@opengeni/core 0.12.2 → 0.12.7

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import { Settings } from '@opengeni/config';
-import { ScheduledTask, Document, GitHubAppApiPort, ConnectionCredentialsPort, SessionAuthorizationPort, Permission, AccessContext, AccessGrant, SessionAuthorizationActor, SessionAuthorizationTarget, SessionAuthorizationOperation, SessionAuthorizationSurface, SessionAuthorizationListScope, LimitAction, LimitDecision, TurnInitiator, TurnInitiatorContext, SessionTurnSource, CapabilityCatalogItem, CapabilityInstallation, CapabilityCatalogResponse, CreateCapabilityCatalogItemRequest, EnableCapabilityRequest, VariableSet, Rig, RigVersion, CreateRigRequest, RigDefinitionEditPayload, RigChange, ProposeRigChangeRequest, UpdateRigRequest, CapabilityPack, SocialConnection, ScheduledTaskAgentConfig, ToolRef, ResourceRef, SessionEffectiveToolPolicy, SessionToolPolicy, Session, CreateScheduledTaskRequest, UpdateScheduledTaskRequest, SessionSpawnDenial, ReasoningEffort, SessionMcpCredentialUpdateInput, SessionEvent, SessionTurn, TurnExecutionPolicyV1, GoalSpec, SessionMcpServerMetadata, CreateSessionResponse, SessionMcpApprovalPolicy, UpdateSessionMcpApprovalPolicyResponse, UpdateSessionToolPolicyRequest, ConnectionMetadata, OpenGeniSlackBotConnectionMetadata, WorkspaceMember, NewSessionDraft, SessionControlRequest, SessionControlResponse, WorkspaceInferenceControlRequest, WorkspaceInferenceControlResponse, DeleteSessionQueueItemRequest, SessionQueueMutationResponse, EditSessionQueueItemRequest, ComposerDraft, MoveSessionQueueItemRequest, SaveComposerDraftRequest, SteerSessionQueueItemRequest } from '@opengeni/contracts';
+import { ScheduledTask, TurnInitiator, Document, GitHubAppApiPort, ConnectionCredentialsPort, SessionAuthorizationPort, Permission, AccessContext, AccessGrant, SessionAuthorizationActor, SessionAuthorizationTarget, SessionAuthorizationOperation, SessionAuthorizationSurface, SessionAuthorizationListScope, LimitAction, LimitDecision, TurnInitiatorContext, SessionTurnSource, CapabilityCatalogItem, CapabilityInstallation, CapabilityCatalogResponse, CreateCapabilityCatalogItemRequest, EnableCapabilityRequest, VariableSet, Rig, RigVersion, CreateRigRequest, RigDefinitionEditPayload, RigChange, ProposeRigChangeRequest, UpdateRigRequest, CapabilityPack, SocialConnection, ScheduledTaskAgentConfig, ToolRef, ResourceRef, SessionEffectiveToolPolicy, SessionToolPolicy, Session, CreateScheduledTaskRequest, UpdateScheduledTaskRequest, SessionSpawnDenial, ReasoningEffort, SessionMcpCredentialUpdateInput, SessionEvent, SessionTurn, SessionSkill, TurnExecutionPolicyV1, GoalSpec, FirstPartyMcpToolName, SessionMcpServerMetadata, CreateSessionResponse, SessionMcpApprovalPolicy, UpdateSessionMcpApprovalPolicyResponse, UpdateSessionToolPolicyRequest, ConnectionMetadata, OpenGeniSlackBotConnectionMetadata, WorkspaceMember, NewSessionDraft, SessionControlRequest, SessionControlResponse, WorkspaceInferenceControlRequest, WorkspaceInferenceControlResponse, DeleteSessionQueueItemRequest, SessionQueueMutationResponse, EditSessionQueueItemRequest, ComposerDraft, MoveSessionQueueItemRequest, SaveComposerDraftRequest, SteerSessionQueueItemRequest } from '@opengeni/contracts';
 export { mergeToolRefs, stableJson } from '@opengeni/contracts';
 import * as _opengeni_db from '@opengeni/db';
 import { Database, SandboxRecord, EnabledMcpCapabilityServer, UpdateScheduledTaskInput, SessionCommandActor, CreateSessionMcpServerInput, UpdateSessionMcpServerCredentialsInput, ConnectionMetadataWithVerification } from '@opengeni/db';
@@ -106,8 +106,9 @@ type SessionWorkflowClient = {
     }) => Promise<void>;
     triggerScheduledTask: (input: {
         task: ScheduledTask;
-        agentRunUsageIdempotencyKey?: string;
-        triggerWorkflowId?: string;
+        agentRunUsageIdempotencyKey: string;
+        triggerWorkflowId: string;
+        initiator: TurnInitiator;
     }) => Promise<void>;
     startRigVerification: (input: {
         workspaceId: string;
@@ -534,6 +535,13 @@ declare function disableCapability(input: {
     capabilityId: string;
 }): Promise<CapabilityInstallation>;
 declare function settingsWithEnabledCapabilityMcpServers(db: Database, workspaceId: string, settings: Settings): Promise<Settings>;
+/**
+ * Register Codex Apps as an optional runtime MCP when the deployment enables
+ * it. Registration only makes the server selectable; the session tool policy
+ * decides whether the model sees it, and Codex credential resolution
+ * independently decides whether calls can authenticate.
+ */
+declare function settingsWithCodexAppsMcpServer(settings: Settings): Settings;
 declare function settingsWithMcpCapabilityServers(settings: Settings, enabled: EnabledMcpCapabilityServer[]): Settings;
 declare function discoverMcpRegistryCapabilities(input: {
     query?: string;
@@ -795,6 +803,13 @@ declare class SessionSpawnDeniedError extends Error {
     readonly denial: SessionSpawnDenial;
     constructor(denial: SessionSpawnDenial);
 }
+/**
+ * Resolve per-session first-party tool visibility without consulting
+ * authorization. Top-level omission uses the minimal runtime default (stored
+ * as null); child omission snapshots the parent's exact effective selection.
+ * Explicit [] is authoritative and must never widen.
+ */
+declare function resolveFirstPartyMcpToolsForCreate(requested: FirstPartyMcpToolName[] | undefined, parentStored: FirstPartyMcpToolName[] | null | undefined): FirstPartyMcpToolName[] | null;
 declare function sessionSpawnDenialEnvelope(error: SessionSpawnDeniedError): {
     readonly error: {
         readonly code: "nested_agent_depth_exceeded" | "nested_agent_depth_override_forbidden";
@@ -831,6 +846,7 @@ declare function createAndStartSession(input: {
     initialMessage: string;
     turnInstructions?: string | null;
     resources: ResourceRef[];
+    skills?: SessionSkill[];
     tools: ToolRef[];
     toolPolicy?: SessionToolPolicy;
     clientEventId?: string;
@@ -853,6 +869,7 @@ declare function createAndStartSession(input: {
     goal?: GoalSpec | null;
     instructions?: string | null;
     firstPartyMcpPermissions?: Permission[] | null;
+    firstPartyMcpTools?: FirstPartyMcpToolName[] | null;
     mcpServers?: CreateSessionMcpServerInput[];
     sessionMcpServers?: SessionMcpServerMetadata[];
     parentSessionId?: string | null;
@@ -1169,4 +1186,4 @@ declare function controlHumanWorkspace(deps: {
 declare function getHumanComposerDraft(deps: SessionAuthorizationCommandDeps, context: HumanSessionCommandContext): Promise<ComposerDraft>;
 declare function saveHumanComposerDraft(deps: SessionAuthorizationCommandDeps, context: HumanSessionCommandContext, input: SaveComposerDraftRequest): Promise<ComposerDraft>;
 
-export { type AcceptSessionUserMessageDependencies, type AccessDeps, type AgentSessionCommandContext, type ApiRouteDeps, type ApiSandboxClient, type ApiSandboxSession, type AppDependencies, type ChannelARoutingServices, type DocumentIndexClient, type FleetContext, type FleetListResult, type FleetLiveness, type FleetReadinessHold, type FleetSandboxEntry, type FleetServices, type FleetSwapResult, type HumanSessionCommandContext, type LimitCheckInput, type LimitDependencies, MARKETING_SOCIAL_PACK_ID, MAX_CHECKS_PER_RIG, MAX_CREDENTIAL_HOOKS_PER_RIG, MAX_DEFAULT_VARIABLE_SETS_PER_RIG, MAX_ENVIRONMENTS_PER_WORKSPACE, MAX_RIGS_PER_WORKSPACE, MAX_VARIABLES_PER_ENVIRONMENT, type ManagedAuth, type McpCapabilityProbe, type McpCapabilityProbeInput, type McpCapabilityProbeResult, type ObjectStorageDependency, type ProvisionResult, type ResolvedSessionAuthorization, type ResolvedSessionToolPolicy, type ResumeBoxByIdInput, type ResumedSandboxSession, type RigServices, type RigVerificationClassification, type RunOnOp, type RunOnResult, SESSION_AUTHORIZATION_DEFAULT_REAUTHORIZE_MS, SESSION_WORKFLOW_WAKE_DISPATCHER_PERIOD_MS, SESSION_WORKFLOW_WAKE_DISPATCHER_SCHEDULE_ID, SESSION_WORKFLOW_WAKE_DISPATCHER_WORKFLOW_TYPE, SessionAuthorizationDeniedError, type SessionAuthorizationDependencies, SessionAuthorizationUnavailableError, SessionSpawnDeniedError, type SessionToolPolicyInput, type SessionWorkflowClient, acceptSessionUserMessage, activateRigVersionForApi, appendRigSetupCommand, applyCapabilityEnablement, assertAllowedEnvironmentVariableName, assertAllowedVariableSetVariableName, assertConfiguredModel, assertPackSandboxImageCompatible, assertToolRefsSubset, assertWorkspaceDeletable, assertWorkspaceMemberRemovable, assertWorkspaceModelPolicyAllows, availableToolRefs, buildCapabilityCatalog, buildFleetContextForSession, buildMarketingDailyAnalysisAgentConfig, canonicalConfiguredModel, checkLimit, classifyRigVerificationOutcome, controlAgentSessionWorkstream, controlHumanSessionWorkstream, controlHumanWorkspace, createAndStartSession, createCatalogItem, createRigForApi, createRigVersionForApi, createSessionForRequest, createValidatedScheduledTask, deleteHumanQueuePrompt, deleteRigForApi, disableCapability, discoverMcpRegistryCapabilities, editHumanQueuePrompt, enableCapability, enabledCapabilityMcpToolRefs, getActorNewSessionDraft, getCapabilityPack, getHumanComposerDraft, hasPermission, hasReservedOpenGeniSlackBotMetadata, hasReservedOpenGeniSlackBotSessionMetadata, isAuthoritativeGitHubRepositorySelectionError, isBuiltInCapabilityPack, isOpenGeniSlackBotConnection, isTrustedScheduledSlackBotSession, isUserMember, listCapabilityPacks, listFleet, listRigChangesForApi, listRigVersionsForApi, listWorkspaceCapabilityPacks, manualScheduledTaskTriggerUsageKey, manualScheduledTaskTriggerWorkflowId, memberCanAdminister, mergeResourceRefs, moveHumanQueuePrompt, normalizeResources, officialMcpRegistryUrl, openGeniSlackBotMetadata, postUserMessageTurn, promoteSetupAppendChange, promoteVerifiedDefinitionEditChangeForApi, proposeRigChangeForApi, provisionSandbox, readSessionLineage, reasoningEffortForSession, recordRigAuditEvent, recordVariableSetAuditEvent, recordWorkspaceUsage, relayConfigFromSettings, relayDialBaseFromSettings, requireAccessContext, requireAccessGrant, requireEnvironmentEncryption, requireLimit, requireOpenGeniSlackBotConnection, requirePermission, requireQueuedTurnForApi, requireRigChangeForApi, requireRigForApi, requireScheduledTaskForApi, requireSessionAuthorization, requireSessionAuthorizationListScope, requireVariableSetEncryption, requireVariableSetForApi, resolveCapabilityPack, resolveMemberSubjectId, resolveSessionToolPolicy, restoreScheduledTask, rigActorForGrant, routingEnabled, runOnSandbox, saveActorNewSessionDraft, saveHumanComposerDraft, scheduledSlackBotConnectionId, scheduledTaskTemporalScheduleId, scheduledTaskToolsProvided, scheduledTaskTriggerToken, sendAgentSessionMessage, sessionSpawnDenialEnvelope, sessionToolPolicyAllowsDefaultNativeTools, sessionWithEffectiveToolPolicy, settingsWithEnabledCapabilityMcpServers, settingsWithMcpCapabilityServers, settingsWithSessionMcpServerMetadata, steerAgentSession, steerHumanQueuePrompt, swapActiveSandbox, syncCreatedScheduledTask, syncUpdatedScheduledTask, updateRigForApi, updateSessionMcpApprovalPolicy, updateSessionTitle, updateSessionToolPolicy, validateFileResources, validateGitHubRepositorySelection, validateGitHubRepositorySelectionShape, validateGitHubRepositorySelectionShapes, validateMcpCapabilityConnection, validateOpenGeniSlackBotConnectionSelection, validateToolRefs, validateToolRefsForSessionPolicy, validateVariableSetAttachment, validatedScheduledTaskUpdate, withDefaultEnabledCapabilityMcpTools, workflowIdForSession, workspaceSessionToolPolicyDefaultServerIds, workspaceSessionToolPolicyServerIds, wrapChannelABoxWithRouting };
+export { type AcceptSessionUserMessageDependencies, type AccessDeps, type AgentSessionCommandContext, type ApiRouteDeps, type ApiSandboxClient, type ApiSandboxSession, type AppDependencies, type ChannelARoutingServices, type DocumentIndexClient, type FleetContext, type FleetListResult, type FleetLiveness, type FleetReadinessHold, type FleetSandboxEntry, type FleetServices, type FleetSwapResult, type HumanSessionCommandContext, type LimitCheckInput, type LimitDependencies, MARKETING_SOCIAL_PACK_ID, MAX_CHECKS_PER_RIG, MAX_CREDENTIAL_HOOKS_PER_RIG, MAX_DEFAULT_VARIABLE_SETS_PER_RIG, MAX_ENVIRONMENTS_PER_WORKSPACE, MAX_RIGS_PER_WORKSPACE, MAX_VARIABLES_PER_ENVIRONMENT, type ManagedAuth, type McpCapabilityProbe, type McpCapabilityProbeInput, type McpCapabilityProbeResult, type ObjectStorageDependency, type ProvisionResult, type ResolvedSessionAuthorization, type ResolvedSessionToolPolicy, type ResumeBoxByIdInput, type ResumedSandboxSession, type RigServices, type RigVerificationClassification, type RunOnOp, type RunOnResult, SESSION_AUTHORIZATION_DEFAULT_REAUTHORIZE_MS, SESSION_WORKFLOW_WAKE_DISPATCHER_PERIOD_MS, SESSION_WORKFLOW_WAKE_DISPATCHER_SCHEDULE_ID, SESSION_WORKFLOW_WAKE_DISPATCHER_WORKFLOW_TYPE, SessionAuthorizationDeniedError, type SessionAuthorizationDependencies, SessionAuthorizationUnavailableError, SessionSpawnDeniedError, type SessionToolPolicyInput, type SessionWorkflowClient, acceptSessionUserMessage, activateRigVersionForApi, appendRigSetupCommand, applyCapabilityEnablement, assertAllowedEnvironmentVariableName, assertAllowedVariableSetVariableName, assertConfiguredModel, assertPackSandboxImageCompatible, assertToolRefsSubset, assertWorkspaceDeletable, assertWorkspaceMemberRemovable, assertWorkspaceModelPolicyAllows, availableToolRefs, buildCapabilityCatalog, buildFleetContextForSession, buildMarketingDailyAnalysisAgentConfig, canonicalConfiguredModel, checkLimit, classifyRigVerificationOutcome, controlAgentSessionWorkstream, controlHumanSessionWorkstream, controlHumanWorkspace, createAndStartSession, createCatalogItem, createRigForApi, createRigVersionForApi, createSessionForRequest, createValidatedScheduledTask, deleteHumanQueuePrompt, deleteRigForApi, disableCapability, discoverMcpRegistryCapabilities, editHumanQueuePrompt, enableCapability, enabledCapabilityMcpToolRefs, getActorNewSessionDraft, getCapabilityPack, getHumanComposerDraft, hasPermission, hasReservedOpenGeniSlackBotMetadata, hasReservedOpenGeniSlackBotSessionMetadata, isAuthoritativeGitHubRepositorySelectionError, isBuiltInCapabilityPack, isOpenGeniSlackBotConnection, isTrustedScheduledSlackBotSession, isUserMember, listCapabilityPacks, listFleet, listRigChangesForApi, listRigVersionsForApi, listWorkspaceCapabilityPacks, manualScheduledTaskTriggerUsageKey, manualScheduledTaskTriggerWorkflowId, memberCanAdminister, mergeResourceRefs, moveHumanQueuePrompt, normalizeResources, officialMcpRegistryUrl, openGeniSlackBotMetadata, postUserMessageTurn, promoteSetupAppendChange, promoteVerifiedDefinitionEditChangeForApi, proposeRigChangeForApi, provisionSandbox, readSessionLineage, reasoningEffortForSession, recordRigAuditEvent, recordVariableSetAuditEvent, recordWorkspaceUsage, relayConfigFromSettings, relayDialBaseFromSettings, requireAccessContext, requireAccessGrant, requireEnvironmentEncryption, requireLimit, requireOpenGeniSlackBotConnection, requirePermission, requireQueuedTurnForApi, requireRigChangeForApi, requireRigForApi, requireScheduledTaskForApi, requireSessionAuthorization, requireSessionAuthorizationListScope, requireVariableSetEncryption, requireVariableSetForApi, resolveCapabilityPack, resolveFirstPartyMcpToolsForCreate, resolveMemberSubjectId, resolveSessionToolPolicy, restoreScheduledTask, rigActorForGrant, routingEnabled, runOnSandbox, saveActorNewSessionDraft, saveHumanComposerDraft, scheduledSlackBotConnectionId, scheduledTaskTemporalScheduleId, scheduledTaskToolsProvided, scheduledTaskTriggerToken, sendAgentSessionMessage, sessionSpawnDenialEnvelope, sessionToolPolicyAllowsDefaultNativeTools, sessionWithEffectiveToolPolicy, settingsWithCodexAppsMcpServer, settingsWithEnabledCapabilityMcpServers, settingsWithMcpCapabilityServers, settingsWithSessionMcpServerMetadata, steerAgentSession, steerHumanQueuePrompt, swapActiveSandbox, syncCreatedScheduledTask, syncUpdatedScheduledTask, updateRigForApi, updateSessionMcpApprovalPolicy, updateSessionTitle, updateSessionToolPolicy, validateFileResources, validateGitHubRepositorySelection, validateGitHubRepositorySelectionShape, validateGitHubRepositorySelectionShapes, validateMcpCapabilityConnection, validateOpenGeniSlackBotConnectionSelection, validateToolRefs, validateToolRefsForSessionPolicy, validateVariableSetAttachment, validatedScheduledTaskUpdate, withDefaultEnabledCapabilityMcpTools, workflowIdForSession, workspaceSessionToolPolicyDefaultServerIds, workspaceSessionToolPolicyServerIds, wrapChannelABoxWithRouting };

package/dist/index.js

@@ -698,6 +698,10 @@ function hasPermission(permissions, permission) {
 }
 async function resolveAccessContext(c, deps) {
   if (deps.settings.productAccessMode === "local") {
+    const delegated = await delegatedAccessContext(c, deps, "local");
+    if (delegated) {
+      return delegated;
+    }
     return await bootstrapWorkspace(deps.db, {
       accountExternalSource: "opengeni:local",
       accountExternalId: "default",
@@ -825,6 +829,7 @@ async function delegatedAccessContext(c, deps, mode, token = bearerToken(c)) {
         metadata: {
           delegated: true,
           ...payload.sessionId ? { sessionId: payload.sessionId } : {},
+          ...payload.firstPartyMcpTools !== void 0 ? { firstPartyMcpTools: payload.firstPartyMcpTools } : {},
           // Caller identity: the turn that minted this token. Tools classify the
           // CALLER from this instead of re-reading the live active pointer.
           ...payload.turnId ? { turnId: payload.turnId } : {},
@@ -1185,6 +1190,12 @@ import { environmentsEncryptionKeyBytes as environmentsEncryptionKeyBytes2 } fro
 import {
   CapabilityCatalogItem
 } from "@opengeni/contracts";
+import {
+  CODEX_APPS_MCP_SERVER_ID,
+  CODEX_APPS_MCP_SERVER_NAME,
+  CODEX_APPS_MCP_URL,
+  CODEX_APPS_STARTUP_TIMEOUT_MS
+} from "@opengeni/codex";
 import {
   decryptVariableSetValue,
   decryptedCapabilityHeaders,
@@ -1200,6 +1211,7 @@ import {
   getVariableSet as getVariableSet2,
   listCapabilityCatalogItems,
   listCapabilityInstallations,
+  listConnectionsMetadata,
   listEnabledMcpCapabilityServers,
   listPackInstallations as listPackInstallations2,
   mcpServerIdForCapability,
@@ -1803,14 +1815,10 @@ function normalizedMcpCredentialHeaders(headers) {
   return Object.fromEntries(entries);
 }
 async function validateMcpCapabilityConnectionRef(input, item, ref) {
-  if (ref.subjectScope === "subject") {
-    throw new HTTPException6(422, {
-      message: "subject-owned connection refs are not supported for agent runtime use yet"
-    });
-  }
+  const subjectScope = ref.subjectScope ?? "workspace";
   const normalized = {
     providerDomain: ref.providerDomain.trim(),
-    subjectScope: "workspace",
+    subjectScope,
     ...ref.connectionId ? { connectionId: ref.connectionId } : {},
     ...ref.provider ? { provider: ref.provider.trim() } : {},
     ...ref.kind ? { kind: ref.kind } : {},
@@ -1826,23 +1834,30 @@ async function validateMcpCapabilityConnectionRef(input, item, ref) {
       message: "MCP capabilities need a remote streamable HTTP endpoint before they can use a connectionRef"
     });
   }
-  if (!normalized.connectionId) {
-    return normalized;
-  }
-  const connection = await getConnectionMetadata(
+  let connection = normalized.connectionId ? await getConnectionMetadata(
     input.db,
     input.workspaceId,
     normalized.connectionId,
     input.grant.subjectId
-  );
+  ) : null;
+  if (!connection && subjectScope === "subject" && !normalized.connectionId) {
+    const visible = await listConnectionsMetadata(
+      input.db,
+      input.workspaceId,
+      input.grant.subjectId
+    );
+    connection = visible.find(
+      (candidate) => candidate.subjectId === input.grant.subjectId && candidate.providerDomain === normalized.providerDomain && (!normalized.kind || candidate.kind === normalized.kind) && candidate.status === "active"
+    ) ?? null;
+  }
   if (!connection) {
     throw new HTTPException6(422, {
-      message: "connectionRef.connectionId does not reference a visible connection"
+      message: "connectionRef does not reference a visible active connection"
     });
   }
-  if (connection.subjectId !== null) {
+  if (subjectScope === "subject" && connection.subjectId !== input.grant.subjectId || subjectScope === "workspace" && connection.subjectId !== null) {
     throw new HTTPException6(422, {
-      message: "agent runtime connection refs must reference workspace-shared connections in I1"
+      message: `connectionRef does not reference a ${subjectScope}-owned connection`
     });
   }
   if (connection.status !== "active") {
@@ -1860,6 +1875,11 @@ async function validateMcpCapabilityConnectionRef(input, item, ref) {
       message: "connectionRef.kind does not match the referenced connection"
     });
   }
+  if (subjectScope === "subject") {
+    const genericSubjectRef = { ...normalized, kind: connection.kind };
+    delete genericSubjectRef.connectionId;
+    return genericSubjectRef;
+  }
   return normalized;
 }
 function authDeferredMcpConnectivity() {
@@ -2016,7 +2036,26 @@ async function disableCapability(input) {
 }
 async function settingsWithEnabledCapabilityMcpServers(db, workspaceId, settings) {
   const enabled = await listEnabledMcpCapabilityServers(db, workspaceId);
-  return settingsWithMcpCapabilityServers(settings, enabled);
+  return settingsWithCodexAppsMcpServer(settingsWithMcpCapabilityServers(settings, enabled));
+}
+function settingsWithCodexAppsMcpServer(settings) {
+  if (!settings.codexConnectedAppsEnabled || settings.mcpServers.some((server) => server.id === CODEX_APPS_MCP_SERVER_ID)) {
+    return settings;
+  }
+  return {
+    ...settings,
+    mcpServers: [
+      ...settings.mcpServers,
+      {
+        id: CODEX_APPS_MCP_SERVER_ID,
+        name: CODEX_APPS_MCP_SERVER_NAME,
+        url: CODEX_APPS_MCP_URL,
+        timeoutMs: CODEX_APPS_STARTUP_TIMEOUT_MS,
+        // Availability is credential-specific, so discover on every run.
+        cacheToolsList: false
+      }
+    ]
+  };
 }
 function settingsWithMcpCapabilityServers(settings, enabled) {
   if (enabled.length === 0) {
@@ -2374,8 +2413,14 @@ function installationConnectionRef(config) {
   if (!ref || typeof ref !== "object") {
     return null;
   }
-  const { connectionId, providerDomain, kind } = ref;
-  if (typeof connectionId !== "string" || typeof providerDomain !== "string" || typeof kind !== "string") {
+  const { connectionId, providerDomain, kind, subjectScope } = ref;
+  if (typeof providerDomain !== "string" || typeof kind !== "string") {
+    return null;
+  }
+  if (subjectScope === "subject") {
+    return { providerDomain, kind, subjectScope: "subject" };
+  }
+  if (typeof connectionId !== "string") {
     return null;
   }
   return { connectionId, providerDomain, kind };
@@ -3332,6 +3377,7 @@ import {
 import {
   CreateSessionRequest,
   DEFAULT_FIRST_PARTY_MCP_PERMISSIONS,
+  DEFAULT_FIRST_PARTY_MCP_TOOLS,
   OPENGENI_SLACK_BOT_SESSION_METADATA_KEY as OPENGENI_SLACK_BOT_SESSION_METADATA_KEY2,
   SessionSpawnDenial,
   ServiceTurnInitiator,
@@ -3454,6 +3500,11 @@ var SessionSpawnDeniedError = class extends Error {
     this.denial = denial;
   }
 };
+function resolveFirstPartyMcpToolsForCreate(requested, parentStored) {
+  if (requested !== void 0) return [...requested];
+  if (parentStored === void 0) return null;
+  return [...parentStored ?? DEFAULT_FIRST_PARTY_MCP_TOOLS];
+}
 function sessionSpawnDeniedMessage(denial) {
   if (denial.code === "nested_agent_depth_override_forbidden") {
     return `requested nested-agent depth limit ${denial.requestedMaxNestedAgentDepthOverride ?? "unknown"} exceeds inherited limit ${denial.effectiveMaxNestedAgentDepth}; workspace:admin is required to increase it`;
@@ -3745,6 +3796,7 @@ async function createAndStartSession(input) {
       initialMessage: input.initialMessage,
       initialTurnInstructions: input.turnInstructions ?? null,
       resources: input.resources,
+      skills: input.skills ?? [],
       tools: input.tools,
       ...input.toolPolicy ? { toolPolicy: input.toolPolicy } : {},
       metadata: sessionMetadata,
@@ -3757,6 +3809,7 @@ async function createAndStartSession(input) {
       rigId: input.rigId ?? null,
       rigVersionId: input.rigVersionId ?? null,
       firstPartyMcpPermissions: input.firstPartyMcpPermissions ?? null,
+      firstPartyMcpTools: input.firstPartyMcpTools ?? null,
       instructions: input.instructions ?? null,
       parentSessionId: input.parentSessionId ?? null,
       createIdempotencyKey: input.createIdempotencyKey,
@@ -3788,6 +3841,7 @@ async function createAndStartSession(input) {
       initialMessage: input.initialMessage,
       initialTurnInstructions: input.turnInstructions ?? null,
       resources: input.resources,
+      skills: input.skills ?? [],
       tools: input.tools,
       ...input.toolPolicy ? { toolPolicy: input.toolPolicy } : {},
       metadata: sessionMetadata,
@@ -3800,6 +3854,7 @@ async function createAndStartSession(input) {
       rigId: input.rigId ?? null,
       rigVersionId: input.rigVersionId ?? null,
       firstPartyMcpPermissions: input.firstPartyMcpPermissions ?? null,
+      firstPartyMcpTools: input.firstPartyMcpTools ?? null,
       instructions: input.instructions ?? null,
       parentSessionId: input.parentSessionId ?? null,
       sandboxGroupId: input.sandboxGroupId ?? null,
@@ -4082,6 +4137,7 @@ async function createSessionForRequest(deps, grant, workspaceId, rawPayload) {
   const resources = normalizeResources(
     hasOwnProperty(rawPayload, "resources") ? payload.resources : parentSession?.resources ?? payload.resources
   );
+  const skills = hasOwnProperty(rawPayload, "skills") ? payload.skills : parentSession?.skills ?? payload.skills;
   const toolsProvided = hasOwnProperty(rawPayload, "tools");
   const requestedTools = validateToolRefs(
     toolsProvided ? payload.tools : parentSession?.tools ?? payload.tools,
@@ -4194,6 +4250,21 @@ async function createSessionForRequest(deps, grant, workspaceId, rawPayload) {
       message: "goal-bearing sessions require goals:manage in the resulting first-party MCP permission set"
     });
   }
+  const firstPartyMcpTools = resolveFirstPartyMcpToolsForCreate(
+    payload.firstPartyMcpTools,
+    parentSession ? parentSession.firstPartyMcpTools : void 0
+  );
+  if (payload.goal) {
+    const effectiveTools = firstPartyMcpTools ?? [...DEFAULT_FIRST_PARTY_MCP_TOOLS];
+    const missingGoalTools = ["goal_update", "goal_complete", "goal_pause"].filter(
+      (name) => !effectiveTools.includes(name)
+    );
+    if (missingGoalTools.length > 0) {
+      throw new HTTPException10(422, {
+        message: `goal-bearing sessions require first-party MCP tools: ${missingGoalTools.join(", ")}`
+      });
+    }
+  }
   const sandboxChoice = payload.sandbox ?? (parentSessionId ? "shared" : "new");
   let sandboxGroupId = null;
   let inheritedBackend;
@@ -4308,6 +4379,7 @@ async function createSessionForRequest(deps, grant, workspaceId, rawPayload) {
       initialMessage: payload.initialMessage,
       turnInstructions: payload.turnInstructions ?? null,
       resources,
+      skills,
       tools,
       toolPolicy,
       ...payload.clientEventId ? { clientEventId: payload.clientEventId } : {},
@@ -4339,6 +4411,7 @@ async function createSessionForRequest(deps, grant, workspaceId, rawPayload) {
       // time. Not surfaced as an event.
       instructions: payload.instructions ?? null,
       firstPartyMcpPermissions,
+      firstPartyMcpTools,
       mcpServers: sessionMcpServers.dbServers,
       sessionMcpServers: sessionMcpServers.metadata,
       parentSessionId,
@@ -5809,6 +5882,7 @@ export {
   requireVariableSetEncryption,
   requireVariableSetForApi,
   resolveCapabilityPack,
+  resolveFirstPartyMcpToolsForCreate,
   resolveMemberSubjectId,
   resolveSessionToolPolicy,
   restoreScheduledTask,
@@ -5825,6 +5899,7 @@ export {
   sessionSpawnDenialEnvelope,
   sessionToolPolicyAllowsDefaultNativeTools,
   sessionWithEffectiveToolPolicy,
+  settingsWithCodexAppsMcpServer,
   settingsWithEnabledCapabilityMcpServers,
   settingsWithMcpCapabilityServers,
   settingsWithSessionMcpServerMetadata,