }
+  if (options.rigId) {
+    const rig = await getRig4(deps.db, workspaceId, options.rigId);
+    if (!rig?.activeVersion) delete options.rigId;
+  }
+  if (options.targetSandboxId) {
+    const sandbox = await getSandbox4(deps.db, workspaceId, options.targetSandboxId);
+    const enrollment = sandbox?.enrollmentId ? await getEnrollment3(deps.db, workspaceId, sandbox.enrollmentId) : null;
+    if (!sandbox || sandbox.kind !== "selfhosted" || !enrollment || enrollment.status !== "active") {
+      delete options.targetSandboxId;
+      delete options.workingDir;
+      delete options.sandboxBackend;
+    }
+  }
+  let tools = [];
+  if (mapped.toolsProvided) {
+    try {
+      tools = validateToolRefs(mapped.tools, runtimeSettings);
+    } catch {
+      tools = mapped.tools.filter((tool) => {
+        try {
+          validateToolRefs([tool], runtimeSettings);
+          return true;
+        } catch {
+          return false;
+        }
+      });
+    }
+  }
+  return {
+    ...mapped,
+    resources,
+    tools,
+    options
+  };
+}
 async function getActorNewSessionDraft(deps, grant, workspaceId) {
   const row = await withWorkspaceSubjectRls2(
     deps.db,
@@ -4812,11 +5165,12 @@ async function getActorNewSessionDraft(deps, grant, workspaceId) {
       subjectId: grant.subjectId
     })
   );
-  return mapNewSessionDraft(row) ?? {
+  return await hydrateNewSessionDraft(deps, grant, workspaceId, row) ?? {
     revision: 0,
     text: "",
     resources: [],
     tools: [],
+    toolsProvided: false,
     model: deps.settings.openaiModel,
     reasoningEffort: deps.settings.openaiReasoningEffort,
     options: {},
@@ -4825,16 +5179,17 @@ async function getActorNewSessionDraft(deps, grant, workspaceId) {
 }
 async function saveActorNewSessionDraft(deps, grant, workspaceId, rawInput) {
   const input = SaveNewSessionDraftRequest.parse(rawInput);
+  const toolsProvided = hasOwn(rawInput, "toolsProvided") ? input.toolsProvided : true;
   const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(
     deps.db,
     workspaceId,
     deps.settings
   );
   const resources = normalizeResources(input.resources);
-  const tools = validateToolRefs(input.tools, runtimeSettings);
+  const tools = toolsProvided ? validateToolRefs(input.tools, runtimeSettings) : [];
   await validateGitHubRepositorySelection(deps.db, workspaceId, resources);
   if (resources.some((resource) => resource.kind === "file") && !deps.objectStorage) {
-    throw new HTTPException12(503, { message: "object storage is not configured" });
+    throw new HTTPException13(503, { message: "object storage is not configured" });
   }
   await validateFileResources(deps.db, workspaceId, resources);
   assertConfiguredModel(deps.settings, input.model);
@@ -4853,6 +5208,7 @@ async function saveActorNewSessionDraft(deps, grant, workspaceId, rawInput) {
           text: input.text,
           resources,
           tools,
+          toolsProvided,
           model: input.model,
           reasoningEffort: input.reasoningEffort,
           options: input.options,
@@ -4867,7 +5223,7 @@ async function saveActorNewSessionDraft(deps, grant, workspaceId, rawInput) {
     return mapNewSessionDraft(saved);
   } catch (error) {
     if (error instanceof NewSessionDraftAccessError) {
-      throw new HTTPException12(403, { message: error.message });
+      throw new HTTPException13(403, { message: error.message });
     }
     throw error;
   }
@@ -5405,7 +5761,12 @@ export {
   getCapabilityPack,
   getHumanComposerDraft,
   hasPermission,
+  hasReservedOpenGeniSlackBotMetadata,
+  hasReservedOpenGeniSlackBotSessionMetadata,
+  isAuthoritativeGitHubRepositorySelectionError,
   isBuiltInCapabilityPack,
+  isOpenGeniSlackBotConnection,
+  isTrustedScheduledSlackBotSession,
   isUserMember,
   listCapabilityPacks,
   listFleet,
@@ -5420,6 +5781,7 @@ export {
   moveHumanQueuePrompt,
   normalizeResources,
   officialMcpRegistryUrl,
+  openGeniSlackBotMetadata,
   postUserMessageTurn,
   promoteSetupAppendChange,
   promoteVerifiedDefinitionEditChangeForApi,
@@ -5436,6 +5798,7 @@ export {
   requireAccessGrant,
   requireEnvironmentEncryption,
   requireLimit,
+  requireOpenGeniSlackBotConnection,
   requirePermission,
   requireQueuedTurnForApi,
   requireRigChangeForApi,
@@ -5454,11 +5817,13 @@ export {
   runOnSandbox,
   saveActorNewSessionDraft,
   saveHumanComposerDraft,
+  scheduledSlackBotConnectionId,
   scheduledTaskTemporalScheduleId,
   scheduledTaskToolsProvided,
   scheduledTaskTriggerToken,
   sendAgentSessionMessage,
   sessionSpawnDenialEnvelope,
+  sessionToolPolicyAllowsDefaultNativeTools,
   sessionWithEffectiveToolPolicy,
   settingsWithEnabledCapabilityMcpServers,
   settingsWithMcpCapabilityServers,
@@ -5472,11 +5837,13 @@ export {
   updateRigForApi,
   updateSessionMcpApprovalPolicy,
   updateSessionTitle,
+  updateSessionToolPolicy,
   validateFileResources,
   validateGitHubRepositorySelection,
   validateGitHubRepositorySelectionShape,
   validateGitHubRepositorySelectionShapes,
   validateMcpCapabilityConnection,
+  validateOpenGeniSlackBotConnectionSelection,
   validateToolRefs,
   validateToolRefsForSessionPolicy,
   validateVariableSetAttachment,